Terms_and_Conditions_140A1125R0007.pdf

BIA San Carlos Irrigation Project RFP NO. 140A1125R0007

TABLE OF CONTENTS

1. SECTION B SUPPLIES OR SERVICES AND PRICES

QUOTE SCHEDULE

2. SECTION C DESCRIPTION / SPECIFICATIONS

Specification / Statement of Work / Performance Work Statement

3. SECTION F DELIVERIES OR PERFORMANCE

52.219-14 Limitations on Subcontracting Oct 2022 (DEVIATION) 52.222-20 Contracts for Materials, Supplies, Articles and Equipment

Exceeding $15,000 June 2020 52.242-15 Stop-Work Order August 1989

4. SECTION G CONTRACT ADMINISTRATION DATA

DOI Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP) April 2013

5. SECTION I CONTACT CLAUSES

1452.203-70 Restrictions on Endorsements—Department of the interior July 1996 (Deviation) 52.203-17 Contractor or Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights June 2020

52.203-19 Prohibition on Requiring Certain Internal Confidentiality January 2017 Agreements or Statements

52.204-12 Unique Entity Identifier Maintenance October 2016 52.204-13 System for Award Management Maintenance October 2018 52.204-19 Incorporation by Reference of Representations Certifications December 2014 Certifications 52.212-4 Contract Terms and Conditions -- Commercial Products and December 2022 Commercial Services 52.212-5 Contract Terms and Conditions Required to Implement February 2024 Statutes or Executive Orders – Commercial Products or Services 52.227-19 Commercial Computer Software License December 2007

52.232-40 Providing Accelerated Payments to Small Business Subcontractors December 2013 52.233-3 Protest after Award August 1996 52.252-2 Clauses Incorporated by Reference February 1998

6. SECTION K REPRESENTATIONS, CERTIFICATIONS, AND OTHER STATEMENTS OF BIDDERS

52.203-11 CERTIFICATION AND DISCLOSURE REGARDING PAYMENTS TO INFLUENCE SEPTEMBER 2007

CERTAIN FEDERAL TRANSACTIONS

52.203-18 Prohibition on Contracting with Entities that Require Certain Internal January 2017 Confidentiality Agreements or Statements-Representation

52.207-4 Economic Purchase Quantities August 1987 52.204-17 Ownership or Control of Offeror August 2020 52.204-20 Predecessor of Offeror August 2020 52.204-24 Representation Regarding Certain Telecommunications and Video October 2020 Surveillance Services or Equipment 52.204-26 Covered Telecommunications Equipment or Services-Representation October 2020 52.209-2 Prohibition on Contracting with Inverted Domestic Corporations— November 2015 Representation 52.209-5 Certification Regarding Responsibility Matters August 2020

52.209-7 Information Regarding Responsibility Matters October 2018 52.209-11 Representation by Corporations Regarding Delinquent Tax Liability

Or a Felony Conviction under any Federal Law February 2016 52.212-3 Offeror Representations and Certifications-Commercial Products and December 2022 Commercial Services 52.225-2 Buy American Certificate February 2021

52.225-18 Place of Manufacture August 2018 52.225-25 Prohibition on Contracting with Entities Engaging in Certain Activities or Transactions Relating to Iran—Representation and Certifications June 2020

7. SECTION L INSTRUCTIONS, CONDITIONS, AND NOTICES TO BIDDERS

Quote completion & submission Instructions

1452.233-2 Service of Protest Department of the Interior July 1996 (Deviation) 1452.236-71 Additive or Deductive Items – Department of the Interior July 1996 (Deviation) 52.204-6 Unique Entity Identifier October 2016 52.204-7 System for Award Management October 2018 52.204-16 Commercial and Government Entity Code Reporting August 2020 52.204-22 Alternative Line Item Proposal January 2017

52.204-18 Commercial and Government Entity Code Maintenance August 2020 52.211-6 Brand Name or Equal August 1999

52.212-1 Instructions to Offerors — Commercial Items June 2020 52.233-2 Service of Protest September 2006

8. SECTION M EVALUATION FACTORS FOR AWARD

General / Evaluation Criteria / Selection for Award 52.212-2 Evaluation — Commercial Items November 2021

SECTION B SUPPLIES OR SERVICES AND PRICES

Item Description Qty U/I Price Amount 01 Software Service Locations Licenses, 30,000 1 YR $_____________ $____________ 02 Site User License 1 YR $_____________ $____________ 03 AM Interface Module AMI-CRA 1 YR $_____________ $____________ 04 Direct Payment Module – ALL 1 YR $____________ $____________ 05 Accounting Interface Module FBMS ALL 1 YR $_____________ $____________ 06 Treasury Interface epay.gov SCIP 1 YR $_____________ $____________ 07 Work Asset Mgmt. API Elements 1 YR $____________ $____________ 08 AMR Interface Module TWACS TCA 1 YR $_____________ $____________ 09 AM Interface Module MVRS SCIP 1 YR $_____________ $____________ 10 Secure e-bill Module 1 YR $____________ $____________ 11 Data Warehouse Environment Service Location

20,000 locations

1 YR $_____________ $____________

12 Additional Warehouse Client Licenses (7 users) 1 YR $_____________ $____________ 13 Additional Service Location Licenses (5,000 locations) 1 YR $_____________ $____________ 14 Lockbox 1 YR $____________ $____________ 15 Elements Software 1 YR $_____________ $____________

A n n u a l C r e d e n t i a l s 16 Senior Analyst, hourly rate 1 HR $_____________ $____________ 17 Director Services, hourly rate 1 HR $_____________ $____________ 18 Project Manager, hourly rate 1 HR $____________ $____________ 19 Project Support, hourly rate 1 HR $_____________ $____________

Elements Facilities Setup Inventory and Fleet Division Projects (includes meetings) 20 Elements (8-hour day) 50 DY $_____________ $____________ 21 Security Analyst (8-hour day) 30 DY $____________ $____________ 22 Training Analyst (8-hour day)_ 40 DY $_____________ $____________ 23 Travel Expenses 10 trip $_____________ $____________ Base Year Subtotal______ $____________

O P T I O N Y E A R 1 24 Software Service Locations Licenses, 30,000 1 YR $_____________ $____________ 25 Site User License 1 YR $_____________ $____________ 26 AM Interface Module AMI-CRA 1 YR $_____________ $____________ 27 Direct Payment Module – ALL 1 YR $____________ $____________ 28 Accounting Interface Module FBMS ALL 1 YR $_____________ $____________ 29 Treasury Interface epay.gov SCIP 1 YR $_____________ $____________ 30 Work Asset Mgmt. API Elements 1 YR $____________ $____________ 31 AMR Interface Module TWACS TCA 1 YR $_____________ $____________ 32 AM Interface Module MVRS SCIP 1 YR $_____________ $____________ 33 Secure e-bill Module 1 YR $____________ $____________ 34 Data Warehouse Environment Service Location

20,000 locations

1 YR $_____________ $____________

35 Additional Warehouse Client Licenses (7 users) 1 YR $_____________ $____________ 36 Additional Service Location Licenses (5,000 locations) 1 YR $_____________ $____________ 37 Lockbox 1 YR $____________ $____________ 38 Elements Software 1 YR $_____________ $____________

A n n u a l C r e d e n t i a l s 39 Senior Analyst, hourly rate 1 HR $_____________ $____________ 40 Director Services, hourly rate 1 HR $_____________ $____________ 41 Project Manager, hourly rate 1 HR $____________ $____________ 42 Project Support, hourly rate 1 HR $_____________ $____________

Elements Facilities Setup Inventory and Fleet Division Projects (includes meetings) 43 Elements (8-hour day) 50 DY $_____________ $____________ 44 Security Analyst (8-hour day) 30 DY $____________ $____________ 45 Training Analyst (8-hour day)_ 40 DY $_____________ $____________ 46 Travel Expenses 10 trip $_____________ $____________ Option Year Subtotal $____________

GRAND TOTAL $____________

CONTRACTOR_______________________________ UNIQUE ENTITY ID#________________________________

PHONE # ______________________________ EMAIL ADDRESS____________________________________

NAICS code 513210 with a $47 M/year size standard applies to this requirement.

INSTRUCTIONS: A quote price is to be provided for each item without alteration to the Quote Schedule. Failure to provide a quote price for each item will result in the quote to be “non-responsive. The quote price is to be inclusive of all costs for the requirement, including but not limited to, all applicable taxes (Tribal, Federal & State), FOB Destination Shipping costs, etc.

SECTION C DESCRIPTION / SPECIFICATIONS

U.S. Department of the Interior

Indian Affairs

Power and Engineering Office

Electric Utility Management System (EUMS)

Performance Work Statement (PWS)

Version 1.0 May 17, 2024

Power and Engineering Office i

Table of Contents

1.0 Background

1.1 EUMS Current Environment

1.2 External System Integration Requirements

2.0 Objective

3.0 Scope

3.1 Phase 1 – On Premises EUMS

3.2 Phase 2 – Cloud EUMS

3.3 Phase 3 – Documentation

3.4 Phase 4 – Installation

3.5 Phase 5 – On Going Support

3.6 Tasks

3.6.4 Task 1 – COTS EUMS

3.6.5 Task 2 – Plan and Buildout

3.6.6 Task 3 – Documentation

3.6.7 Task 4 – Installation

3.6.8 Task 5 – Training

3.6.9 Task 6 – Training

3.6.10 Task 7 – Support

3.6.11 Task 8 – Life Cycle

Task 9 – System Monitoring and Reporting

3.7 Key Performance Indicators

3.7.1 Changes to KPI

4.0 Deliverables

4.1 Acceptance/Disapproval of Deliverables:

5.0 Government Furnished Property, Material, Equipment, or Information

6.0 Contractor Personnel Security and Suitability Requirements

7.0 Contractor Personnel Security and Suitability Requirements

Table 1: Uptime Service Band Table 2: Downtime Service Table 3: Recovery Point Objective Table Table 4: Mean Time to Restore Bands Table Table 5: Knowledge and Performance Indicators Table 6: Activity and Deliverable Timetable

1.0 Background

The Department of the Interior (DOI), Bureau of Indian Affairs (BIA) assesses electric power utility charges to its customers in accordance with 25 CFR §175 and other applicable regulations. Revenues collected provide funding for items and tasks described in 25 CFR §175.200. Initially in 2012 the establishment of the Electric Utility Management System (EUMS), for both the Truxton Canon Agency (TCA) and Colorado River Agency (CRA) electric utilities, consolidated the billing, collections, accounting, work order, inventory, and asset management needs of the BIA into a single system. Later in 2014 the San Carlos Irrigation Project (SCIP) was added to the EUMS. The three electric power utilities, hence forth referred to as “utilities”, process approximately twenty thousand (20,000) electric utility bills per month. The EUMS has improved the work efficiencies related to the processing of the bills and collections; over time the EUMS has been adapted to meet the ever-changing reporting needs of the government. The creation of customized reports and processes provide enhanced accounting and managerial analysis of system health, and accuracy of electric usage rates and fees. The customized reports provide timely submission of daily and quarterly reports to the DOI Federal and Business Management System (FBMS). The customized processes provide easier end user interface and data collection to/from the U.S. Treasury, Bureau of the Fiscal Service (BFS) services, such as Pay.gov, Over-the-Counter Channel Application (OTCnet), Cross- Servicing Net Generation (CSNG), and Collections Information Repository (CIR) Online Bill Pay.

Currently the EUMS is hosted within the BIA Albuquerque Data Center (ADC). The EUMS is comprised of two On-Premises (On-Prem) software modules. The billing module is the Utility Management System (UMS) offered by Continental Utility Solutions Inc. The services order/asset management module is the Elements XS5 system offered by Novotx LLC. Within the UMS and Elements XS5 each identified utility is setup with their own rate structure, customer list, location information, fees, assets, and service order tracking. The EUMS and all its functions are critical to the operations of each utility, and any disruption to the billing, collections, reporting, service order, and asset management functions will have critical consequences to the utilities and the BIA. A current project goal for the EUMS is to migrate to the DOI/BIA Microsoft Azure Government Community cloud tenant, hence forth referred to “cloud environment”, enabling new additional functionality such as a customer web portal (CWP), online service order requests and application for service, rate review and setting component, payment integration options, bill/statement printing and mailing, and an Integrated Voice Response (IVR) application. The migration to the cloud environment has a goal completion between the years 2026 to 2027. During the migration period the EUMS will require parallel instances for continuity of services, testing, and system redundancy.

1.1 EUMS Current Environment

The EUMS is categorized as Federal Information Security Modernization Act (FISMA) moderate, due to the system housing Personal Identifiable Information (PII) as well as Federal Financial Information. Currently there are approximately twenty (20) concurrent Federal users, but once the migration to a cloud environment is complete it is anticipated that there will be up to thirty (30) Federal Users and up to 15000 non-federal concurrent users (e.g. customers). Currently the EUMS is hosted on a virtualized Windows Server 2016, SQL 2019, SQL SMS 20 in the ADC. The security boundary is running VMware cluster with three (3) VMware ESXi hosts and participating fully with the Indian Affairs (IA) virtual infrastructure.

EUMS has six (6) key performance metrics: (1) EUMS uptime vs planned and unplanned outages; (2) Treasury on Referrals Reporting;

(3) Generation of bills and sending of eBill; (4) Generation of system reports; (5) Timeliness related to generation of late payment and outstanding debt letters; (6) Uptime between billing/collection software and the asset/work order management software.

1.2 External System Integration Requirements

The EUMS interfaces with DOI’s FBMS and BFS shared services. The FBMS interface involves report generation with the UMS and manual data entry into template files that are sent to FBMS power users for upload into FBMS. BFS services include Pay.gov, OTCnet, CSNG, and CIR. The identified BFS services complete the debt management support elements of the EUMS, in accordance with the Debt Collection Improvement Act (DCIA) of 1996 and BFS guidance/procedure. The Contractor shall be responsible for development and coordination, with government technical, of file transmission in and out of the EUMS.

This PWS builds upon prior modernization efforts:

1. Move from multiple legacy systems to a centralized modern MS SQL platform.

2. Migrate multiple legacy system data to a centralized database.

3. Training of approximately 50 government employees.

4. Generate standardized and custom reports that will be used to populate FBMS templates for BFS reporting.

5. Generate standardized process for data import/export of the EUMS.

This document supports the following activities:

• system procurement,

• phase migration, customization, and future modernization,

• deliverables to determine the success criteria of the project.

2.0 Objective

The DOI, BIA’s objective is to procure a Commercial Off the Shelf (COTS) UMS and asset/service order management system that meet current EUMS capabilities and while operating within the ADC On-Prem environment while planning and preparing for a migration to a new cloud-based environment that meets current EUMS capabilities and includes a new CWP, online service order requests and application for service, rate review and setting component, payment integration options, bill/statement printing and mailing, and an Integrated Voice Response (IVR) application.

• During the execution of these objectives the contractor shall be required to provide technical and administrative support services, training, and troubleshooting assistance as needed.

• Follow on task orders may be required as updates/changes are made to reporting and data collection requirements.

The EUMS IT System shall,

• support the established regulations for administering the BIA’s electric power utilities as specified in 25 CFR §175.100 – 175.600,

• meet applicable current National Institute of Standards and Technology (NIST) Special Publications, Federal Information Processing Standards (FIPS), A-130, and DOI policies,

• as related to the migration to a cloud environment provide a solution in accordance with the “Federal Cloud Computing Strategy,” dated June 24, 2019, released by The White House and NIST Special Publication 800-37.

3.0 Scope

The BIA has a multi-phased approach to the execution of tasks identified within this PWS.

3.1 Phase 1 – On Premises EUMS, contractor to provide a COTS UMS and asset/service order management system capable and permissible of operating within the current On-Prem ADC environment, and ensuring all features and service provided are equivalent to current EUMS application features and functionality. All new systems shall be required to submit the following to achieve an Authorization to Operate (ATO),

• DOI Privacy Impact Assessment (PIA)

• System of Record Notice (SORN)

• Implementation and Test Plan (I&TP)

Due to the work required to receive approval of the submittals the contractor shall be required to participate in all meetings and workgroups needed to complete all submission documents and the submittal process.

Contractor shall provide Project Management (PM) for the entirety of the project scoped in this PWS. The PM role is a key role to the success of this project, contractor any and all personnel who occupy this role must be identified with both the Contracting Officer (CO) and the Contracting Officer Representative (COR).

3.1.1 Current EUMS Features and Functionality

• Create New Customer(s)/Manage Current Customer(s)

• Create New Location(s) /Manage Current Customer(s)

• Process Payments, Miscellaneous Fees, NSF, Apply Adjustments, Refunds, Deposits

• Issue Reversals, Debt Management

• Accounting Reports (i.e. Aged Receivables, Accounts Receivables, List Reports, etc.)

• Customizable Reports (i.e. Aged Receivables, Accounts Receivables, Custom Meter Reports, Treasury Report on Receivables (TROR))

• Billing

• Collections

• Meter Reading

• Interface with Automated Metering Infrastructure (AMI) systems (e.g. ITRON, Landis+Gyr, Alcara)

• Create and Management Service Orders

• Integrate with BIA Geographic Information Systems (GIS)

• Manage Meter Inventory

• Role Based Access Control (RBAC)

• Company Information Setup and Management

• Inventory, Fleet, and Asset Management

3.1.2 Debt Management principles and practices detailed below derive from and comply with the following authorities:

3.1.2.1 Federal Claims and Collection Act of 1966;

3.1.2.2 Administrative Dispute Resolution Act of 1990;

3.1.2.3 Federal Debt Collection Procedures Act of 1990;

3.1.2.4 Office of Management and Budget Circular A-129, revised January 1993;

3.1.2.5 DCIA of 1996 (PL 104-134);

3.1.2.6 Federal Claims Collection Standards, December 22, 2000.

3.1.2.7 Bill Due Date, determined by the project, unless otherwise provided for by statute, regulation, contract, or agreement.

3.1.2.8 Delinquency, when a debt has not been paid by the date specified in the initial written bill for payment.

Debt may also accrue as specified in an agreement or other written instrument. Post-delinquency payment agreements may be used in the absence of satisfactory payment arrangements. See 31 CFR § 900.3(b).

3.1.2.9 Past Due Debt. See 25 CFR § 143.5(c)

3.1.2.10 Demand Letters, also referred to as final bills. An administrative fee is charged for each demand letter issued. See 31 CFR § 901.9(d)

3.1.2.11 Interest, Penalty, and Administrative Fees shall be calculated automatically and assessed on all delinquent debt. See 31 CFR § 901.9 and 31 U.S.C. 3717.

3.1.3 Collection Actions

3.1.3.1 Referral of unpaid debt(s) through external interface with U.S. Treasury. Management of the referrals shall be accomplished by using Treasury's online system, CSNG

3.1.3.2 Treasury Collections on Referred Debts – Payments made by Treasury to BIA for collections received on referred debt must be processed through Intra-Governmental Payment and Collection

3.1.3.4 Debt Reclassification as Currently Not-Collectible, Termination of Collections Actions, and Discharge

3.1.4 Billing Adjustments – Perform adjustments for transactions that have not been included in business transactions. Initiate ad-hoc credit memo and debit voucher memos; record credit memo and debit voucher in journal; and create credit memo and debit voucher.

3.1.5 Payment Processing and Collections

3.1.5.4 Post payment actions against the receivables; deposit; finalize the proof of collections; process a schedule of collections; Debit voucher(s)

3.1.5.5 Generate daily summarized transactions for interfacing with FBMS

3.1.5.6 Segregate duties requirements for billing and collection functions based on user role.

3.1.6 Refund of fees, overpayments, and deposits

3.2 Phase 2 – Cloud EUMS, contractor to provide a plan and buildout of a COTS UMS and asset/service order management system capable of operating within the new cloud environment. Basic features to include in the Phase 2 plan shall include all the features and functionality as defined in Phase 1, and include provisions for a CWP, online service order requests and application for service, rate review and setting component(i.e creating new rates such as Time of Use, Pre Pay metering, solar buy back, flat rate, tiered rates, residential demand), payment integration options, bill/statement printing, mailing, eBilling, and an Integrated Voice Response (IVR) application. While leveraging inherited controls from the established government packages, processes, accreditations, and maintain compliance with all FISMA moderate-sensitivity security controls with Privacy overlay for compliance.

3.2.1 Cloud Environment and Application Standards and Requirements

3.2.2 OMB M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

3.2.3 Federal background check per HSPD-12 regulations

3.2.4 NIST Special Publications

3.2.4.1 SP 800-37

3.2.4.2 SP 800-53

3.2.4.3 SP 800-145

3.2.4.4 SP 800-18

3.2.4.5 SP 800-30

3.2.4.6 SP 800-34 Rev 1

3.2.4.7 SP 800-53

3.2.4.8 SP 800-53 Rev 4

3.2.4.9 SP 800-53 Rev 5

3.2.4.10 SP 800-53A

3.2.4.11 SP 800-53A Rev 5

3.2.4.12 SP 800-60

3.2.4.13 SP 800-61

3.2.4.14 SP 800-61 Rev 2

3.2.4.15 SP 800-61 Appendix J, Table J-1

3.2.4.16 SP 800-64

3.2.4.17 SP 800-70

3.2.4.18 SP 800-70 Rev 2

3.2.4.19 SP 800-160 vol 1

3.2.4.20 SP 800-160 vol 2

3.2.4.21 SP 800-172

3.2.5 NIST Special Publication Guides

3.2.5.1 for Applying the Risk Management Framework to Federal Information Systems

3.2.5.2 Security Life Cycle Approach 800-39, Managing Information Security Risk: Organization, Mission, and Information System View

3.2.6 FIPS 199, 200

3.2.7 OMB Circular A-130

3.2.8 DOI IT security standards Policies, in Appendices A and, B

3.2.9 DOI Security Test and Evaluation (ST&E) Guide

3.2.10 DOI System Development Life Cycle (DOI SDLC)

3.2.11 DOI SDLC Security Integration Guide

3.2.12 DOI Contingency Plan Guide

3.2.13 Federal Acquisition Regulation (FAR) 39.101(d)

3.2.14 Federal Information Technology Acquisition Reform Act (FITARA)

3.2.15 System of Records Notice (SORN)

3.2.16 Secure access requirements, and the underlying technology not be restricted to one manufacturer.

3.2.17 Shall fit into the current OIMT architecture and integrate with current external systems.

3.2.18 Centralized data repository with open standards-based database management system that is not reliant on a single manufacturer.

3.2.19 IP Enabled (Web based) – Client systems are expected to access the EUMS through an IP enable thin client, (e.g., Windows, Chrome, etc.)

3.2.20 Modularized – Functionality can be added without breaking other functions.

3.2.21 Remote access – Mobile device compatibility for Government Furnished Equipment (GFE) devices approved by DOI.

3.2.22 Notification and alerts – This capability shall enable system users to receive automated email, text SMS notifications and alerts, and to set up personal reminders and alerts based on user roles, due dates, critical dates, follow-up dates, approval notifications, etc.

3.2.23 Robust reporting – System must provide several canned reports and allow for modification or ad-hoc reports to be developed. If the vendor recommends a third-party reporting tool, this must be listed separately in the proposal.

3.2.24 Data integration and compatibility – Defined protocols for bulk upload and extraction of data using industry-standard file formats (i.e., ASCII, XML, XLS, CSV, TXT, etc.).

3.2.25 Interface and or interact with external systems within DOI Trusted Network – This capability shall enable the replacement solution to interface with external systems such as FBMS, BFS Shared Services, and other IA applications.

3.2.25.1 Some interface/interactions may be limited to manual file import/export, DOI Security policy will dictate interface requirements.

3.2.26 Interface and or interact with other non-IA systems to permit and facilitate streamlined billing, meter reading and collections.

3.2.27 Incident Reporting – The incumbent contractor must report computer security incidents affecting DOI data or systems in accordance with the DOI Computer Incident Response Guide below. Upon any security or privacy breach, the contractor shall immediately report all incidents, whether suspected or confirmed, involving potential risks to the confidentiality, integrity, or availability of the IT System.

3.2.27.1 Department of the Interior - Computer Incident Response Center (DOI-CIRC) at doicirc@ios.doi.gov and 703-648-5655

3.2.27.2 Contracting Officer

3.2.27.3 Contracting Officer Representative

3.2.27.4 Authorizing Official and/or System Owner

3.2.27.5 Information System Security Officer and/or Cloud Service Provider portal within max.gov.

3.2.28 Security - Incident: NIST Special Publication 800-61 Rev 2 defines a reportable computer incident within the Federal Government as a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard computer security practices. Cloud Service Providers are required to report all computer security incidents to the United States Computer Emergency Readiness Team (US-CERT) in accordance with US-CERT “Incident Categories and Reporting Timeframes” in Appendix J, Table J-1 of NIST SP 800-61 (as amended). Any incident that involves compromised Personally Identifiable Information (PII) must be reported to US-CERT within one hour of detection regardless of the incident category reporting timeframe.

3.2.29 Self-Assessment – The incumbent contractor must conduct an annual self-assessment in accordance with, SP 800-53 Rev 5, and SP 800-53A Rev 5. Electronic copies will be provided to designated security personnel at time of award.

3.2.30 Logon Banner – Anyone who will access DOI data must acknowledge a government-approved logon warning prior to each logon to the EUMS.

3.2.31 Security Controls – The incumbent contractors will be required to ensure compliance with the security control requirements of the current version of NIST SP 800-53 and FIPS 200 which are appropriate to the sensitivity and criticality of the data or system. FIPS 199 and PIA will be used to determine system sensitivity and criticality.

3.2.32 Contingency Plan – The incumbent contractor will work with BIA Department of Information Security (DIS) to update the current contingency plan in accordance with NIST SP 800-34 Rev 1 (Updated 11/11/2010) and the DOI Contingency Plan Guide.

3.2.33 Security Configuration – The system(s) being procured will be evaluated in accordance with appropriate IT security policies and requirements, including use of common security configurations available from the NIST's website at http://checklists.nist.gov. This requirement is in accordance with NIST SP 800-53 Rev 4 and 800-70 revision 2; and with Federal Acquisition Regulation (FAR) 39.101(d) regulations involving NIST common security configuration checklists including Federal Desktop Core Configuration or United States Government Configuration Baseline initiative.

3.2.34 System Generated Event – Adverse Event – An event with a negative consequence, such as system crashes, network packet floods, unauthorized use of system privileges, defacement of a Web page, and execution of malicious code that destroys data. Adverse events are reportable incidents that are computer security-related which are not caused by sources such as natural disasters and power failure.

3.2.35 System Generated Event – Anomaly – Any detected or reported security event that requires further analysis by the IA CIRT. Denial of Service: An attack that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources.

3.2.36 System Generated Event – Event – Any observable occurrence in a system or network, such as a firewall blocking a connection attempt.

3.2.37 Availability Uptime/Downtime: The contractor shall provide several tiers of on demand services for the scale of basic resources that must be always readily provisional. The contractor shall provision defaults of pre-approved tiers within the Cloud Service Offering instance, dashboard, or portal. Authorized BIA users shall be able to establish the resource scaling sequence most appropriate to their requirements when configuring automatic scaling. The contractor may propose alternative methods for meeting the automated, scalable objectives to streamline incremental provisioning for common, cost-effective configurations.

3.2.38 Adapt to Demand Fluctuations: The contractor shall ensure system infrastructure is able to accommodate fluctuations in demand with minimal impact on system performance. Anticipated seasonality, minimum, peak, and average demand rates will be provided in individual task orders to facilitate resource planning.

Latency shall be managed by the contractor, to optimize IT System responsiveness to end users and ensure functionality of the hosted application. The contractor shall deploy Virtual Application Hosting as applicable to improve the user experience. The contractor shall meet the minimums identified in the description or tables below.

3.2.39 Uptime – Downtime: The contractor shall guarantee Band 3 of uptime of all contractor-controlled resources in terms of percentage of minutes and hours a month the contractor-controlled resources shall be fully operational and available. Planned scheduled downtime and mean-time-to-restore are counted as the system being fully operational.

3.2.39.1 The contractor shall provide planned downtime services within Band 4 tier listed below. The contractor shall notify system administrators through email of specific associated patching and version control services 48 hours in advance.

Table 1: Uptime Service Band

Uptime Service Band

Minimum (<=) Maximum (<) Maximum Planned Downtime

Band 1 99.99% 100.00% <4 minutes/month

Band 2 99.90% 99.99% <43 minutes/month

Band 3 (default)

99% 100% <7.2 hours/month

Band 4 95% 99% <36 hours/month

Table 2: Downtime Service

Downtime Service Band Minimum

Maximum

Note

Band 1 (high availability) 0.1 min

Band 2 0.1 min 1 hr

Band 3 1 hr 2 hr

Band 4 (default) 2 hr 4 hr

Band 5 4 hr 8 hr During non-peak times

3.2.40 Availability – Disaster Recovery Plan: The contractor shall identify the Cloud Service Offerings minimal service objectives identified as their Disaster Recovery Plan metrics within their proposal for the Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

Combinations of compute services, storage, file systems, applications, programming interfaces, and data are defined as the minimum availability requirements. The contractor shall meet at least the default minimum performance requirement and may propose one or more alternative service bands to provide either a more robust service level for mission critical applications or less stringent service level to save on test and sandbox services.

3.2.40.1 The RTO identifies downtime and how long it takes to restore the incident until normal operations area available to both administrators and users. The contractor shall guarantee that, following any outage attributable to failure of the infrastructure support, systems will be made operational within a specified maximum time (48 hours).

Table 3: Recovery Point Objective Table RPO From To

Band 1 (high availability) 0 min 5 min

Band 2 5 min 4 hr

Band 3 (default) 4 hr 24 hr

Band 4 24 hr 48 hr

Band 5 48 hr 7 days

3.2.41 Availability - Mean Time to Restore Requirements is the average time required to complete a restore request. Depending on the size of a restore request the following service levers are calculated as the “Average” of all restore requests over a month. The contractor shall meet this minimum and may propose an alternate with explanation.

Table 4: Mean Time to Restore Bands Table Mean Time to Restore Bands Time to Restore

Band 1 (high availability) 15 min

Band 2 4 hr

Band 3 (default) 24 hr

Band 4 48 hr

3.2.41.1 Within thirty (30) days of any major outage occurrence resulting in greater than one hour of unscheduled downtime, the contractor shall describe the outage including description of root-cause and fix.

3.2.42 Accessibility Service Level Agreement: Cloud Service Provider solutions shall provide and protect millions of people who have disabilities that impede their ability to use Information and Communications Technology (ICT). IT solutions shall provide assistive technologies such as magnifiers, screen readers, braille readers and alternative input devices on client computing platforms to make the use of ICT, including cloud services, easier for people with disabilities. The following standards and guidelines for ICT services is available and shall be used to provide cloud services to persons with disabilities including:

3.2.42.1 W3C Web Content Accessibility Guidelines (WCAG) 2.0, Level A and AA Guidelines, also published as ISO/IEC 40500:2012

3.2.42.2 ISO/IEC TR 29138 (all parts) — Accessibility considerations for people with disabilities

3.2.42.3 ISO/IEC Guide 71 — Guide for addressing accessibility in standards

3.2.42.4 Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) in the United States of America

3.2.42.5 Applicable ICT Accessibility Provisions from Information and Communication

3.2.42.6 Technology (ICT) Standards and Guidelines (36 CFR Part 1194)

3.3 Phase 3 – Documentation, contractor to assist in the completion of a Privacy Impact Assessment (PIA), Plan of Action and Milestones (POAM), Assessment and Authorization (A&A) efforts, I&TP and obtain an ATO to operate the new cloud-based EUMS within the cloud environment.

3.4 Phase 4 – Installation, Install new EUMS solution in cloud environment, migrate data from the On- Prem environment to the cloud environment, while running parallel instances of the On-Prem environment and the cloud environment so to provide continuity of service, test services and data integrity, train up to fifty (50) government staff members in the operations of the new EUMS applications and cloud environment operations and maintenance, implement new EUMS.

3.5 Phase 5 – On Going Support, will consist of on-going support for POAM’s, A&A efforts, Auditing, end-users support, and as needed system updates and maintenance.

3.6 Tasks – The contractor shall supply all tools, equipment, materials, management, labor, training, travel, and Subject Matter Experts (SME’s) required to successfully complete all tasks identified in this PWS.

3.6.1 All deliverables must be accurate, complete, consistent with best industry practice, and adhere to all identified security standards and requirements.

3.6.2 Contractor Program Manager and assigned Subject Matter Expert(s) (SME) will be required to attend and participate in project meetings. Meetings will be assigned as required; the government intends to conduct meetings virtually via Microsoft Teams. There may be instances where in person meetings maybe required, the government will provide a reasonable notice to the contractor.

3.6.3 Contractor and all assigned contractor team members working on or with EUMS that will require access to government systems, and or data that contains any Personal Identifiable Information (PII) will be required to complete all assigned government training, complete a government background check, and have a have a government Personal Identity Verification (PIV) card issued. It will be the responsibility of the contractor to facilitate all logistics and travel for employees to complete and receive their assigned PIV card(s).

3.6.4 Task 1 – COTS EUMS – Provide COTS EUMS capable of meeting Phase 1 requirements and applicable Phase 2 security requirements for a On-Prem service.

• All new system shall be required to receive an ATO.

• Initial Kick-Off meeting shall be no later than 10 days after notice-to-proceed.

3.6.2.1 Contractor to provide for acceptance;

• Complete Technical Requirements for operating and integrating the EUMS solutions into the DOI cloud environment.

o Project Management (PM) Plan detailing strategy and tasks o System/Technical Design that illustrates system architecture and system requirements.

o Contingency of Operations Plan o User and Administrative guides

• Install, configure, and test application on test environment and validate functionality of system operations within ADC environment and apply updates and fixes as needed.

• Verify Users, User Roles, groups, and administrators.

• As part of the PM requirement the contractor shall submit a project plan identifying how the contractor will meet established requirements, perform and complete work, and communicate any strategies. The plan shall identify any risks, hurdles, potential pit falls, assumptions, and dependencies associated with all tasks identified in this PWS.

3.6.5 Task 2 – Plan and Buildout – Provide plan and buildout of a COTS UMS and asset/service order management system meeting requirements established in Phase 2.

• Contractor to provide for acceptance;

o Project management plan detailing strategies and tasks o Complete Technical Requirements for operating and integrating the EUMS solutions into the DOI cloud environment.

o System/Technical Design that illustrates system architecture and system requirements.

o Enterprise Architecture Diagram o I&TP that details the contractor’s installation and implementation strategy o Contingency of Operations Plan (COOP) Capabilities o User and Administrative guides

3.6.6 Task 3 – Documentation – Assist in the completion, meetings, and work requirements to complete the following BIA required documents, with the goal of obtaining an ATO from the government to operate in the DOI cloud environment.

• PIA

• A&A

• I&TP

3.6.7 Task 4 – Installation – Install, migrate, and test EUMS data from On-Prem environment and the cloud environment. This task shall include the following,

• Analyze current EUMS data and tables.

• Develop and submit migration plan identifying steps, prerequisites, and hurdles.

• Develop and submit system test plan.

• Install new EUMS in cloud environment.

• Migrate data from On-Prem environment to cloud environment.

• Test data integrity, system security, load testing and deployment of applications within the cloud environment.

3.6.8 Task 5 – Training – EUMS system training. Training plans and materials shall be tailored where possible to follow the “train the trainer” methodology. Training materials shall be tailored for up to 50 government employees. This task shall include the following,

• Develop and provide Training Plans and materials specifying training methods.

• Conduct best practices training in the use, administration, maintenance, and operation of the system. The government will require one (1) each end user to be completed onsite at San Carlos Irrigation Project (SCIP) and Colorado River Agency (CRA). Site locations for administrative, maintenance, security training for government employees will be determined later. Where possible remote training via web conference is recommended.

• End User Training for Government employees – billing, collections, debt management, meter reading, system reporting, account location and setup.

3.6.9 Task 6 – Training – Contractor Mandatory Training Requirement. All contractor employees working on, or with the EUMS project shall be required to successfully complete the DOI’s end-user computer security awareness training and agree to DOI Rules of Behavior prior to being granted access to DOI data or being issued a user account. This is an annual requirement. Additional training requirements may be assigned as required by the government.

3.6.10 Task 7 – Support – On-going support for POAM’s, A&A efforts, Auditing, end-users support, maintenance, and security. Tasks shall include the following,

• Provide technical support to System Administrator, at a minimum, in:

o Identifying the causes of unexpected states, not as designed, of content, o Identifying the causes of unexpected system crashes, o Recommending potential solutions to prevent unexpected happenings, o Assisting with resolution of items captured in system error queues.

• Perform software upgrades including application of patches. Assess any impacts to continued operations from any patches or upgrades before applying them and provide proposed plan for software upgrade or patch application. IA shall be notified in advance and given sufficient time to test compatibility with all related software.

o Maintenance items shall be categorized as “Corrective Maintenance” and “Adaptive Maintenance”.

Corrective Maintenance – modifications that fix issues or problems related to design, logic, or coding.

Adaptive Maintenance - modifications that are mandated in response to laws or regulations that govern IA programs, to hardware or software changes, and/or to upgrades within IA’s technical architecture. This type of maintenance may also involve activities aimed at adding or modifying functionalities in response to new or changed requirements.

It includes those activities that have been thought out and planned for future implementation. This type is usually a modification required because of software changes or a modification required because of anticipated hardware changes.

• Infrastructure upgrades or changes may include, but are not limited to, operating system patches, database patches, application patches or upgrades, network changes, and hardware replacement.

3.6.11 Task 8 – Life Cycle – System Life Cycle Process for both the On-Prem and Cloud Environment Systems. The BIA requires a defensible system development process that blends both waterfall and Agile methodologies.

Goal is to understand the current and future health of the IT ecosystems to end-of-life. The contractor shall describe and document their methodologies and procedures to meet the following,

3.6.9.1 Standards

• DOI SDLC

• NIST SP 800-64

• DOI SDLC Security Integration Guide

• FITARA

3.6.9.2 Requirements

• Analyze EUMS needs and develop requirements

• Create a detailed list of functional requirements

• Define inputs, processes, outputs

• Define functions must be delivered

• Define and describe process as to how deliverable items will be disseminated

3.6.9.3 Design/Development

• Create a requirement-based design specification o Demonstrate system conforms to established requirements o Include known product upgrades, releases, patches, and fixes to stay compliant with all established requirements.

• Convert design specifications into a complete information system. To include

• software installation

• database creation and main

• system configuration

• test file preparation

• compiling code

• test readiness and review o All test reports shall be submitted to the government for review

3.6.9.4 Monitoring and Maintenance

• Implement system into test environment and resolve any identified issues during implementation.

• Implement system into production environment, Go-Live

• Post Implementation Corrective and Adaptive maintenance o Contractor shall fully test all patches and upgrades prior to installation o Contractor shall submit test results

3.6.9.5 Change Control

• Identify Change Management Process

• Identify Patch Management Process

3.6.9.6 Identify Decommissioning Process and Requirements

Task 9 – System Monitoring and Reporting – The contractor shall provide to the government access to an executive dashboard detailing the following,

• First Call Resolution (FCR) o Percentage of trouble calls resolved after first contact with contractor support services.

• System Uptime

• Number of System Downtime Incidents

• Incident Downtimes o Total incident downtime resulting in EUMS application to be non-responsive (e.g. CWP, UMS, Asset Management, GIS Interface).

• Mean Time Between Failures (MTBF) o Average time between downtime incidents/Failures.

• Mean Time to Restore (MTTR) o Average time to restore system following downtime incident.

• Mean Time to Detect (MTTD) o Time taken from when a problem first occurs to the moment the problem is detected by a human or system.

• Patch Management

• System Compliance

• Backup Success Rate

• Recovery Time Objective (RTO)

• Recovery Point Objective (RPO)

• Application Performance – Indicators used to measure and track system performance per Quarter, Contractor shall send out, receive, and track end-user survey collecting information related to, o System Availability o End-User Experience o Resource Utilization o System Reliability o System Responsiveness

• Scope Creep

• Total Cost of Ownership (TCO)

The assigned categories will be used to evaluate system health, operations, and contractor performance. Government evaluation will be conducted at minimum once per fiscal quarter. At minimum the data shall be exportable to either a .pdf, .xlsx, or .csv file type.

3.7 Key Performance Indicators

The contractor service requirements are summarized into key performance indicators (KPI) that relate directly to mission essential items.

Table 5: Knowledge and Performance Indicators

No. KPI Description Performance Threshold

1 FCR FCR calculation (No. of FCR Issues Resolved per Quarter)/(No. Total Calls per Quarter)= FCR Rate %.

95%

2 System Uptime

Total Quarter system uptime (e.g. CWP, UMS, Asset Management, GIS Interface). System Uptime Calculation (Recorded Uptime Seconds)/(per Quarter Seconds Available)=Uptime %.

99%

3 Number of System Downtime Incidents

Per Quater occurrence of Incidents that result in EUMS applications to be unavailable (e.g. CWP, UMS, Asset Management, GIS Interface).

4 Incident Downtimes

System Downtime Calculation ((Number of Downtime Incidents)*(Average Incident Downtime per Quarter))/(per Quarter Seconds Available)=Downtime %.

1%

5 MTBF MTBF Calculation (((Quarter Available System Uptime)-(Total per Quarter Downtime))/(Total Number of Downtime Incidents))/3600=MTBF hours.

544 hr

6 MTTR MTTR Calculation (Sum of All per Quarter Individual Time to Resolve Periods)/(Total per Quarter Downtime Incidents)=MTTR hours.

4 hr

7 MTTD MTTD Calculation (Sum of All Incident Detection Times per Quarter)/(Total number of downtime incidents)=MTTD hours.

1 hr

No. KPI Description Performance Threshold

Security Scorecard Rating

Rating is based on standard score card rating 0-100, where 59% and below is an F and 90% and greater is an A. Each of the identified risk factors will be measured by grouped individual risk factor occurrences divided by the total number of incidents within the per quarter period.

A+ or >95%

8 Patch Management

Rating will be based on Number of Patches Applied with per Quarter period, number of security vulnerabilities closed per quarter, Percentage of System(s) patched in per Quarter period, Number of unplanned downtime incidents per quarter, percentage of critical vulnerabilities patched within 30 days of release.

A+ or >95%

9 Compliance Score

• Code/Policy Review Frequency (per Quarter)

• Number of Code/Policy violations (Per Quarter) (0)

• Training Requirement and Completion Rate (Per year) (100%)

A+ or 98%

10 Backup Success Rate

Percentage of successful backups, per Quarter, divided by total number of backups attempted

>95%

11 RTO Maximum system downtime before impact is made to mission critical operations

24 hr

12 RPO Restoration point in time that backup must be capable to restore to 24 hr

13 Application Performance

Application Performance Calculation (Each Category will be surveyed, and totals calculated, then total scores will be averaged to provide a score card grade):

A or >90%

(((SatisfiedCount)+(ToleratingCount/2))/(TotalSamples))=Category Score ACategory+ BCategory+ CCategory+DCategory+ECategory=Application Performance Score

14 Scope Creep Measurement of uncontrolled project scope expansion per Quarter, indicators are;

• Scope Change Requests

• Scope Change Request Approvals

• Scope Change Impact Analysis, Rating (No Impact, Minor

Impact, Significant Impact) Scope Creep Calculation (Each Category will be meausred, and totals calculated, then total scores will be averaged to provide a score card grade):

(Scope Change Requests)+(Scope Change Request Approvals)=Change Request Score

Scope Change Impact Rating Score

• No Impact = 1

• Minor Impact = 2

• Significant Impact = 3

Scope Creep Score = ((Change Request Score)+( Scope Change Impact Rating Score))/3

≤1

15 TCO Total, Per Quarter, Cost Ownership associated with,

• Initial Cost (IC)

• Operating Cost (OC)

• Maintenance Cost (MC)

• Downtime Cost (DC)

• Production Cost (PC)

• Project Remain Cost (PRC)

≤1

3.7.1 Changes to KPI

Over the course of the contract, key performance measures that are being monitored for performance evaluations may also need to change. Modifications to the key performance measures for this contract will be made by mutual agreement of the Government and the contractor. Either party may propose such changes for consideration and the agreed upon key measures will become the basis of future performance monitoring evaluation.

4.0 Deliverables

Activity and Deliverable Timetable: Deliverable products shall be submitted to the COR, in accordance with the following schedule:

Table 6: Activity and Deliverable Timetable

Item # Task Description Distribution Approval Required Due Date

Initial Kick-Off Meeting and Minutes

N/A COR – One (1) digital copy N/A 15 Days after Notice-to-Proceed

002 Task 1 Project Management Plan CO & COR – One (1) digital copy each YES 15 Days after Notice-to-Proceed

002 Task 1 Technical Requirements COR –…