6.5.25 Special Notice of Intent to Sole Source Transportation Management System Maximo Support Services.pdf

Special Notice of Intent to Sole Source

# NIHODSN060525

The National Institutes of Health (NIH) intends to award a contract to TOTAL RESOURCE MANAGEMENT, for Transportation Management System Maximo Support Services.

In accordance with FAR Part 6.302-1, the Contractor is the only known responsible source who can provide the required services per SOW below.

The NIH, Transportation Management Branch ( TMB) of the Division of Logistics Services (DLS) provides fleet and freight forwarding solutions to the NIH community.

This notice is not a request for competitive quotes. However, any party that believes it can provide the services as stated herein may submit a written capability statement that clearly supports and demonstrates their ability to satisfy the requirement. A determination by the Government to compete this proposed award based upon responses to this notice is solely within the discretion of the Government.

This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed. Information provided will be used to assess tradeoffs and alternatives available for the potential requirement and may lead to the development of a solicitation.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted.

Any solicitation resulting from the analysis of information obtained will be announced to the public on Sam.gov in accordance with the FAR Part 5. However, responses to this notice will not be considered adequate responses to a solicitation. No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

It is anticipated that an award will be issued approximately five (5) days after the date of this notice unless the Government determines that another organization has the capability to meet this requirement.

STATEMENT OF WORK

BACKGROUND

TMB conducts fleet management and freight forwarding operations for the NIH community.

TMB has been mandated by Executive Orders to utilize a transportation management system.

To manage and track its assets and services, TMB uses IBM’s Maximo asset management application, which is a web-based system accessible via NIH intranet. Maximo is hosted by NIH CIT Hosting and Storage Services.

REQUIREMENTS

Maximo Application Support

The Contractor shall use reasonable efforts to make the Maximo application and services available 24 hours a day and 7 days per week except for planned maintenance. Any planned maintenance shall be communicated with TMB and scheduled during non-business hours when possible. The Contractor shall work with CIT and TMB to restore service to normal levels following a major event or disaster and develop a communications channel for use during such an event.

The Contractor shall provide on-demand Maximo administration support Monday-Friday 8:00am-5:00pm EST via e-mail. TMB estimates that its users will require 20 hours of support per month for new features and troubleshooting issues. If fewer than 20 hours of support is required, the remaining hours shall be conserved for another month (not to exceed the Period of Performance). If more than 20 hours of support is required during a single month, the Contractor shall notify TMB.

The Contractor Project Manager shall provide the TMB Contracting Officer's Representative (COR) with a monthly report summarizing all support hours and activities.

Service Level Agreement

The Contractor shall meet or exceed the following Service Level Agreement (SLA):

Response Time Targeted Resolution Time

Critical Problems (Issues that prevent the use of the system)

1 hour 24 hours from point that the servers/VMs and O/S are available

Crucial Problems (Issues that curtail but do not prevent the use of the system)

2 hours 48 hours

Routine Problems (Issues that do not significant impair the use of the system)

Next business day

4 business days

Escalation Process

The Contractor shall have an established escalation process in place for NIH users requiring support or experiencing system issues.

Software License Annual Subscription and Support

The Contractor shall provide the following software licenses annually plus any additional licenses that are necessary by TMB or the Contractor:

• (Qty x43) IBM Maximo Application Suite per AppPoint from Eligible Programs Trade Up

License + SW Subscription & Support 12 Months

• (Qty x1) TRM RulesManager SE for MAXIMO (Enterprise) Annual Customer Support

Program (ACSP), 9-licenses.

Monitoring

The Offeror shall include a plan and costs for their Maximo monitoring system(s) (e.g. IBM Tivoli Monitoring, TRM RulesManager, etc.).

Patch and Upgrade Services

The Contractor shall patch and upgrade Maximo as necessary to ensure compliance with NIH CIT policies. The Contractor shall work with NIH Center for Information Technology (CIT) personnel and TMB personnel to communicate requirements during any upgrades and troubleshoot any issues directly with CIT or IT.

The Contractor shall ready environments for automated NIH CIT server patching on the 3rd (non-production) and 4th Friday (production) of each month. If required, the Contractor shall test Maximo to assure there is no adverse impact from any network or reconfiguration changes made by CIT.

Security Vulnerability Reports

The CIT Hosting and Storage Services Security Team regularly performs Maximo system scans and sends notification e-mails to the project listserv when security vulnerabilities are detected. TMB will ensure that the Maximo Developers are added to this listserv upon contract award. The Contractor shall patch any application-related software within the specified timeframes in the notification e-mail and notify TMB upon completion.

In cases where the Contractor cannot address the vulnerability during the specified timeframe, they must notify TMB as soon as possible and provide a business justification. To assist TMB in the submission of the waiver, the Contractor shall identify compensating controls and provide written justification from the vendor(s) specifying their awareness of the security risk associated with their software/hardware. The TMB COR will submit the waiver request on the NIH Incident Response Team (IRT) Portal.

Submitting NIH Tickets

CIT Application Service Request System

The Maximo Developers shall submit all requests for services and resources (such as hosting services, capacity or configuration changes, account administration database changes, contingency planning tests, testing of backups, and incident response tests etc.) and report problems via the ASR ServiceNow System at https://myitsm.nih.gov/sp , keeping TMB informed as necessary. TMB will request ASR accounts for Contractor personnel upon https://irtportal.ocio.nih.gov/index.jsp https://myitsm.nih.gov/sp contract award. It is the Contractor personnel’s responsibility to submit, monitor, and follow up with their own CIT ASR tickets.

IT Service Desk

Upon experiencing any NIH account issues, Contractor personnel shall notify TMB, submit an NIH IT Service Desk Ticket at https://myitsm.nih.gov/sp (866-319-4357), and keep TMB informed as necessary. It is the Contractor personnel’s responsibility to submit, monitor, and follow up with their own IT helpdesk tickets.

Personnel Requirements

The Contractor shall provide three employees for contract performance: a Project Manager, a main Maximo Developer, and a backup Maximo Developer to allow for 100% coverage.

Contractor employees shall be supervised by Maximo management personnel. The Contractor’s management shall ensure that employees properly comply with the performance standards outlined in this Statement of Work. Contractor employees shall perform independent of and without the supervision of any Government official.

Account Access

The main and backup Maximo Developers are required to maintain active NIH accounts. The Project Manager is not required to obtain an NIH account unless specifically requested by the Contractor. If the Contractor requests an NIH account for the Project Manager, then the Project Manager must maintain an active status throughout the Period of Performance.

Information on the badging and fingerprinting process can be found on the Division of Personnel Security and Access Control (DPSAC) website at https://ors.od.nih.gov/ser/dpsac/pages/home.aspx . Contractor personnel shall be responsible for keeping their NIH accounts active and compliant with all NIH policies. This includes but is not limited to: completing mandatory training courses; resetting PINs;

resetting passwords; and renewing certificates. NIH regularly sends out notification emails regarding these, so the Contractor personnel is responsible for completing these tasks when notified.

The main Maximo Developer shall maintain an active Secondary (AA) Account approved by the NIH OD Information Systems Security Officer (ISSO).

E-Mail Communication

Most IT-related e-mails and automated notifications from the NIH are sent to NIH e-mail addresses only and not secondary or contractor company e-mail addresses that may be on file. Therefore, Contract personnel are expected to monitor their NIH inbox for important e-mails, including mandatory training reminders, password expirations, and other account-related issues. The Maximo Developers shall make a reasonable effort to use their official Government e-mail addresses when communicating with the NIH, especially the NIH security and IT departments, regarding contract work.

Mandatory Training

Contractor personnel shall successfully complete all NIH mandatory training courses by the deadlines provided and e-mail their course completion dates to TMB. The NIH regularly http://itservicedesk.nih.gov/support/ https://myitsm.nih.gov/sp https://www.ors.od.nih.gov/ser/dpsac/pages/home.aspx https://www.ors.od.nih.gov/ser/dpsac/pages/home.aspx https://ors.od.nih.gov/ser/dpsac/pages/home.aspx sends NIH-wide email notifications regarding recurring mandatory training courses and their respective deadlines. A list of mandatory training courses can also be found on the NIH Information Security and Information Management Training portal at https://irtsectraining.nih.gov/nih.aspx .

Password Resets

Contractor personnel must change their NIH password according to the NIH Account Lifecycle and Password Policy to keep their account active. The current policy requires that passwords are changed at least every 120 days. Users will receive an automatic notification reminder from NIH PassExp 14 days prior to password expiration. Users can perform their own password resets by visiting the Self-Service Password Management Portal or at https://www.cit.nih.gov/contact-us .

CONTRACT TYPE

This is a Sole Source Time and Materials contract due to the variability of activities to be performed. There may be instances where there the NIH CIT team updates its cybersecurity policy requirements or discovers system vulnerabilities on our servers that require additional hours or new Maximo versions.

PERIOD OF PERFORMANCE

The Government anticipates the Period of Performance for this contract is anticipated to be for 12 months.

PLACE OF PERFORMANCE

Work will be primarily performed remotely from the Contractor site. The Contractor will be required to travel to the NIH main campus for personnel security actions, such as badge renewal and fingerprinting. Additional information regarding badge issuance can be found on the NIH Division of Personnel Security and Access Control website at https://ors.od.nih.gov/ser/dpsac/applicants-employees/DPSAC-process-overview/Pages/default.aspx .

OPERATIONAL HOURS

Operational hours for on-demand application support are Monday-Friday 8:00am-5:00pm EST.

In instances of NIH IT system outages, resets, recoveries, patch upgrades, or testing, contract performance may be necessary outside of regular business hours.

https://irtsectraining.nih.gov/ https://irtsectraining.nih.gov/ https://irtsectraining.nih.gov/nih.aspx https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIHAccountLifecycleandPasswordPolicy.pdf https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIHAccountLifecycleandPasswordPolicy.pdf mailto:PasswordAgeReminder@mail.nih.gov https://iforgotmypassword.nih.gov/ https://www.cit.nih.gov/contact-us https://ors.od.nih.gov/ser/dpsac/applicants-employees/DPSAC-process-overview/Pages/default.aspx https://ors.od.nih.gov/ser/dpsac/applicants-employees/DPSAC-process-overview/Pages/default.aspx https://ors.od.nih.gov/ser/dpsac/applicants-employees/DPSAC-process-overview/Pages/default.aspx

SAFETY ISSUES

Work shall be primarily performed remotely from the Contractor site in their own office setting.

There are no known safety issues.

SECURITY

Background Checks

The Contractor shall provide staff that have passed, or are capable of passing, a Federal background check. This position is unclassified in nature.

Confidentiality and Nondisclosure of Information

Any information provided to the Contractor (and/or any subcontractor) by the Government or collected by the contractor on behalf of the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any Government records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

Cybersecurity

Upon contract award and account creation, Contractor personnel shall agree to and follow all guidelines listed in the NIH Secure Remote Computing User Certification Agreement at https://irtsectraining.nih.gov/SRC/SRC_99_Agreement.aspx .

As an HHS Operating Division, the NIH adheres to the HHS Cybersecurity Program Policy at https://intranet.hhs.gov/working-at-hhs/cybersecurity/policies-standards-memoranda-guides. As a federal agency, all HHS/NIH staff are also obligated to follow the National Institute of Standards and Technology (NIST) standards and guidance at https://csrc.nist.gov/ .

Personal Identifiable Information

There work performed under this contract does not require the Contractor to handle any Personal Identifiable Information (PII). Therefore, there are no PII security concerns.

Privacy

NIH systems are provided for Government-authorized use only. Unauthorized or improper use of Government systems are prohibited and may result in disciplinary action and/or civil and criminal penalties. At any time, and for any lawful Government purpose, the Government may monitor, record, and audit system usage and/or intercept, search, and seize any communication or data transiting or stored on Government systems. Therefore, there is no reasonable expectation of privacy. Any communication or data transiting or stored on Government systems may be disclosed or used for any lawful Government purpose.

https://irtsectraining.nih.gov/SRC/SRC_99_Agreement.aspx https://irtsectraining.nih.gov/SRC/SRC_99_Agreement.aspx https://intranet.hhs.gov/technical-support/cybersecurity/policies-standards-memoranda-guides https://intranet.hhs.gov/working-at-hhs/cybersecurity/policies-standards-memoranda-guides https://intranet.hhs.gov/working-at-hhs/cybersecurity/policies-standards-memoranda-guides https://csrc.nist.gov/ https://csrc.nist.gov/ https://csrc.nist.gov/

GOVERNMENT FURNISHED EQUIPMENT

Government Furnished Equipment (GFE) will be provided to the Contractor in accordance with NIH Manual Chapter 26101-25-2-03 – Personal Property Management Guide (PPMG) - Manage Phase. Contractor personnel shall use the GFE laptops provided to access NIH IT systems, applications, networks, and data. In accordance with NIH Manual Chapter 2814, NIH Policy on the Prohibited Use of Non-Government Furnished (Non-GFE) IT Equipment, Government furnished IT equipment must be used to perform official duties or connect to NIH IT resources (excluding NIH public websites and other public use systems). Personally-owned IT equipment (e.g., flash drives, external hard drives, mobile devices) shall not be physically connected to government furnished equipment.

The Contractor shall be required to obtain a NIH Property Pass to utilize the GFE laptops outside of NIH facilities. In accordance with NIH Manual Chapter 26101-42-F – Shipping Policies and Procedures, the IC Property Accountable Officer or Property Custodial Officer will coordinate and document the shipment of all GFE associated with this contract. The Contractor shall be responsible for the security of all GFE issued to them and shall be held financially liable for any loss, damage, or destruction of the property while in their possession. All GFE shall be turned in to TMB by the end of the contract Period of Performance.

The Government will provide all servers as deemed necessary by the Contractor.

End.

https://policymanual.nih.gov/26101-25-2-03 https://policymanual.nih.gov/26101-25-2-03 https://policymanual.nih.gov/2814 https://policymanual.nih.gov/2814 https://policymanual.nih.gov/26101-42-F https://policymanual.nih.gov/26101-42-F