75ACF124AppleDAAS RFI - 6.22.24.pdf

vp

Request for Information (RFI)

Title: ACF Tech/HHS OCIO Apple Device as a Service

Response Due Date: July 8, 2024

Email: Correspond directly to the point of contact listed below:

Kevin M. Duvall, ACF Chief Technology Officer/HHS Senior Executive for Technology and Delivery, Kevin.Duvall@acf.hhs.gov

Avery Q. Muse, HHS OCIO Executive Director for Operations, Avery.Muse@acf.hhs.gov

Joseph East, Contract Specialist, Joseph.East@acf.hhs.gov

Please ensure that your e-mail response has “75ACF124AppleDAAS” in the subject line.

Issued by: This RFI is being issued by the Government Contracting Services (GCS) on behalf of the U.S.

Department of Health & Human Services (HHS) - Administration for Children and Families (ACF).

RFI Purpose: The government is seeking information related to the considered acquisition of an information technology contractor to provide full lifecycle management of Apple devices (Macs, iPads, iPhones). This includes device acquisition, provisioning, management, logistics (shipping/tracking), refresh and secure decommissioning.

Additional Information: Responses to this RFI are strictly voluntary and will not affect any vendor’s ability to submit an offer if, or when, a solicitation is released. This is being issued solely for information and planning purposes and does not constitute a solicitation or obligation on the part of the Government. Neither unsolicited proposals nor any other kinds of offers will be considered at this time.

No entitlement to payment by the Government of direct or indirect costs or charges will arise as a result of the submission of information in response to this RFI.

The Government will not be liable for or suffer any consequential damages for any improperly identified proprietary information. Proprietary information will be safeguarded in accordance with the applicable Government regulations. If you submit proprietary information, you must clearly mark “PROPRIETARY” on every sheet containing such information and segregate the proprietary information to the maximum extent practical from other portions of your response (e.g., use an attachment or exhibit). Respondents are responsible for adequately marking proprietary information in their response. All information received in response to this RFI that is marked “Proprietary” will be handled accordingly. An electronic acknowledgement of the vendor’s submission will be provided. If you do not receive an acknowledgement within one business day, please notify the point of contact listed above to ensure successful delivery.

Responses from this RFI may be shared with other components within HHS for information and planning purposes.

Submission Information: Responses to this RFI must be submitted via email to acf_techhub@acf.hhs.gov and Joseph.East@acf.hhs.gov with the subject: “75ACF124AppleDAAS”

RFI Timeline: The timeline for this request for information is:

RFI Released: June 22, 2024 Responses Due: July 8, 2024

Background Information In 2021, the Administration for Children & Families (ACF) established the ACF Office of the Chief Technology Officer (CTO) organization and hired an inaugural Chief Technology Officer to oversee all technology matters at ACF. The CTO function provides leadership and strategic direction to technology, artificial intelligence, and innovation delivery at ACF. This includes optimization and enhancement of the endpoint computing experience for its 3,000+ federal staff and contractors that serve ACF’s mission. ACF is interested in understanding how we can further propel and enhance individual and team productivity through delivering a modernized and secure next-generation endpoint computing environment. This includes the utilization of Apple-based operating systems to perform and deliver government workloads.

In doing so, ACF seeks to lower per unit costs (as compared to today’s delivery mechanism), increase customer satisfaction, increase zero trust maturity, decrease total support costs, and most importantly accelerate our personnel’s ability to deliver more for our missions and those we serve.

ACF currently receives the bulk of its endpoint computing services from HHS OCIO, which provides Windows-based laptops and iPhone mobile endpoints. ACF seeks to, in partnership with HHS OCIO, consider additional offerings of Mac-based endpoints, augmented business models for iPhone mobile endpoints (including the relevant cellular services), and iPad-based endpoint computing. ACF seeks a novel and advanced business model for providing such services that allows for maximum flexibility and agility to the government, as well as a stellar customer experience for asset lifecycle management. ACF seeks a full and mature Device as a Service offering that allows zero-touch deployment of Macs, iPhones, and iPads.

Assumptions of the Apple Device as a Service Offering

• Devices will be available to ship every business day, will be overnighted to customers for break/fix matters (or equivalent resolution of issues will be addressed through other means), and will be fully inventory managed by the vendor. The government may retain a small amount of devices (e.g., a service pool) for immediate servicing at walk-up service centers, but the majority of interactions will occur virtually, via parcel service, or other novel mechanisms not requiring government intervention or support.

• Vendor will provide support, including AppleCare OS Support.

• The vendor will lower costs through one or more of the following mechanisms:

o Apple Financial Services (or its equivalents) – Utilize mechanisms to turn purchases of devices into low monthly costs over the deployment period, and guaranteed Buy Backs for refreshes.

o Planned Future Value – The contractor will lower costs by planning to securely wipe the device and reselling/doing guaranteed Buy Back, as appropriate. If there is specific date or lifecycle band that balances and optimes overall monthly cost (relative to historical mailto:acf_techhub@acf.hhs.gov mailto:Joseph.East@acf.hhs.gov resale cost), all innovative mechanisms for lifecycling can be considered and recommended.

• The vendor will provide services in the following manner:

o The vendor will have a one-time firm fixed price CLIN for initial service stand-up, including configuration of the MDM, integration with existing services (Microsoft 365, PIV authentication, etc.), and all other matters related to standup and issuance of the first Apple device.

o The vendor will have a firm fixed price CLIN to support the base operations of these services for an ongoing basis, including standard reporting, continuous service optimization, road-mapping, and other program management-type services. This will likely include maintenance of the catalog for ordering/break/fix management.

o The vendor will provide pricing for devices that includes the financing (i.e., vendor’s use of Apple Financial Services) of the device, the MDM licensing, and other variable cost in a single per device per month cost.

o The vendor can include pricing for ongoing enablement services (including training and self-service/support optimization) to support high levels of customer satisfaction.

o The vendor will run the Mac Evaluation Utility (MEU) on devices inside our Washington DC headquarters and inform the Network team of required hosts and ports that are required to use Apple devices on enterprise networks. Vendor shall run the MEU monthly and on demand.

o The vendor will automatically feed serial numbers of Apple devices into Apple Business Manager (ABM) to facilitate zero touch deployments nationwide, and to other asset management programs.

o The vendor will configure Apple devices to run a weekly check against configured baseline(s) and will proactively remediate, check, and report that required modifications were successfully completed.

o The vendor will manage our Volume Purchase Plan (VPP) to ensure end users have access to required AppStore applications. Vendor will also package and deploy custom applications via the MDM.

• The vendor will address loss/damage through innovative mechanisms, and corresponding pricing. In an effort to provide low monthly costs, the vendor should distinguish whether or not the monthly cost includes loss/damage, and whether there is a “buy out” for an irreparable/lost device. The vendor could also utilize other services/capabilities (e.g., AppleCare for Enterprise) to provide an assumed loss/damage rate into the cost of the per month device cost. The vendor, through its MDM, will provide the capability to immediately disable the device, and ensure the safety of government data on the device. The vendor should also provide tracking mechanisms for possible recovery of the device. Any MDM running in the cloud has to be able to achieve FedRAMP certification

• The vendor will seek advanced ways to provide a national support network for devices. This could include the utilization of AppleCare for Enterprise services, and the ability for government users to have issues addressed through onsite hardware service. This could also include strong servicing through parcel services.

• The federal government will rely exclusively on the vendor to provide end to end asset management of these devices. At any time, the vendor will be able to produce a report of all devices upon request from the federal government. In addition, the device inventory should be readily available through automated means to allow for device locking of services and whitelisting in support of Zero Trust.

• The vendor will provide an internet-accessible end user portal to order Apple devices in accordance with the approved personas.

• The vendor will provide an account manager available during working hours defined as Monday through Friday, 9am to 5pm ET for administrative and routine issues. Vendor will provide a 24/7 contact for emergencies.

• The vendor will provide a comprehensive Program Management Plan, including but not limited to, a subcontractor/partner management plan (if applicable), a financial plan, a technical plan, a test plan, a logistics plan, an operations plan, an asset disposition plan, and a reporting plan.

• The federal government seeks simplicity, elegance, and sophisticated and delightful customer experiences throughout the delivery of these devices. This includes little things, and big things, such as:

o The vendor should consider whether or not they have the ability to provide materials and brochures about the services offerings, with the device (e.g., a “Welcome to HHS” or “Welcome to ACF” booklet).

o The vendor should seek to provide design services to the initial configuration of screens for the Mac, including the lock screens, the initialization screen for the zero-touch configuration, etc. to be HHS and/or ACF branded. These screens can be used to convey HHS and ACF messaging and other information while the device is preparing itself.

o The vendor should consider whether or not physical stickers are required to properly asset manage devices. Devices should have relevant government warning banners and other security mechanisms that distinguish these devices as government property, but we seek novel ways to do so.

o The vendor should provide a clear and quick request and approval process for an individual or a team who wish to obtain a new device. The vendor will contact users 1 month before the end of their contract period to select their next persona-approved device.

o The vendor should have a proposed position on the utilization of cases, screen protectors, etc. to provide devices. Acknowledging that the goal and target is to lower cost through device recycling/trade-in, the vendor should have an opinionated offering for these matters to protect trade-in value, useful life, and lower environmental impact.

An example could include:

▪ Macs will be deployed without a screen protector or other mechanisms. A sleeve case will be shipped separately with the device.

• Example Contractor Opinion: According to our experience/research, screen protectors yield minimum value on laptop devices relative to cost/labor of application before shipping and the disruption to a direct flow from Apple supply chains to the consumer (require kitting). A separate sleeve (vs. a full blown laptop case) will allow maximum flexibility for users to carry in a backpack and protect the device. We believe this will yield a 90% Grade B refurbished rate, which will allow a lower cost to the per month device rate.

▪ iPhones and iPad will be shipped with a screen protector, Otterbox Commuter Case, and USB-C block.

• Example Contractor Opinion: According to our experience/research, we have higher loss, damage rates providing iPhones without cases.

Accordingly, we recommend pre-issuance application of a case and screen protector. We generally believe shipping a USB-C block with the device is needed, as USB-C is still being adopted.”

• The vendor should be able to build an initial configuration for these devices, in collaboration with the government to strike a balance between security, usability, and productivity. This includes pulling in macOS Security Compliance Project, DISA STIGs, and other mechanisms of security tightening the device posture. The vendor should be readily available to provide a starting configuration based on past experiences with other government customers.

• The vendor should be able to proper optimize and harness the Apple supply chain mechanisms that are unique and competitive to deliver enhanced outcomes for the government. This includes, but is not limited to:

o The vendor show be able to offer newly released devices within weeks of commercial availability to the government through this offering. The vendor (and the contract structure) should allow for this flexibility with minimal administrative burden.

o The vendor should not require the establishment of a depot or a limited one at best.

The vendor should not require the government to have to estimate consumption (within reason) to properly fulfill the offering for the agency.

o The vendor should utilize services such as Apple Financial Services, AppleCare for Enterprise, Apple Stores, etc. to optimize a highly available endpoint computing environment at a low monthly cost.

• For the iPhone and iPad offerings, the vendor should be able to price in monthly costs of cellular services. The government assumes national coverage with unlimited data, talk, & Text on a 5G and/or 4G LTE network from a carrier capable of support Wireless Priority Service (WPS).

Allowing the device to serve as a hotspot is a requirement as well. If the vendor can drive lower costs through a non-unlimited plan, the vendor should articulate how the government can effective manage such plans to stabilize costs.

• The vendor should have a standard refresh cycle period (2-3 years for iPhones and iPads, 2-4 years for Mac devices), and should have an opinion about the periodicity.

• The vendor should address how they would logistically support a limited number of “international travel” laptops, iPhones, and iPads that can be provided to ACF/HHS managers or executives, who are not allowed to travel outside the US with their usual hardware due to risks of data exposure. The configuration profile of these assets should be tightened and managed according to the higher posture.

• The offering should enhance our Zero Trust posture. This includes, but is not limited to:

o Compliance with NIST SP 800-124 Rev. 2 for mobile device management o Need to have a fully automated process for provisioning, registering, monitoring, isolating, remediating and deprovisioning devices.

o Need to automate policies for the lifecycle management of the devices.

o Need to be able to rack all the devices and manage supply chain risk.

o Need visibility into all devices.

o Support for passkey/FIDO2 and methods of phishing resistant MFA (PIV and otherwise) o Hardening of devices through:

▪ DISA STIG of OS and browser

▪ EDR Agent (use of Crowdstrike [current EDR agent] or other means)

▪ Log Forwarding (use of Splunk Universal Forwarder or other means)

▪ VPN Access (use of Palo Alto Prisma Access)

▪ Automated Patching and Patch Verification

▪ Secure Software Installation and Distribution o Remote Access through secure means o Secure deletion through NIST SP 800-88 Rev. 1, and production of a certificate of sanitization

Information Requested ACF is especially interested in obtaining feedback and ROM estimates to inform a solicitation for the offering described above.

The following information is required in the RFI response:

1. Company name, details, and contact info

2. Relevant contract vehicles and/or mechanisms useful to this requirement

3. Any Apple-related certifications your company may have (Apple Authorized Government

Reseller, Apple Premier Partner, Apple Premier Service Provider, etc.).

Request for Information Review/Structure

4. Please review the assumptions listed in this RFI, and note anything that you think drives costs up or down dramatically, or is not sound or logical. Please provide information about how you would approach fulfilling this requirement.

5. Please provide commentary on how you think the contract should be structured.

6. Is there additional things that we aren’t thinking about that should be included in a follow along

RFP for these types of offerings? Where do you disagree with our premises or line of thinking?

7. Do you have recommendations for how to best do the broad change management needed to adopt macOS for government users?

Device Management

8. The government currently manages the Windows-based devices, iPhones, and iPads deployed through Microsoft Intune. Please provide an opinion on the MDM technology that best balances advancement of Zero Trust and overall usability. ACF (and HHS OCIO) currently purchase Microsoft 365 G5 licenses to support end user productivity, and thus have access to Microsoft Intune to manage endpoints (already licensed for management). Should you recommend or propose an additional tool for MDM (e.g., JAMF Premium Cloud Plus) (which has associated cost), please justify or provide an explanation for why you recommend the addition of this tool for management.

9. What is your recommended refresh lifecycle time for devices? Are there specific factors that you recommend considering ahead of picking this timeframe (price, Apple product lifecycle estimates/historical trends, etc.)?

10. Do you offer peripherals and accessories (PIV readers, accessories, etc.)? How should those be priced and consumed?

11. What do you recommend for help desk services? How do we build a unified experience with existing help desk services?

12. Provide recommendations for user authentication. Do you have recommendations about how to integrate PIV cards and use them, as well as authentication to the devices themselves?

Currently, ACF and HHS utilize Hybrid Active Directory for its authentication and will remain doing so. How do you recommend integration here? Alternatively, how could derived credentials be implemented on the Apple devices?

13. Do you have any opinions about architecture to best support success here?

Rough Order of Magnitude (ROM) Pricing/Total Cost of Ownership As part of the Government’s ongoing efforts to engage with industry and gather insights for ACF

Tech/HHS OCIO Apple Device as a Service and to help us better understand potential solutions and associated costs, we kindly ask that you include a Rough Order of Magnitude (ROM) estimate in your response. The government is particularly interested in your expertise and insights, which will greatly inform our decision-making process. The ROM should provide a cost estimate based on your understanding of the project requirements and scope as outlined in the RFI.

Please ensure that your ROM includes:

1. A breakdown of major cost components, including an estimate of the fixed costs that you would charge regardless of unit consumption and the per user per month cost for device.

2. Assumptions and constraints that inform your estimate.

3. Any relevant details that support the cost estimation.

We would like to do a direct comparison of cost to our existing model for delivering Windows-based devices, which is currently on a 4-year lifecycle. To the extent practical, please propose a ROM model for delivering Macs instead. A shorter lifecycle can be proposed, if it lowers the overall cost (e.g., higher resell value at a certain mark, lowers operational costs). We provided a sample in the pricing ROM template. The specifications of the current laptop offerings at:

Standard Laptop (Dell Latitude 7320) High-End Laptop (Dell Latitude 7440)

13th Gen Intel® Core™ 17-1365U vPro® Windows 11

16 GB RAM

256 GB Storage Intel Iris Xe Graphics 14.0", 1920x1200, Non-Touch Built-In Smartcard Reader

13th Gen Intel® Core™ 17-1365U vPro® Windows 11

32 GB RAM

512 GB Storage Intel Iris Xe Graphics 14.0", 1920x1200, Non-Touch Built-In Smartcard Reader

4 Year Refresh Cycle

Please provide other factors that you believe should be considered in comparing the total cost of ownership of Mac/Apple Device as a Service to Windows-based devices and iPhone/iPads purchased directly from wireless carriers.

Attached to this RFI is a sample ROM Pricing template that is illustrative of the type of details we expect in the rough order of magnitude pricing. Please utilize this template as an example of the level of detail we expect.

Please provide a pricing ROM that includes a range of devices and cost optimizations. Generally, we expect our users will primarily use MacBook Air 13-inch/15-inch M3 devices, iPad Air 11-inch/13-inch WiFi + Cellular devices, and non-Pro iPhones. You are free to provide ranges for pricing as well. We included varied options for management and lifecycle in the examples. We expect that we will have one MDM solution for these products.

Information provided in the RFI should be responsive to the questions above, and generally short in length. While we are not setting a page limit, we expect a response to be less than 20 pages.