Web-based Emergency Operations Center (WebEOC) Unified Command Platform migration from existing on-premises WebEOC solution.

TSA’s existing Web-based Emergency Operation Center (WebEOC) incident management system is hosted on-premise and is a designated DHS/TSA Mission Essential System (MES), High Value Asset (HVA), categorized as a Federal Information Processing Standards (FIPS) 199 High system. The FIPS Publication 199 defines “High” as the impact level where “the loss of confidentiality, integrity, or availability could be expected to have a severe/catastrophic adverse effect on organizational operations, organizational assets, or individuals.” To address system security and operational mission readiness requirements, TSA requires the existing WebEOC system (e.g., features, data, workflows, reports, interconnections, mobile application) and its full capabilities be hosted, managed, and migrated to a WebEOC FedRAMP High authorized Software-as-a-Service (SaaS) cloud solution/platform. The WebEOC cloud platform must be NIST SP 800-53 “Rev 5” compliant; certified for ISO 27001 (Information Security Management System), ISO 27017 (Cloud Services Information Security), ISO 27018 (Protection of PII), ISO 22301 (Business Continuity Management) and ISO 27701 (Privacy Information Management System), as well as for SOC 2 Type 2 (System and Organization Controls audit including compliance with security, availability, processing integrity, confidentiality, and privacy standards). The WebEOC cloud platform must fulfill security, scalability and resiliency FedRAMP high requirements and provide multiple geographically disparate storage and high availability across multiple GovCloud regions. The WebEOC cloud platform must adhere to Federal/DHS/TSA Cybersecurity and Zero-Trust compliance requirements and integrate with existing TSA single sign-on and multi-factor authentication solution (e.g. Okta, PIV). For the base year, vendor will: • Provision and manage the cloud infrastructure and environments to provide TSA a development, stage/test, training, and production TSA WebEOC platform within a federal government FedRAMP High authorized environment. • Provide operations and maintenance of all TSA WebEOC cloud environments, to include: full technical stack administration/configuration, 24/7 helpdesk support, and upgrades to core platform software in coordination with TSA and in accordance with TSA IT release/configuration management policy/procedures. • Provide project management and fulfill TSA IT system security tasks/requirements to secure a WebEOC FedRAMP-High Authority to Operate (ATO) from TSA’s Authorizing Official. • Provide licenses (as needed) to support up to 250 TSA users. These users will be leveraged to validate readiness of the TSA ATO environments/platform in preparation for full migration in the following option year. • Conduct process-and-architecture reviews/assessments; prepare recommended activities/schedules to begin migration of existing environment in the following option year. • Migrate existing TSA WebEOC tools and/or provide other solutions to enable: reporting and analytics, error log analysis, synchronize user access across training/live environment and user auditing, DevOps toolkits for DevSecOps best-practices, database optimization and records-retention capabilities, and support CI/CD pipeline deployments. For the option year, vendor will: Maintain WebEOC cloud environment as required in base year; Provide licenses to support up to 9,000 users (3,000 active monthly users) and 500 concurrent users; Fully migrate all existing on premise WebEOC modules, data, and interconnections; Go live with new WebEOC cloud platform to allow on premise application to be decommissioned.