SOW CSA CATI Phone Survey Recompete Rev 13 Apr 21 (002).pdf

U.S. Department of Homeland Security (DHS) Federal Emergency Management Agency (FEMA) Recovery Technology Programs Division (RTPD)

Statement of Work (SOW) v1.1

Over the Phone Survey Software and Support

Rev. 13 April 2021

Contents

1.0 Background

2.0 Purpose

3.0 Scope

4.0 Progress Reports and Meetings

5.0 Post Award Conference

6.0 Project Plan

7.0 Transition Plan

8.0 Security Compliance Maintenance and System Documentation

8.1 Privacy Documentation Requirements

9.0 Business Continuity Plan

10.0 Government Acceptance Period

11.0 Deliverables

12.0 Period of Performance

13.0 Place of Performance

Appendix I – Government Furnished Equipment (GFE) Appendix II – DHS Enterprise Architecture Compliance Appendix III – 508 Compliance Accessibility Requirements Appendix IV – Security Appendix V – HSAR Class Deviation 15-01: Safeguarding of Sensitive Information (March 2015) Appendix VI – HSAR Class Deviation 15-01: Information Technology Security and Privacy Training (March 2015)

1.0 Background

When the President declares a disaster, the Federal Emergency Management Agency (FEMA) accepts registrations for assistance from disaster survivors in the designated geographical area. As required by the Government Performance and Results Act (GPRA) of 1993, GPRA Modernization Act of 2010, Executive Order 12862, Executive Order 13411 and Executive Order 13571 and as approved by the Office of Management and Budget (OMB), FEMA is required to ensure the consistent delivery of excellent customer service to Disaster Survivors requesting assistance under the Stafford Act. In addition to measuring satisfaction and program effectiveness for GPRA results reporting, the information is used by FEMA to identify areas for improvement and apply changes to better serve the public. The program currently utilizes the Medallia platform for electronic based surveys for internal and external customers/stakeholders.

2.0 Purpose

The purpose of this requirement is to deliver and support a survey software product which includes but is not limited to surveys for the Individual Assistance (IA) Program and the Public Assistance (PA) Program. FEMA requires the ability to conduct phone surveys via Computer Assisted Telephone Interview (CATI). FEMA responsibilities include questionnaire design, respondent sampling methodology, data collections, data analysis, and formal result reports.

3.0 Scope

FEMA requires a survey software system to perform CATI Phone Surveys for disaster survivors and emergency managers with a FEMA Interviewer over the phone.

FEMA desires a solution for their survey requirement through Software as a Service (SaaS). Data security must be demonstrated at moderate risk or higher, and must meet FEMA standards for server type, operating systems, relational database software, ports and network security. A cloud-based solution must be hosted within a FedRAMP certified environment. Offeror may suggest bundled software service with adequate detail to determine compatibility with FEMA security and technical requirements as well as business model. Contractor to provide access to their software for security scans or other OCIO-mandated requirements.

The software shall meet FEMA IT Security Requirements and be 508 Compliant (see Appendix III for further information) and includes the ability to be approved on the DHS/FEMA Technical Reference Model (TRM) for approved software and/or hardware. Although not required, DHS and FEMA-approved software will be considered.

The Software shall be capable of being single-sign on enabled utilizing the DHS/FEMA Personal Identity Verification (PIV) Card badges. In addition, FEMA shall have the ability to designate rights and roles for different users of the software.

The Software shall include Development, Test, and Production environments that will allow FEMA to develop studies, test them,and then move studies and questionnaires to production environment.

3.1 Survey Study Capabilities

https://ea.dhs.gov/mobius/homepage https://ea.dhs.gov/mobius/homepage

The software shall include the ability to deploy studies by CATI through an Interviewer functionality.

The offeror shall include the numbers of surveys, users, and active surveys in their proposal. In addition, the proposal must identify how many concurrent users can conduct surveys at the same time.

FEMA requires the minimum capability of:

• 30 Simultaneous Users conducting Phone surveys at the same time.

• 150,000 attempted phone surveys annually.

• Minimum user accounts for 30 in-house Federal interviewers

• Minimum user accounts for 20 administrator/supervisors for survey questionnaire development, study administration, interviewer assignments, and results reporting.

• Minimum Survey languages to include English and Spanish.

• Ability to have 20 active surveys available for use at any given time.

• Ability to surge the number of users and/or surveys in the event of a catastrophic disaster and special projects which increase demands. This surge can be up to 50% beyond requirement and should be priced separately.

A representative example of past survey results are as follows (per CY 2019):

• Individual Assistance (IA) Surveys – approved for up to 250,000 Random Samples a year. In 2019, 132,000 surveys were attempted with a 22% completion rate

• Public Assistance (PA) Surveys – Every PA applicant is sent a survey, with normal volume of approximately 35,000-40,000. In 2019, 31,000 surveys were sent with a 34% completion rate

3.2 Survey Questionnaire Design and Development Component/Role The software shall have a specific user role for survey questionnaire development for the FEMA staff who are designing, loading and testing the questionnaires. The survey questionnaire design-development component/role shall allow FEMA to create and design a survey based on the requirements of the customer/stakeholder. Specified users will have the ability to move development/testing copies to a production environment.

The software shall include the ability to use sample survey templates within the software, create survey templates specific to FEMA requirements, and copy questions from existing studies to new studies.

When creating surveys, FEMA requires the ability to create questions with drag and drop functionality as well as to create questions and response options using copy and paste from within the survey tool, Microsoft Word, Microsoft Excel, Microsoft Outlook (email), or Microsoft PowerPoint.

Questionnaire development shall include all standard survey questionnaire styles, including but not limited to:

• Single and multiple response options

• Checkboxes that allow respondents to select multiple answers (all that apply or a specific number)

• Radio buttons that allow respondents to select only one answer

• Response type Other, opens specify text box with required or not required designation

• Drop-down boxes that allow a respondent to select a single answer from a drop-down list

• Display a series of questions in chart format with a rating scale header

• Use of 5, 7, and 10 point rating scales

• Ranking that allows a respondent to rank a list of answers in the order of preference or significance

• Rostering of multiple questions based on response(s) to prior questions

• Open-ended text boxes allowing the respondent to enter a response into a free text area with the ability to set the maximum characters allowed

• Interactive tiered responses based on a decision tree and logic for follow up questions based on responses to initial question(s) and/or user defined fields in a sample record.

The questionnaire design shall include:

• The ability to incorporate user-defined/user-created fields within the questionnaire not used just for branching (e.g. FEMA is interested in feedback on your experience following the [Disaster Type] declared on [Declared Date]

• The ability to designate if questions are required or not required;

• The ability to randomize display of response options;

• Rules for skip patterns;

• Rostering of questions;

• Ranking responses;

• The ability to format individual screen displays based on space allocation

• The ability to display prior response selection or values from user defined data filed within a question or lead in statement.

• Any other standard survey methods for efficient and effective information collection.

• Shall include spelling and grammar check on questions and response options and verify the answer is in the correct format (i.e. date, telephone numbers, etc.).

FEMA desires the ability to achieve a minimum of 100 questions per questionnaire and 200 pages per study/survey. In the event of a special project, FEMA desires the capacity to increase questions and pages under the Surge Contract Line Item Number (CLIN). Surveys in the same study shall be available in English and Spanish with the interviewer being able to select the language within the questionnaire.

Authoring to provide functionality for design of background colors, fonts, logos, page placement for display, and formatting for date, time, phone, or special format objects. Objects created during authoring should automatically build the database fields used for collection of survey responses and associate with the study management component. Questionnaire must allow for single or multiple pages and allow FEMA to set how many questions are on each page, which can vary survey to survey and page to page.

Software must include action button display with use scripted labels (i.e. Next, Previous, Complete, etc.)

as well as the ability to create unique labels. All studies, surveys, and questionnaires shall allow user-specified naming conventions. The solution shall have the ability to print the questionnaire in draft and final survey form. FEMA desires the ability to have the printouts to include custom design layouts such as a flow diagram of skip patterns and branching.

The ability to copy an existing questionnaire from a prior study into a new study and to edit an existing questionnaire is required. The software should also provide for default setting for design elements, so they apply for all new questionnaires, but can be changed at questionnaire level when needed.

3.3 Survey Administration and Management Component/Role

The software shall have a specific user role for survey administration, primarily for the FEMA staff that is to manage or administer the survey. The survey administration component/role shall include the following survey administration features for selecting and building business rules: FEMA desires the ability to set business rules according to types of surveys available, hours of operations, time zones, disposition codes type and functions, conditions for recall or representation based on prior attempt type, maximum number of attempts, and priority of presentation (i.e. not attempted or definite call back), etc.

If there are cost thresholds or limitations to business rules, it must be stated in the proposal along with appropriate pricing. Core functionality must include Telephone Area Code driven Time Zone assignments, flexible set up or changes to rules, copying set up from an existing survey study, sample prioritization rules based on rules and status codes, sample status code designations, real time study status reports, quota assignments at total level as well as sublevel based on qualifications or designations.

The software shall allow FEMA to designate Interviewer skills sets (i.e. English, Spanish, Longitudinal, etc.). The software shall allow FEMA Schedulers to assign Interviewers to specific studies and move Interviewers to different studies while surveys are in progress.

The software shall allow FEMA to set up specific business rules set-up to facilitate survey management:

• Business rules can be adjusted, if needed, during an open study, which includes adjustment to close date

• Import of sample list from .csv, .txt, .xlsx, etc.

• Ability to change the status of a sample record

• Ability to update sample to add, delete or change records

• Ability for the survey to save during the survey process when the next/previous button selected and when survey submitted.

3.3 Interviewer Component / Role

The software shall have an interviewer specific user role, primarily for the FEMA staff conducting the phone surveys. This will be used by the CSA staff for outbound and inbound survey calls. The component/role shall allow the interviewer to see user’s specific productivity reports, queue list to understand available/assigned sample, specialized queuing, ability to select and display sample record from queue list, display of available disposition codes to allow proper selection, and interviewer initiated manual dialing or auto-dialing. System shall allow to set up an individual interviewer profile and skills and present samples for survey based on skill sets (i.e. language or other attributes).

The Interviewer software component shall provide the following:

• Unique Interviewer individual login with ID

• The Interviewer may access only the studies they are assigned to

• The Interviewer may select mode (Data collection, Practice, or Auto Test)

• Records will be automatically queued to assigned Interviewers

• Interviewers may select from queue list or allow next available record to auto display

• Respondent information (Name, telephone Number, etc.) will display

• Temporary and Permanent Interview comment text field display for special comments or instructions

• Prior attempt information is display for Interviewer

• Attempt (disposition) code list is displayed for Interviewer selection

• Help button for interviewer additional information

• Interviewer may transfer sample to queue to another interviewer assigned to the same study

• Record may be returned by Interviewer to sample file when not attempted

• Interviewer options to log off or continue to next record

• Spell check available for text comments

3.4 Administrative Reports

The software shall provide survey administration reports which can be viewed real-time, downloaded or printed and be based on study name or parameters such as date. This includes the ability to run reports by all studies, all active studies, a specific study, and by specific groups (i.e. Individual Assistance and Public Assistance), a specific Interviewer or a specific Supervisor group. All reports should include the ability to run by date and/or date range.

Reports shall include all management statistics including but not limited to the following:

• Number of records imported, completed, mid-terminated, not completed, etc. by date, time and time zone.

• Number of each attempt (disposition) code; such as, call back, no answer, declined, etc. by date.

• Number of attempts by each Interviewer by date and by Study.

• Number of mid-terminated by each Interviewer by date and by Study.

• Number of completed surveys by each Interviewer by date and by Study.

• Amount of time duration for each Interviewer by date, by Study, etc.

• Amount of time duration for each question by Study type and overall duration for each record.

The software shall provide a survey results component that allows FEMA to design and run study specific results reports with response option calculations with the ability to collapse single choice columns to one for export for each question as well as charts and graphs. FEMA desires the capability for study level text analytics for open text box responses.

• Ability to review reports real-time throughout the survey cycle

• Ability to download reports in Microsoft Word, Microsoft Excel, or Adobe PDF

• Ability to create custom charts and reports

3.5 Query of Data Files

The system shall allow FEMA to run queries against the data files with the ability to specify fields, search value, specify parameters, and display, download results as well as mass change field values.

Query methods shall be study specific and provide for drag and drop of selected fields or select and copy. Queries include the following:

• Query mask display of data fields allowing for drag and drop to build query

• Ability to specify parameters to find based on specified fields and valid values

• Ability to run as read only, mass change, and delete records based on specified parameters

• Ability to export query results as Excel or other common formats

• Ability to view sample table/file with filter capabilities

• Ability to save queries for recurring use

• Ability to have a minimum of 100 saved queries per study/survey

3.6 Data Import and Export

The software shall allow data to be imported and exported using formats identified by FEMA including the ability to identify which data fields are required to be imported / exported depending on the study specific survey (i.e. allowing drag and drop, selecting specific fields, etc.).

The export of survey results shall be available while a survey is still in progress and after the close of the survey period, as well as the ability to export raw data, and to collapse response columns, as needed.

FEMA requires the ability to:

• Import and Export data from a variety of data sources, at a minimum FEMA requires the ability to use Microsoft Excel, CSV files, Text delimited files.

• FEMA desires the ability to interface with Open Database Connectivity (ODBC) such as Oracle, Microsoft SQL, or other databases for download and upload capability. FEMA desires the ability for import and export from Microsoft Access, Adobe PDF, SPSS, and XML.

• For study specific imports and exports shall include the ability of assignment of user defined fields with the desire for a minimum of 300 fields and 15,000 records for an import; and the ability to append sample records to internal sample files on the next import

• Manage archiving and/or deleting studies and their data from the system.

3.7 Training

FEMA desires relevant training to occur within two weeks of notice. In coordination with the FEMA COR and PM, the Contractor shall:

• Provide training for the initial roll out of the survey software solution and conduct Train-the- Trainer sessions within two weeks of the contract approval along with system user documentation

• Schedule training within two weeks of request.

• Provide training that shall cover all requirements outlined in Section 3 of the SOO and be sufficient for FEMA personnel to design survey questionnaires, complete surveys, and administer survey assignments at the conclusion without assistance from the contractor.

• Provide ad-hoc training for new employees and/or advanced skills, as needed in coordination with the Contractor.

3.8 Operations and Maintenance

The Contractor shall provide maintenance support, troubleshooting, repair and diagnosis, data backup and recovery, software upgrades (bug fixes, improvements, and enhancements) and patches for the proposed solution. All patching/fixes to be applied outside of business hours with time to implement with automated reboots applied before start of business day.

Maintenance support shall be available to FEMA Program Manager (PM), COR, and the FEMA end users to assist them in accessing the system, user account set up issues, general questions, and submitting tickets for issues. The Contractor shall provide a point-of contact information (name, phone, email address) for all maintenance related issues at least -twenty-one (21) business days prior to the installation or set up being complete.

At a minimum, the Contactor shall provide maintenance support during standard business hours (8:00 AM CT to 5:00 PM CT), Monday through Friday. The Contractor shall include in their proposal what days/hours of support are included and the process for submitting maintenance issues during and after support hours with severity levels and expected turnaround times.

In addition, the contractor shall provide separate pricing structure, if applicable, for evening and weekend coverage, if required during high disaster activity. This support, if required, will be funded incrementally to support disaster activity.

4.0 Progress Reports and Meetings

The Project Manager shall be responsible for keeping the FEMA PM, COR, and CSA Section Chief informed about Contractor progress throughout the performance period of the contract. The Contractor Project Manager shall provide a monthly progress report to the FEMA PM and COR via email. The report shall include a summary of all Contractor work performed during the month until the software is operational. Once operational the monthly report shall include the number of tickets opened, a brief description of the issue, the number of days open and the status.

As needed the Project Manager and Contractor staff shall be available to meet with the FEMA PM, COR, and/or stakeholders upon request to discuss the status, progress, exchange information and resolve emergent technical problems and issues. These meetings shall take place via teleconference.

5.0 Post Award Conference

The Contractor shall attend a Post Award Conference with the Contracting Officer (CO), the PM, the COR, and the CSA Section Chief no later than five (5) business days after the date of award. The purpose of the Post Award Conference, which unless otherwise directed will be chaired by the CO, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held via teleconference.

6.0 Project Plan

The Contractor shall provide a draft Project Plan 3 business days before the Post Award Conference for Government review and comment. The Contractor shall provide a final Project Plan to the COR not later than ten (10) business days after the Post Award Conference.

7.0 Transition Plan

A full and complete transition from the current service provider to the new contract solution within four-months from award of contract is required. Transition is defined as a seamless operation on a non-interference and non-interruption-in-services basis. The Contractor shall address the transition plan in the proposal and provide information on the overall approach to transition. Clarifying information will be discussed during the post award conference and the finalized Transition Plan is due ten (10) business days after the Post Award Conference. The Plan will address all facets of the transition that the Offeror deems important but, at a minimum, should address the timeline, actions, responsibilities and the processes for transition, including adjusting to surge requirements on a 24/7 basis, should a disaster strike at the same time the transition takes place.

8.0 Security Compliance Maintenance and System Documentation

At the direction of FEMA COR, the Contractor shall ensure that all applications remain in full compliance with all security, operations, legal, and regulatory requirements. System vulnerabilities identified by the contractor should be shared with FEMA immediately. The contractor shall support OCIO-mandated security requirements for routine and ad-hoc scanning to include DBA rights and access as needed. The contractor shall support and implement the remediation of security vulnerabilities identified though the vulnerability scanning processes process as outlined by FEMA and support the security Authorization to Operate (ATO) process with documentation and materials as needed for each system and maintain a repository for training as well as supporting data where applicable. The contractor shall assist with remediation in a timely manner to ensure the integrity of the ATO and FEMA’s security posture. The current vulnerability scanning tools utilized by FEMA include Fortify for custom source code, AppDetective for databases, and WebInspect for web applications. For systems that may be hosted on the FEMA Enterprise Network (FEN), this would also include Nessus for the operating system. Aforementioned tools may change; future scanning tools such as CrowdStrike may be researched and implemented for use on FEMA systems and acquired software during and after contract approval.

8.1 Privacy Documentation Requirements

In order to accomplish the tasks outlined in this contract, FEMA may provide the contractor access to FEMA Systems, which may include PII collected in said systems, as outlined in DHS/FEMA/PIA-035 Customer Satisfaction Analyst System (CSAS).

The information sharing outlined in this contract is authorized by the following System of Records Notice(s) and Routine Use(s):

SORN: DHS/ALL-004 General Information Technology Access Account Records (GITAARS), 77 Fed.

Reg. 70792 (Nov. 2012), OPM/GOVT-2 Employee Performance File System Records (June 2006) and OPM GOVT-7 Applicant Race, Sex, National Origin, and Disability Status Records (June 2006).

Routine Use F allows FEMA to disclose/allow access to user login information from FEMA systems “To contractors and their agents, grantees, experts, consultants, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for DHS, when necessary to accomplish an agency function related to this system of records. Individuals provided information under this routine use are subject to the same Privacy Act requirements and limitations on disclosure as are applicable to DHS officers and employees.”

Contractor access to proprietary information and information protected under the Privacy Act may be required under this SOO. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation, including DHS MD 11042.1, Safeguarding Sensitive but Unclassified (For Official Use Only) Information. The contractor will limit access to the PII and proprietary information provided by FEMA under this contract only to the contractor’s authorized personnel who need to know the information to accomplish the tasks outlined in this contract. The Contractor shall ensure that all Contractor personnel having access to sensitive information sign a non-disclosure agreement (DHS Form 11000-6).

The contractor shall assist with and/or consult with the Contracting Officer Representative (COR), Program Manager (PM), and/or System Owner (SO) to ensure compliance with all DHS information security policies as the relate to sensitive systems to include training, risk assessments, remediation, and handling of privacy incidents. Actions may include supporting FEMA in completing the appropriate Privacy Act Threshold Analysis (PTA), Privacy Impact Analysis (PIA), for submission and approval by

FEMA and DHS Privacy prior to the collection of Personally Identifiable Information (PII) related information associated with the services and/or technology included in this solicitation. Compliance should include the contractor taking necessary steps as outlined by FEMA to allow effective system troubleshooting by the contractor with FEMA information technology personnel and end users.

The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), will occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

All deliverables, source code, and data received, processed, evaluated, loaded, and/or created as a result of this contract shall remain the sole property of the Government unless specific exception is granted by the CO.

If at any time during the term of this contract any part of FEMA PII or proprietary information, in any form, that the contractor obtains from FEMA ceases to be required by the contractor for the performance of the contract, or upon termination of the contract, whichever occurs first, the contractor shall, within fourteen (14) calendar days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request destroy, un-install and/or remove all copies of such PII in the contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.

9.0 Business Continuity Plan

The Contractor shall prepare and submit a Business Continuity Plan (BCP) to the Government. The BCP Plan shall be due thirty (30) business days after the date of award and will be updated on an annual basis. The BCP shall document Contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, shall include the following:

• A description of the Contractor’s emergency management procedures and policy;

• A description of how the Contractor will account for their employees during an emergency;

• How the Contractor will communicate with the Government during emergencies;

• A list of primary and alternate Contractor points of contact, each with primary and alternate:

o Telephone numbers;

o E-mail addresses.

Individual BCPs shall be activated immediately after determining that an emergency has occurred, shall be operational within 48 hours of activation or as directed by the Government, and shall be sustainable until the emergency is resolved and normal conditions are restored, or the contract is terminated, whichever comes first. In case of a life-threatening emergency, the COR shall immediately contact the Contractor Project Manager to ascertain the status of any Contractor personnel who were in Government controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the Contractor Project Manager and the COR shall promptly open an effective means of communication and verify:

• Key points of contact (Government and Contractor);

• Temporary work locations (alternate office spaces, telework, virtual offices, etc.);

• Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.);

• Essential Contractor work products expected to be continued, by priority;

• Impact on current schedule and resource availability.

The Government and Contractor Project Manager shall make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances.

Contractors shall obtain approval from the Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type and work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

10.0 Government Acceptance Period

The COR will review deliverables prior to acceptance and provide the Contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying it that the deliverable has been accepted.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

The COR will have 7 business days to review deliverables and make comments. The Contractor shall have 7 business days to make corrections and redeliver.

All other review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan. The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review. The Contractor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

11.0 Deliverables

The following deliverables shall be completed as identified in the Statement of Work in coordination between the FEMA CO, COR, PM and/or CSA, and the Contractor.

# Section Deliverable / Event Due By / Method Distribution 1 3.0 Scope: Delivery and

Transition of Proposed Survey Solution

Within four-months of award N/A

2 3.7 Training – Initial Training Scheduled within two weeks of notification in coordination with the FEMA PM and COR and prior to the full implementation of the survey solution

COR, Program Manager

3 3.7 Training – Ad hoc and additional

Scheduled within two weeks of notification in coordination with the FEMA PM and COR

COR, Program Manager

4 3.8 Operations and Maintenance Points of Contacts (POCs)

Within 7 days of completion and transition to production

COR, Program Manager

5 4.0 Monthly Progress and Status Reports

Due the 5th Calendar day of the month (if occurs on a weekend or

COR, Program Manager

12.0 Period of Performance

The period of performance for this contract will be one (1) base period and three (3) option periods. The base period will be 12 months from the date of award. Subsequent option periods will be 12 months to be exercised at the discretion of the Government.

13.0 Place of Performance

The Contractor shall work from their facility, but occasional travel may be required to FEMA facilities for system set up and training. The primary FEMA facilities are located at:

• Texas Recovery Service Center, 3900 Karina Ln, Denton TX 76208

• Virginia Disaster Operations Center, 430 Market Street, Winchester, VA 22603 holiday, due date is moved to the next business day). Report can be submitted in Microsoft Word or Adobe PDF.

6 4.0 Progress and Technical Meetings

Scheduled within 24 hours of notice, unless it is an outage and meeting shall be scheduled within the O&M time frames.

COR, Program Manager

7 5.0 Post Award Conference Within 5 business days of contract award

CO, Program Manager, COR

8 6.0 Project Plan – Draft Within 5 business days of contract award & reviewed at the post award conference. Plan can be submitted in Microsoft Word or Adobe PDF.

CO, COR,

Program Manager

9 6.0 Project Plan – Final Within 10 business days of the post award conference. Plan can be submitted in Microsoft Word or Adobe PDF.

CO, COR,

Program Manager

10 7.0 Transition Plan Discussed at the post award conference. Plan due within 10 business days of the post award conference. Plan can be submitted in Microsoft Word or Adobe PDF.

CO, COR,

Program Manager

# Section Deliverable / Event Due By / Method Distribution 11 8.0 Business Continuity Plan –

Initial Within 10 Business Days After Award. Plan can be submitted in Microsoft Word or Adobe PDF.

CO, COR

12 9.0 Business Continuity Plan - Updated

Annually and due within 10 business day of option period being exercised. Plan can be submitted in Microsoft Word or Adobe PDF.

CO, COR

Appendix I – Government Furnished Equipment (GFE) When required to complete the requirements outlined in the SOO, FEMA Government Property (Laptops, PIV Badges, etc.) will be provided to Contractors, in accordance with FAR 45.102(b), under the following conditions:

• Providing the property is in the Government’s best interest due to directives established by the Information Technology Security Branch (ITSB) for cyber security management.

• The overall benefit to the acquisition significantly outweighs the increased cost of administration, including ultimate property disposal.

• Providing the property does not substantially increase the Government’s assumption of risk.

• Government requirements cannot otherwise be met.

The Contractor shall pick up the FEMA laptops and badges from a FEMA facility. The equipment and components shall be returned to the Contracting Officer’s Representative (COR) at the designated location at the Contractor’s expense. All the security controls for GFE must be adhered to by the Contractor to fulfill the requirements of the contract.

The Contractor shall login with the FEMA laptop and connect to the FEMA network at least once every two (2) weeks for a minimum of four (4) hours to ensure the download of appropriate patches.

Therefore, the Contractor shall bring their laptop to a FEMA office every two (2) weeks and attach it directly to the FEMA Local Area Network (LAN) or log in remotely and connect to the FEMA Virtual Private Network (VPN) once every two (2) weeks. If a Contractor employee logs in remotely, they shall use a high-speed internet connection and leave the laptop logged in for a minimum of four (4) hours to allow all patches and updates to properly load as downloads will not occur properly via a dial-up connection.

If this mandatory requirement is not adhered to, then the Contractor employees shall travel to the local/nearest FEMA office to reset their credentials.

Any Government equipment provided for FEMA’s contract shall be used exclusively for FEMA business and are subject to FEMA and DHS rules of behavior regarding access and use of DHS sensitive information technology resources. Government equipment shall not be used for Contractor or personal business outside of the work required for FEMA.

Appendix II – DHS Enterprise Architecture Compliance All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures.

Specifically, the Contractor shall comply with the following Homeland Security Enterprise Architecture (HLS EA) requirements:

(a) All developed solutions and requirements shall be compliant with the HLS/FEMA EA.

(b) All IT hardware and/or software shall be compliant with the HLS/FEMA EA Technical Reference Model (TRM) Standards and Products Profile.

(c) Description information for all information assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

(d) Development of information assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01[1] and all data-related artifacts will be developed, validated, managed, stored and tagged according to DHS data management architectural guidelines.

(e) Applicability of IPv6 to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant as defined in the USGv6 Profile (NIST Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

[1] Department of Homeland Security (DHS) Directives System, Enterprise Data Management Policy, 2008.

https://www.dhs.gov/sites/default/files/publications/mgmt_directive_103_01_enterprise_data_management_policy.pdf https://www.dhs.gov/sites/default/files/publications/mgmt_directive_103_01_enterprise_data_management_policy.pdf

Appendix III – 508 Compliance Accessibility Requirements

Section 508 Requirements Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-

220) (codified at 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities.

Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

1. All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT or that contain ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards.

Item that contains Information and Communications Technology (ICT): IT Software Applicable Exception: N/A Authorization #: N/A Applicable Functional Performance Criteria: All functional performance criteria apply to when using an alternative design or technology that results to achieve substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable requirements for electronic content features and components (including Internet and Intranet website; Electronic documents; Electronic forms; Electronic document templates; Electronic surveys; Electronic reports; Electronic training materials; Interactive maps): All Level AA Success Criteria Apply Applicable requirements for software features and components (including Web, desktop, server, mobile client applications; Electronic content and software authoring tools and platforms; Software infrastructure; Service Offerings): All WCAG Level AA Success Criteria, 502 Interoperability with Assistive Technology, 503 Application, 504 Authoring Tools Applicable requirements for hardware features and components: Does not apply Applicable support services and documentation: All requirements apply

2. When providing and managing hosting services for ICT, the Contractor shall ensure the hosting service does not reduce the item’s original level of Section 508 conformance before providing the hosting service.

3. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item’s level of Section 508 conformance prior to the services being performed.

4. When providing maintenance upgrades, substitutions, and replacements to ICT, the Contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution or replacement. Prior to acceptance, the Contractor shall provide an Accessibility Conformance Report (ACR). The ACR should be created using the on the Voluntary Product Accessibility Template Version 2.1 or later. The template can be located at https://www.itic.org/policy/accessibility/vpat

5. When developing or modifying ICT for the government, the Contractor shall ensure the ICT fully conforms to the applicable Section 508 Standards. When modifying a commercially available or https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf https://www.itic.org/policy/accessibility/vpat government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

6. When developing or modifying web and software ICT, the Contractor shall demonstrate Section 508 conformance by providing Section 508 test results based on the versions of the DHS Trusted Tester Methodology currently approved for use, as defined at https://www.dhs.gov/compliance-test-processes. The Contractor shall use testers who are certified by DHS on how to use the DHS Trusted Tester Methodology (e.g “DHS Certified Trusted Testers”) to conduct accessibility testing.

Information on how testers can become certified is located at https://www.dhs.gov/publication/trusted-tester-resources.

7. When developing or modifying ICT that are delivered in an electronic Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance by providing Section 508 test results based on the Accessible Electronic Documents – Community of Practice (AED COP) Harmonized Testing Guidance at https://www.dhs.gov/compliance-test-processes.

8. When developing or modifying software that generates electronic content (e.g., an authoring tool that is used to create html pages, reports, surveys, charts, dashboards, etc.), the Contractor shall ensure software can be used to create electronic content that conforms to the Section 508 standards.

9. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the applicable revised Section 508 Standards for each ICT.

10. Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated January 29, 2016 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated January 11, 2017.

11. Where ICT conforming to one or more requirements in the Revised 508 Standards is not commercially available, the agency shall procure the ICT that best meets the Revised 508 Standards consistent with the agency’s business needs, in accordance with 36 CFR E202.7. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated January 29, 2016 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated January 11, 2017 and 36 CFR E202.6.

https://www.dhs.gov/compliance-test-processes https://www.dhs.gov/publication/trusted-tester-resources

Appendix IV – Security See Solicitation Section C – Contract Clauses C.4. Standard Security Clause In addition to C.4 Standard Security Clause, the following applies:

Separation from Contract The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to Contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a Contractor employee’s employment.

• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or Contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the Contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the Contractor personnel and the Contractor to civil and criminal liability.

Security Training

SECURITY: All personnel require access to information up to the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure Contractor employees receive a favorably adjudicated public trust suitability prior to entry on duty (EOD). All individuals will be U.S. citizens.

The Contractor shall follow the standards established within DHS and FEMA policy.

Unauthorized Disclosure of Classified or Unclassified Information Contractors and Subcontractors who are working on this contract shall receive Unauthorized Disclosure of Classified or Unclassified Information training.

Access to the training can be obtained at:

https://securityawareness.usalearning.gov/unauthorizedrefresher/index.htm

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

OPSEC Training Contractors and Subcontractors who are working on this contract shall receive the OPSEC Awareness Brief.

Access to the briefing can be obtained at http://cdsetrain.dtic.mil/opsec https://securityawareness.usalearning.gov/unauthorizedrefresher/index.htm http://cdsetrain.dtic.mil/opsec

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

Insider Threat Training Insider Threat training for Contractors can be found at: http://cdsetrain.dtic.mil/itawareness/index.htm.

Certificate of training is required for all cleared Contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared Contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

For Official Use Only (FOUO) Information In accordance with DHS Management Directive 11042.1 Contractor, consultants and others to whom access is granted will abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities.

The Contractor shall:

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer-based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. Be aware that divulging information without proper authority could result in administrative or disciplinary action.

Contractors and Consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified Information Non Disclosure Agreement (NDA), as a condition of access to such information.