RFP 25-69 Montgomery County Department of Public Safety Multi-Factor Implementation Services

1.0 INTRODUCTION

The FBI CJIS Division has added a requirement for Multi-Factor Authentication (MFA) to be utilized for all access to Criminal Justice Information (CJI). The Montgomery County Department of Public Safety (MCDPS) handles CJI and controls access to it through the Department’s Computer Aided Dispatch (CAD) system. To be compliant with the new CJIS security policy, all individuals having access to CJI via the County’s CAD system will need to utilize MFA to gain access.

MCDPS seeks to purchase software and licensing for MFA, physical hardware tokens, and retain the services of a firm with the necessary staff and expertise to assist with design, configuration, deployment, and management of MFA to all users of MCDPS systems that provide access to CJI.

The two groups that the new MFA requirement is applicable to are the telecommunicators located inside one of the MCDPS Public Safety Answering Points (PSAPs) or satellite dispatch centers, and external Law Enforcement Officers (LEOs) that have access to CJI through the County’s Mobile Data Computers (MDCs), and any Law Enforcement agencies Civilian staff who has access to the County’s Net Viewer dispatcher program.

2.0 BACKGROUND

• Montgomery County Department of Public Safety is the Public Safety Answering Point (PSAP) for

Montgomery County, Pennsylvania, which is a suburb of Philadelphia and home to over 860,000 residents.

• The MCDPS 9-1-1 communications center dispatches approximately 53 police departments, 90 fire companies, and 22 EMS agencies.

• MCDPS operates out of a primary 9-1-1 communications center facility in Eagleville, Pennsylvania which is equipped with 32 primary call-taking and dispatching consoles and 27 additional training consoles.

• MCDPS also operates an alternate 9-1-1 communications center at a second facility in Conshohocken, Pennsylvania containing 20 call-taking and dispatching consoles.

• MCDPS also operates 4 additional CAD positions located at the satellite agencies of Lower Merion Police Department and Upper Merion Police Department.

• MCDPS also has remote call taking capabilities for up to 25 positions

• MCDPS maintains 4 operational platoons of telecommunicators comprised of approximately 150 full-time and part-time staff with access to CJI.

• MCDPS manages and deploys its mobile CAD software to more than 1000 Mobile Data Computers (MDC). Approximately 600 of these MDCs are currently used by law enforcement agencies. The MDC’s provide the LEOs with access to CJI through the Hexagon Mobile for Public Safety (MPS) application.

• MCDPS supports nearly 1,700 LEOs across 53 separate law enforcement agencies by providing them with MDC’s and software to access CAD and relevant CJI.

• The MCDPS MDCs utilize Absolute Secure Access virtual private network (VPN) software to securely connect back to the Department’s CAD system.

• MCDPS CAD workstations within the communications center utilize thin clients or department issued laptops along with Omnissa VDI software to connect to the CAD infrastructure. All workstations are Windows 11.

3.0 SCOPE OF WORK

A. Implementation & Deployment Services

• Vendor shall provide a solution that is compatible with the current Absolute Secure Access Mobility VPN software.

• Provide licensing and hardware for the proposed solution assuming 2000 users. Also provide addendum for future growth.

• Provide detailed pricing for proposed solution with breakdowns for hardware, software, and managed services.

• Provide an MFA solution for field users utilizing CJIS approved authentication methods. Vendor will need to determine on a department-by-department basis what methods will need to be used.

• Load and configure all new MFA licensing and tokens to the Department’s environment.

• Create all necessary group policy or other AD controls to utilize MFA for the telecommunicators and external law enforcement officers.

• Plan, coordinate, and execute the creation of a new AD user account for each individual LEO, including successful enrollment in the chosen MFA solution.

o The County will provide a current officer roster from CAD that includes names and agencies for all LEOs.

o The County will provide contact information for each agency so that the vendor can contact the agency to complete the user setup and MFA registration process.

• Plan, coordinate, and execute the creation or modification of an AD user account for each

MCDPS Staff Member, including successful enrollment in the chosen MFA solution.

o MCDPS would like to explore potential use of access cards for MCDPS staff, either existing HID building access cards or new cards compatible with existing security system.

o Vendor is to provide any potential hardware or cards needed.

• Coordinate and execute an agency-by-agency cutover plan to activate MFA to the MDCs. As all officers in an agency complete the user account creation process, enable that agency’s new MFA configuration.

• Coordinate and execute a cutover plan for the activation of MFA for all MCDPS staff and protected workstations.

B. Ongoing Managed Services The vendor shall be responsible for 24x7 help-desk support services during the deployment phase of the MFA project. The vendor shall include 12 months of comprehensive 24x7 help desk and managed services support included as part of the base offering. Commencement of the 12-month term shall begin once all MCDPS Staff and external LEOs are migrated to the new MFA solution.

The vendor shall be responsible for a 24x7 help desk and managed services package to provide ongoing support to field and staff with yearly renewable terms. The ongoing services would take effect following the initial 12-month help desk support period. Vendor is to provide year two through five pricing for all support/managed services.

All Help Desk & Managed Services offerings need to include:

• 24/7/365 Help-Desk support to resolve account and password issues including MFA solution support. The support shall be full service with staff capable of all aspects of user management.

• The Help Desk shall be staffed and available to answer all calls for service 24/7/365. Leaving messages and returning calls at a later time is not an acceptable solution.

• Provide sample SLA/Escalation policy document for review.

• Text based chat or SMS support services should be included if available.

• Provide a secure mechanism to validate a user’s identity when calling the Help Desk for assistance with account, password, or MFA issues.

• Provide a secure mechanism for transmitting new passwords to Telecommunicators and law enforcement officers when they are reset manually by the help desk.

• Enroll new MCDPS staff as they are hired and require a user account with MFA enrollment.

• Enroll new LEOs as they are hired and require a user account and MFA enrollment. This is estimated at a rate of 15 LEOs per month.

• Handle MFA re-enrollments as needed when users utilizing smartphone applications update to a new device.

• Deploy and manage all aspects of the physical MFA hardware tokens. Including deployment, inventory, troubleshooting and replacement. This should include the cost for all hardware tokens needed for initial deployment.

• Provide MCDPS with a monthly report of current devices and their status. Reports should include authentication failures, suspicious activity, and audit logs.

• Provide a sample cyber security incident response plan in the event of MFA related security event.

• Provide documentation/reports as needed for CJIS compliance and auditing.

• Provide a summary of the token replacement process including turnaround time and interim access solution and billing options that will be available to the end user agency. (MCDPS will provide tokens for initial deployment and ongoing new users. Fields agencies will be responsible for lost, damaged, or unserviceable tokens).

• As LEOs and MCDPS Staff leave, deactivate the user’s AD account and MFA token to remove system access within a timeframe specified by MCDPS. Vendor shall follow MCDPS policy regarding disabled accounts.

4.0 VENDOR REQUIREMENTS

• The vendor must adhere to industry best-practices based on Cybersecurity frameworks and current FBI and CJIS policy/requirements. Vendor to provide a list of frameworks they adhere to as well as proof their solution meets the requirements.

• All vendors/contractors who work with MCDPS, are required to adhere to the following internal and external guidelines set forth, as follows:

• MCDPS is required by department policy to maintain compliance in accordance with the following guidelines pertaining to the security of criminal justice information and systems:

Pennsylvania State Police (PSP) Commonwealth Law Enforcement Assistance Network; the U.S. Department of Justice Federal Bureau of Investigation (FBI) Criminal Justice Information Services Division pursuant to the Criminal Justice Information Services (CJIS) Security Policy;

and applicable state and federal regulations.

• Prior to allowing a vendor or contractor to perform their duties, a mandatory vetting process must be completed for remote and/or unescorted access for vendors/contractors to maintain badge access within our agency, related departments and/or locations, including network access. Each vendor/contractor is mandated to submit to and successfully pass the following:

Live Scan Fingerprinting.

Criminal History Background Check; and Successful completion of Criminal Justice Information Services (CJIS) Security

Awareness Training.

• All individuals engaged in providing the services outlined above on behalf of the Vendor need to maintain CJIS level 4 certification training for IT Personnel.

5.0 IT GUIDELINES

A. Summary

• The Vendor agrees that all notes, plans, analysis, design, training, procedures, software and other documentation produced as a result of this project shall be delivered to and is the property of the County.

• The vendor agrees to create and provide detailed As-Built documentation for all systems and software provided under this contract.

• The vendor agrees that each staff member assigned to work on the deliverables of this contract by the Vendor shall sign any County confidentiality and/or computer access and security document/form required by the County. Any subcontractor staff utilized by Contractor as a part of this implementation/ engagement must also sign the same.

• The vendor agrees any work to be performed by Contractor staff off-site, except that which is specifically referenced to be done off-site elsewhere in this contract, must have the approval of the County prior to such off-site work being conducted.

• All contractor staff must be accompanied by a County employee where/when required, as determined by the County when at the County’s work site.

• The contractor agrees that system support protocols, policies and procedures, escalation protocols, system responsibility agreements, and system hardware, operations, software and application documentation will be developed and provided as defined by the County and that such items will be considered as delivered upon final acceptance by the County.

B. Security

• Contractors must provide a summary of how they handle hardware and software security for the system. The summary must provide information on updates, patching, remote access and the overall security involved. All information provided will be considered in the process of choosing a qualified Contractor.

• Contractor will comply with any/all Security Specifications made by the County for System Delivery which may vary depending on the solution delivered. Any security violations involving Contractor solution may mandate on-site, non-reimbursable support from the Contractor.

• Contractor will provide the County’s staff with full Administrative Privileges for all Microsoft®-based systems, or Root-level access for all Unix®-based systems.

• The contractor agrees that all work products, including computer system technical and application deliverables, data transaction processing systems, procedure and processing documentation, workflow design and/or process recommendations, and other work performed as a part of this agreement shall be delivered in compliance with HIPAA rules; CJIS guidelines; CHRIA legislation; and PCI-DSS standards where required by the County for compliance.

C. Network

• The vendor will comply with all County of Montgomery network standards for build, configuration, implementation, and management. No changes to delivered solution may be made without the written approval of the County.

D. Project Management

• The vendor agrees to incorporate components of the County's Project Management

Methodology as required by the County. Contractor must produce project plans with format and contents acceptable to the County. The project methodology must include a project plan along with other project reporting and status documentation acceptable to the County.

• The vendor agrees that the County's designated Project Manager will oversee the activities of the Contractor Project Manager with regard to project activities and how they are performed and communicated.

Please Note: Vendor agrees that the County’s staff can participate in any project activity, meetings, and work sessions the County deems appropriate.

Submission Method Responses to this RFP must be submitted through the County’s procurement submission portal, Bonfire, at https://montcopa.bonfirehub.com/portal .

Questions All questions must be submitted through the Bonfire portal and answers will be posted there for public review.

https://montcopa.bonfirehub.com/portal