PWS_FEMA_RIII_Multifuction_Device_RFI.pdf

FEMA Region III

RFI 70FBR318RFI00000001

Multifunction Device PWS

PERFORMANCE WORK STATMENT

Multifunction Device Contract – Long Term Lease

I. Background

This Performance Work Statement (PWS) defines the requirement for copying, scanning, printing, and faxing capabilities through multi-function devices (MFDs) for Department of Homeland Security (DHS) Federal Emergency Management Agency (FEMA) Region III and for subsequent modifications as applicable. FEMA RIII requires a long term lease of MFDs and estimates that approximately six (6) MFDs will be required.

II. Scope

FEMA Region III requires a Document Management Services Solution. The solution must provide an aggregate flat-rate program including equipment, maintenance and supplies (except paper) with no additional cost or overage charges for MFDs on a firm fixed price basis with copying, network printing, scanning and facsimile, tailored to the needs of each organization/customer entity.

FEMA seeks to reduce the environmental and Health and Human Services impact of electronics, their use, and disposal, through continuous improvements in design, material choices, reuse, and recycling.

Therefore, all equipment procured through this contract must be Gold registered under the Electronic Products Environmental Assessment Tool (EPEAT) for imaging devices. Contractors also may offer environmentally sustainable consumable and maintenance packages to include bio-based toner where available. Contractors are also encouraged to provide devices with increased recycled content paper handling ability, as well as devices that are manufactured according environmentally sound practices.

The award will be made on a “best value” bases and based on agency past performance, technical evaluations, tested product specifications, and contractor’s proposal, and description of work that best meets or exceeds all standards in the stated requirements for: configurations, capabilities, descriptions, functions, specifications, safety, security, and quantity, pricing, and termination terms.

All equipment must be delivered and installed within 30 days after receipt of order (ARO). The period of performance will be one (1) base year plus four (4) option years. The place of performance will be the FEMA Region III Office: One Independence Mall, 615 Chestnut St., Philadelphia, PA.

III. Detailed Requirements

1. Equipment:

Lease of:

Six (6) 25,000 page B&W / 25,000 page color copiers

2. Specific Requirements for all MFDs:

Each copier is to have the following items as the standard package:

Each copier must duplex, collate, staple and sort with an attached finisher

Each copier must have three paper trays to account for High capacity 8 ½ X 11 paper, 8 ½ X 14 paper and 11 X 17 paper.

Each copier must have the capability to print and scan all three size pages above

Each copier must have a high speed top feeder

Each copier must have the capability to reduce or enlarge documents

Each copier must have PIV capabilities.

3. System Requirements:

Security criteria are critically important and must include but not be limited to:

Security of Data at Rest on the system;

Data in Transit over the network, insure that any network communications can be encrypted (printing – IPSec, Scanning Secure Socket Layer – HTTPS, Remote management over the web-secure socket Layer HTTPS, Secure LDAP, enforced encrypted user authentication for email, Scan, SA – Kerberos/SMB encrypted authentication, Web SA authentication protected by HTTPS; network vulnerability;

Disk encryption at a minimum of 256-bit AES (standard out of the box);

Disk image overwrite a minimum of 3 passes (out of the box);

Data in flash memory will be encrypted and/or overwritten;

Data stored in RAM cannot be removed from machine without losing contents;

Ensure MFP System must allow packages to be pushed remotely for system upgrade/updates to include IAVA/IAVM mandated fixes.

All devices must be approved on the DHS/FEMA network.

4. Personal Identification Verification (PIV):

All MFDs connected to the network shall support the use of the FEMA issued PIV for all functions to include controlled release of the device for walk-up printing, copying, and scanning. All MFDs connected to the FEMA network shall be able to utilize government-owned and furnished Online Certificate Status Protocol (OCSP) responder(s) as the primary means for validation of the user’s presentation of his/her DHS PIV as currently authentic and valid. Digital signature and FIPS140-2 encryption, at the MFD, must also be supported for scan to e-mail functionality. Vendors PIV should also support authentication against FEMA’s Windows /Active Directory. All MFD’s require the ability to Scan to Folder and Home Folder.

MFDs will have the capability to network to standard microcomputer networks. The contractor shall supply all cables, connectors, device drivers, utility software, print servers, receptacles and any such necessary type of accessories to provide service from available network ports to the location of the MFDs. It is desirable that offered models support Windows 7, Windows 10, Windows 2012 Server, Windows 2008 Server, Linux, Unix, along with upgrades and variants. Scan to file format should include standard adobe and/or graphic file format(s), example: TIFF, JPG, and PDF.

Device can be configured to disable any protocol as needed.

Device can be configured to use an assigned static IP

Device must allow the default passwords and SNMP community strings of all management services to be changed. It must also support the use of complex passwords up to 15 characters (to include uppercase letters, lowercase letters, numerals, and special characters).

Device must maintain its configuration state (i.e., passwords, service settings, disabled protocols, etc.) during a power down or reboot.

Device must support flash upgrades of the firmware and must have the ability to be configured with the most current firmware available.

Device can be configured to restrict print services to port 9100 and/or LPD.

Device must support disabling any USB or flash/thumb drive or any removable storage capability.

Device must support the clearing of an internally used/installed hard drive between jobs if scan to disk functionality is used.

Device must have a mechanism to lock and prevent access to any installed hard drive. An acceptable alternative is to ensure the hard drive is encrypted (FIPS 140-2 compliant) or if the drive is zeroized when removed.

Device can be configured to prevent unauthorized users from changing the global configuration of the device.

Device can be configured to disable fax, scan to email, or print services as required.

Device can be configured to integrate with government network’s Active Directory to facilitate authentication of user’s credentials.

Device’s PIV/PKI module must be certified to be FIPS 140-2 compliant.

Device must support ability to encrypt and automatically sign all outgoing emails.

Government will retain the hard drive upon return of the device to the manufacturer at end of lease/contract.

Device can be configured to only allow certain IP addresses to access it for remote management.

Device can be configured to only accept print jobs from authorized IPs (i.e., from print servers).

Device must not damage or render PIV card unoperable in any way. The performance metrics for this contract will address PIV card damage associated with MFD use.

5. MFD Integration Requirements:

Distributed MFD Capture & Print: Must provide an integrated solution to enable secure document printing, scanning, and outbound faxing on networked MFDs.

User Authentication: Must integrate with current authentication methods, including

Windows Active Directory and government issued CAC/PIV cards in support of HSPD-12 requirements, to provide single sign-on access to all MFD network scanning, printing, and faxing capabilities.

Information Security: To comply with information security requirements, including the security policies outlined in DHS 4300A&B, the proposed MFD solution must adhere to the following guidelines:

The MFDs must use a secure web services protocol to transfer documents between the

MFDs and the network; transmission must be SSL-encrypted.

To prevent loss of sensitive information, such as personally identifiable information (PII), all documents transferred from the MFDs must be scanned for sensitive content prior to delivery to network destination. For documents with identified sensitive information, the solution must be able to provide automatic email notification to security officer/system administrator, place a watermark on the document, and optionally permanently delete the document prior to delivery.

The proposed solution must provide a configurable option for validation of destination prior to delivering a document scanned at the MFD. For example, validate that all email addresses are in the FEMA domain prior to scanning to email.

The proposed solution must provide full audit trail data on all documents scanned, faxed, and printed, including username, date/time stamp, page count, workflow metadata, and IP address of the MFD. Must support detailed metric reporting at the user level and department level.

6. Document Scanning Requirements:

Must have the ability to scan documents to user home directories (i.e. U: Drives). Must be automatically mapped based on user authentication at the MFD. The user must not be required to type in or browse for home folder.

Must have the ability to scan documents to department level network share drives. Must support browsing network shares based on authentication at the time of scan. Must also provide user with list of “most frequently selected scan destinations” based on authentication. The solution must also provide users with ability to enter a password at the time of scan, such that when the document is delivered to the network share drive, it cannot be opened without the password.

Must have be ability to scan documents directly into Microsoft SharePoint. The integration must enable the user to scan a document directly into a selected SharePoint site and/or library and enter associated indexing values and metadata at the time of scan. The solution must also be able to check in/check out document and set SharePoint permissions at the time of upload.

Must have the ability to scan documents into Microsoft Server 2008 / 2012 file server system. Must enable authorized Microsoft Active Directory users to scan content from

MFDs directly into current file data structure. File and metadata format must be supported by Microsoft Word 2013 / 360 / Adobe Acrobat reader.

Must have the ability to customize document scanning options at the MFD based on the authenticated user’s Active Directory profile. For example, only members of the HR security group will be given access to scan to HR department network destinations.

Embedded Optical Character Recognition (OCR): Must have the ability to automatically OCR-convert scanned documents into user-selectable formats, including text-searchable PDF, MS

Word, and MS Excel, without the need for specialized user desktop software (such as Adobe

Acrobat, etc.). Scanned documents must be converted prior to delivery to network destination, to eliminate additional post processing steps by the user.

Upon delivery of scanned documents to the network destination, the proposed solution must have the ability to provide an email notification to the user.

7. Document Printing Requirements:

Pull printing: must provide the capability to hold user-initiated print jobs in a centralized queue and allow only the specified CAC/PIV user to release the print job from any networked MFD. Queued jobs must not be held on the MFDs.

Print applications: must support secure print release from both Windows applications and mainframe systems.

The solution must enable manual or automatic redirection of print streams for failover purposes, in the event that the selected printer is down.

To implement print cost containment measures in support of U.S. Executive Order 13589, the solution must manage print output and follow defined rules-based printing logic for maximum efficiency. Specifically, rules-based logic includes the enforcement of duplexing, printing in specific toner mode, and printing in black & white instead of color. Rules-based logic must be systematically applied according to print source determined both by user and/or application.

The solution must include the ability to limit a user's permissions to print based on application (e.g. prohibit printing from internet browser), time of day, and print device.

Print-to-file: The proposed solution must be able to recognize print output from print-enabled applications to automatically convert the print stream to a digital format to a secured network location for authorized users.

8. Document Faxing Requirements:

The selected vendor must provide integration capabilities with existing fax server to enable outbound network faxing from the MFDs.

Must provide user with list of “most frequently used fax numbers” based on authentication.

Must provide user with one-touch faxing destinations, for example “fax expense sheet” and

“fax invoice”.

Must prove administrative control to limit what fax numbers or area codes users can fax to, at the user, user group, and global level.

9. System Administration:

In support of future initiatives to consolidate, standardize, and optimize IT infrastructure, the proposed MFD solution must provide the following functionality related to the administration and IT management of the solution:

All MFD network capabilities must be centrally configured and replicated across all MFDs.

(i.e. the solution must not require individual scan templates to be configured on each MFD).

Must support import and export of MFD IP/hostnames from centralized administrative interface for automatic push to all devices.

The proposed solution must have the ability to run fully load balanced and in a highly available configuration of all network capabilities to ensure uninterrupted performance.

The proposed solution must be configured to provide administrators with automatic emails in the event of any issues with processing or delivery of documents on the network.

10. Cost accounting:

The proposed solution must centrally track prints, scans, and copies for all users and all

MFDs for cost accounting purposes.

User-level tracking must be fully integrated with MFD authentication including CAC/PIV card authentication. User must not be required to enter additional information for identification purposes (e.g. a separate PIN code).

The proposed solution must track the following data elements for all documents printed:

(1) document name, (2) document owner, (3) date time stamp, (4) total pages, (5) document size, (6) duplex vs. simplex, and (7) cost.

The proposed solution must track centrally the following meter data elements for all devices: (1) total sheets/impressions, (2) total color sheets/impressions, (3) total B&W sheets, and (4) total duplex sheets/impressions.

The proposed solution must provide detailed and summary reports on all data tracked, including: (1) history by user, (2) history by department, (3) history by date range, (4) history by billing amount, (5) alert history by device, and (6) meter history by device. Must also provide graphical summary reports including (1) most active users, (2) most active departments, and (3) usage by day & hour to identify peak usage periods.

In conjunction with the secure print release functionality, the proposed solution must provide a report on all documents sent to the queue but not released.

11. Device monitoring:

The proposed solution must proactively monitor all MFDs for issues including (1) paper jam,

(2) low supply, and (3) network problems.

The proposed solution must automatically report issues to the user as well as identified helpdesk and administrator resources.

12. Desktop Scanning Requirements:

The proposed solution must provide a user workstation interface for scanning documents from a desktop scanner. Must support TWAIN driver.

The workstation scanning client must provide scanned page image preview and scanned page image thumbnails, with the capability to merge and split pages into multiple document(s) or batches.

The workstation scanning client must provide indexing capabilities to enable users to index individual documents and batches of documents. Indexing capabilities must include database-driven pick lists, database-validated text fields, and barcode recognition (i.e.

automatically capturing a barcode on the scanned page and converting to text for indexing purposes). In addition, to minimize manual data entry error, the client must provide the capability for a user to click text within the scanned document image preview to automatically populate the indexing fields.

For information security compliance, the workstation scanning client must communicate over an SSL-encrypted protocol for document transmission.

13. Mobile Device Integration Requirements:

**Please note, this functionality will not be required immediately but the contractor must be able to transition to the use of mobile device integration in the future.**

Mobile device connectivity: The proposed solution must provide integration with mobile devices to enable content (documents, images, and metadata including barcodes and geo-coordinates) submission directly from the mobile device.

Mobile capture: The proposed solution must enable content submission directly into network destinations, including the following:

Network folders - mobile user must be able to browse and select authorized network folders from the mobile device based on existing user permissions.

Home folders – mobile user must be able to route a document or images directly to home folder.

Microsoft SharePoint document sites/libraries - the SharePoint mobile capture integration must enable the mobile user to submit a document or image directly into a selected

SharePoint site and/or library and enter associated indexing values and metadata at the time of submission.

Mobile file access: The proposed solution must provide the mobile user with a method of securely accessing documents in her or her home folder and/or other network folders directly on the mobile device.

Mobile form submission: The proposed solution must provide an interface on the mobile device to fill out an electronic form and automatically generate a completed standard form based on a provided template (for example, equipment request form, travel expense reimbursement form, etc.). eSignature must be supported.

Mobile security: In support of information security compliance to protect Personally

Identifiable Information (PII) on content submitted/accessed from mobile devices, the solution must meet the following guidelines:

Authentication: the mobile solution must integrate with Microsoft Active Directory to enable and restrict user access.

Data transmission: all data transmitted to and from the mobile device must be SSL-encrypted.

Data access: all data accessed on the iOS mobile device must be accessed in memory and not stored on the mobile device itself.

Mobile printing: The proposed solution must enable a user to print to a networked MFD from the mobile device.

14. Web-Based Document Processing Requirements:

**Please note, this functionality will not be required immediately but the contractor must be able to transition to the use of web based document processing in the future.**

Must provide a thin client web browser-based capability for desktop users to convert electronic documents into text-searchable formats, including PDF, MS Word, and MS Excel.

Must provide a thin client web browser-based capability for desktop users to fax electronic documents from the desktop, through integration with existing network fax server.

Must provide a thin client web browser-based capability for desktop users to upload content into Microsoft SharePoint to automate and standardize file format, file naming convention, and file indexing per existing SharePoint infrastructure.

15. Additional Requirements for ALL devices:

All products must be Electronic Product Environmental Assessment Tool (EPEAT) registered

(http://www.epeat.net).

Must be capable of operating satisfactorily and providing acceptable copies on recycled paper conforming to the requirements of Commercial Item (CID) A-A-1912 and Joint

Committee on Printing (JCP) Standards JCP 0-460.

Must have a self-diagnostic system which indicates as a minimum, the following condition;

(a) needs toner, (b) needs paper, and (c) paper mis-feed or jam.

Must offer 110/120 volt 20 amp Power Filter with: (a) Cat 5e Ethernet protection, (b) High

Frequency noise filtering, (c) Power abnormality event logging with time and date stamp per event, and (d) Lifetime replacement warranty.

Must conform to the requirements of underwriter’s laboratories (UL) Standard or 114 or

1950.

All devices proposed must be models that are in current production as of the date offer is submitted. “Current production” means the equipment is being manufactured as new equipment for the United States market.

Must feature a definite indicator of when the equipment energized. This may be with a special “power on” light or an appropriate indicator on the control panel.

Must have a zoom feature allowing continuously variable reduction in increments no larger that 1%. The zoom feature must, at a minimum, cover a range from 67% through 100%.

Must have a minimum of two present reduction ratios, one of 64+ /-3% the size of the original and one of 75+/-4% the size of the original, and one enlargement mode of 120%

(+10mm-5) the size of the original.

Must be capable of producing copies on transparencies, gummed labels, and business card stock. Limitation of use of particular brands/stocks must be noted with offered model.

Must have the manufacturer’s serial number permanently and legally stamped or affixed on a major component in a readily accessible location. In addition, each MFD must be permanently and legally marked in a conspicuous location with the manufacturer’s name or trademark and model number of machine.

Must have the capability to copy pages of bound documents.

Must be furnished with an operator’s manual.

16. Relocations:

Any MFD may be relocated by the contractor (after initial installation) once per year at no charge to the Government. Thereafter, if the same copier is relocated and labor is performed by the contractor personnel, the Government will be billed based on the contractor's current GSA published pricing at the time of the relocation.

17. Transition/Phase-in, Installation, and Support:

Vendor must deliver and completely install all systems within 30 days of receipt of order.

Vendor must describe their process for replacing equipment with an identical model, or one with comparable features and capabilities, at customer's request due to persistent and/or catastrophic failure of the original device, at same cost as original equipment.

MFDs may be required to be relocated by the vendor (after initial installation) unlimited times per contract period at no charge to the government.

The phase-in/transition period will also require sufficient personnel to accomplish such tasks as receiving orders, staging equipment, installing equipment, and training personnel.

By the end of the transition phase, all equipment will be in place and operational (to include replenishment supplies).

The government reserves the right to increase or decrease quantity of MFDs throughout the duration of the contract by modification. Government must provide vendor with thirty days’ notice when requesting additions or deletions.

18. Supplies / Consumables:

The contractor shall provide all consumable supplies, excluding paper necessary for the continuous operation of the devices throughout the contract period of performance.

The vendor will maintain basic equipment supplies and will auto-replenish supplies directly to end user’s machines based on monthly production levels and established need.

All consumable supplies required for copying, printing, and scanning, excluding paper and transparencies, must be provided by the contractor. Consumable supplies will consist of and are not limited to toner, developer, printer heads, black and color cartridges, etc.

19. Operator Training:

The contractor shall provide training to the key operator for each device at the time of installation. The Training shall include, at a minimum, how to operate the basic function keys of the MFD; location and procedures for installing consumable parts, such as toner, staples, paper etc.; how to operate special features, including but not limited to duplexing, enlargements, and reductions; multiple job queues; diagnosis and resolution of basic device malfunctions, etc. In addition, the training shall give the key operator the necessary knowledge to sanitize the device(s) after sensitive information has been exposed (e.g., copied, faxed, e-mailed, scanned, or printed) or spilled.

Five (5) days after government notification to the contractor of network certification of the MFDs, the Contractor shall provide access to training materials that meet the initial ordering activity's key operator training requirements. The following two training methods are acceptable training methods if government key operators are not available For the preliminary vendor offered in-person training session(s): CD-ROM and web-based training. The training shall be provided at no additional cost to DHS.

The type of training shall be specified in each quote.

20. Maintenance Services:

The contractor shall be responsible for maintaining the devices at a 95% monthly availability/up-time rating. Availability/up-time ratings are based on the nine (9)-hour

Government business day and industry standards. DHS requires consistent service, support and response time nationwide therefore, all services will be done through directly through manufacture support (no third party).

Unless otherwise specified by the ordering activity, the Contractor shall affix identification/asset tracking labels to all devices under a maintenance agreement. All labels shall clearly identify the device model serial number. The identification/asset tracking label shall be clearly visible to the end users during normal operation of the device, and shall remain so throughout the duration of the agreement. The asset tracking label is for DHS asset tracking purposes. Unless otherwise specified by DHS, the onsite maintenance repair technician will be the primary point of contact (POC) regarding preventive maintenance, service orders, and re-ordered consumables.

The contractor shall provide a toll free number that shall be available during normal business hours from 8:00 a.m. to 5:00 p.m. (Eastern Time) to be used by the FEMA Help

Desk for service requests, supplies/consumables request, and device support. This number shall not be an automated answering device during the normal business hours.

For all service orders, the contractor shall dispatch a technician within six (6) hours to respond to all devices requiring onsite service. Response time on a service order begins when the order is received by the contractor. Service orders received after normal hours of operation shall begin the following business day at 8:00 AM, Eastern Time. After determining that an MFD cannot be repaired, the Contractor shall provide a temporary device that has been certified by DHS of equal or greater capabilities within two (2) business days at no additional cost to DHS.

21. Compliance with 508:

All electronic and information technology (EIT) procured through this contract must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www.accessboard.gov/sec508/508standards.htm -

Part 1194.

The contractor must indicate for each line item in the schedule whether each product or service is compliant or noncompliant with the accessibility standards at 36 CFR 1194.

Further, the proposal must indicate where full details of compliance can be found (e.g., vendor's website or other exact location).

22. Security and Privacy:

Contractor personnel will conduct support in accordance with DHS, to assure compliance with security guidelines involving IT operations within 90 days from start of the contract employee(s).

Privacy Act. The contractor must comply with requirements of the Privacy Act of 1974

(Public Law 93-579).

Physical Security. All government buildings are a smoking restricted workplace. Due to the nature of the work, and facilities, contractor staff may only smoke in designated areas outside the building.

23. Invoicing Procedures:

The contractor must establish a billing cycle for all services provided under this contract.

This cycle will be a 30 day billing cycle, and it must line up with the contract period of performance dates. The Contractor must submit this invoice the FEMA Finance Center electronically at FEMA-Finance-Vendor-Payments@fema.dhs.gov. The invoice must reference the contract number.

The invoice must match the contract CLINs should include the following information for each piece of equipment: serial number, model number, MFD band, begin meter read, end meter read, price per copy, monthly MFD count, and/or monthly MFD cost.

IV. Performance Metrics:

Performance Criteria

Measurement Description Calculation

On-site Service Response Time

95% Response Time

The associate will respond to end user issues within four hours.

The measurement for Service Response Time is calculated by dividing the total number of calls responded to in four hours by the total number of calls during each month.

PIV Card Failures

Less than five (5) monthly PIV failures.

No more than five

(5) PIV cards per month should fail as a result of MFD use.

The number of PIV failures per month due to MFD use will be tracked in a format agreed to by the contractor, as well as the cost per PIV failure.

mailto:FEMA-Finance-Vendor-Payments@fema.dhs.gov

Average Service Response Time by Product Family

95% Achievement of Target Response Time (6 or more pieces of equipment)

90% Achievement of Target Response Time (5 or less pieces of equipment)

The amount of time between service call and the arrival of the onsite rep at the site.

The measurement for Average Service Response Time by Product Family is calculated by dividing the Target Response Time by the Average Service Response Time.

Example:

Target Response Time is the standardized response time for a specific product family.

Average Service Response Time is measured by dividing the Sum of all Service Call Response Times, by product family, (this is done by adding up the total response times for all products within a specific product family) by the Total Number of Service Calls on all pieces of equipment within that product family.

Target Response Time for product family A = 4 hours.

Product family A Service Call Response Times = 49 hours

Total Number of Service Calls for product family A = 12

= 4 / (49/12)

= 4 / 4.08 = 97.9% Avg Service Response Time

Remember to use Average Service Response time for entire product family and calculate on quarterly basis.

Performance Criteria

Measurement Description Calculation

Equipment Uptime (“Availability Hours”)

95% Three Month Rolling Average Uptime

The three month rolling average percentage that the equipment population covered under this Agreement is available for use within the Contracted Period of Coverage.

The measurement for Equipment Uptime is calculated by dividing (Availability Hrs – Equipment Downtime) by Availability Hrs.

Equipment Downtime is the Total Service Response Time plus Machine-Repair Time (excludes normal interrupts, e.g. lunch)

Total Service Response Time:

actual time the technician arrived on site minus the time initial service call was placed.

Machine-Repair Time is the time it takes the technician to repair the machine to be operational.

Availability Hours is the contracted period of coverage hours per calendar month that the equipment subject to this Agreement may be available.

Note: Remember to calculate Availability Hours by entire fleet of machines (multiply Contracted Period of Coverage hours by total number of machines) on a 3 month rolling average.

24. Critical Machines:

Critical machines will be designated for the purpose of responding to calls for maintenance.

It is anticipated that no more than 20% of the total number of machines provided under this contract will be designated as critical. Response time will be four hours for critical machines.

25. Ongoing communications:

Contractor must set up quarterly meetings w/ COR or any others designated by COR to discuss any issues that may arise.