Defense Sexual Assault Incident Database (DSAID)

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for market research information to identify potential sources that are interested in, and capable of, performing the work described in this RFI. It does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. Funding is not available at this time. This request for information does not commit the Government to contract for any supply or service. The Department of Human Resources Activity (DHRA) is not seeking proposals and will not accept unsolicited proposals. DESCRIPTION: The Sexual Assault Prevention and Response Office (SAPRO) requires a bridge contract with ASM Research, Inc. to sustain the current Defense Sexual Assault Incident Database (DSAID) system management support. The intent of the bridge is to allow time to get the necessary Department of Defense (DoD) system approvals and complete the re-compete of the current contract H98210-10-D-0002. Performance of the system management support includes: - Maintaining all functional capabilities of the DSAID system. - Developing and maintain change requests per the scope of each Task Order. - Executing Project Management Activities (i.e., implementing a Project Management Plan, providing formal and comprehensive project management, assisting SAPRO with ad-hoc meetings, submitting status reports, and verifying hardware and software changes are functioning and documented). - Executing Configuration and Change Management Activities (i.e., developing/maintaining a Configuration Management Plan, updating/maintaining DSAID release documentation, and technical design and configuration documentation). - Executing System Management Activities (i.e., assisting with Help Desk activities, executing Issue Management Activities per DSAID EITSD Contingency Plan, and executing Risk Management Activities per DSAID Risk Management Plan). - Executing Change Management Activities (i.e., analyzing changes to DSAID functional capabilities and executing changes). - Executing Hardware and Software Maintenance Activities to include maintenance and upgrades. - Executing Performance Management Activities (i.e., generating DSAID reports and data queries, implementing procedures for addressing/correcting areas where DSAID performance levels are not compliant and providing performance measurements reports). - Executing Corrective Maintenance Activities (i.e., performing corrective maintenance on DSAID and report on scheduled and unscheduled outages). - Executing Interface Management Activities (i.e., performing interface data transfers between DSAID and interfacing systems, maintaining/updating data transfer functionality, and extract/transform/load data from DSAID to DSAID Enhanced Reporting Capability module. - Executing Technical Training Environment Support Activities (i.e., maintaining/operating DSAID training environment). - Providing system documentation/information that will assist the Government in developing the required Enterprise Architecture products for acquisition and business modeling activities. - Providing support for DSAID demonstration(s) to Congress, GAO, DoD leadership or other Government entities. - Providing support/information/documentation to the Government to ensure Information Assurance requirements are met. - Conducting weekly In Progress Reviews and a Phase End Review Session as the end of each phase. - Performing data quality analysis. - Providing a remediation report of all issues and/or defects. - Providing support to the Government's DSAID User Acceptance Testing. - Developing a set of Test Plans and Test Cases that identify critical issues, assess perceived quality risks, identify Information Assurance impacts, verify requirements, and document the testing activities. - Evaluate each test to compare expected outcomes to actual outcomes for the DSAID functionality. BACKGROUND: The NDAA FY09 mandated that the Secretary of Defense implement a centralized, case-level database for the collection, maintenance, and reporting of information regarding sexual assaults involving members of the Armed Forces. DSAID was implemented to meet this mandate and encompasses five functional capabilities to include, reporting, data entry, data interface, case management, and business management. Security Requirements: - Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of government data. - The Contractor shall ensure a breach mitigation plan is in place in the event a breach occurs. - The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall comply with: DoD Instruction (DoDI) 8500.1, Cybersecurity The Privacy Act (5 U.S.C. 552a) DoD 5400.11-R, and DoD Directive 5400.11, DoD Privacy Program DoD 6025.18-R, DoD Health Information Privacy Regulation DoD 5200.2-R, Personnel Security Program HSPD-12, Homeland Security Presidential Directive. - Comply with HSPD-12 Personal Identity Verification (PIV) issuance capabilities, known as the Common Access Card (CAC) for DMDC and: - Be CAC or PIV ready prior to reporting for work. At minimum all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing. - Be citizens of the United States. - Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment. - If at any time, any Contractor personnel requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, immediately notify the DMDC Information Systems Security Group (DISSG) remove such person from work under this contract. - Immediately report to the discovery of any Privacy breach first to the DMDC CIO/ Privacy Office and secondly to the COR. - Perform offsite work with Personally Identifiable Information (PII) only on systems and platform information technology systems (PIT) that meet Risk Management Framework (RMF) (formerly Defense Information Assurance Certification and Accreditation Process (DIACAP)) for DoD Information Technology (IT) capabilities. Systems previously certified under DIACAP must be current but cannot exceed an authority to operate (ATO) date later than October 2016. Such information systems and PIT systems will be updated on an on-going basis to continue to meet applicable RMF capabilities. Systems must have and maintain an Authority to Operate (ATO) or if acceptable to the Government, if under DIACAP an Interim Authority to Operate (IATO) not to exceed the October 2016 time frame. - Contractor systems and information networks that receive, transmit, store, or process nonpublic Government data must be accredited according to DoDI 8510.01 "Risk Management Framework for DoD IT" (RMF) (formally DIACAP) and comply with annual Federal Information Security Management Act (FISMA) security control testing. All systems subject to RMF must present evidence of authorization in the security plan, Security Assessment Report (SAR) Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has successfully went through the Risk Management Framework Process in order to integrate information security and risk management activities into the system's life cycle. The RMF decision must be current and cannot exceed a 3 year timeframe. Evidence FISMA compliance must be presented in the form of a POA&M. The Contractor will be responsible for the cost of RMF processes and FISMA testing required for any Contractor owned and operated network, facility and/or application processing DoD information. SUBMISSION INFORMATION: All potential sources are invited to submit a written capability statement that includes information that demonstrates the vendor's ability to provide the services/supplies described in this RFI. Responses shall also include a cover sheet that identifies the following information: 1. Company Name & Address 2. Point of Contact Name/Telephone/Email 3. North American Industry Classification System (NAICS) code. Identify the NAICS code under which your company would provide the supplies/services described in this RFI 4. Business Size/Status. From the list below, identify all of the business sizes applicable to your company under the NAICS code identified at item three above. Small Business Veteran-Owned Small Business Service-Disabled Veteran-Owned Small Business Small Disadvantaged Business Woman-Owned Small Business Large Business 8(a) Certified HUBZone Small Business 5. Data Universal Numbering System (DUNS) Number 6. Commercial and Government Entity (CAGE) Code. 7. If you have a GSA or other contract vehicle that covers these services, provide the contract number. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party's expense. All information received in response to this RFI that is clearly marked Proprietary will be handled accordingly. Acknowledgement of receipt of responses will not be made and RFI submissions will not be returned. Not responding to this RFI does not preclude participation in any future RFP, if issued. The information provided in this RFI is subject to change and is not binding on the Government. RESPONSE DUE DATE: Responses are due by 10:00 a.m. (Eastern) on December 24, 2015. All responses shall be submitted electronically to the DHRA Procurement Support Office point of contact: Melanie Thornsbury, Contract Specialist, at melanie.c.thornsbury.civ@mail.mil.