Request for Information Power Platform consulting services

Request for Information The Department of Housing and Urban Development (HUD) is issuing Request for Information (RFI) for subject matter expertise industry review of the draft Performance Work Statement (PWS) listed below and attached and provide recommendations for a successful solicitation. Future requirement of services may or may not result in solicitation based on industry feedback. This is a non-personal service to provide Power Platform consulting services in support of the U.S Department of Housing and Urban Development, Office of Public Housing Investments Office of Capital Improvements. The contemplated North American Industry Classification System (NAICS) code is 611430 Professional and Management Development Training, Product Service Code is R410 Support- Professional: Program Evaluation/Review/Development, and the Size Standard applicable is $15 million. This is only an RFI does not constitute a request for proposals; submission of any information in response to this market survey is purely voluntary; the government assumes no financial responsibility for any costs incurred. Based on the responses to this RFI, this requirement may be set-aside for small businesses or procured through full and open competition. Submission Instructions: Please submit RFI feedback by April 14, 2023, no later than 5:00pm (MT). All responses under this RFI must be via emailed to Claudia.coria@hud.gov. Additional information on the required services is listed below. PERFORMANCE WORK STATEMENT (PWS) 1. General: Introduction: This is a non-personal services contract to provide Power Platform consulting services in support of the U.S Department of Housing and Urban Development, Office of Public Housing Investments Office of Capital Improvements. The Government shall not exercise supervision or control over contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The U.S, Department of Housing and Urban Development (HUD)/Office of Public Housing Investments/Office of Capital Improvements (OCI) is seeking contractor for developing applications using the Power Platform and providing OPHI and OCI staff with training on the development and maintenance of the applications. Background: The Office of Capital Improvement (OCI) is a division of the Office of the Deputy Assistant Secretary for Public Housing Investments (OPHI). OCI administers the Capital Fund program, which provides funds annually via a formula to approximately 3,200 public housing agencies (PHAs) across the country. The Office provides technical assistance to PHAs and HUD Field Offices relating to development, financing, modernization, and management improvements of public housing developments. It prepares quarterly reports to Congress on the status of the obligation and expenditure of Capital Fund grants and implements the statutory sanctions for PHAs that are in noncompliance with the statutory deadlines. In order to process and administer the Capital Fund Program proficiently and effectively, the Office of Capital Improvements would like to utilize Power Platform to develop applications that could extract data and integrate business process. Power Platform and licenses are already installed and available for use by all HUD staff and contractors. 1.3. Constraints: The work identified in this contract will adhere to the rules, regulations, laws, standards and conventions identified by HUD as well as within the federal Government. Constraints may include but are not limited to: 1. The Contractor shall maintain compliance with all current and future Federal IT security requirements. The Contractor shall: Maintain IT security and comply with all terms and conditions of the contract throughout the term of the contract with respect to all data and information technology requirements. Use, maintain, enhance, develop and upgrade all information technology software and system documentation under this Contract in accordance with Federal Laws, best practices, and regulations. This includes, but is not limited to: Federal Information Security Management Act - https://www.dhs.gov/fisma The Privacy Act - https://www.archives.gov/about/laws/privacy-act-1974.html The E-Government Act - https://www.archives.gov/about/laws/egov-act-section-207.html; The Clinger-Cohen Act - https://www.fismacenter.com/Clinger%20Cohen.pdf Government Paper Reduction Act - http://www.hhs.gov/ocio/policy/collection/; Office of Management and Budget Circulars A-130, and A-I23 - https://www.whitehouse.gov/omb/circulars_default; Office of Management and Budget Memorandum 17-12 https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/ 2017/m-17-12_0.pdf; Department of Housing and Urban Development regulations, Handbooks and Policies - http://www.HUD.gov; GAO directives; and Federal Financial Manager Integrity Act (FFMIA). C. Maintain Security Assessment and Authorization (SA&A) standards in accordance with guidance published by NIST. An independent SA&A will be performed by Housing and Urban Development (HUD) during the period of performance of this contract. The Contractor shall complete the SA&A within 30 days of contract's convene date. after the award of the contract and again at the expiration of the SA&A and to include any revisions or updates. D. Follow HUD's Project Planning and Management (PPM) Life Cycle and industry best practices in the analysis, design, development, testing and implementation of proposed new systems and/or the enhancement to existing systems. This includes prohibiting live data from being used in any environment other than Production and Disaster Recovery (DR) environments. Specifically, no live data should be used in development, testing or staging environments. E. Review and update system documentation to ensure accuracy, compliance, and completeness. Reviews and revisions must be completed and delivered to HUD quarterly. F. The Contractor will prepare its security plan as part of its demonstration that it meets the requirements for SA&A per the applicable requirements from HUD, OMB, NIST, etc., which will require the preparation of several related documents, including but not limited to: NIST FIPS 199/200 Security Categorization Analysis; NIST SP-800 Security Controls Self-Assessment; Application and network venerability scans; Business Impact Assessment; Privacy Impact Assessment; Create System Security Plan, Risk Assessment, Technical Architecture, COOP and Contingency Plans, Quality Control Plan, ST&E Plan and other relevant SA&A supporting documentation for each new application; Security Assessment Tests (formerly ST&E Testing); Security Assessment Reports (formerly ST&E Report); POA&M; and Accreditation Documentation. G. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades will be assessed under the Federal Information System Controls Audit Manual (FISCAM) methodology that include control families for both General Computer and Business Process Application controls: i. General Controls: Security Management Access Controls Configuration Management Segregation of Duties Contingency Planning ii. Business Process Application Controls: Application Security Business Process Controls Interfaces Data Management H. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades must comply with identified OMB A-123 Appendix A "Management's Responsibility for Internal Control", and Appendix D - Compliance with the Federal Financial Management Improvement Act of l996 key controls; and the Federal Information Security Management Act of 2002 (FISMA) to include: National Institute of Standards and Technology Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 5 (NIST SP 800-53, Rev. 5); NIST SP 800-18 Rev. 5 - Guide for Developing Security Plans for Federal Information Systems; NIST SP 800-23 - Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products; NIST SP 800-30 Rev. 5 - Guide for Conducting Risk Assessments; NIST SP 800-34 Rev. 5 - Contingency Planning Guide for Federal Information Systems; NIST SP 800-37 Rev. 5 - Guide for Applying the Risk Management Framework to Federal Information Systems; NIST SP 800-47 - Security Guide for Interconnecting Information Technology Systems NIST SP 800-53A Rev. 5 - Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans; NIST SP 800-59 - Guideline for Identifying an Information System as a National Security System; NIST SP 800-60 Rev. 5 - Guide for Mapping Types of Information and Information Systems to Security Categories; NIST SP 800-84 - Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities; Federal Information Processing Standards (FIPS) 199/200 - Security Categorization Analysis; and FIPS 191 - Guideline for the Analysis of Local Area Network Security. HUD's Office of the Chief Information Officer (OCIO) will have responsibility for maintaining the FISCAM-based mapping of security controls that will be required in order to maintain compliance with FISMA, OMB A-123, and HUD security requirements. The Contractor shall support and provide system security to ensure availability, confidentiality, and integrity of the HUD data applications (e.g. maintaining access control, user identification, password protection and authentication, confidentiality of customer profiles and traffic, physical and personnel security required under this PWS). Provide SA&A support, including potential off cycle or unanticipated SA&A support, over the life of the contract. The HUD System Security Plans (Risk Assessment, Incidence Response Plan and IT Contingency Plan) shall be reviewed and presented to HUD's Chief Information Security Officer for approval. The Contractor shall maintain compliance with OMB Memorandum 17-12 (Preparing for and Responding to a Breach of Personally Identifiable Information), which requires contractors and sub-contractors (at any tier) to: Cooperate with and exchange information with agency officials, as determined necessary by the agency, in order to effectively report and manage a suspected or confirmed breach. Properly encrypt PII in accordance with OMB Circular A-130 and other applicable policies and to comply with any agency-specific policies for protecting PII; Provide and participate in mandatory training on how to identify and report a breach; Report a suspected or confirmed breach in any medium or form, including paper, oral, and electronic, as soon as possible and without unreasonable delay, consistent with the agency's incident management policy and US-CERT notification guidelines; Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector; Allow for an inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M 17-12, the agency's breach response plan, and to assist with responding to a breach; Identify roles and responsibilities, in accordance with OMB M 17-12 and the agency's breach response plan; and, Explain that a report of a breach shall not, by itself, be interpreted as evidence that the contractor or its subcontractor (at any tier) failed to provide adequate safeguards for PII. The Contractor shall provide and present a Security Self-Assessment Report to HUD's Chief Information Security Officer on an annual basis, due no later than August 31st of each calendar year. Plans of Action and Milestones (POA&Ms) shall be reviewed and updated at every 90-day, beginning with contract's convene date, and presented to HUD's Chief Information Security Officer for review and approval. Failure to adhere to the above NIST requirements could result in penalties, to include a contract performance stop-work order until compliance can be demonstrated. Disregard of these NIST requirements could also lead to other criminal, civil, administrative, or contract penalties, including, but not limited to: Breach of Contract damages False Claims Act damages Liquidated Damages Termination for Default Termination for Convenience Poor Past Performance Suspensions/debarment Federal Information Security Modernization Act (FISMA) of 2014 Section 508 of the Rehabilitation Act of 1998 - http://www.gpo.gov/fdsys/pkg/PLAW-105publ220/pdf/PLAW-105publ220.pdf Federal Records and Retention Acts and Regulations, and Freedom of Information Act (FOIA) Laws and Regulations Publications from National Institute of Standards and Technology (NIST) - https://csrc.nist.gov/publications/sp OMB Memorandums - https://www.whitehouse.gov/omb/information-foragencies/memoranda/ 15. HUD OCIO Handbooks: https://www.hud.gov/program_offices/administration/hudclips/handbooks/cio AS- 2315 Cybersecurity and Privacy Requirements (APRIL 2022) 1. The Contractor shall comply with all current and future Federal Information Technology (IT) security requirements. 2. The Contractor shall maintain compliance with all terms and conditions of the contract throughout the term of the contract with respect to all IT security and privacy requirements. 3. The Contractor shall use, maintain, enhance, develop, and upgrade all information technology software and system documentation under this contract in accordance with Federal Laws, Regulations, NIST guidance (https://csrc.nist.gov/publications/sp) and HUD Policies. 4. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades must comply with Office of Management and Budget (OMB) A-123, including Appendix A, Internal Control over Financial Reporting, as well as Federal Information Security Modernization Act (FISMA) of 2014, and shall be assessed under the Federal Information System Controls Audit Manual (FISCAM) methodology that include control families for both General Computer and Business Process Application controls. 5. The Contractor shall use only HUD email system to conduct HUD government business. To the extent that a non-HUD email system use occurs for HUD government business, the individual must copy their HUD email account during the initial creation of transmission or forward the email record to their HUD email account within 20 calendar days of creation or transmission of the record. Once the message is sent or forwarded to HUD email, the user must save the record (do not delete). Further, the record should be removed from non-HUD email systems unless there is a specific obligation, such as a litigation hold, to maintain the files on all non-HUD systems on which they appear. 6. The Contractor shall maintain compliance, as per the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations. 7. The Contractor shall follow HUD's Project Planning and Management (PPM) Life Cycle in the analysis, design, development, testing and implementation of proposed new systems and/or the enhancement to existing systems. No live data shall be used in any environment other than Production and Disaster Recovery (DR) environments. Specifically, no live data must be used in development, testing or staging environments. 8. The Contractor shall ensure each of its employees working on the HUD contract completes the mandatory HUD Security Awareness Training annually. 9. The Contractor shall ensure each of its employees working on the HUD contract acknowledges the HUD Rules of Behavior (RoB) annually. 10. The Contractor shall ensure each of its employees working on the HUD contract completes the mandatory HUD role-based/specialized cybersecurity and privacy training annually. 11. The Contractor shall review and update system documentation to ensure accuracy, compliance, and completeness. Reviews and revisions must be completed and delivered to HUD quarterly or within one day of a major system release. 12. The Contractor shall provide Security Assessment and Authorization (SA&A) support, including potential off cycle or unanticipated SA&A support, over the life of the contract. 13. The Contractor shall complete and maintain SA&A documentation in accordance with the guidance contained within NIST publications, after the award of the contract and again at the expiration of the SA&A to include any revisions or updates. 14. The Contractor shall complete and maintain security and privacy related documents, in accordance with all Federal Laws, Regulations, NIST guidance (https://csrc.nist.gov/publications/sp) and HUD policies. 15. The Contractor shall present IT security and privacy related documents to HUD's Chief Information Security Officer (CISO) for review and approval. 16. The Contractor shall designate an Information System Security Officer (ISSO) or a Security Point of Contact (POC) within the contractor staff to interface with HUD Office of IT Security (OITS) and to respond to cybersecurity related requests. 17. The Contractor shall support and provide system security to ensure availability, confidentiality, and integrity of the HUD data applications (e.g. maintaining access control, user identification, password protection and authentication, confidentiality of customer profiles and traffic, physical and personnel security required under this PWS). 18. The Contractor shall maintain compliance with OMB Memorandum 17-12, Preparing for and Responding to a Breach of Personally Identifiable Information. 19. The Contractor shall review and update the Plan of Action and Milestones (POA&Ms) on a timeframe that is consistent with contract terms, e.g. quarterly, annual, bi-monthly, etc. and present them to HUD's CISO for review and approval. 20. Each contractor employee working on the HUD contract shall not provide contract support until clearance is received from the HUD security background check. Failure to adhere to the above requirements could result in penalties, to include a contract performance stop-work order until compliance can be demonstrated. Disregard of these requirements could also lead to other criminal, civil, administrative, and/or contract penalties. 1. 4. Scope of Services: This is a non-personal service contract to provide Power Platform consulting services in support of the U.S Department of Housing and Urban Development, Office of Public Housing Investment - Office of Capital Improvements. The Contractor shall provide experienced Power Platform Expert, who to plan, design, develop, test, and implement Power Platform Applications that fit the organization's needs. The Power Platform Applications will enable the Government to extract data, integrate business processes in an organized and efficient manner. The Contractor shall also provide training to HUD staff on the maintenance and utilization of the developed Power Platform Applications. Any matter concerning a change to the scope, prices, terms or conditions of this contract shall be referred to the Contracting Officer (CO) and not Contracting Officer Representative (COR). 1.5. Non-Personal Services: The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. It the Contractor feels any action constitutes, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer immediately. These services shall not be used to perform work of a policy, decision making or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government. 1.6. Period of Performance: The contemplated period of performance shall be for one (1), twelve (12) month Base period. 1.7. Place of Performance: The contemplated services to be performed under this contract shall be performed remotely. 1.8. Hours of Operation: The Contractor is responsible for providing services between the hours of 6:00AM - 6:00PM, Monday thru Friday except Federal holiday or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. Weekly hours shall not exceed a forty (40) hour work week and a typical work day will be 8 hours each day Monday through Friday. The Government reserves the right to change hours of operation or restrict contractor access. Work outside these daily hours is prohibited without Contracting Officer approval. Government agencies will not be available during scheduled holidays, inclement weather, weekends, after duty hours. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential. 1.9. Qualifications & User Experience Principle The Contractor shall employ fully qualified and experienced employees with the required knowledge and expertise as described in this PWS. Preferred certifications: Microsoft Certified: Power Platform Developer And/or Microsoft Certified: Power Platform Functional Consultant Associate The Contractor shall apply principles of user experience (UX) design using appropriate UX frameworks to develop products that are usable and intuitive through a user-centered design approach that meets and balances users and mission needs with no more than two (2) validated customer complaints per month and 100% approved for HUD staff. 1.10. Post Award/Kick off Conference The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award. 1.11. Status Meetings The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR 42.5. The Contracting Officer, Contracting Officer Representative (COR) and other Government personnel, as appropriate may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Office will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be a no additional cost to the Government. 1.12. Contractor Travel Prior to travel (each planned trip) the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of CONUS travel costs will be in accordance with the Federal Travel Regulation in accordance with FAR 31.205-46. The Contractor shall travel using the lower cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the Contractor shall use the tourist class, economy class or similar lodging accommodations to the extent they are available and commensurate with the mission requirements. HUD will not reimburse Contractor's local travel. Local travel is defined as travel within 50 miles of performance location. All other travel will be reimbursed on a cost reimbursable basis; no profit or fee will be paid. The Contractor shall provide total accountability, accuracy, disclosure, control, forecasting, estimating, and overall management of all cost-based control activities, including monthly status report, Hours and Expenditure Report, Trip reports, certificates of service, invoices, proposals, and limitation of funds. The report shall be provided no later than five (5) after travel. 1.13. Transition In The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services as required. As a successor, the Contractor shall have sufficient personnel on board during the ten (10) business days Transition-In period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract Transition-In period. Transition-In is not required if the successor Contractor is the incumbent Contractor. 1.14. Transition Out To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the ten (10) business days Transition-Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In 1.15. Contractor Manpower Reporting The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this Contract via the System for Award Management (SAM). The NDAA and FAR provide the minimum data required for a Services Contract report. The SAM interface provides those fields for data entry, including some data validations. The contractor shall completely fill in all required data fields using the following web address: www.sam.gov. Reporting inputs will be for the labor executed during the period of performance during each government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may contact the Federal Service Desk (FSD) at (866) 606-8220 or forward questions to www.sam.gov. 2 DEFINITIONS and ACRONYMS 2.1 DEFINITIONS Contractor A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime. Contracting Officer (CO) A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government. Defective Service A service output that does not meet the standard of performance associated with the Performance Work Statement. Deliverable Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports Government Furnished Property (GFP) Government-furnished property means property in the possession of, r directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract. Contracting Officer Representative (COR) An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities in regard to technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract. Key Personnel Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel clause. When key personnel are used as an evaluation factor in best value procurement, offerors can be rejected if they do not have firm commitments from the persons that are listed in the proposal. Performance Work Statement (PWS) A statement of work for performance based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes. Physical Security - Actions that prevent the loss or damage of Government property. Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contract's quality requirements. Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the contractor's performance in meeting critical performance standards identified in the contract. Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements. Subcontractor - Any person , other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor. Work Day - The number of hours per day the Contractor provides services in accordance with the contract. Work Week - Monday through Friday, unless specified otherwise. 2.2. ACRONYMS ACRONYM DEFINITION ACWP Actual Cost of Work Performed AQL Acceptable Quality Level ARAMS Automated Renewal and Amendment System BAA Business Area Analysis Study CBT Computer-Based Training CCB Change Control Board CCMB Configuration Change Management Board CFO or OCFO Office of the Chief Financial Officer of HUD CFR Code of Federal Regulations CIO or OCIO Office of the Chief Information Officer of HUD CLIN Contract Line Item Number CO Contracting Officer COB Close of Business COR Contracting Officer Representative CPO Office of the Chief Procurement Officer of HUD CR Change Request DACA Days After Contract Award EAC Estimate at Completion EST Eastern Standard Time (U.S.) ETC Estimate to Completion GAO U.S. General Accounting Office HARTS HUD Automated Release Tracking System HITS/HUDNET HUD Information Technology Service HRMB HITS/HUDNET Request Management Board HTC HUD Test Center HUD U.S. Department of Housing and Urban Development HUDAR HUD Acquisition Regulation HUD/ISG Internet Services Group within the Telecom Processing Division HUDATWORK HUD's Intranet Web Site and related WEB pages. HUD Web HUD's Intranet Web Site and related WEB pages. IG or OIG I...