Subscriber Communication Service Specification Sheet (draft).pdf

Subcriber Communication Service Specifications Sheet

Performance Requirements:

The Contractor shall provide technical requirements necessary to sustain an ongoing communication and social media tool, utilizing Software as a Service (SaaS) to support the Security Training (ST) Directorate, Center for Development of Security Excellence (CDSE) and their wide range of customers across the federal workforce. The SaaS must be able to provide CDSE with a comprehensive set of email templates and design tools, as well as provide reporting and analytic tools. Additionally, the SaaS must include RSS Feed, web site integration capabilities and the ability to post to social media sites enabling the Government to connect with its target and segmented audiences.

The Contractor and any subcontractors must comply with DFARS Regulation 239.76, DFARS Subpart 252.239-7009, DFARS Clause 252.239.7010 and Cloud Computing Security Requirements Guide (CCSRG) for achieving a DoD Provisional Authorization (PA) at Impact Level (IL) Two (2) unless exceptions as defined within the DFARS 239.76 apply.

The period of performance is for a one-year base period, with one (1) one-year option, plus one 6-month extension periods (if exercised):

The Contractor shall provide SaaS and support to meet the following capabilities:

Administration:

• Allow the Government to export/import all subscriber email addresses.

• Desirable: Allow the Government to export/import subscriber email addresses and preferences.

• Allow Government 10 Account Administrators, 25 Topic Administrators, and unlimited

Report Viewers.

• Allow the Government to manage unlimited independent campaigns across email, social, mobile, web, and other channels per year.

• Allow the Government to update, query, and edit email list of subscribers.

• Allow the Government to segment subscribers by email domains (i.e., /mil, gov, .com) and other categories.

• Provide the Government a subscription link or page to its registration website.

Subscribership and Segmentation:

• Allow up to 999,999 users.

• Allow subscriber to select digesting rate (instant, daily, weekly, or monthly alerts).

• Allow subscriber to select interests, preferences, location, and job/roles to drive messaging.

• Allow subscribers to manage all aspects of subscription, including sign-up, opt-out, and other preference settings (such as e-mail, e-mail to SMS wireless, RSS and social media channels), from one location.

Email Management capabilities include:

• Personalized (addresses subscriber by name) and contextually relevant messages.

• Analyzes and predicts open rates and optimal send times based on historical engagement metrics.

• Personalized content on a one-to-one basis based on the rules set for each recipient or group.

• Standard and customizable templates with the ability to import photos/graphics.

• Assured content deliverability as a “trusted sender” (without significant format changes) by complying with the requirements necessary to participate in the DOD/DISA Trusted sender program.

• Allows attachments.

• Ability to simultaneously send text and HTML versions of communications based upon.mil/.gov and all other email addresses.

• All communications will be created with HTML and Text versions.

• Allow the Government to schedule communications distribution.

Content and Retention:

• Allow the Government to create content in accordance with WCAG 2.0 requirements.

• Communications can be created by importing Word and /or Text documents or created directly in the template with editing/formatting capability.

• All data created shall be archived and available for at least 12 months.

• The Government will control all email content to include title and body of email.

Testing:

• Ability to view email A/B tests prior to sending.

• Ability to view from web, mobile and email client perspective prior to sending.

Reporting:

• User-friendly, built-in, or tailored reports to analyze email delivery, engagement data, and success of campaigns.

• Automated on a recurring or ad hoc basis.

• Ability to export to other tools for analysis.

• Detailed and aggregated reports with graphical and raw data outputs.

Helpdesk:

• Maintenance and help desk support for the Government administrators with resolution in 3 business days. Coverage is expected during normal business hours (8 AM-5 PM), Monday-Friday.

• Service uptime: The Government requires the SaaS be available 99%, excluding scheduled maintenance and upgrades, during the Government core business hours for (6:30 AM-6:30 PM ET). Performance is based on a 30-day monthly period; not to exceed 3 hours and 36 minutes of unscheduled downtime.

• The contractor must provide 24/7/365 monitoring to ensure the SaaS availability and provide emergency support if required by the Government.

Other:

• Maintain infrastructure to effectively handle mass email distribution (10,000+) to targeted segments monthly.

• Provide web-based training for the Government administrators.

• Provide information on SaaS tool/communication best practices and feedback on ways to improve tool usage.

• Controlled Unclassified Information (CUI) / Receive, Store, or Generate Controlled

Unclassified Information: Contractor will be provided and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover. In accordance with DoD Instruction 5200.48 (DoDI 5200.48) dated March 6, 2020, Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to DoD personnel and contractors through CDSE.

• OPERATIONS SECURITY (OPSEC) REQUIREMENTS

1. The contractor shall comply with OPSEC requirements contained in the contract, addendum thereto, or identified herein. The contractor will comply with all security and OPSEC policies, directives, instructions or mandates as directed. OPSEC and other security guidance issued to the Prime Contractor shall also apply to subcontractors working on this effort.

2. The contractor will ensure compliance with the Agency’s OPSEC Policy Statement, Critical Information and Indicators List (CIL), and unclassified document destruction procedures. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

3. Include OPSEC as part of the security awareness program. The contractor shall be familiar with OPSEC and will be required to take Government furnished initial and annual refresher OPSEC training and will be reminded of their continued responsibility to protect sensitive information as directed by DoDM

5205.02. Sensitive unclassified information includes, but is not limited to, agency identified critical information, legacy “For Official Use Only” (FOUO), CUI, Privacy Act of 1974, Personally Identifiable Information (PII), Department of Defense

Unclassified Controlled Nuclear Information (DoD UCNI) and company proprietary information.

4. The contractor shall take the necessary precautions to ensure employees with access to the sensitive and critical information are instructed not to disclose or disseminate any information relating to the conduct and performance of the contract to any individual not authorized to perform on this contract. Assigned personnel shall be knowledgeable of the designated critical information and measures in place to protect it.

5. For programs protected by a Program Protection Plan (PPP) and have identified Critical Program Information (CPI) and/or Critical Technologies Information (CTI), must be identified and protected in accordance with DoD Instruction 5200.39, CPI Identification and Protection within RDT&E. The contractor shall ensure that any program with CPI or CTI has the corresponding supplements and associated plan, such as an OPSEC plan, approved and in effect in support of the PPP.

6. The contractor shall comply with OPSEC content review policies within the Agency. A content review is an evaluation of all information, to include all CUI, intended for release outside the control of the organization or release to the public. OPSEC focuses on identifying and protecting the organization’s unclassified information that may individually or in the aggregate lead to the compromise of classified information and sensitive activities. The contractor will ensure that these reviews are conducted according to agency guidance in accordance with mandates from DoDD 5205.02E, DoD OPSEC Program, DoDM 5205.02-M, DoD OPSEC Program Manual, DoDI 5230.09, Clearance of DoD Information for Public Release, DoDI 5230.29, Security and Policy Review of DoD Information for Public Release, DoDI 5400.04, Provision of Information to Congress, DoDM 5400.07, DoD FOIA Program, and DoDI 8170.01, Online Information Management and Electronic Messaging.

7. Further OPSEC guidance may be obtained by the Prime contractor contacting the OPSEC PM by group e-mail: dcsa.quantico.dcsa-hq.mbx.operations-security@mail.mil.

All programs and materials developed at Government expense during the performance period of this contract are the property of the US Government.

Contractor personnel shall utilize US Government or official company e-mail for transmitting official US Government business. Official US Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, JUNO, AOL, COMCAST, KNOLOGY, VERIZON, etc.

mailto:dcsa.quantico.dcsa-hq.mbx.operations-security@mail.mil mailto:dcsa.quantico.dcsa-hq.mbx.operations-security@mail.mil

Subcriber Communication Service Specifications Sheet