Att._2_-_IDMS_Task_Order_1.pdf

Task Order 1: Solution Provision and Initial Support Services

I. Background The Department of State (the Department or DOS) requires continued, uninterrupted

Department-wide HSPD-12 compliant Identity Management System and Credential Management

System (IDMS) capability at current One Badge locations, The Department has implemented

One Badge, its hardware appliance-based HSPD 12 compliant IDMS solution, domestically and at selected pilot sites overseas. Domestically, One Badge provides identity management, card management, and an authentication mechanism for physical access to all of its domestic facilities. Overseas, One Badge provides identity management and card management at five pilot locations.

II. Scope The scope of this task order includes all labor, hardware, middleware, software, interfaces, licenses and license maintenance, warranties, card stock, consumables, and services necessary to provide the contractor’s IDMS solution, including technical support, training, and program and project management services, at current One Badge locations.

Appendix C, Table C-1, Summary of Domestic IDMS Units, provides the current enrollment, issuance, and self-service card management stations located domestically. Appendix C, Table C-

2, Summary of Overseas IDMS Units, provides the current dual enrollment and issuance stations and self-service card management stations located at overseas locations.

III. Requirements

A. Program and Project Management The contractor shall provide comprehensive program and project management to control quality, manage risks and communications, establish monitoring and reporting processes, and to ensure that contracted tasks stay on track and important milestones are met.

Specifically, the contractor shall:

Provide and maintain a Task Order Management Plan (TOMP) and an Integrated

Master Schedule (IMS) that are compliant with the Project Management Institute

(PMI) Project Management Body of Knowledge (PMBOK) or other industry-equivalent guidance. The TOMP/IMS must include the following, at a minimum:

o A detailed plan and schedule that lay out the logical flow of project events and identify the activities, milestones, significant dependencies, and deliverables for each phase. Exit criteria must be established for each phase and milestone reviews must be conducted with DOS stakeholders to ensure that the project’s management quality and technical feasibility remain sound and the project is ready to move forward to the next phase. The TOMP/IMS must address the following phases, at a minimum:

Provision of the core solution including development, integration, and testing sufficient to demonstrate that the solution is ready for deployment (achieves a DOS Authorization to Operate (ATO) determination, and establishes and demonstrates interfaces, including both symmetric and asymmetric physical access control authentication), successfully deploys into the DOS production environment, and is capable of producing compliant cards;

Provision of enrollment and issuance stations at all current One Badge locations and training for existing users, administrators, the NSM

Branch Chief and all relevant contracting officer’s representatives and government technical monitors, and DOS Tier 1 and 2 personnel; and, Migration and management of existing identities, cards, and users to the Offeror’s proposed solution.

o The Offeror’s specific approach for demonstrating that appropriate criteria are met at each milestone.

1) Provide and maintain a risk management plan that identifies, assesses, and prioritizes risks that could negatively impact the project’s success and identifies the contractor’s strategies to manage or mitigate them.

2) Provide and maintain a communication plan that specifically addresses how the contractor will coordinate installations and upgrades, communicate with and manage multiple stakeholders, and work across DOS organizations and affiliates for project planning and execution with minimal government oversight.

3) Provide and maintain a quality control plan (QCP) that describes the methods the contractor will use to review and analyze accomplishment of the IDMS objectives and compliance with applicable constraints. When accepted by the COR, the contractor shall operate under the QCP. The QCP shall include at least the following elements: a performance measurements plan and a performance reporting plan.

4) Provide and maintain a Staffing Plan with a list of names, applicable Labor

Categories, and proposed duties of the personnel proposed for Task Order #1, as well as the approximate percentage of time each individual is assigned. Key personnel shall be clearly identified..

5) Develop, document, implement, and maintain standard operating procedures (SOP) for all IDMS-related activities and services.

6) Provide briefings to all stakeholders to apprise them of project plans, issues, and status updates.

7) Provide clear government visibility into program cost, schedule, technical performance, and risk. At a minimum, the contractor shall provide:

a) Weekly Status Reports, including the following information, at a minimum:

i) Resource usage;

ii) System performance against the established baseline;

iii) Unexpected outages and/or reports of performance degradation including issue/problem analyses and recommendations.

b) Monthly Status Reviews, including the following information, at a minimum:

i) Progress on tasks and projects that were scheduled for the month including a checklist demonstrating performance against TOMP readiness checks and IMS milestones;

ii) Problems encountered or remaining from prior months and plan to resolve them;

iii) Risks and issues (both backward- and forward-looking);

iv) Tasks and projects scheduled for the upcoming month; and,

v) Resource updates and issues.

c) Quarterly Contract Reviews with the contractor’s program management team, including the following information, at a minimum:

i) Progress on all task orders and projects for the quarter;

ii) Performance reporting on PRS metrics and acceptable quality levels (AQL);

iii) Outstanding issues and problems, measures taken to address them, results, and measures to address any residual issues or problems.

8) Provide and maintain full life cycle documentation for the solution and all interfaces.

Update documentation as changes are made to ensure that it always reflects the most current information. Refer to the documentation and interface requirements in the following DOS references:

a) 5 FAM 861, Configuration Management,

b) 5 FAM 116, Role of Governance and Policy (GP) in IT Management

c) 5 FAH-5 H-520, Lifecycle Management.

9) Provide and maintain a release schedule that will set the timeframe for change request identification, requirements elicitation, development, testing, flaw remediation, system and program documentation updates, and deployment.

10) Provide configuration management and quality control to ensure that planned hardware and software, database, and operating configuration changes are documented, tested in the appropriate environments, and approved IAW Department-approved SOPs prior to each release.

11) Report all qualified assets using the Bureau of Diplomatic Security, Office of Security

Technology’s (DS/ST) Computerized Maintenance Management System (CMMS).

At a minimum, the contractor shall provide the program and project management deliverables listed in Table 1.

DELIVERABLES DUE DATE

Project Management Plan and

Integrated master Schedule

Draft with proposal; Final 30 Days after

Award; updates as needed

Risk Management Plan Draft with proposal; Final 30 Days after

Award; updates as needed

Communication Plan Draft with proposal; Final 30 Days after

Award; updates as needed

Quality Control Plan Draft with proposal; Final 30 Days after

Award; updates as needed.

Standard Operating Procedures

Phased IAW government-approved

TOMP and IMS. Review and update NLT each subsequent anniversary of the Date of Award

Quarterly Contract Review Quarterly, NLT 10 business days after the completion of the quarter

Monthly Status Review Monthly, NLT the 5th of the following month

Weekly Status Report Weekly, NLT the end of the first business day of the following week

Full Life Cycle Documentation for the Solution and all Interfaces

Drafts during development; Updates as changes are made.

Operations and Maintenance Plan

NLT 30 days before the contractor’s core solution and enrollment and issuance infrastructure has been fully deployed at all current One Badge locations.

Table 1: Program and Project Management Deliverables

B. Core Solution Deployment The contractor shall implement and deploy its core IDMS solution in IAW its PWS and approved TOMP/IMS. At a minimum, the contractor shall:

1) Implement environments to efficiently allow for the following: development efforts, user acceptance testing (UAT), interface testing, training, production, and disaster recovery (DR).

2) Achieve a three-year authority to operate (ATO). Provide all hardware, documentation, system access and services to achieve and maintain the system accreditation throughout the task order period of performance.

3) Demonstrate interfaces, including physical access control authentication, to the systems identified in Appendix E.

4) Produce a performance baseline of the Department’s IDMS solution and technical environment, including supported interfaces.

5) Provide the core IDMS solution in the DOS Production Environment and produce fully compliant cards.

At a minimum, the contractor shall provide the deliverables listed in Table 2.

DELIVERABLES DUE DATE

Authorization and Accreditation documentation

NLT 60 days after contract award. All information assurance related inquiries must be responded to within 72 hours until fully accredited system is deployed in DOS Production Environment.

Documentation of the critical dependencies between the solution and the Department’s data

Phased IAW government-approved

TOMP and IMS.

Interface Control Documents Phased IAW government-approved

TOMP and IMS.

Test Plans and Reports Phased IAW government-approved

TOMP and IMS.

Table 2: Core Solution Deliverables

C. Enrollment and Issuance Station Deployment The contractor shall implement and deploy enrollment and issuance stations and self-service card management stations IAW its PWS and approved TOMP/IMS. At a minimum, the contractor shall:

1) Demonstrate that issuance and enrollment capabilities meet or exceed applicable objectives.

2) Acquire and manage DOS PIV cards and provide inventory control of PIV cards from acquisition to termination/destruction of the card.

3) Provide domestic and overseas enrollment, issuance, and self-service card management stations at all existing locations.

4) Provide initial certification curriculum and training for Diplomatic Security’s Domestic

Operation’s (DO) issuance and enrollment personnel and for issuance and enrollment personnel serving at the overseas pilot sites. Certification training must be sufficiently detailed and clear so as to permit existing personnel to achieve certification with the new system within 6 hours.

At a minimum, the contractor shall provide the deliverables listed in Table 3.

DELIVERABLES DUE DATE

Certification Curriculum IAW government-approved TOMP and

IMS.

Deployment Plan IAW government-approved TOMP and

IMS.

Certification Training Schedule IAW government-approved TOMP and

IMS.

Enrollment and Issuance Installation

Guide

IAW government-approved TOMP and

IMS.

System Administration Guide IAW government-approved TOMP and

IMS.

Enrollment and Issuance User Guide IAW government-approved TOMP and

IMS.

Table 3: Enrollment and Issuance Deliverables

D. Training and User Support The contractor shall provide training and user support services IAW its PWS and approved TOMP/IMS. Specifically, the contractor shall:

1) Provide curriculum, training and train-the-trainer services (e.g., courseware, content, tracking, and certification) that meet or exceed the requirements of all IDMS stakeholders (e.g., DS Security Technology Assistant Center (STAC) and the Network

Operations Center (NOC), DS Identity Management (IDM) personnel, and interface partners). Training shall include course material and training content for the following activities: system functional and capability updates; enrollment, issuance, and system administration user training; system set-up and configuration; Tier 1 and 2 and general workflow trouble shooting and resolution; and One Badge overseas workflow.

2) Provide and maintain a User Support Plan to integrate the contractor’s Tier 3 support into the existing ST user support workflow. Provide checklists and other diagnostic aids to support resolution of common issues and problems by DOS Tier 1 and Tier 2 personnel. Receive, acknowledge, track, and resolve assigned/escalated user inquiries, outages, issues, and problems using DS/ST’s work order management system, currently CMMS. Provide documentation updates to reduce the number of duplicate inquiries.

3) Provide a One Badge global deployment workflow, SOP, and testing materials (e.g.

system operations testing).

4) Provide a documentation package with all system modifications that includes impacted material, courseware, and process changes.

At a minimum, the contractor shall provide the deliverables listed in Table 4.

DELIVERABLES DUE DATE

Overall Training Plan

Draft with proposal; Final 10 Business

Days after TOMP and IMS are approved;

updates as needed

Train-the-Trainer Curriculum

All training material must be finalized and delivered to the government 45 days prior to deployment.

Functional Curriculum (system functional and capability updates;

enrollment, issuance, and system administration user training; system set-up and configuration; Tier 1 and 2 and general workflow trouble shooting and resolution; and One Badge overseas workflow.)

All training material must be finalized and delivered to the government 45 days prior to deployment.

Train-the Trainer Sessions

Three (3) train-the-trainer sessions must be conducted NLT 30 days before the end of the task order period of performance.

Table 4: Training and User Support Deliverables

E. Migration of Current Identities The contractor shall complete the transition of existing identities, cards, and users to the new solution IAW its government-approved TOMP and IMS.