Revised_11-01-19_SOURCES_SOUGHT.pdf

SOURCES SOUGHT

SOLICITATION NUMBER: 29FTC120B0001

MODERNIZATION OF FTC PRINTER AND MULTI-FUNCTIONAL DEVICE FLEET

Posted Date: October 28, 2019

Response Date: November 12, 2019 (15 days after posting date)

Archive Date: November 27, 2019 (15 days after response date)

Set Aside: N/A

Classification Code:

NAICS Code: 541519

PSC: 7030

Synopsis:

SOURCES SOUGHT/REQUEST FOR INFORMATION

The Federal Trade Commission (FTC), Office of the Chief Information Officer (OCIO) is currently conducting market research seeking capabilities statements from potential sources, including small businesses (SB), 8(a), HUBZone, Economically Disadvantaged Woman-Owned (WOSB), Service Disabled Veteran Owned (SDVOSB) small business that are capable of providing the requirement as described below.

The purpose of this request is to determine available sources with expertise in providing a modernized fleet of printers and multi-functional devices and managed print services to the Federal Trade Commission (FTC) headquarters and Constitutional Center offices in Washington, D.C., as well as eight (8) regional offices.

The goals are as follows:

1. Increased customer satisfaction and productivity through the deployment of new printing devices with improved performance and reliability.

2. Greater efficiency through optimized device distribution and reporting and analytics on usage, performance, status, and costs of individual devices.

3. Centralized management, maintenance, security, and monitoring of all networked printing devices and printing infrastructure

4. Decommission of stand-alone fax machines and associated analog lines

5. Improved security and privacy of FTC data and information through capabilities such as centralized policy management, secure pull printing, and watermarking

6. Maximize the use of industry available print technology and monitoring tools while minimizing the FTC’s overall on-premise infrastructure footprint

I. BACKGROUND

The Federal Trade Commission (FTC) is seeking a vendor to provide a fully managed and modernized printing fleet. The Contractor will support the FTC’s mission through the provision, management, and maintenance of printers and multi-functional devices (MFDs) as well as related infrastructure, security and productivity tools. The FTC seeks a knowledgeable Contractor that can provide innovative ideas and methods for modernizing the FTC’s printing devices, infrastructure, and security while improving customer satisfaction and eliminating unnecessary and duplicative devices.

The FTC is an independent federal government law enforcement and regulatory agency with the authority to promote and protect consumers’ welfare through its jurisdiction over both consumer protection and competition issues. The FTC deals with issues that touch the economic life of every American, and is the only federal agency with both consumer protection and competition jurisdiction in broad sectors of the economy. The FTC pursues vigorous and effective law enforcement; advances consumers’ interests by sharing its expertise with federal and state legislatures and U.S. and international government agencies; develops policy and research tools through hearings, workshops, and conferences; and creates practical and plain-language educational programs for consumers and businesses in a global marketplace with constantly changing technologies.

• Mission: Protecting consumers and competition by preventing anticompetitive, deceptive, and unfair business practices through law enforcement, advocacy, and education without unduly burdening legitimate business activity.

• Vision: A vibrant economy characterized by vigorous competition and consumer access to accurate information

The Office of the Chief Information Officer (OCIO) is the organizational unit within the agency that designs, implements, and manages the technical infrastructure, business applications, office productivity tools and systems, and information assurance activities. In support of FTC’s mission, the OCIO has embarked on a multi-year effort to modernize IT systems and services in order to improve performance, reliability, and innovation. An area that requires substantial modernization is the agency’s printer and MFD fleet. The agency’s current fleet consists of devices that range in age from five to 10 years old, with the average age close to seven years (more information on the current inventory is provided in Appendix A). Customers are increasingly frustrated with the current printer fleet, which detracts from overall productivity due to frequent performance failures. In support of the FTC’s mission, the OCIO seeks to improve office productivity through the deployment of new devices, along with increased maintenance and support and improved back-end technology that allows proactive monitoring of devices and facilitates innovation and streamlined business practices.

II. PERFORMANCE WORK STATEMENT

1. The Contractor will design and deploy, upon approval of the FTC, an enterprise printer fleet and management solution that promotes and achieves the Objectives in Section 5 and includes the leasing of printing and multi-functional devices. The FTC encourages the Contractor to offer cloud-based or externally hosted solutions where feasible. These services must include:

• Assessment of the current environment, with the ultimate objective of delivery, deployment and installation of new printers and multi-functional devices. The final deliverable should include recommendations for deployment and distribution based on usage and customer requirements.

• Installation, configuration, and testing of new printers and MFDs. Delivery and installation of new devices will not be permitted until the completion and approval of the Print Assessment and Integrated Project Plan (detailed in Section 8 – Contract Deliverables)

• Installation, configuration and testing of any system components necessary to provide a complete solution and meet the FTC’s requirements.

• Training for FTC help desk and system administrators and training materials for FTC end users

2. The Contractor shall provide ongoing maintenance and management of leased devices. The Contractor shall provide consumables (except paper), parts, and labor as detailed below:

• Consumables includes toner, staples, drums, maintenance kits and other consumable parts necessary to keep devices operable. FTC will accept TAA-compliant compatible or remanufactured consumables.

• Parts includes fuser units, transfer kits, waste toner bottles, rollers, paper guides and trays, and all other parts necessary to keep devices operable

• Labor includes delivery, installation, and disposal of consumables and parts, as well as preventive maintenance and general repairs and break/fix, decommission, and disposal of devices as needed

a. The Contractor will provide technical support for any components of the solution installed in FTC’s environment. The Contractor must provide capable and knowledgeable technical resources to assist FTC engineers in the maintenance and administration of any tools installed and ensure that the applications and tools are updated at no less than n-1 (where, “n” is the current commercial standard major version of the application) at any point in the contract term. The Contractor will also work closely with the FTC’s infrastructure service provider to remediate any security, integration, or performance issues related to the application or tools.

b. The Contractor will support the FTC’s security and privacy assurance activities, such as development of authorization documents, security plans, contingency plans, and privacy impact assessments.

c. The Contractor will continuously assess and analyze the FTC’s printing needs and make recommendations for continuous improvements, potential areas for cost savings, innovation and integration with FTC information systems, and lifecycle replacement of aging or obsolete devices and components. The Contractor shall document these recommendations and provide them to FTC no less than once annually.

d. The Contractor will support the orderly transition to a new service provider upon the end of the period of performance. This includes the decommission and disposal of all leased equipment and the destruction of removable media in accordance with best practice and in a method agreed upon between FTC and the Contractor.

III. CONSTRAINTS

All new devices must be installed and in working order for customer use no later than 90 days after exercise of leasing option.

a. Due to limited space availability at FTC locations, the Contractor must be able to deliver devices in multiple batches of limited quantities based on a delivery schedule established after award and approved by the COR. No devices will be delivered to an FTC location without prior approval of the COR. Upon request, the Contractor must also provide sample devices to conduct required acceptance and integration testing.

b. The solution and all devices must comply with the accessibility standards of Section 508 of the Rehabilitation Act of 1973, as amended, 29 U.S.C. 794(d), Access Board regulations, 36 CFR parts 1193 and 1994, and related guidance.

c. All devices must be “factory produced new models”. The FTC will not accept “newly manufactured” or “remanufactured” devices.

d. All devices must comply with Executive Order 13873, Securing the Information and Communications Technology and Services Supply Chain, which prohibits Federal agencies from purchasing products manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries.

e. All devices and tools installed on the FTC’s network must comply with the Technical Specifications and Requirements detailed in Section 10 of the PWS.

f. All devices provided under this task order must meet Federal energy-efficiency regulations and all devices must be ENERGY STAR certified.

g. For any components of the solution that process or store FTC data or metadata outside of the FTC’s security boundary, the Contractor must assure compliance with a subset of NIST 800-53 controls deemed by FTC as mandatory. These mandatory minimum controls are listed in Section 11 of this PWS. The Contractor shall demonstrate compliance with these controls through either (A) a FedRAMP authorization, minimum LOW impact level; or (B) an independent audit and assessment of those security controls through a third party auditor using the SOC2 audit methodology. The Contractor must provide evidence of a FedRAMP authorization OR SOC2 audit no later than 90 days after contract award. FTC will not authorize the transmission of FTC data or metadata outside of the FTC’s security perimeter (example: transmitted through ports 443 or 80) without demonstrated compliance with said controls.

h. The Contractor’s system, including contractor personnel, must adhere to the provisions of the Privacy Act of 1974, 5 U.S.C. 552a, including agency rules and regulations for the handling and protection of Personally Identifiable Information (PII), and relevant privacy and security provisions of the Federal Acquisition Regulation (FAR), including, but not limited to, initial and annual privacy training. See FAR 52.224-3 (privacy training); FAR 52.224-1 & -2 (Privacy Act);

see also FAR 52.239-1 (privacy or security safeguards) & 52.204-21 (basic safeguarding of covered contractor systems).

IV. TECHNICAL SPECIFICATIONS AND REQUIREMENTS

Due to technical limitations of FTC’s current infrastructure, any component of the solution that hosted within the FTC’s Production environment must be compatible with FTC’s standard hosting configurations:

• Server Installations:

o Applications must be installed on virtual machines using VMWare ESX virtualization.

o Must be compatible with Microsoft .NET Framework 4.5 or higher o Must be compatible with current versions of Microsoft Windows Server 2016 with CIS Level 1 compliance benchmarks o Any external database requirement must be compatible with current versions of Microsoft SQL Server 2012 and 2016 o SAML 2.0 authentication for any console/portal access to integrate with FTC’s Single-Sign-On (SSO) provider for admin access (OKTA) o Must support SNMP v3 and TLS 1.1 and 1.2

• Desktop Client Installations:

o Supported browsers: Google Chrome; Internet Explorer; Microsoft Edge o Operating Systems: Microsoft Windows 7 and 10 with CIS Level 1 compliance benchmarks o Compatible with Microsoft Office suite of applications; allow data exports to CSV or Microsoft Excel formats o Compatible with Citrix XenDesktop as a virtual desktop infrastructure (VDI) platform

All devices must meet the following technical and security requirements, regardless of form factor:

• Ability to allow printing from iOS mobile devices, Citrix XenDesktop VDI, and Microsoft Office365

• Windows 7 (all 32-bit and 64-bit editions); Windows 10 (all 32-bit and 64-bit editions)

• All devices must support SNMPv3

• 802.1x standard for port-based network authentication with network access control (NAC) enabled ports

• Kerberos authentication with the ability to use to LDAP authentication with Active Directory and/or PIV/CAC card authentication (exception: AD and/or PIV/CAC card authentication are not required for the devices intended for the FTC’s Copy Center/production devices).

• Each device must come equipped with a security kit that enables hard drive overwrite and encryption (validated to FIPS 140-2)

• Scanning units shall be able to create TIFF, MULTI-TIFF, JPEG and PDF formats;

should support Scan to Email, Scan to FTP, and Scan to Network

• Each device must allow removal of hard drives and other media to be wiped or destroyed before equipment is returned or decommissioned

• Support both PCL and PostScript printing

V. MANDATORY MINIMUM CONTROLS

In order to streamline the deployment of external services with minimal impact on FTC’s information assurance resources, the FTC has chosen a subset of 22 NIST 800-53 Rev 4 security controls that are mandatory for all external service providers. For any component of a system that stores or processes FTC data beyond the FTC’s security perimeter, the FTC requires either

(A) a FedRAMP authorization at the minimum LOW impact level or (2) attestation from a third party auditor, using a compliance auditing procedure such as a SOC 2 Type 2, that demonstrates that the service provider effectively implements the following minimum controls as stated in NIST 800-53 Rev 4:

AC-2 Account Management AC-3 Access Enforcement AC-6 Least Privilege AU-2 Audit Events AU-6 Audit Review, Analysis, and Reporting CA-8 Penetration Testing CM-2 Baseline Configuration CM-3 Configuration Change Control CM-6 Configuration Settings CM-8 Information System Component Inventory IA-2 Identification and Authentication

(Organizational Users) IA-2(1) Network Access to Privileged Accounts IA-2(2) Network Access to Non-Privileged Accounts IA-2(12) Identification and Authentication Acceptance of PIV Credentials PL-8 Information Security Architecture RA-5 Vulnerability Scanning SA-22 Unsupported System Components SC-7 Boundary Protection SC-13 Cryptographic Protection/ FIPS Validated

Cryptography SC-28(1) Protection of Info at Rest/ Cryptographic

Protection Applicable to systems with Personally Identifiable Information or Sensitive Data

SI-2 Flaw Remediation SI-4 Information System Monitoring

VI. SUBMISSION OF CAPABILITY STATEMENTS

Responders to this Sources Sought Notice shall provide a Capability Statement setting forth its expertise in providing the equipment and services in accordance with the performance work statement, constraints, technical specifications and requirements, as well as federal and FTC statutory policies and regulations . The capability statement shall have a cover page for each responder with the following information:

1. COVER PAGE:

a. Name of Business

b. Tax Identification Number

c. DUNS

d. Business Status

e. Address

f. Point of Contact:

Name

Address

Telephone Number

Fax Number

E-mail Address

2. FORMAT: No more than twelve (12) 8 ½ x 11 pages, single-spaced, type size 12 points, 1” inch margins.

3. CONTENTS: Discussion of qualifications and expertise for performance of the work shall address responders qualification and experience to meet the government requirements within system specifications and mandatory policies and regulations.

Responders are encouraged to indicate their GSA Schedule contracts or other GWACs under which this requirement can be performed.

4. SUBMISSION: Capability Statements shall be submitted no later than 2:00 p.m. on Tuesday, November 12, 2019 to Beverly Johnson, Senior Contract Specialist, at bjohnson4@ftc.gov.

mailto:bjohnson4@ftc.gov

5. OBLIGATION OF THE GOVERNMENT: This Sources Sought Notice does not in any way obligate the government to provide follow up with responders to this notice and/or obligate the government to procure the services set forth in this notice. Any costs incurred by responders to this request will be the responsibility of the responders.