Statement of Work (Post-Award Grant Monitoring Activity Automation).pdf

Statement of Work (SOW) Orders for Services

GENERAL INFORMATION

Title of Project:

Post-Award Grant Monitoring Activity Automation

Statement of Need, Purpose, and/or Objective:

AmeriCorps is currently implementing a modernization initiative, which includes the adoption of a robust grants management system to support the comprehensive grant application, review, and award cycle for grants. Until AmeriCorps adopts and launches an agency-wide grants management system, grants will continue to be reviewed and award through the legacy system.

The Office of Monitoring (OM) is seeking an interim software solution to support the critical need for back-end administration and management of automated post-award monitoring activities. OM currently supports monitoring for up to 200 grants a year with the possibility of monitoring up to 500 a year within the next five years. OM support up to 15 different monitoring activity types, including support of feedback mechanisms to programmatic staff to ensure that monitoring results are communicated to grant recipients and corrective actions are able to be tracked and resolved.

This interim technology software solution must support automation of monitoring processes and activity. The software solution will offer flexible and configurable tables, forms, fields, reports, and dashboards to meet the broad range of monitoring activities to be implemented, as well as the ability to set up workflows that automate monitoring through stages and offer user activity history.

Stand-up and implementation of the full scope of AmeriCorps monitoring activities will be delayed without the ability to create and manage standardized protocols within an electronic platform that can streamline efficiencies and expedite tracking and reporting for purposes of program accountability, ensuring compliance, as well as formalizing processes for monitoring officials to interact with grant recipients, when necessary.

Background Information:

The AmeriCorps Office of Monitoring is responsible for standardizing and strengthening monitoring of the Agency’s grant portfolio within a centralized unit, whose functions have high visibility with Executive leadership, the Office of Inspector General, and the Government Accountability Office. As part of the agency’s Transformation and Sustainability Plan, OM is centralizing monitoring activities and broadening the type of compliance monitoring activities to be performed for awarded grants. OM independently monitors and tests over 3,000 AmeriCorps funded grants, projects, and recipient organizations to ensure program activities are in compliance with Federal regulations and AmeriCorps policies. The Office provides mission-critical program monitoring and evaluation to support information gathering and reporting on a continuous basis to show effectiveness of grant programs and to evaluate effectiveness of the monitoring system.

Currently, the legacy system at AmeriCorps is unable to offer functions to support the standardization of post-award monitoring activities and corrective action protocols, therefore, the legacy system does not support a structured process for collecting longitudinal data for evaluation purposes. A critical goal of OM is to streamline and reduce the administrative burden related to performing and reporting on monitoring efforts, without reducing the quality of compliance assessment. Stand-up of the new OM unit and implementation of the full scope of AmeriCorps monitoring activities will be delayed without the ability to create and manage standardized protocols within an electronic platform that can streamline efficiencies and expedite tracking and reporting for purposes of program accountability, ensuring compliance, as well as formalizing processes for monitoring officials to interact with grant recipients, when necessary.

Period of Performance:

Base Period (12 months): July 15, 2022 through July 14, 2023 Option Period 01 (12 months): July 15, 2023 through July 14, 2024 Option Period 02 (12 months): July 15, 2024 through July 14, 2025 Option Period 03 (12 months): July 15, 2025 through July 14, 2026 Option Period 04(12 months): July 15, 2026 through July 14, 2027 Optional six-month extension: July 15, 2027 through January 14, 2028

Place of Performance:

Service is provided via internet browser and software license subscription. Subscription provides users with credentials to access secure software system from AmeriCorps headquarters.

Hours of Operation:

Contractor employees shall generally perform all work between the hours of 7:00am and 6:00pm, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends, to fulfill requirements under this Statement of Work.

Federal Holidays:

Federal law (5 U.S.C. 6103) establishes the following public holidays for Federal employees.

Please note that most Federal employees work on a Monday through Friday schedule. For these employees, when a holiday falls on a non-workday – Saturday or Sunday – the holiday usually is observed on Monday (if the holiday falls on Sunday) or Friday (if the holiday falls on Saturday).

Contractors shall follow these same guidelines.

Direct billing/invoicing shall not be allowed for any Federal Government Holidays (e.g. New Year’s Day; Birthday of Martin Luther King, Jr.; Birthday of George Washington; Memorial Day;

Juneteenth; Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day;

Christmas Day) or on days designated as a holiday for federal employees via Executive Order.

SCOPE OF WORK

General Requirements:

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government as needed to perform the Statement of Work below.

Specific Requirements:

The functionality requirements of the platform services include the capacity to:

• Support secure location for performing virtual, back-end administration and management of automated post-award monitoring activities for 3,000+ grants.

• Offer flexible and configurable tables, forms, fields, reports, and dashboards to meet the broad range of post-award monitoring activities to be implemented by staff.

• Configure and adapt to changing processes and meet custom needs related to collecting and sharing post-award grant monitoring information.

• Manage importing new grant records using a CSV or similar file type at various points throughout the period of service.

• Offer users full administrative control of the tables, forms, fields, reports, and dashboards, including ability to make ad-hoc modifications and customization throughout period of service.

• Set up workflows that automate post-award monitoring activities through stages.

• Assign role-based permissions and access user activity history.

• Transfer data within the platform to outside systems using a secure transfer method.

• Support tracking and status reporting of compliance activities, such as corrective action implementation and resolution.

• Create and send batch notifications to points of contact, including scheduled notifications.

• Accept and maintain various file types.

• Download batches of file submissions.

• Support electronic feedback mechanisms, including correspondence templates, to external contacts to ensure that information is communicated to staff and grant recipients.

• Meet the standards of AmeriCorps security needs (see Information Security Requirements section);

• Track and log user changes within in platform.

• Support a multi-factor authentication login portal.

• Complete database backups on at least a monthly basis with incremental backups on a daily basis. Restorations must be able to be completed within 24 business hours upon request by the Office of Monitoring. A backup and restoration plan must be submitted to the Office of Monitoring prior to system launch; and

• Provide data export (in CSV or XLS formats), should software license agreement terminate without renewal.

GOVERNMENT RESPONSIBILITIES

The Federal government will not be furnishing any equipment to the contractor. The Government will provide conference rooms or offices for the contractor to conduct interviews with staff or perform testing of the platform documentation and workflow produced on an as needed basis. The Government will provide the contractor with AmeriCorps Monitoring Office templates, workflow documentation, and other items as needed.

The Government will work with the Implementation Lead to customize and implement monitoring office platform for internal and external users.

The Government will test the workflow and platform forms and provide feedback to the Contractor on the functionality of the platform. The Monitoring Office will work with the Implementation Lead to customize tables and forms to meet the Monitoring Office’s needs.

DELIVERY OR DELIVERABLES

The Contractor shall provide:

• Application Service Level Agreement

• An exported CSV file for each table of all data stored in the system upon request and at the termination of the contract.

• Access to platform customization training and back-end support within 5 business days of award.

• Support for development and modification of workflows within 2-month build-out period from beginning of contract.

• Continuation of access to platform.

Additionally, the system should be compliant with the guidelines described within NIST SP 800- 37 RMF. The Contractor shall provide:

• System Security Plan (SSP).

• Continuous Monitoring Plan; and

• Plan of Actions and Milestones (POA&M)

REPORTING REQUIREMENTS

All Application Service Level Agreements (SLAs) are measured monthly and require:

• Uptime: 99.9% Monday - Friday, 6AM - 9PM US Eastern Time.

• Mean time to interaction: 1 hour.

• Average number of interactions per resolution: 4.

• Mean time to remediate: 12 hours.

The Contractor shall provide quarterly status reports through a conference call. The conference call schedule will be determined after award.

PAYMENT PROVISIONS:

This is a subscription-based product with a prepaid one-time payment for an annual subscription. There are two labor line items for Key Personnel that are to be invoiced and paid only as needed.

OTHER CONSIDERATIONS

Travel:

No Travel is required for this procurement.

Key Personnel:

There is a need for an Implementation Lead and Cybersecurity Analyst. Each position requires up to 100 hours of service.

Personnel Security Requirements

Not Applicable.

Information System Security Requirements:

The Contractor is required to: (1) develop; (2) have the ability to access; and (3) host and/or maintain federal information system(s), information security policies, and procedures. The Contractor is required to provide support for the review process of the Security Compliance Requirements to receive a full ATO. Please note, a "federal information system" is defined as an information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency. [40 U.S.C., Sec. 11331]

The Contractor shall provide an information system that meets all the cybersecurity and privacy (as applicable) requirements.

The Contractor shall follow the AmeriCorps IT Risk Management Framework (RMF) and all related documentation necessary for the information system to obtain or retain an authority to operate (ATO) or authority to use (ATU).

The Contractor shall provide a FedRAMP cloud-based information system that adheres to the scope and value of the contract. If a FedRAMP cloud service provider is not available, a commercial cloud service can be used; however, it must meet all the security requirements as required based on the system categorization. The system categorization is part of the RMF lifecycle. If a cloud-based information system is not provided, the information system must meet all the security requirements based on the system categorization.

During the initial ATO/ATU process the Contractor shall provide the following as part of the accreditation process:

1. System Security Officer (SSO) – a person with the knowledge level to facilitate the system in obtaining an ATO or ATU.

2. Accreditation Documentation – at a minimum the following complete documentation is required in order to obtain an ATO/ATU:

a. FIPS 199, System Categorization,

b. E-Authentication,

c. Authorization Boundary Diagram,

d. Baseline Configuration,

e. Applicable Interconnection Security Agreements (ISA) or Memorandums of

Understanding/Agreement (MOU/A), and

f. System Security Plan (SSP).

Once an information system has obtained or retained an ATO/ATU, the Contractor shall follow the RMF lifecycle in order maintain an Ongoing Authorization (OA). At a minimum this shall include:

1. System Security Officer (SSO) – a person with the knowledge level to maintain the OA.

In some instances, at the direction of the AmeriCorps CISO an information system or service provided or retained may become a part of an existing AmeriCorps authorization.

2. Continuous Monitoring – following established AmeriCorps processes to ensure the security posture of the information system or service is maintained. Guidance on this process and the specific requirements based on the contract are provided after the information system or service receives an ATO/ATU.

3. Annual Assessment – a third party review of pre-defined security controls.

At the discretion of AmeriCorps CISO this annual assessment will be conducted by the Agency’s Cybersecurity Support contractor.

4. Change Control Management – submit changes to the AmeriCorps Technical Review Board (TRB) and/or Production Change Control Board (PCCB) before changing an authorized system.

If the information system uses a FedRAMP cloud service, this requirement may be waived.

Data Rights:

Contractor will not share, distribute, or sell AmeriCorps data to external parties. AmeriCorps retains ownership of all data that is uploaded to the product.

Section 508—Electronic and Information Technology Standards:

The platform must meet the standards for accessibility to information and communication technology (ICT) under Section 508 of the Rehabilitation Act and Section 255 of the Communications Act.

Confidentiality of Information:

The Contractor will be required to maintain security provisions for all data received from the government. These provisions include security for computer data, systems, databases and data files, electronic data transfers and sensitive paper documents. Contractor employees and subcontractor employees will be required to comply with all security standards set forth in the applicable AmeriCorps department directives, AmeriCorps cybersecurity and privacy policies, public laws, OMB circulars and bulletins, Federal Information Processing Standard publications, Office of Personnel Management Federal Personnel regulations, and any other applicable Federal Regulations.