QA IT Managed Services 2252022 Final.docx

Office of Inspector General Legal Services Corporation

3333 K Street, NW, 3rd Floor Washington, DC 20007-3558

202.295.1660 (p) www.oig.lsc.gov 2/25/2022

IT Managed Services RFP Questions and Answers

1. Who is the vendor of the 6 on-premises switches? The current vendors are Cisco and Linksys.

2. Who is the vendor of the firewall? The current vendor is Fortinet.

3. The RFP mentions virus, spam, and malware protection. In the RACI, it is listed as an OIG IT responsibility. Who is the vendor of the solution? The current vendor is Trend Micro.

4. What security/compliance frameworks does the OIG follow at the OS level? (For example, CIS Benchmarks, DISA STIGS, etc.) Currently there is no formal framework as the LSC-OIG has traditionally adhered to many of the NIST standards. The LSC-OIG is seeking to implement the appropriate IT controls and compliances as the assessments described in the RFP are completed.

5. Does the OIG cloud infrastructure follow FedRAMP guidelines? The cloud infrastructure does not follow FedRAMP guidelines. The Legal Services Corporation is a District of Columbia 503.c non-profit, and the OIG is not on a federal government computing platform.

6. What is the current patching solution (WSUS, SCCM, etc.)? The current solution is the Windows Server Update Services.

7. Is there a system monitoring solution in place, or can the IT contractor propose/implement their own solution? Currently, there is not a system monitoring solution in place and the OIG will be seeking proposed implementation of a monitoring solution for review/approval once the assessments are completed.

8. Who is responsible for vulnerability and compliance scanning? The scanning responsibility is currently designated to the LSC-OIG Senior Information Technology Cybersecurity Specialist.

9. Who is the incumbent contractor? ECS Federal.

10. Please mention exact names and count of existing Microsoft Licenses you are currently using. 30 Microsoft 365 Audio Conferencing, 36 Microsoft 365 E3, 15 Microsoft Visio, 31 Enterprise Mobility + Security, 6 Microsoft Server Standard 2012 r2 , 1 Microsoft 2016 SQL Standard, 1 Microsoft SQL Standard 2017, 5 Microsoft Server 2016 Standard.

11. What are the Total Number of users who need Managed Services? 50, as mentioned in current environment of the company, or 30 as mentioned in Appendix B point no. 5? The current technical environment refers to the 50 licensed user email accounts combined with shared mailboxes. The LSC-OIG currently has approximately 30 users.

12. As Communication Square operates remotely, can you tell how often do you need on-site visits? Not frequently. There could be the occasional need for onsite visits when new server and network equipment is being put into production and old equipment removed.

13. What company is currently providing these services? And how long has the current Company been serving the OIG LSC? The current vendor is ECS Federal. They have been serving the OIG for 6 years. The current vendor has announced they do not plan to send a proposal in response to this RFP.

14. How much did the OIG LSC pay for the Services for the last two (2) years? The last 2 contract years the OIG paid $141,000 and $150,000.

15. Is the current Company’s office serving the OIG LSC located in the city where the OIG LSC resides? Yes. ECS has several offices in the DC metro area.

16. How many individuals, by labor category, are currently supporting this contract by the incumbent? Of those individuals, how many are onsite (customer facility) and how many are offsite at the contractor facility? Roles and individuals supporting: Project Manager (1), Technical writer (1), Systems Engineer (2), Cyber Security Analyst (1), Service Coordinator (served by the project manager), O365 Software Engineer (1), Software Engineer (1), Graphics Designer (1).

No contractors regularly work onsite at the OIG’s offices.

17. Are the current Services the same as those described in the RFP? Yes, however we have dropped website support and 508 document compliance support in this RFP.

18. What ITSM system does the OIG LSC use? Does the OIG LSC plan to keep using that system? The OIG will use the ITSM of the vendor.

19. What are the key elements or aspects of the Services provided currently would the OIG LSC like to improve upon in the future? Timely helpdesk support and IT security and disaster recovery policy creation.

20. What is the annual budget for this RFP? $150,000.

21. What was last year’s spending? $150,000.

22. What is the annual overall IT budget? The overall OIG IT budget including OIG IT personnel, equipment, software licenses and is approximately $750,000. Of that the annual OIG budget on IT consultants is $425,000.

23. What tasks are we doing vs your OIG IT Dept (“Best Efforts” are referenced)? See Appendix C LSC OIG IT Roles and Responsibility Matrix. Contractor will perform “R” tasks and may perform “C” tasks as requested.

24. Ticketing platform – outside of helpdesk and we use Zendesk.. What should our ticketing system do specifically? The system should be able to notify the LSC-OIG Cybersecurity/IT Specialist combined with contractor when a ticket has been created and responses and resolutions. Workflows should be customized based on priority of request certain tickets should be able to have direct escalation to the next level support group. The system will be used as a direct integration to support the LSC-OIG IT Department. The system should be able to produce daily, monthly, and yearly reports on tickets and resolution status. . In short, the system should capture, track, respond, resolve, close, and report on all requests for technical support and assistance.

25. M365 – are we hosting or are we just managing? It will only require to be managed.

26. 50 user Email Accounts are we just managing? It will only require to be managed.

27. Are we hosting external website or maintaining it? The LSC-OIG hosts and maintains its current website with plans for changes in the future.

28. Does OIG staff currently have a Service Desk? Currently, the LSC-OIG staff does have a service desk being provided by the current IT contractor.

29. Does OIG have a ticketing system, if so what system? The LSC-OIG does not have its own ticketing system, the system ServiceNow is being provided by the current contractor.

30. If OIG does not currently have a ticketing system, does it require an ATO? The LSC-OIG does not require a ATO due to agency staff size but will require possible customized workflows and notifications in the ticketing system the contractor is providing.

31. Does the ticketing system have to be in a government domain, or can it be in the public domain? The ticketing system does not have to be on a government domain.

32. Are all OIG users currently remote? Yes, but we anticipate the majority of users returning to the office 2 or more days a week in the spring.

33. Are OIG staff users within a 50-mile radius of 3333 K St, NW Washington, D.C. 20007? No. The OIG has a handful of staff who live more than 50 miles outside DC.

34. Can all meetings with the project manager be remote? We anticipate that the vast majority of project management activities can be conducted remotely, but occasionally we may need to meet in person.

35. Is OIG staff intention to order all 1000 hours at once or in iterations based on needs? The OIG plans to order hours in iterations as needs arise.

36. Do contractors require a special clearance to enter the facility? Contractors will need to be authorized to check in at the building at a designated area. Certain IT areas are always restricted and require key card access and an LSC-OIG IT personnel present.

37. Do Network/System administrators require a clearance? They do not

38. What is the current backup solution in place? The current backup solution is Cloudberry Backup by MSP360.

39. Is OIG staff using any cloud solutions? Currently the LSC-OIG utilizes Microsoft Azure and Amazon Web Services.

40. Does OIG staff have a preferable cloud vendor? The preferable would-be Microsoft.

41. Are you willing to use our Device Management agent for System troubleshooting, performance tuning and monitoring services/prevention? After the initial assessment, any recommendations would be considered and reviewed for appropriate approval.

42. Can you provide equipment make, model and operating systems (where applicable) for the following? Currently we are only providing limited equipment information to provide some security to the LSC-OIG IT Infrastructure.

43. What servers are running Linux and what version of Linux is it? CentOS.

44. For the capped time and materials project - Would our Device Management services on a per node pricing basis be acceptable? We would have to look at the proposal and see if the proposed worked within our capped contract.

45. The RFP mentions providing Microsoft 365 (including intranet) support. Please clarify what is meant by “intranet.” If referring to SharePoint, to what extent has it been customized? The LSC-OIG SharePoint has been moderately tailored with a large amount of information being used by the staff.

46. Please provide greater details on what “In house application support services” means and what applications are specifically being referred to. The LSC-OIG has certain customized applications that may require backend support such as updating or upgrading operating systems or patching security vulnerabilities on the servers they are hosted on.

47. In Section C Staff Qualifications “Subsequent substitution of personnel must be approved by the OIG.” Does this requirement apply to this requirement applies to help desk staff, or other support staff that may not be specifically assigned to OIG? Yes, all contracting staff to work with the LSC-OIG IT systems must be approved.

48. Please provide the minimum number of past performances required as per Section 8. Point (B) References and Section 9 point (B) of RFP? One project 3 POC references or three projects with 3 references for each of them? A total of 3 past performance examples are required, 1 for each project referenced.

49. The RFP Section 9-point B.(i) states relevant experience and point (iii) states Past performance on other contracts via references. Are offerors need to submit different projects for each of these points or else should provide one project under relevant experience and give 3 POC references for that project? The offeror should submit references for 3 different projects. Each project should relate as closely to the current project as the offeror can provide.

50. Historical labor categories of the project? $150,000 per year is the annual budget for these services. We would like firms to competitively bid under that budget at market rates and not based on historical labor rates.

51. What is the incumbent contract value? See number 14.

52. Did the existing IT Management Service Provider (ECS Federal) submit a response to a RFP for current contract? Yes. They did in 2015 under the company InfoReliance. InfoReliance was purchased by ECS in 2018. They will not do so for 2022.

· If so, where (please provide direct link and/or a copy of award) are the results (award to the original bid not available on cities website? Results are not publicly available as the OIG is not subject to the FAR and our information is not tracked on spend.gov or other similar websites.

· If not, please describe the process ECS Federal completed to get the original approved contract. The contractor won the active procurement evaluation in 2015 with 8 proposals and 2018 among 3 competing firms. Top competitors are also interviewed. The evaluation team scores the technical and price proposals, and the Contract Officer makes the final selection considering the Team’s input including the COTR. The winner’s proposal is incorporated into the final services contract which is drafted by the OIG legal unit.

53. What percentage of this RFP did ECS Federal assist with in preparing? None.

54. Please tell me about your current experience with ECS Federal (i.e.: good / bad)? Not responding to any vendor specific questions.

55. What areas in this RFP that ECS Federal do you feel could use the most improvement? Not responding to any vendor specific questions.

56. Please tell me about any challenges that occurred with ECS Federal over the previous contract. Not responding to any vendor specific questions.

57. If you could change one thing with ECS Federal relationship, what would it be? Not responding to any vendor specific questions.

58. What are some of the roadblocks you have been facing with achieving goals in the past? Timely access to shared technical resources and elevated helpdesk tickets.

59. What has been ECS Federal’ approach to solving these problems so far? Not responding to any vendor specific questions.

60. What does a successful solution look like to you? Client satisfaction is based on responsive resources that help to plan the path forward and bring adequate technical and project management skills to support on-going and future OIG operations. To do such the firm needs to have an understanding of OIG operations and goals and continue to add value to the OIG.

61. What type(s) of data is the OIG using and/or creating on a daily basis? The OIG is a heavy email and Microsoft 365 (M365) user which focuses on the creation of written reports which include audit and investigative assessments and reviews. Team approaches also use resources in Teams and onsite management support systems.

62. Do any of OIG employees bring personal devices to work? BYOD are restricted in the LSC-OIG.

63. What security risks is the OIG most concerned about? Phishing, ransomware, and network intrusion.

64. Do you feel confident ECS Federal is equipped to handle all potentials issues and risks related to security? Not responding to any vendor specific questions.

65. Who is the OIG most important IT Vendor? Microsoft.

66. How do you or other important stakeholders with OIG find out when systems go down? System alerts and user feedback.

67. Has anyone higher up than yourself ever called you to let you know systems were down? Yes.

68. Tell me about your last Disaster Recovery test? Individual Backup testing on systems has occurred, but a formal DR test has not been initiated in alignment with the BC plan. The LSC-OIG is seeking assistance with reviewing and recommendations to the areas of BIA, BCP and DR.

69. Would you please share some of your performance dashboards? The LSC-OIG management does not use nor have deployed performance analytics.

70. How often do you apply security patches and updates? Patches and updates are preformed monthly or more frequently as the situational need arises.

71. What security tools are already in place? I.E., firewalls, endpoint protection, vulnerability management, email, identity access management, networking (routers, switches, access points), user behavior analytics, network threat analytics, security orchestration automation, response (SOAR), etc. Currently we are only providing limited information to provide some security to the LSC-OIG IT Infrastructure. More information will be provided to the successful vendor and possibly during the interviews. See #42.

72. Please tell me about OIG’s leadership team. Who supports IT? Who gripes about IT? Our IT team is made up of the Senior cyber security/IT specialist, his supervisor (the Assistant Inspector General for Management and Evaluation - AIGME), and a Senior Applications Developer. The team is supported by the IT managed services vendor, a software developer, and website developer.

73. When do you budget? How do you budget? Who approves OIG’s budget? The OIG budget is developed through a multiyear process by the AIGME and OIG unit heads. The budget is real takes shape over the summer before the coming fiscal year, which starts October 1st. The OIG receives it funding through the Legal Services Corporation appropriation from Congress via a separate OIG budget line item. The LSC Board of Directors adopts the Inspector General recommended request number. The OIG also maintains a contingency reserve and is not impacted by brief federal government shutdowns as a DC non-profit organization.

74. What was OIG budget for 2019 – 2020 Fiscal Year? $6,739,000 2020-2021 Fiscal Year? $6,978,000 2021-2002 Fiscal Year? $7,157,000 2022-2023 Fiscal Year? The OIG is operating under the Continuing Resolution, so the annual budget has not been set as of today. How much of those budgets were allocated to items on the RFP? Approximately 2%.

75. How much of the budget was/is allocated towards this RFP for past years and future years? Approximately $150,000 annually, but that can increase for any needed services that could fall under the scope of the contract arises.

76. What has ECS Federal advised you for your future IT Budget? Not responding to any vendor specific questions.

77. Did virtualization “pay off” for you? Yes, we run more systems and services than ever before under that same basic footprint.

78. Are you getting pressure from ECS Federal to do more in the cloud? Not responding to any vendor specific questions.

79. In your opinion, what is the single most important project IT is working on? Cybersecurity.

80. In your board’s opinion, what is the single most important project IT is working on? Cybersecurity.

81. Would you prefer to reach a person 24/7/365 when help desk is called? Of course, the OIG follows the federal holiday schedule and employees are encouraged to take their time off, so the hours described in the RFP are sufficient.

82. How many helpdesk tickets did ECS Federal have in each year of their contract last? 90 Day help desk ticket average is about 23 tickets a month.

83. How many helpdesk tickets did ECS Federal have in the past 6 months? See number 82.

84. How many helpdesk tickets did ECS Federal have in the past 3 months? See number 82.

85. How many calls occurred on average per month on weekends during the last year? None. The last 6 months? The last 3 months?

86. Please list the percentage of calls that were: NA

· Level 1 Service Desk?

· Level 2 Service Desk?

· Level 3 Service Desk?

87. Do you have an outlier application? No.

88. Do you have an escalation process? There is an informal escalation process.

89. How many dedicated remote Service Technicians does ECS Federal currently provide the OIG? Please see number 16.

90. Do you have a Standard Operation Procedure Manuals for your Service Desk? How many pages is it in printed format? No.

91. What is your currents helpdesk average response time? 4 hours.

92. When is the last time you revised your service level agreements? 4 years ago.

93. How many on-site hours did ESC Federal spend on-site last year? 6 months? 3 months? In the last year, 4 hours were spent on site.

94. Which tech vendor does the single best job of meeting your business needs? Microsoft.

95. What is the one priority that never seems to be addressed in the IT department? Updated and complete policies.

96. If you had to choose three applications that cannot go dark for the city, which ones would they be? Internet access and M365.

97. Would you please provide a list of all your applications or at least your digital graphic applications? See #10 and 61. There is no digital graphic application currently.

98. Does OIG have any custom applications requiring Devops? We contract that out separately.

99. What was your single biggest IT disappointment that you had this year? Why did you wind up disappointed? Status on written policies.

100. What is your single biggest IT cost that delivers the least value? NA.

101. Are you pushing ECS Federal on strategic improvements or is ECS Federal offering them to you? Not responding to any vendor specific questions.

102. How much does an hour of downtime cost the OIG? Approximately $2,200.

103. How many employees use cell phones to access network? All LSC-OIG members are issued cell phones integrated with a MDM to utilize MFA to LSC-OIG services.

104. Do you officially support BYOD devices on your network? No BYOD is restricted from the LSC-OIG network.

105. What steps are you taking to ensure those devices properly access your network? NA.

106. What projects are you not able to get to today? Are they revenue driving? NA.

107. Is your IT Team able to look around the corner or is the main focus on putting out fires? Some of both.

108. Does your current IT plan address your business strategic plan? (Growth, Customer Service, etc.) Yes.

109. Who is involved in your decision process for the IT Department? See #72.

110. How much turn-over occurred (if any) with each onsite staff member from ECS Federal? NA.

111. Would you please share your current user lifecycle control process? NA.

112. Do you currently have formal policies outlining the configuration of procedures? If so, would you please share? NA.

113. Does your current backup policy contain scope, backup configurations, including frequency/type/etc., recovery plan with time estimations for data restorations for non-emergency situations? The LSC-OIG is seeking assistance in formalizing the current backup strategy including assistance with its RTOs and RPOs for a complete DR plan. This work will take place under the contract.

114. Are your Backup systems immutable/protected from Ransomware? They are protected from Ransomware.

115. Do you have formal or informal process for system breach and incident reporting? Yes.

116. Does your Incident Report include contains basic information on who, what, when, where, why, and how events transpired or are about to take place that affects the PHI or ePHI? The first one.

117. Do you have an Information Technology Security (written) Policy? Currently the LSC-OIG has been creating written policies and is seeking assistance in reviewing and recommending with its documentation for a complete formal Security Policy.

118. Do you have an IT Infrastructure Protection Plan (written policy)? No.

119. When was you last security assessment performed? Currently we are only providing limited information to provide some security to the LSC-OIG IT Infrastructure. More information will be provided to the successful vendor and possibly during the interviews. We foresee undertaking a security assessment as part of the contract.

120. When was OIG’s most recent network assessment? See #119.

121. Would you please share any documentation that exists regarding the design of your infrastructure? Currently we are only providing limited information to provide some security to the LSC-OIG IT Infrastructure. More information will be provided to the successful vendor and possibly during the interviews.

122. Who is OIG’s Internet Service Provider? The OIG has two services providers – Comcast and 365 Data Centers.

123. How much Bandwidth does OIG’s ISP provide? The LSC-OIG currently has bandwidth of 200 mbps.

image1.png