DFC OIT IDIQ CFESSS 77344423Q0005.pdf

United States International

Development Finance Corporation

Office of Information Technology (OIT)

OIT Cloud First Enterprise Systems

Support Services (CFESSS)

Request for Proposal

RFP #77344423Q0005

Date: November 4, 2022

Table of Contents

Section A: Solicitation/Contract Form

Section B: Supplies or Services and Price/Costs

Section C: Statement of Work

C.3.1 Pool A – Operations 9

C.3.2 Pool B – Application Development (App/Dev) 12

C.3.3 Pool C – Cyber Security 14

C.3.4 Pool D – PMO Support Services 16

Section D: Packaging and Marking 19

Section E: Inspection and Acceptance 20

Section F: Deliveries or Performance 21

Section G: Contract Administration Data 26

Section H: Special Contract Requirements 34

Section I: Contract Clauses 44

Section J: List of Attachments

Section K: Representations, Certifications, and Other Statement of Offerors

Section L: Instructions, Conditions, and Notices to Offerors

Section M: Evaluation Factors for Award

Section A: Solicitation/Contract Form

(see attached)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ IFB RFP

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF. OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NAICS:

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8 (A)

EDWOSB

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

STANDARD FORM 1449 (REV. 2/2012) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

Section B: Supplies or Services and Price/Costs

SCHEDULE

Item

No.

Supplies/Services QTY UNIT

Unit

Price Amount

OIT Enterprise Systems Support

Services in accordance with the

Statement of Work (SOW).

This Contract Line Item Number

(CLIN) is for Commercial – Fixed

Price type orders.

Ordering Period: ______ through

1 LOT 0.00 0.00

OIT Enterprise Systems Support

(CLIN) is for Commercial – Time and Materials type orders.

1 LOT 0.00 0.00

OIT Enterprise Systems Support

(CLIN) is for Commercial – Labor

Hour type orders.

OIT Enterprise Systems Support

1 LOT 0.00 0.00

B.1 General

The OIT CloudFirst Enterprise Systems Support Services (CFESSS) solution is a suite of multiple award Indefinite-Delivery, Indefinite Quantity (IDIQ) contracts consisting of four pools: Pool A – Operations, Pool B – Application Development, Pool C – Cyber

Security, and Pool D – PMO Support Services. These pools provide resources in support of the operations of the US International Development Finance Corporation (DFC) Office of Information Technology (OIT), in its mission to support the whole of the agency. The shared ceiling dollar amount for all orders under CFESSS is $250,000,000.

Each pool under the IDIQ contract has its own multiple awards. The NAICS codes for each pool are as follows:

Pool A – Operations: 541513 – Computer Facilities Management Services

Pool B – Applications Development: 541511 – Custom Computer Programming Services

Pool C – Cyber Security: 541512 – Computer Systems Design Services

Pool D – PMO Support Services: 541611 – Administrative Management and General

Management Consulting Services

The scope of work under this IDIQ covers all DFC Information Technology (IT) operations. This includes all requirements IT products and services, except where 1) The

IT portion of the requirement cannot be feasibly separated from the non-IT portion of the requirement or 2) when the IT is incidental to contract performance. For purposes of level-setting understanding, IT is defined by Office of Management and Budget (OMB)

Memorandum 15-14, Management and Oversight of Federal Technology as:

“Any services or equipment, or interconnected system(s) or subsystem(s) of equipment, that are used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency;

where such services or equipment are 'used by an agency' if used by the agency directly or if used by a Contractor under a contract with the agency that requires either use of the services or equipment, or requires use of the services or equipment to a significant extent in the performance of a service or the furnishing of a product. If delivering IT products or services, the Contractor shall comply with government IT standards, such as those for IT security, and with requirements for sharing and efficiency at the federal, agency, bureau, and line office levels.”

The individual scope of each pool is defined in Section C

B.2 Period of Performance

The term of CFESSS is a five-year continuous ordering period, with the ability for orders to be placed with periods of performance of up to five years , throughout the ordering period of the IDIQ. This means that work resulting from this IDIQ may span up to a ten-year performance period. This is not a multi-year contract as defined in Federal

Acquisition Regulation (FAR) 17.103.

B.3 Contract Type

CFESSS is a multiple-award IDIQ that allows for task orders to be issued on a Fixed-

Price (FP), Time and Materials (T&M), and/or Labor Hours (LH) basis. Task orders may also combine more than one pricing arrangement (e.g FP/LH, etc.), although separate contract line-item numbers (CLINs) are required for each pricing arrangement. Orders may be funded via traditional SF1449 contract-orders, or through payment via a government purchase card. Pricing structure should be the same regardless of payment method.

B.4 Task Order Pricing

CFESSS provides the flexibility to determine fair and reasonable pricing tailored to the task order requirement dependent upon level of competition, risk, uncertainties, complexity, urgency, and contract type. The Task Award Contracting Office (TACO) has the authority and responsibility to determine price reasonableness for task order requirements, normally not to exceed the contracted ceiling rates.

Competition at the task order level is expected to establish fair and reasonable pricing for task orders placed for all contract types. For those relatively rare instances when competition does not exist, these ceiling rates will be available for the TACO to consider and use.

Exceptions where the TACO has the flexibility to exceed contracting ceiling rates including special security clearances (see www.state.gov/security-clearances) and other circumstances deemed “extraordinary” by the TACO.

Some task orders may require services that do not correspond to the labor categories included in CFESSS. Accordingly, if permitted by the task order solicitation, the

Contractor may propose appropriate labor categories and labor rates necessary to meet the requirements of the solicitation despite their not being included in CFESSS as awarded.

B.4.1 Fixed-Price Orders

FP orders are defined under FAR Subpart 16.2, Fixed Price Contracts, and other applicable agency-specific regulatory supplements.

B.4.2 Time-and-Materials and Labor Hours

T&M and LH orders are defined under FAR 16.601 and 16.602 respectively, and other applicable agency-specific regulatory supplements.

B.4.3 Other Direct Costs http://www.state.gov/security-clearances

Other Direct Costs (ODCs) established on a cost-reimbursement basis, including but not limited to travel costs, shall be pre-approved by the Contracting Officer Representative

(COR) at the task order level and be allowed on the task order only if approved as outlined in the task order.

B.4.4 Program and Project Management Costs

Program management support costs encompass support for management, reporting requirements, and related travel and meeting attendance costs associated with the

Contractor’s program management staff as it relates to the overall management of the

IDIQ contract. Program Management (IDIQ Contract-Level) Support Costs and Contract-level program management support costs shall not be proposed or billed as a direct charge to the CFESS IDIQ. These costs will be billed at the task order level.

Project Management (Task Order-Level) Support Costs: Contract-level program management support costs are differentiated from individual task order project management support costs. Task order project management support costs may be proposed and billed against individual task order for direct support of the effort performed under those task order.

B.5 Minimum and Maximum Contract Amounts

During the term of CFESSS, DFC will place orders totaling a minimum of $250. The total amount of orders under CFESS will not exceed $300,000,000.

Section C: Statement of Work

C.1 Introduction and Background

DFC is America’s development bank. It was established in 2019 through the passage of the Better Utilization of Investments Leading to Development (BUILD), Act, which strengthened and modernized American development finance. The BUILD Act combined the capabilities of the Overseas Private Investment Corporation (OPIC) and the

Development Credit Authority which had previously been housed in the U.S. Agency for

International Development (USAID). DFC partners with the private sector to finance solutions to the most critical challenges facing the developing world today. DFC invests across sectors including energy, healthcare, critical infrastructure, and technology. DFC also provides financing for small businesses and women entrepreneurs in order to create jobs in emerging markets. DFC investments adhere to high standards and respect the environment, human rights, and worker rights. DFC makes America a stronger and more competitive leader on the global development stage with greater ability to partner with allies on transformative projects. Further, DFC provides the developing world with financially sound alternatives to unsustainable and irresponsible state-directed initiatives.

The vision of the DFC Office of Information Technology (OIT), herein after referred to as DFC/OIT or OIT, is to become a Cloud First, Agile IT enterprise that adapts quickly to new technology and industry standards, enabling secure, innovative, cost-efficient support to our DFC customers. DFC/OIT’s Mission, and Goals, as follows:

• To advance DFC's ability to drive global development impacts through providing reliable, innovative IT solutions.

• Infrastructure Stabilization: Strengthen current infrastructure to support our customers growing IT needs. Ensure resiliency, security, mobility, and availability.

• Cloud First adoption. Moving the needle forward to cloud first approaches and usage for DFC. Doing our best to minimize on premises data infrastructure and support.

• Application Development Maturation: Mature toward an agile, automated development/test pipeline using DevOps, CI/CD methodologies.

• Desktop Stabilization: Standardize the desktop image and provide desktop security and mobility to our customers.

• IT Governance: Meet statutory and legal reporting/audit requirements while enforcing IT processes and policy that matures our investment, security, architecture compliance and posture. (This includes policy, security, and architecture efforts)

• Service Desk Maturation: Mature our service desk operations by standardizing our service delivery processes and maturing our ITIL supporting processes and metrics

• IT Workforce Development: Hire, train and retain competent IT professionals to support the DFC mission.

• OIT Branding/Service Delivery Improvement: Raise awareness of OIT provided services and work to be seen as a strategic, collaborative business partner within the organization.

• Information Security: Continue to support the OIT, Chief information security office in protection of IT equipment and software owned and used by the DFC and outside users.

• DFCs move towards “Zero Trust”. A shift of network defenses toward a more comprehensive IT security model that enables restricted access controls to networks, applications, and environment without sacrificing performance and user experience.

C.2 Objectives

The overall objectives of CFESSS are to:

• Obtain high quality professional and technical services

• Develop an industrial base of partners for DFC OIT operations

• Develop and maintain performance-based contracts

• Contribute to the DFC mission

Services not covered by the CFESSS scope of work include Inherently Governmental

Functions, which are prohibited in FAR Subpart 7.503(a) and Personal Services as defined in FAR Subpart 37.104(a).

C.3 CFESSS Pools

The primary client for this IDIQ is DFC OIT, however other DFC offices may also use the contracts awarded through this IDIQ upon the approval and coordination with OIT, and if their requirements are covered herein.

The following outlines the type of tasks that may be completed under the four IDIQ pools. When orders are issued that cover multiple tasks across pools, they will be solicited to the pool that will perform the preponderance of work.

Note: The tasks outlined within the pools are demonstrative in nature of the type of work that may occur within the pool and are being put forth for evaluation purposes.

Additional tasks may be requested at the ordering level if they meet the scope of the type of work that may occur within the pool. The work, and its associated standards, are subject to changed based on the evolution of Executive guidance and policy, as well as changes in technology over the period of performance of the IDIQ. All future task orders will be issued with expectations that work will follow best-in-class performance technology and standards at the time of issuance.

C.3.1 Pool A – Operations

The Contractor shall support DFC OIT in all aspects of day to day IT operational functions. Major areas of support include help/service desk support, general operations and maintenance (O&M) work, data center operations, hardware and software purchasing and asset management, and audio/visual support. Services will primarily be on-site, at

DFC Headquarters, with some options for remote work. Specific tasks in this pool that the Contractor shall complete include, but are not limited to, the following:

C.3.1.1 Provide a business forward focused agency-wide IT service desk, capable of resolving all tickets within the Service Level Agreements (SLAs) at the task order level.

This will be monitored through the operation of a DFC ticketing system, while simultaneously ensuring incidents that are not entered via the system such as phone calls, emails, IMs, on-site desk support, and walk ins, are entered in for monitoring and reporting purposes. Support for service desk operations will consist of the following groups:

1. Tier 1 Support: The first level, customer-facing support. Tier 1 should resolve most common incidents and requests, escalating when appropriate, while performing Total Cost of Ownership of all incidents and requests within or outside of Service Desk queues.

2. Tier 2 Support: The second level support team. Tier 2 intercepts and handles all escalations from Tier 1 and serves as Senior Systems Administrators. Tier 2 is responsible for daily operations and maintenance of DFC infrastructure. Tier 2 will also include a security operations team that will focus primarily on security operations and compliance. This includes work such as system patching and vulnerability mitigation.

3. Tier 3 Support: This is the engineering support team responsible for network modernization, technical refresh implementations, and enterprise architecture solutions. This team also serves as technical and application support specialists in cases of major service desk ticket escalations, system-wide outages, and total cost of ownership activities.

C.3.1.2 Provide support for all OIT-issued end-user IT equipment (laptops and docking stations, conference room equipment, network and personal printers, wireless devices, computer monitors, mobile devices and assorted peripheral devices) to support the current organizational IT structure, conduct asset tracking on the supplies, and accommodate all future changes such as the refreshes (current PC refresh cycle 1/3 agency per year) and migrations operationally and via market expertise on best-in-class equipment purchase recommendations. This includes managing the inventory of the

Service Desk IT Stock equipment, reporting to the cognizant DFC FTE when items run low, and overseeing the shipment of hardware or peripherals to remote/onboarding staff to private residences. Coordinate the warranty/non-warranty repair of all OIT-approved end user hardware after authorization by the COR.

C.3.1.3 Conduct conference room support via a daily early morning walk through of all

DFC HQ conference rooms (currently 17) to confirm equipment availability and functionality, documenting and reporting discrepancies. This includes providing direct support when the conference rooms are in use via WebEx and other A/V conference support (such as Teams, Zoom, Cisco WebEx, etc.). As well as perform daily verification of onsite printers, scanners, and faxes.

C.3.1.4 Provide written reports on the status of OIT Service desk operations upon request of the government, and weekly activity reports that summarize application failures, root causes, and resolution steps taken.

C.3.1.5 Draft, update, and maintain Standard Operating Procedures (SOPs) and checklists and store them in a master document repository.

C.3.1.6 Manage all directory and application accounts, including disabling inactive user and admin accounts, account review, and administrative account management.

C.3.1.7 Provide accurate and timely information on the status of all applications, systems, reports, and interfaces. The Contractor shall monitor and evaluate at least 95% of all applications, reports, interfaces and batch jobs in real-time. Monitoring shall include system resources such as disk usage and CPU utilization. Specifications on monitoring procedures and protocol will be outlined at the order level.

C.3.1.8 Optimize performance by tuning systems, making required changes to the way in which the various system resources are consumed. Coordinate with the Infrastructure

Team to make required changes to DFC infrastructure, recommending changes to business practices, and making changes to the applications.

C.3.1.9 Ensure that all software components are upgraded and/or maintained at the software vendor’s specified release/patch levels, and test and validate applications whenever any patches are deployed. Conduct change and configuration management, logging all application changes and bug fixes in a Kanban-like dashboard that is tracked within DFC’s approved ticketing system. Confirm that all nightly batch and other data exchanges are completed

C.3.1.10 Collaborate with DFC support contractors and government staff on the as-is and future state logistics of DFC hardware, software, and leasing licenses, including asset tracking. This includes an in-depth process for the identification of existing resources and making timely recommendations for best-in-class process improvements. Procure hardware, software, and leased equipment as specified at the task order level, with the ability to store the equipment in inventory offsite, at a secure facility operated by the

Contractor, manage and report on the inventory, and conduct imaging and shipping activities. Provide a turn-key equipment solution to include set up of a web page/portal for ordering equipment (FedRAMP certified and integrable with ServiceNow), inventory and storage capabilities for items ordered through the portal or otherwise for DFC, that meets the standards for secured facilities, verify receipt and condition of items received

(working with the manufacturer to return items Dead on Arrival, installation of a software image, preliminary asset management tagging and reports, and shipping to Washington, DC and other locations for the deployment of workstations, laptops, monitors, tablets, and other peripherals.

C.3.1.11 Provide services to install, configure, and integrate an audio-visual conference system into DFC conference rooms using three standardized options (small, medium, and large). The new system must fully integrate into a Cisco WebEx and Microsoft Teams environment, as well as Cisco Call Manager and Cisco Unity. Assist CISCO in resolving

Plan of Action and Milestones (POA&M).

C.3.1.12 Ensure all DFC required applications and interfaces are fully operational in the

Disaster Recovery (DR) and COOP sites, participating in one live exercise per year to ensure application availability. In the event of a disaster, execute the DR plan to restore the applications in the DR site.

C.3.1.13 Update and maintain the ServiceNow (SNOW) executive dashboard daily to allow OIT leadership to keep track of operations. Gather user stories and conduct business analysis activities in relation to SNOW, verifying user needs are met and kept within a backlog for future developments. Ensure the full operational integration of

SNOW within the larger DFC system, including the unimpeded flow of information between SNOW and other DFC applications and conducted any additional development found to be necessary.

C.3.1.14 Process, procure, and maintain an inventory of term and perpetual software licenses, hardware maintenance, and support requirements. Part of this includes having a detailed strategy and lifecycle management plan for software applications, infrastructure licenses, and hardware licenses. Manage a software and license executive dashboard that incorporates all software and licenses in use at DFC, as well as maintain access both as directly and for appropriate DFC government personnel to all external licensing portals.

C.3.2 Pool B – Application Development (App/Dev)

The Contractor shall support DFC OIT in all aspects of application development. Major areas of support include cloud and related IT services, data warehouse capabilities and services, continuous diagnosis and mitigation tools and services, App/Dev and mobile services, Data Architecture and engineering type support, and associated Operations and

Maintenance (O&M) for the development. Specific tasks in this pool that the Contractor shall complete include, but are not limited to, the following:

C.3.2.1 Support for DFC adoption/migration to/governance/management of Cloud computing operations, including support for generating and maintaining the FedRAMP

ATO documentation and participating in the continuous monitoring (CONMON) program. As well as activities associated with assessing Cloud solutions, refactoring workloads for Cloud solutions, migrating legacy or other systems to Cloud solutions, and providing management/governance for Cloud solutions. Development of cloud native applications or other Cloud orientated activities.

C.3.2.2 Database administration activities for all applicable DFC databases, responsible for the installation, upgrade, migration, patching, monitoring, performance tuning, enhancements conducting backup and recovery on databases and application servers and maintaining users and role-based security and object level security in the databases and applications.

C.3.2.3 Work with DFC Finance and Acquisition Offices on contracting and financial systems to assist DFC in management of the General Leger, Account Payable, Account

Receivable, Federal Administration, Small Fixed Asset, Load, Core Purchasing components, and development programs to fit business needs and maintain Axway

Secure Transport connections to interact with other government agencies.

C.3.2.4 Develop full-cycle Informatica and Oracle Data Integrator programs to perform

Extract-Transform-Load (ETL) from Salesforce and Oracle Enterprise Business Systems to dimensional models in Enterprise Data Warehouse with reporting capabilities.

C.3.2.5 Oversee the installation, upgrade, migration, patching, management, monitoring, performance tuning, enhancements, functionality improvements and innovations, and backup and recovery operations applications, website, programs, and platforms on the

DFC network. Develop and maintain system architecture diagrams, entity relationship models, and source to target mapping documents.

C.3.2.6 Conduct diagnostic and mitigation of DFC OIT approved hardware and software products, including the full complement of CDM Tools SIN products and services products associated with maintenance and other related activities such as training.

C.3.2.7 Manage service offerings for electronic credentials (assurance levels IAL, AAL, and FAL), identify and access management, authentication, and identity and access management professional services. Provide PIV products and PIV services to implement the requirements of HSPD-12, FIP-201, and associated NIST special publications and implementation components. Serve as a Public Key Infrastructure (PKI) Shared Service

Provider (SSP) to provide reliable, authenticated, policy-compliant service offerings to support Federally issued Personal Identity Verification (PIV), Personal Identity

Verification Interoperable (PIV-I), and associated certificates and cryptographic key service offerings.

C.3.2.8 Conduct as needed training on all hardware, software, cloud, and other applicable systems.

C.3.2.9 Support DFC’s wireless mobility solutions, including but not limited to

CONUS/OCONUS, facilities and remote requirements for Wireless Carriers Services, Telecommunication Resellers, Other Mobility End-Point Infrastructure - Mobility infrastructure, Mobility-as-a-Service, Enterprise Mobility Management, Mobile Backend-as-a-Service, Telecom Expense Management, Mobile Application Vetting, Mobile Threat

Protection, Mobile Identity Management, Internet of Things (IoT), and Other/Mobile

Services.

C.3.2.10 Provide a technical approach and execution for elements of a data management program and supporting architecture that would eliminate current DFC pain points and yield new benefits such as:

• A minimally customized data store that is easier to maintain and update

• Role-based security for both row-level and column-level policies and firewalled data marts to protect sensitive data (e.g., PII and proprietary financial information) while supporting external user access and publicly available data

• Robust metadata management for better cataloguing and definition of data fields

• Decoupling data warehouse from data storage (i.e., ELT vs. ETL) to support evolving business logic while retaining original source data

• Ability to connect best-in-class, stand-alone Business Intelligence (BI) tools to a data warehouse without having to build those BI tools into the data warehouse

(Ideally already inhouse Tableau, Oracle Analytics and Power BI products)

• Ability to incorporate external agency data via data connection (e.g., via application programming interface [API]) instead of batch uploading of flat files

• Ability to add new data sources and easily combine with existing data in new schemas for ad hoc analyses

• Ability to integrate from a Customer Relationship Management (DFC’s project origination platform) system (Salesforce), Oracle EBS and a document/records repository

• Better incorporation of project and project impact data to enhance visualization and reporting

• Underlying data models and designs that eliminate need for downloading datasets to local drives to perform analyses outside of the system

• Capture real-time updates to data queries and associated dashboard or other reporting outputs, eliminating the need to rerun and re-analyze data (e.g., for recurring, standard reports)

• Future data analysis capabilities that track the percentage of year-to-date revenue that could be impacted by potential investments

C.3.2.11 Provide post data warehouse implementation operations and maintenance support services including, but not limited to, backlog grooming, sprint planning, incident and problem management, change and configuration management, patching, compliance, system monitoring, and application performance.

C.3.3 Pool C – Cyber Security

The Contractor shall support DFC OIT in all aspects of its cyber security operations.

Major areas of support include security software and hardware tools, security-based

Operations and Maintenance, monitoring and reporting, threat detections, identification, monitoring, and like services, security policy and governance support, and access controls. Specific tasks in this pool that the Contractor shall complete include, but are not limited to, the following:

C.3.3.1 Support classified as Highly Adaptive Cybersecurity Services (HACS) operations. These services include governance, risk management, and compliance support, security architecture, standards and design, cybersecurity monitoring (Detection, Response, and Prevention), and threat intelligence.

The services covered under this response shall comply with the NIST RMF per Office of

Management and Budget (OMB) guidance along with the NIST Cybersecurity

Framework (CSF) Functions and be aligned with proven industry standards and best practices.

The DFC Cybersecurity Program is based on the NIST Risk Management Framework

(RMF) and NIST Cybersecurity Framework in accordance with FISMA, OMB and all pertinent NIST 800 special publications along with industry standards and best practices where applicable.

C.3.3.2 Provide computer security incident response (CSIR) services aligned with appropriate NIST 800 publications and best practices including, but not limited to:

i. Contingency planning

ii. Plan development and review

iii. Coordination and scheduling testing and documenting lessons learned

iv. Operations per project including documentation created or updated initially, testing conducted annually, and documentation updated based on lessons learned

C.3.3.3 Provide CSIR services related to Incident Response (IR) activities including, but not limited to:

i. Assist with IR Plan Development, Implementation and Review

ii. Perform Investigation to identify root cause (Forensic and Malware Analysis)

iii. Perform Data Recovery

iv. Develop Monitoring and Reporting Metrics

v. Documentation created or updated initially and develop IR Playbooks to be reviewed annually. Provide recommendations on reporting capabilities and periodicities for Agency approval.

C.3.3.4 Respond to Freedom of Information Act (FOIA)/E-Discovery requests

C.3.3.5 Develop rules of engagement for penetration testing for agency review and approval, providing a detailed report of testing to include lessons learned. Penetration tests are performed annually or as needed based on significant change or event. Support adversarial assessments as necessary to make sure DFC understands, if planned, how it would hold up to attacks.

C.3.4 Pool D – PMO Support Services

The Contractor shall support DFC OIT in all aspects of the operation of its IT Program

Management Organization (PMO). Major areas of support are vast and range from program and release management operations to agile adoption and implementation and requirements engineering, all the way to contingency management, COR support, and

User Interface/User Experience customer support. Specific tasks in this pool that the

Contractor shall complete include, but are not limited to, the following:

C.3.4.1 Provide program management support in the areas of strategic planning, portfolio management, business case analysis, risk management, communication management, contingency planning/management, operational division stand-up, performance measurement, program reporting, enterprise data gathering and reporting, and quality management.

C.3.4.2 Perform release planning and management activities such as the development of release management plans, technical analysis and support for production and maintenance builds, the development of configurable release guidance and other documents tailored for each release, support for release readiness reviews, configuration and implementation of release management software, and the implement release management data and documentation standards (for example: release numbering, required documents, etc.)

C.3.4.3 Support each IT PMO project with project planning and management, milestone status tracking and reviews, risk and issue identification, tracking and resolution and participation in program and release level activities. Project support shall align with the

DFC OIT selected development path, methodology, and delivery approach.

C.3.4.4 Support a wide range of agile adoption and implementation needs across DFC, with the intent of assisting in leading the agency to full agile adoption.

C.3.4.5 Assist DFC OIT Policy and Governance branch and the IT PMO to support the as-is state for policy and governance, but also recommend the to-be state based on best-in-class updates. This includes the ability to transform, tailor and maturate policy, process and standards in an agile and cloud first environment.

C.3.4.6 Provide support in the selection, tailoring, management, and execution of

Systems Development Lifecycle (SDLC) paths, methodologies, and approaches for development and delivery of program capabilities. Selected SDLC development paths shall include Waterfall, Iterative, COTs, Mobile Apps, Managed Services, or another

DFC approved path.

C.3.4.7 Establish and execute stakeholder engagement processes and models, as well as support the identification, as well as consistent definition, communication, and application of standards, processes, methodologies, and approaches for DFC operations.

C.3.4.8 Provide systems engineering and integration services to support upfront identification of program dependencies and integration points, as well as continuous monitoring, management, and response. Engineering support shall also be used for applying subject matter expertise and best practices for requirements development, analysis, management, traceability, validation, reengineering, and tool integration. All solutions architecture must reflect the strategic directions of DFC/OIT.

C.3.4.9 Perform business process analysis, reengineering support, creation of user stories, and project assessments to the program using modern techniques (ex: human centered design). This also includes work to define and establish Change Management and Change

Control processes for DFC. The Contractor shall support the establishment of a Change

Control Board (CCB) as the official mechanism for reviewing and recommending dispositions of change requests.

C.3.4.10 Support Configuration Management functions to include Investment Review

Board, Engineering Review Board, and CCB activities, business rule changes, configuration identification, configuration control, configuration status accounting and configuration audits.

C.3.4.11 Perform organizational readiness support working across technical and business organizations to ensure that the readiness work ties directly to the DFC’ goal of ensuring people, process and technology readiness to support development, delivery and operation of program capabilities. This also includes support to identify and plan for organizational change needed to support or resulting from the execution or delivery of OIT programs.

C.3.4.12 Support OIT budget operations, including identifying and recommending the optimal allocation and utilization of financial resources across contract in support of priority projects and services. This also includes planning and management support related to the CIO' s investment alignment with the corporate mission and strategic goals.

The Contractor shall provide expertise to ensure business processes are appropriately engineered before investing in those processes. The Contractor shall provide support for capital planning and management support related to the CIO' s investment alignment with the corporate mission and strategic goals. The Contractor shall provide expertise to ensure business. In addition: The Contractor shall provide analyses of investments via the documentation of financial, technical and strategic merits to ensure each one demonstrates a strong business case and is adequately justified.

C.3.4.13 Perform integration and coordination support to the Applications Development organization that encompasses risk mitigation planning, application system requirements management and impact coordination, test planning, deployment and operations/production process support, financial material weakness resolution and related integration, independent Verification and Validation (IV&V) type services for oversight of all work streams, and coordination activities as required.

C.3.4.14 Ensure the facilitation of transition activities between third-party contractors on

DFC contracts to accomplish the necessary knowledge transfer and ramp up activities between parties, including ensuring the OIT PMO can manage and oversee the program.

C.3.4.15 Assist DFC OIT Contracting Officer’s Representatives (CORs) with non-governmental, overarching IT program coordination services for DFC. For project being performed by OIT contractors, the contract shall provide backup support/assist the COR in the monitoring of these contracts.

C.3.4.16 Perform duties associated with User Interface (UI)/User Experience (UX) and/or

CI (Continuous Improvement)/Customer Experience (CX), User Interface (UI)/User

Experience (UX) and/or CI (Continuous Improvement)/Customer Experience (CX).

Section D: Packaging and Marking

D.1 Packaging

Unless otherwise specified, packaging of all deliverables must conform to commercial packing standards to assure safe delivery at destination. Clauses and other requirements regarding packaging shall be designated by the TACO at the task order level.

D.2 Marking

All deliverables required under this contract shall be marked in accordance with

Government specifications. At a minimum, all deliverables shall be marked with the base

IDIQ + order number and Contractor name.

Specific marking requirements may be addressed in individual task orders.

Section E: Inspection and Acceptance

E.1 FAR 52.252-2 Clauses Incorporated by Reference

This contract incorporates the following clauses by reference with the same force and effect as if they were given in full text.

Full text can be accessed electronically at the following: https://www.acquisition.gov/

FAR Clause Title

52.246-2 Inspection of Supplies – Fixed Price

52.246-4 Inspection of Services – Fixed Price

52.246-6 Inspection – Time-and-Material and Labor-Hour

52.246-16 Responsibility for Supplies

(End of Clause)

E.2 Place of Acceptance

The Contracting Officer or the duly authorized representative will accept supplies and services provided through orders issued against this IDIQ.

The place of acceptance will be specified in each individual task or delivery order.

Section F: Deliveries or Performance

F.1 FAR 52.252-2 Clauses Incorporated by Reference

This contract incorporates the following clauses by reference with the same force and effect as if they were given in full text.

Full text can be accessed electronically at the following: https://www.acquisition.gov/

FAR Clause Title

52.242-15 Stop-Work Order (Aug 1989) for other than cost-reimbursement task orders

52.242-17 Government Delay of Work

52.247-34 F.o.b. Destination

52.244-35 F.o.b. Destination, within Consignee’s premises

(End of Clause)

F.2 Period of Performance

The five-year ordering period is this IDIQ contract is [TBD] through [TBD].

A six -month extension to the ordering period may be exercised with an additional period of ordering from [TBD] through [TBD].

The notice of requirements for a unilateral exercise of the optional extension period is set out in FAR 52.217-8.

F.3 Delivery

The supplies and services under each individual task or delivery order shall be delivered and received at the destination within the timeframe specified in each order.

F.4 Place of Performance

Place of performance shall be set forth in the individual task or delivery orders.

Alternative work schedules (i.e., remote workplaces) may be included at the task order level. Any “onsite” work at DFC facilities shall take place at:

U.S. International Development Finance Corporation (DFC)

1100 New York Ave, NW

Washington, DC 20527

F.5 Notice to the Government of Delays

In the event the Contractor encounters difficulty in meeting performance requirements, or when it anticipates difficulty in complying with the contract delivery schedule or completion date, or as soon as the Contractor has knowledge that any actual or potential situation is delaying or threatens to delay the timely performance of this contract, the

Contractor shall immediately notify the TACO and the Task Award Contracting Officer

Representative (TA COR), in writing. This notification shall give pertinent details, but this data shall be informational only in character; this term shall not be construed as a waiver by the Government of any delivery schedule or date, or any rights or remedies provided by law or under this contract.

F.6 Schedule of Deliverables

a) The following is a schedule of all deliverables, including administrative deliverables, required during the period of performance of this base IDIQ.

Item Description Qty Due Date Deliver to Ref.

Monthly IDIQ

Contract Progress

Report

10th calendar day of each month

-IDIQ CO

-IDIQ COR

Sec.

F.6.1

Annual IDIQ

Contract Status

Report

Within 10 calendar days of IDIQ anniversary

-IDIQ CO

-IDIQ COR

Sec.

F.6.2

IDIQ Contract

Completion Final

Report

1 Final day of IDIQ

-IDIQ CO

-IDIQ COR

Sec.

F.6.3

Bi-Weekly Order

Level Project Status

Review (PSR)

Prior to PSR and bi-weekly participation

-IDIQ COR

-TACO

-TA COR

See

F.6.4

b) All applicable task and delivery orders and their required delivery dates, destination of delivery, and schedule for completion of work to be performed, will be specified in task and delivery orders issued under this IDIQ contract as applicable.

c) For purposes of delivery, all deliverables shall be made by close of business (COB)

4:30 PM EDT, Monday through Friday, unless stated otherwise in the task or delivery order.

d) All deliverables shall be submitted in electronic format shall be free of any known computer virus or defects. If a virus or defect is found, the initial deliverable will not be accepted. A replacement file shall be provided within two business days after notification.

e) Any failure of the Contractor to adhere to a delivery schedule or a deliverable requirement may be reflected in the Contractor’s past performance report.

f) The Contractor shall meet with the OIT staff, CO and COR, as necessary, to maintain satisfactory performance and to resolve other issues pertaining to

Government/Contractor procedures. At these meetings, a mutual effort shall be made to resolve all problems identified. Upon request, written minutes of these meetings shall be prepared by the Contractor, signed by the Contractor's designated representative, and furnished to the Government within two (2) workdays of the subject meeting.

F.6.1 Monthly IDIQ Contract Progress Report

The Contractor shall provide a Monthly IDIQ Contract Progress Report (summation of individual task order activity), which documents the Contractor’s delivery and/or task order awards and modifications received during the reporting period, significant activities, issues, corrective actions, and planned significant activities projected in the next 60-day period. The report is due by the 10th calendar day of each month consisting of activity from the previous month. (For example: The report due February 10th is to cover the activity – new task orders awarded and new modifications received - for the period January 1st through January 31st.) If the 10th calendar day falls on a weekend or holiday, the report is due the following business day.

If there is no activity (e.g. no active task order) during the reporting period, the report shall be submitted with “no activity” annotated under Task Order Summary section.

The Monthly IDIQ Contract Progress Report shall be provided in Adobe electronic format and emailed to the designated recipients listed in the deliverables table. The subject line of the email notice presenting the submission of the monthly report shall be annotated with – Monthly IDIQ Contract Progress Report.

The Monthly IDIQ Contract Progress Report shall be formatted to contain two main sections as indicated below, to be filled out as applicable:

Financial Status Report - The following shall be provided in Section I:

• Hours Expended during the reporting period by individual.

• Cumulative hours expended throughout the reporting period by job category.

• Contract funds expended during the reporting period.

• Schedule of Activities planned and estimated hours for the next reporting period and number of remaining hours to complete activities.

Progress Report - The following shall be provided in Section II:

• Descriptive information about the activities undertaken during the reporting period.

• Planned activities for future reporting periods.

• Summary of work accomplished during the previous month.

• Milestones and deliverables.

• IT ticket trends.

• Any issues, problems, or risks impacting project progress along with their ultimate resolution.

• Tracking of data calls from DFC or other agencies.

• Status of Contract meeting SLAs.

• IT asset inventory.

F.6.2 Annual IDIQ Contract Status Report

Like the Monthly Report, the Annual Progress Report shall summarize the progress of the contract and provide specific information on all the activities of the contract as described in the Statement of Work. The Annual Report should be cumulative for the contract year being reported and should:

Provide a description of the activities during the reporting period:

• Discuss problems encountered and how they have been addressed.

• Detail activities planned for the ensuing reporting period.

• Projects completed and reported clearly showing completed on schedule and within budget.

The Annual Progress Report shall be submitted in a format specified by the COR and shall include:

• An expenditure summary for the contract, including expenditures specific to each task outlined in the Statement of Work.

• A description of progress in each specific task identified in the Statement of Work.

• A discussion of any problems or difficulties encountered and proposed solutions.

The Contractor shall provide an Annual Progress Report to the Contracting Officer and

COR within 10 calendar days after the anniversary date of each contract year. No

Monthly IDIQ Contract Progress Report shall be due for the period when the Annual

Progress Report is due.

F.6.3 IDIQ Contract Completion Final Report

The report shall summarize:

• Objectives achieved.

• Significant issues, problems, and recommendations to improve the process in the future.

• Final Recommendation Statement.

F.6.4 Bi-Weekly Order Level Project Status Review (PSR)

If the Contractor does not have any active task or delivery orders during the reporting period, then participation in the bi-weekly order level PSR shall not be required.

If the Contractor does have an active order, they shall report on it during the Bi-Weekly

Status Review (PSR) and participate in the meeting. The Contractor shall attend the other DFC/OIT team PSRs as necessary. The Contractor shall prepare a presentation that provides the following:

• Operational highlights for the period.

• Operational trends.

• Identified risks and issues along with potential mitigation plans.

• For significant projects (that shall require more than a cumulative 160 hours of

Contractor or government level of effort (including customer time)) o Project objectives.

o Project Scope.

o Activities performed in the period.

o Planned activities.

o Risks and issues.

o Dependencies.

o Milestones and deliverables.

Section G: Contract Administration Data

G.1…