VEMP_SOO_v13 (002).docx

Virtual Event Management Platform Statement of Objectives (SOO)

Federal Deposit Insurance Corporation Virtual Event Management Platform August 2022 v13 Statement of Objectives

August 2022

1.0 INTRODUCTION

The purpose of this Statement of Objectives (SOO) is for the Federal Deposit Insurance Corporation (FDIC) to obtain an innovative, cloud-based IT solution for an all-in-one event platform that supports in-person, hybrid and virtual events and conferences. The Contractor provided product must support FDIC event needs, be user friendly, and comply with FDIC security requirements and Section 508 of the Rehabilitation Act.

The Contractor must have depth, breadth and experience in providing event technology to support a wide range of in-person, virtual and hybrid events that involve domestic and international participants.

2.0 BACKGROUND

The FDIC maintains the stability and public confidence in the nation’s financial system by (1) insuring deposits, (2) examining and supervising financial institutions, (3) resolving and managing receiverships of failed banks and (4) making large and complex financial institutions resolvable. Additionally, FDIC promotes economic inclusion and community development initiatives and programs. FDIC sponsored events are a key component to fulfilling FDIC’s mission.

· On average each year, FDIC conducts 400+ events with up to 10,000 participants.

· FDIC-hosted events may be conducted in-person, virtually or in a hybrid format.

· FDIC events include, but are not limited to, public outreach events, conferences (small and large), forums, symposiums, town halls, training sessions, fairs and special programs (i.e. Annual Awards Ceremony, etc.).

· FDIC event staff rely on various tools to support events. These tools; however, lack integration and limits the FDIC’s ability to effectively schedule, market, register, manage, host, stream, and report and track events. Additionally, these tools do not effectively support hybrid events or interface with existing FDIC IT equipment (see Appendix C) which requires troubleshooting and workarounds to when supporting large-scale events or conferences.

· Limited capabilities with current event management and registration software negatively impact customer experience, staff productivity and the organization’s ability to accurately track performance due to minimal integration between systems across FDIC’s event lifecycle.

FDIC is looking for a commercially available solution to modernize and automate its event lifecycle.

3.0 Scope

The Contractor will support the implementation and configuration of an event management platform to replace the FDIC’s event registration and reporting platform (CARES). The platform must be scalable to support a growing number of contacts and events; must be user-friendly; and must have the ability to handle a growing number of FDIC users.

The Contractor will provide licensing, configuration, system integrations, testing, and training in the initial phase. Training shall include “train the trainer” as well as guides for all users, including attendees and event speakers.

The Contractor will also provide hosting services, help desk support, and maintenance for the duration of the contract. Maintenance will include servicing all hardware, software, and patches as needed.

The Contractor must propose a development methodology that outlines how it will customize and configure, integrate, implement, host, and maintain the solution to meet the FDIC’s requirements. The FDIC estimates that the solution will need to support 50,000 to 100,000 registrations per year across multiple events. In addition, the FDIC estimates that the solution will need to support the management of at least 500,000 contacts.

3.0 OBJECTIVES

The solution must provide expertise and services in hosting events using a hybrid solution for the implementation, management, and administration of the FDIC events.

This platform will be centrally managed within the Division of Administration’s Special Events and Hospitality Unit and support other various divisions within the Corporation.

The high-level objectives are as follows:

· Obtain a SAAS solution that supports Event Planning and Contact Management for FDIC Events: Configure, test, and implement a cloud-based Virtual Event Management Platform (VEMP) that supports both 50,000 to 100,000 registrations per year across multiple event types (virtual, in-person, hybrid) as well as managing at least 500,000 contacts.

· Provide a Secure Solution: Implement a solution that meets the FDIC Security Standards contained in Appendix B, and that obtains an Authorization to Operated (ATO) issued from the FDIC Chief Information Officer (CIO). Maintain the confidentiality, integrity and availability of system data. The FDIC plans many events each year. It is imperative the event platform is secure, reliable, available, and protected from improper access. The information maintained in the event platform must be accurate and readily accessible to authorized users and stored in accordance to FDIC’s records and information management policy. Identify security protocols for non-FDIC presenters and attendees using multifactor authentication (MFA).

· Training/User Guides: Provide a smooth transition for FDIC stakeholders to the new event management platform by providing training and implementation support. Training shall include “train the trainer” as well as guides for all users, including attendees and event speakers.

· Hosting/Support: Provide hosting services, 24/7 help desk support, white glove services (as needed) and maintenance for the duration of the contract. Maintenance will include servicing all hardware, software, and patches as needed.

· Sustain Business Operations: Ensure continuity of event planning and management operations by providing a platform replacement by June 1, 2023. Provide a smooth transition for FDIC stakeholders to the new event management platform by providing training and implementation support.

· Reporting and Post Event Activities- Make all event and contact data available for reporting. Allow keyword, date range, and other flexible criteria in search and reporting. Provide report formatting and graphical representation capabilities. Allow data exporting. Share certain reports with other divisions and offices and other Federal agencies via special access portal. Ability to send post event survey to attendees, automatically capture survey result data, and associate the survey data to corresponding events. Ability to enter post event summaries and other related information to the original event entry in the system. Include approval process for the post event summary.

4.0 CONSTRAINTS

This section documents constraints that the FDIC identifies for this SOO. While attempts have been made to make this list accurate and comprehensive as of the submission date of this SOO, it must be recognized that these constraints may change over the life of the SOO.

· Stakeholder Availability: The FDIC will identify key resources and subject matter experts to support this effort. The availability of these resources may be periodically impacted by ongoing operational activities.

· Fed RAMP Certified is highly desired. If the solution’s provider does not have a Fed RAMP certification then a qualified third party assessment is required to achieve Authority to Operate.

· Data must be held within the Continental USA (CONUS).

APPENDICES

Virtual Event Platform SOO

APPENDIX A – Functional Requirements

WebEx Room Kit Plus (WebEx Codec Plus, WebEx Camera, WebEx Room Navigator)

The solution must have accurate transcripts available after the event.

Reporting and Post Event Activities

The solution must provide the ability to make all event and contact data available for reporting. Allow keyword, date range, and other flexible criteria in search and reporting. Provide report formatting and graphical representation capabilities. Allow data exporting.

Reporting and Post Event Activities

The solution must provide the ability to share reports with other divisions and offices and other Federal agencies via special access portal.

Reporting and Post Event Activities

The solution must provide the ability to generate reports from existing event management platform to new solution.

Reporting and Post Event Activities

The solution must provide the ability to send post event survey to attendees, automatically capture survey result data, and associate the survey data to corresponding events.

Reporting and Post Event Activities

The solution must provide the ability to enter post event summaries and other related information to the original event entry in the system. Include approval process for the post event summary.

APPENDIX B - FDIC SECURITY STANDARDS

System Security Assessment and Authorization Requirements

Authority to Operate The solution must not input, store, process, output, and/or transmit FDIC data within a Contractor IT system without an Authority to Operate (ATO) signed by the FDIC Authorizing Official (AO) granted via the System Security Authorization (SSA) process. The FDIC process for obtaining and maintaining ATO, is in accordance with NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The vendor must adhere to current FDIC policies, procedures, and guidance for the SSA process as defined below.

Complete the Security Authorization Process. The SSA process shall proceed according to the NIST SP 800-37 Risk Management Framework for Information Systems and Organizations or any successor publication including templates.

a. System Security Assessment and Authorization Process Documentation. SSA documentation shall be developed by the vendor using the FDIC provided security documentation templates. SSA documentation consists of the following: Security Categorization Worksheet, System Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

b. Independent Assessment. Contractor shall have an independent third party perform an assessment of the FDIC-prescribed security and privacy controls as outlined in NIST SP 800-53 to determine the extent to which the selected controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements for the system and the FDIC. Should the independent assessment find deficiencies, the vendor must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if The solution does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

c. Support the Completion of the Privacy Compliance Documentation. As part of the SSA process, the vendor may be required to support the FDIC in the completion of a Privacy Threshold Analysis (PTA). The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a contractor IT system that will store, maintain and use PII. Upon review of the PTA, the OCISO Privacy Section determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The solution shall provide all support necessary to assist the FDIC in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the FDIC about the use, access, storage, and maintenance of PII on the vendor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the FDIC’s privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at www.fdic.gov/privacy.

d. Authorization to Operate. Upon completion of the SSA documentation and independent assessment, the vendor must submit a signed SSA package, validated by the independent third party, to the Oversight Manager for acceptance by the FDIC Authorizing Official (AO), or designee, at least thirty (30) days prior to the use of the system. The FDIC is the final authority on the compliance of the SSA package and may limit the number of resubmissions of a modified SSA package. Once the ATO has been granted by the FDIC AO the Contracting Officer shall incorporate the ATO letter into the contract as a compliance document. The FDIC’s issuance of the ATO does not alleviate the vendor’s responsibility to ensure the controls are implemented and operating effectively.

The SSA package must include the following:

Deliverables (30 Days Prior to System Use)

Security and privacy plans

Security and privacy assessment reports

Plan of action and milestones

Supporting assessment evidence or other documentation, as required.

e. Continuous Monitoring/Ongoing Assessment. After an initial authorization, the vendor must have the security and privacy controls assessed on an ongoing basis in accordance with NIST SP 800-37 and based on the FDIC Control Assessment Frequency. Ongoing assessment of the control effectiveness is part of the continuous monitoring activities of the FDIC. Adherence to the terms and conditions specified by the AO as part of the authorization decision are also monitored. Ongoing control assessment continues as the information generated as part of continuous monitoring is correlated, analyzed, and reported to the Oversight Manager for acceptance by the FDIC AO. The system needs to undergo a Security Impact Assessment (SIA) whenever any changes/modifications are made to the system. Should the independent assessment find deficiencies, the solution must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if The solution does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

Other Security Requirements:

a. Ensure event registrations email and server configuration must comply with the Department of Homeland Security (DHS) BOD-18- 01 directive and the White House Executive Order on Improving the Nation's Cybersecurity.

b. The vendor must maintain all software patches and updates in accordance with their timelines; maintenance will also include servicing all hardware as needed.

image1.png