J.1__FRTIB_ExPRESS_CDRLs.docx

PROCUREMENT SENSITIVE

TIB-2016-R

F

P-XXXX

ExPRESS Reques t fo r Proposal Contents

Contract Data Requirement List (CDRL) CDRLs Overview The Contractor is required to develop and submit deliverable to FRTIB in order to facilitate effective management oversight of the contract. At a minimum, the following deliverables shall be provided by the Contractor.

CDRLs by Order

The operating procedures shall include all procedures for the services defined in the PWS for Program Management, Participant and Agency services, Integration Services, and Operational Services.

The Plan shall include all aspects of Contract Management for ExPRESS including but not limited to:

· Program Management

· Organization Chart and Structure

· Key Personnel

· Staffing Approach

· Significant Subcontractors

The plan shall include at a minimum:

· Business continuity objectives

· Business continuity scope

· Business continuity strategy

· Business continuity recovery procedures

The plan shall include a description of the risk management procedures. The Plan shall include, at a minimum, the following elements for each identified risk:

· Risk ID

· Risks and Consequences

· Probability

· Impact

· Priority

· Mitigation Response

The plan shall include at a minimum:

· A description of the overall approach to managing security

· Performance metrics

· Training

· Policies and procedures (to include at a minimum):

· Incident Response Procedure

· This procedure shall include a listing of all violations that could be considered as security incidents. It should also address roles and responsibilities, reporting/escalation, containment, eradication, recovery and lessons learned.

· Roles and responsibilities

· Testing and assessments

First submission due 6 months after Contract Award

The Plan shall include, at a minimum, the following components:

· Quality objectives

· Quality standards

· Quality control and assurance activities

· Quality roles and responsibilities

· Quality tools

· Plan for reporting quality control and assurance problems and remediation

Quarterly (5th business day of each fiscal year quarter; i.e. first business day of October, January, April, and July) Annually (5th business day of each fiscal year; i.e. first business day of October)

· High level financial overview of ExPRESS contract

· Detailed financial summary of ExPRESS contract based on operational areas

· Contract cost burn rates and estimated cost projects in collusion with volume forecasts

· Major events or projects impacting cost with detailed analysis

· Identification and detail of problem areas as well as suggested remediation

· Identification and detail of areas for opportunity as well as suggested path forward

Finalized Plan due 30 days after Contract Award and updated per instructions below in Content section

The contractor shall provide a Phase-In plan that, at a minimum, includes the following components to describe the delivery of Phase-In services:

· Organization

· Staffing

· Tasks

· Processes

The contractor shall provide a Phase-Out plan that includes, at a minimum, the following components to describe the delivery of Phase-Out services:

· Organization

· Staffing

· Tasks

· Processes

The contractor shall provide an Organization Conflict of Interest Management Plan that includes, at a minimum, their corporate OCI plan specifically addressing how they identify, manage, and mitigate potential and/or actual OCIs.

Quarterly (5th business day of each fiscal year quarter; i.e. first business day of October, January, April, and July) Annually (5th business day of each fiscal year; i.e. first business day of October)

· High level overview of Service Center activities

· Detailed summary of Service Center activities based on operational areas

· Identification of major events or projects impacting cost with detailed analysis

· Identification and detail of problem areas as well as suggested remediation

· Identification and detail of areas for opportunity as well as suggested path forward Metrics regarding service levels and volumes. This should detail whether SLRs were met or not, volume forecast information, and other pertinent operational information regarding metrics data.

The Plan shall include, at a minimum, the following components:

· Content and Training objectives

· Content and Training standards

· Content and Training control activities including lifecycle development and management

· Content and Training roles and responsibilities

· Content and Training tools

· Plan for reporting problems and remediation

· Change Management

· Release Management

· Availability Management

· Security / Incident Management

· Problem Management Additional contents of the agreement shall also include roles and responsibilities, escalation of issues, period of effectiveness, and organizational conflict of interest.

FRTIB requirements for protecting the security of FRTIB information and information systems are derived from National Institute of Standards and Technology (NIST) guidance. Information System Owners (ISOs) and other personnel responsible for the protection of FRTIB information or information systems shall follow NIST guidance in the proper security categorization (Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization for Federal Information and Information Systems), and in the selection and implementation of information security controls (FIPS 200, Minimum Security Requirements for Federal Information and Information Systems and NIST Special Publication (SP) 800-53 revision 4, Recommended Security Controls for Federal Information Systems and Organizations), in a manner consistent with the Risk Management Framework (NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems).

The output and end result of the assessment is the security assessment report (SAR), which documents the assurance case for the information system and is one of three key documents in the security authorization package developed by information system owners and common control providers for authorizing officials In accordance with Special Publication 800-37 revision 4, the security authorization package consists of the:

· Security Plan or System Security Plan (SP or SSP) (including the risk assessment);

· Security Assessment Report (SAR);

· Plan of Action and Milestones (POAM) Additional documentation that shall be included in the A&A package consists of:

· Security Categorization;

· Privacy Threshold Analysis (PTA);

· Privacy Impact Analysis (PIA);

· eAuthentication Assessment (if applicable);

· Interconnection Security Agreement (ISA) (if applicable) Moreover, in light of an ever-changing security landscape, designated FRTIB officials and the ExPRESS contractor should always be prepared to determine the impact of a system’s operation on the success of the FRTIB mission.

Disentanglement documentation must have traceability to the following components:

o Participant/ Beneficiary Service Center Processes and Workflows o All Systems and Sub-Systems utilized in the Service Center o All knowledge / content management components in the Service Center A plan to provide 100% of all design documents A plan to provide 100% of FRTIB-owned data on Participants, Beneficiaries and other entities

The document shall provide transition details for FRTIB assets, including, but not limited to:

Participant / Beneficiary and other records (including subcontractor agreements that are required to provision Service Center functions) Configuration information Databases Documentation Asset registers Design Documents Knowledge databases Error Logs Asset maintenance history and status Manuals Process and procedure documentation Any other similar items that the contractor used or produced during the course of, or for the purpose of, provisioning the ExPRESS Service Center requirements Knowledge transfer of all such information so that FRTIB, its Affiliates, the Replacement Provider and/or Third-Party personnel can assume full responsibility for providing the Services without interruption.