DDI_RFQ_2015-04_PKI.pdf

RFQ 2015-04 SOW Public Key Infrastructure Page 1 of 9

The Army and Air Force Exchange Service (AAFES)

Request for Quotations (RFQ)

{# 2015-04}

Statement of Work for the

Public Key Infrastructure Project

RFQ 2015-04 SOW Public Key Infrastructure Page 2 of 9

Table of Contents

Introduction 3

Project Life Cycle 3

Proposal Submission 4

RFQ/SOW Due Date 4

Evaluation for Award 4

Submission of Proposals 5

Statement of Work 7

SOW Cost Proposal 10

RFQ 2015-04 SOW Public Key Infrastructure Page 3 of 9

1. Introduction This RFQ is issued pursuant to the Design and Implementation IDIQ contract awarded to your company. In reference to our Public Key Infrastructure Implementation Project, Exchange’s-Specific Requirements:

Installation and configuration of MIM/CM and the installation of smart card readers and issuances of smart cards to Exchange employees and contractors

2. Project Life Cycle

The following services are required.

2.1 Design Phase:

The supplier will produce design specifications that meet the AAFES's functional and technical architectural standards and identify and describe the most cost-effective solution to the implementation option under consideration within the limitations of the involved application platforms and or application frameworks. The supplier will create and the AAFES will verify and validate design specifications that represent the solution to be implemented for the defined requirements.

2.2 Implementation Phase:

The supplier will perform all the activities associated with the installation and migration of new or upgraded components to the production environment. After all required tests have been executed and the programmed solution is verified and validated to be fit for purpose, the AAFES will implement the programmed solution. Fit for purpose is defined as the ability to realize the objectives that are implemented through the specific programmed solution. The supplier will perform some or all of the implementation and data migration activities required to move the programmed solution to the production environment of the involved application, in accordance with the design specifications.

2.3 Training and Knowledge Transfer:

The supplier will perform all the activities associated with the development and execution of: a knowledge transfer plan; first-, second- and third-line support, end-user and train the-trainer content and materials;

functional and or technical assistance to users. The supplier will perform all activities and provide all materials and technology that is required for the successful use and operation of the developed or programmed solution by the users and support staff that will deploy or support the programmed solution.

3. Submission of Proposal

3.1 RFQ/SOW Due Date

Those suppliers who wish to respond to this RFQ must mail two copies of their proposal to the address shown below. Proposals are due 21 Oct 2015. In addition to mailing the hard copy, the AAFES also requires the supplier to email their complete proposal to hammonswt@aafes.com, DurhamP@aafes.com mailto:hammonswt@aafes.com mailto:DurhamP@aafes.com

RFQ 2015-04 SOW Public Key Infrastructure Page 4 of 9

AAFES

ATTN: Contracting Officer William Hammons (PL-K-IT – Room 173 2nd Floor North) 3911 S. Walton Walker Blvd.

Dallas, TX 75236-1598

3.2 RFQ Questions

Questions related to this RFQ must be submitted in writing in Excel format to the Contracting Officer via email to:

hammonswt@aafes.com no later than 21 Oct 2015.

3.3 Submission of Proposals:

Supplier responses must include at a minimum:

1. A detailed response to this Statement of Work (SOW) on the supplier's project approach and methodology to perform the services outlined in the SOW.

2. A high level project plan to include the timeline to complete all phases outlined in the SOW.

3. The suppliers experience in performing the required services outlined in the SOW.

4. The proposed Milestones, Deliverables, Acceptance Criteria to include a disincentive if milestones are not met by the date identified.

5. Complete and return the Cost Proposal as requested in the RFQ. The cost proposal will be

Firm, Fixed Price (FFP) which is inclusive of all costs associated with the scope of work.

4. Evaluation for Award:

The AAFES may award the resulting delivery order to the responsive supplier whose proposal offers the best value to the AAFES.

The AAFES reserves the right to open discussions with only the most favorable supplier or multiple supplier(s) and to individually adjust the proposed approach to the AAFES's advantage. The AAFES may alter the project/task content after award without restriction, based on the changing requirements of the project.

The AAFES is relying upon the supplier for their technical expertise on how to successfully carry out these requirements. The AAFES will be responsible for only those costs established and formally accepted during the execution of the resulting delivery order. In the event of supplier error or oversight, the supplier shall bear any additional costs to successfully complete the delivery order requirements. The AAFES Contracting Officer will be the determining official should a dispute arise.

mailto:hammonswt@aafes.com

RFQ 2015-04 SOW Public Key Infrastructure Page 5 of 9

5. Facility Access and Security Requirements All supplier personnel who will require access to the AAFES network and/or Information Systems will require a National Agency Check (NAC). The below listed requirements apply to any contractor who needs access to the AAFES building and/or systems.

Supplier personnel may be impacted by the time the AAFES requires to conduct security requirements. The period of performance under this SOW is contingent upon approval to access the AAFES Information Systems.

The AAFES is not liable for any expenses required to comply with this requirement.

In the event access or interim access is denied under this paragraph, the delivery order may be cancelled immediately at the AAFES’ sole discretion and at no cost.

Upon the issuance of a delivery order, the respective documents will be required to be submitted and/or action taken to complete the below listed requirements. The following requirements must be met for sensitive access.

5.1 SENSITIVE ACCESS – Required if accessing the AAFES systems A. Fingerprints are taken electronically at HQ AAFES. Results are normally provided within 10 business days. Contact 214-312-3657 for a fingerprint appointment.

B. Hardcopy of Company’s Pre-employment Background Check, which includes a Local and National

Criminal Check.

C. The following information is needed to add applicant to e-QIP. Applicant will not be able to access e-

QIP until invitation with link and detailed instructions have been sent from C-FP.

a) FULL NAME (Last, First, Middle) (Jr, Sr, III, etc if applicable)

b) PLACE OF BIRTH

c) DATE OF BIRTH

d) SSN (last 5) (Complete SSN is needed. Call or send another e-mail with the rest)

e) E-MAIL ID

D. AAFES Badge Request Form must be completed.

E. Must be a U.S. Citizen in order to have access to Sensitive information.

5.2 NON-SENSITIVE ACCESS

A. Clear pre-employment Background Check, which includes a Local and National Criminal check.

B. The following information needs to be completed on Company Letterhead:

a) CONTRACTOR NAME

b) DATE OF BIRTH

c) LAST 5# OF SSN

d) HOW LONG THE PERSON WILL BE AT HQ

RFQ 2015-04 SOW Public Key Infrastructure Page 6 of 9

C. The AAFES Badge Request Form must be completed.

D. Does not have to be a US Citizen to obtain this access.

///////////////////////////////////CONTINUED ON NEXT PAGE////////////////////////////////////////////////////

RFQ 2015-04 SOW Public Key Infrastructure Page 7 of 9

Statement of Work for the

1. Objective The Exchange objective is to obtain a solution that will provide a Public Key Infrastructure for user’s authentication and remote access.

A. Exchange’s-Specific Requirements: Installation and configuration of MIM/CM and the installation of smart card readers and issuances of smart cards to a test group of a 250 users.

B. Special Considerations for Implementing Technology at Exchange’s Location(s): The Exchange currently has

SSO for several Microsoft applications; we need to maintain our SSO capabilities with smart card authentication.

C. Other Project Characteristics to Insure Success

2. Background The Exchange currently uses user names and passwords for their logon credentials. We are looking to implement a PKI environment to support smart card authentication.

A. Background of the Exchange’s Business Situation: The Exchange is looking into implementing smart card authentication.

B. Current Architecture and Operating System: The Exchange is currently using Microsoft Active Directory and

Certificate Authority.

C. Current Work Flow/Business Flow and Processes: Currently the Exchange uses user names and passwords for authentication.

D. Current Legacy Systems: None.

E. Current System Dependencies: Microsoft Exchange, SharePoint, Office 365, Microsoft Active Directory, Microsoft Threat Management Gateway and Cisco VPN.

F. Current Infrastructure (Limitations, Restrictions)

G. Usage/Audience Information: This engagement will be for a test group of 250 users.

RFQ 2015-04 SOW Public Key Infrastructure Page 8 of 9

3. Place/Period of Performance The services defined under this SOW will be performed at the AAFES HQ building located at 3911 S. Walton Walker Blvd.

Dallas TX 75236.

The supplier must complete the scope of this RFQ within three (3) months from the kick off meeting.

4. Project Scope - Requirements

The Exchange expects solutions that have been successfully implemented for numerous commercial customers. The Exchange is not interested in a research and development effort or beta testing effort for this solution.

A. What is in Scope: All systems required to enable smart card authentication and the conversion of our existing Single Sign On (SSO) enabled systems to smart card authentication. The required hardware and software to enable smart card authentication to a test group of 250 users.

B. What is out of Scope: Enterprise (organization wide) deployment.

C. Service Level Requirements: The PKI environment must be designed to provide fail-over to our Disaster

Recovery site.

Mean-Time-Between-Failure Requirements: None.

Data Access/Retrieval Requirements: N/A.

Additional Warranties

5. Acceptance Procedures The AAFES will have ten (10) business days to accept or reject deliverables. In the event of a rejection of any deliverable, the AAFES will provide in writing an explanation as to why the deliverable is being rejected. The supplier will have five

(5) business days to correct the rejected deliverable and resubmit the deliverable for acceptance. The deliverable is considered completed upon receipt of written acceptance by the AAFES. If no approval is provided by the AAFES within the acceptance period the deliverable is to be escalated to the sponsoring AAFES Vice President. If no response is received after that then the deliverable will be considered accepted and complete.

6. Project Change Control A project change request will be the only vehicle used for communicating change to this SOW. The change request (CR) must describe the change, the cost impact, the rationale for the change, and the effect the change will have on the project schedule. AAFES will initiate CR's to the supplier.

RFQ 2015-04 SOW Public Key Infrastructure Page 9 of 9

7. RFQ/SOW Cost Proposal The supplier is required to submit a Firm Fixed Price (FFP) to deliver the requirement set forth in this RFQ. The supplier must list the milestone(s), deliverable(s) and the payment percentage for each deliverable. The supplier is required to provide a detailed breakout of proposed resources listing them by resource type and role. Any travel costs must be included within the FFP proposal.

A sample cost proposal is as follows:

Phase Cost % of Total

Discovery $ %

Assessment $ %

Recommendation $ %

TOTAL COST $ 100%

///////////////////////////////////////////////last item\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

RFQ 2015-04 SOW Public Key Infrastructure Page 10 of 9

RFQ 2015-04 for the

Cost Proposal

Phase Cost % of Total Cost

Discovery $

Design $

Implementation $

30 Day Post Production Support

$0 0%

Total FFP Cost $ $