A04_SOW.pdf

Confidential

Microsoft Consulting Services Statement of Work

Introduction

Department of Interior Indian Affairs (IA) is preparing to launch a new project with six major workstreams, to continue improving and modernizing Bureau of Indian Affairs (BIA) Information Technology environment.

The overall goal of this project is to assess, plan, design, and execute the migration of on-premises servers and applications to the cloud, to help drop maintenance costs and increase reliability.

As part of that goal, IA is requesting assistance with improving enterprise security, particularly on endpoints and servers, using a Zero Trust methodology. Finally, IA wishes to continue efforts to widen both the productivity and effectiveness of M365 Office, OneDrive, SharePoint, and Intune, to minimize wherever possible the need for local on-premises servers. This will give IA employees a smoother and better user experience that is more suited to working remotely with good security practices.

Microsoft Consulting Services: Supplemental assistance from Microsoft Consulting Services (MCS) to

Indian Affairs’ existing full-time and contractor talent. MCS allows Microsoft to assist Indian Affairs in accomplishing ‘hands-on-keyboard’ work, building out Indian Affairs documentation, and working closely with Indian Affairs resources to complete migration workloads, as hours provided in this contract permit.

Microsoft Consulting Services

This section describes what type of assistance, guidance, and documentation Microsoft Consultants can offer, when requested and directed by Indian Affairs project managers. The group of Consulting resources that Indian Affairs will utilize through MCS will be referred to in the rest of this document as the

Microsoft Consulting Services Team or MCS.

1. Engagement objectives and scope

1.1. Objectives

The objectives of this effort are as follows:

• MCS Consultants will provide guidance on migration, cybersecurity, and management assistance for Microsoft cloud technologies.

• Microsoft consultants will work in parallel with IA key technical personnel, advising and guiding and providing informal knowledge transfer directly to their respective IA counterparts, as requested and required by the IA staff.

• Microsoft will execute as much of the work as possible remotely, using Microsoft infrastructure and collaboration tools, including Microsoft Teams.

• Microsoft will work with IA to put together an actionable plan to accomplish the IA work described in this contract, including timeline, resourcing, and upon request and direction from

Indian Affairs, provide documentation of the recommended design and approach. Work will include the following, under the direction of IA project managers:

o Assist IA in maintaining the plan throughout execution, including modifications after reviews with stakeholders, adjusting project plans, coordinating the sequence of visits and events and resources.

o Assist IA with planning and conducting communications with Indian Affairs personnel and stakeholders. The communications will include presenting the migration plan, assisting with achieving the recommended rhythm for communications and drafting technical content of e-mails, phone call agendas, and more, as directed by IA executive sponsors for this project.

o Work with IA to coordinate across the various Microsoft and IA resources to provide

Microsoft recommended practices about targeted tasks and workloads described in this document.

The objectives have been designed to assist IA as it plans, designs, and executes on the six workstreams identified in this document. The respective Digital Advisor or Solution Architect and a supporting

Microsoft Project Manager will act as the primary point of contact throughout this project for each of the

IA projects, coordinating at their level and summarizing the projects for senior management in IA, including suggesting what other types of tasks the MCS team members could perform.

Note finally that the MCS team will provide guidance around the Cloud Adoption Framework (CAF) and

Cloud Center of Excellence principles and can assist in educating IA during the planning to use CAF, since parts of this effort will utilize and/or depend upon cloud services.

1.2. Areas in scope

1.2.1. General scope

Microsoft will provide assistance in individual projects that require Consulting expertise in one or more of the areas of specialization listed below as time and budget allow. The project, including all six workstreams identified in this contract, will be planned, designed, and executed together with the customer, until the hours assigned to this contract are finished.

Workstream Description of Scope

DevOps • Assist with introducing SaaS based DevOps tracking tools such as Azure

DevOps.

• Assist with DevOps support and provide support to developers on Azure based Services.

• Assist in establishing new processes for application development management, as Indian Affairs determines is necessary.

• Assist with informal knowledge transfer to use Microsoft cloud technologies and tools to improve both productivity and accountability.

Server Migration from

On-Premises to the

Cloud

• Assist with upgrading, deprecating, or replacing Windows 2012 servers that are approaching EOL within six months; wherever it is most effective and efficient, the goal is to move as many of these servers as possible into the Microsoft Azure cloud.

• Assist with assessments of on-premises SharePoint to either Azure or

M365 online SharePoint platforms, then migrations of sites to the cloud

• Assist in identifying which on-premises servers and applications make sense to migrate, and which should be migrated first, by gathering inventory, raw data assessments of server processes and configurations, and interviews with application owners.

• Assist with developing and driving a reasonable migration timeline working with IA staff.

• Assist with actual server migration deployment, decommissioning of replaced or deprecated servers, and upgrade-in-place tasks.

Disaster Recovery, Backup, and Data

Retention Policy

Redesign

• Assist with rationalizing existing data archival stores, to retire out-of-date archives which Indian Affairs has determined are no longer required.

• Assist with replacing old tape-based systems with cloud backups and disaster recovery services.

• Assist with developing new retention policies that will meet DOI and

Federal guidelines.

• Assist with improving the speed of storage and restoration of data.

• Assist with Improving time-to-recover from server events.

CISA ZTMM

Compliance

• Assist with architecture design and strategy for implementing comprehensive Zero Trust Architecture across all five pillars of the CISA

Zero Trust Maturity Model (ZTMM).

• Assist with improving security scores and compliance for Indian Affairs tenants across the board by taking advantage of the licenses and products that BIA has already purchased

• Assist with fully integrating reporting and monitoring of the BIA enterprise with services provided by DOI.

Cloud and Endpoint

Management and

Compliance

• Assist with improving performance and governance and security using

Cloud Management and Compliance tools available to Indian Affairs, including Intune and Microsoft Defender for Endpoint (MDE)

• Assist with improving security through monitoring and alerts, cross-referencing with DOI and Federal regulations and requirements.

• Assist with leveraging and designing additional dashboards to offer customized views to monitor events that concern Indian Affairs most, as needed.

1.3. Areas out of scope

Any area not explicitly included in the Areas in scope section is out of scope for Microsoft during this engagement. Areas out of scope for this engagement are listed in the following table.

Area Description

Product licenses and subscriptions

Product licenses (Microsoft or non-Microsoft) and cloud service subscriptions are not included.

Hardware Microsoft will not provide or set up hardware for this engagement.

Product bugs and upgrades

Product upgrades, bugs, and design change requests for Microsoft products are not in scope for this engagement.

Source code review The Customer will not provide Microsoft with access to non-Microsoft source code or source code information. For any non-Microsoft code, Microsoft Services will be limited to the analysis of binary data, such as a process dump or network monitor trace.

Process reengineering Designing functional business components of the solution is not included.

Organizational change management

Designing—or redesigning—the Customer’s functional organization is not included.

Training Formal training of customer staff is not included.

Third-party software Microsoft will not be responsible for integration with third-party software.

Use of competing, non-Microsoft tools and products is not included

Data migration Actual execution of data migration activities is not in scope for this project. Microsoft can assist with planning and strategy for data migration projects, however.

Testing Testing and configuration of applications and services outside of those required to support the deployment of the solution

Network & Storage Troubleshooting or remediation of existing network and storage systems

2. Engagement approach, timeline, and deliverable acceptance

2.1. Approach

Microsoft will supplement the IA project technical staff for this engagement and help as directed by the designated project manager, utilizing IA designated project methodologies. The project manager will provide directions to the overall project team, of which Microsoft will be a part.

Should changes be needed to the agreed upon staffing mix, you will work with the Microsoft delivery manager to make a change following the management process described below.

2.1.1. Engagement initiation

Upon contract signature, the following prerequisite activities must be initiated.

Category Description

Microsoft activities

The activities to be performed by Microsoft

• Conduct a pre-initiation call in order to initiate team formation and communicate expectations.

• Document the engagement launch prerequisites using input from this SOW.

• Track the status of launch prerequisites and adjust the engagement initiation phase start date accordingly.

• Conduct a detailed walk-through of the SOW with the customer.

Customer activities

The activities to be performed by the Customer

• Attend and participate in the pre-initiation call.

• Participate in a detailed walk-through of the SOW.

• Assign engagement initiation and launch prerequisites responsibilities to accountable customer leadership and establish target completion dates.

• Complete the engagement initiation and launch prerequisites.

• Staff the engagement with the required customer resources in the time frames that were agreed upon in the preinitiation call.

2.2. Timeline

The project plan will be defined and adjusted through the period of performance by the IA project manager.

Microsoft will provide a Project Manager who will be under the direction of the IA Project Manager to assist with logistics, status reports and general scheduling of the MCS team members.

A Digital Advisor or Solution Architect will provide strategic design, Adoption Change Management, and other planning and process or operations redesign assistance, again as directed by the IA Project

Manager.

Microsoft will provide the resources during the contract period of performance up to the extent of the funding authorized under the contract. Should you need additional resources and/or a longer term, you will work with the Microsoft Delivery Manager to make a change following the Change management process described below.

2.3. Deliverables

Microsoft has no specific service deliverables requiring formal acceptance.

During the engagement, the IA project manager will assign tasks to the joint project team. Microsoft anticipates working with the IA team as directed by the IA project manager to assist with the following types of deliverables. All deliverables are deemed accepted upon delivery.

Deliverables Description

Strategic Plan Strategic Plan

Roadmaps Roadmap

WBS Work Breakdown Structures for each major Project in the Roadmap

Architectural Designs Architectural Designs

Documentation of Work Done Step-by-Step Instructions, How-Tos, Documentation of

Configurations

2.4. Engagement governance

The IA project manager will manage the engagement and define the project management approach that will be followed by the Microsoft team. Microsoft assumes the basic governance structure and processes described in the following sections will be followed.

2.4.1. Engagement communication

The following will be used to communicate during the engagement:

• Status reports: the Microsoft Project Manager will prepare and issue written monthly status reports for the project manager and the Microsoft delivery manager.

• Status meetings: the Microsoft team Project Manager will participate in regular status meetings scheduled to review the overall engagement status and to review open problems and risks.

2.4.2. Risk and issue management

The Microsoft team will assist the project manager in identifying project issues and risks. You will be responsible for managing project issues and risks.

The following general procedure will be used to manage active project issues and risks during the engagement:

Identify: identify and document project issues (current problems) and risks (potential problems that could affect the project).

Analyze and prioritize: assess the potential impact and determine the highest priority risks and problems that will be actively managed.

Plan and schedule: determine the strategy for managing priority risks and issues and identify a resource who can take responsibility for mitigation and remediation.

Track and report: monitor and report the status of risks and problems.

Escalate: escalate to project sponsors the high impact problems and risks that the team is unable to resolve.

Control: review the effectiveness of risk and issue management actions.

Active issues and risks will be regularly monitored during the engagement.

2.4.3. Change management process

During the engagement, either party can request, in writing, additions, deletions, or modifications to the services described in this SOW (“change”). Approved changes will be managed through amendments and could lead to additional costs and schedule impacts. Microsoft will have no obligation to commence work in connection with any change until the details of the change are agreed upon in an amendment signed by the authorized signatories from both parties.

Within three consecutive business days of receipt of the proposed amendment, IA must either indicate acceptance of the proposed change by signing the amendment or advise us not to perform the change. If

IA does advise Microsoft not to perform the change, Microsoft will proceed with the original agreed upon services only. In the absence of IA acceptance or rejection within the previously noted time frame, Microsoft will not perform the proposed change.

2.4.4. Escalation path

The Microsoft delivery manager will assist the customer project manager, sponsor, and other designers to manage project issues, risks, and change requests as described previously. The customer will provide reasonable access to the sponsor(s) to expedite resolution. The standard escalation path for review, approval, or dispute resolution is as follows:

• Engagement team member (Microsoft or the Customer).

• Customer project manager and/or Microsoft delivery manager.

• Customer project sponsor.

2.5. Engagement completion

Microsoft will provide services defined in this SOW to the extent of the fees available and the period of performance specified in the Work Order. If additional services are required, the Change management process will be followed, and the contract modified. The engagement will be considered complete when at least one of the following conditions has been met:

• All funding has been utilized for the hours of services delivered and expenses incurred.

• The period of performance of the engagement has expired.

• All Microsoft activities and in-scope items have been completed.

• The Work Order has been terminated.

3. Engagement organization

3.1. Engagement roles and responsibilities

The key engagement roles and the responsibilities are as follows.

Customer

Role Responsibilities

Project sponsor • Provide the estimated engagement commitment of: 8 hours per week.

• Make key project decisions.

• Serve as a point of escalation to support clearing project roadblocks.

• Authority to request expansion of workstreams outside already tasked assignments.

Project manager • Provide the estimated engagement commitment of 16 hours per week.

• Serve as primary point of contact for the Microsoft team.

• Manage the overall project.

• Deliver the project on schedule.

• Take responsibility for customer resource allocation, risk management, and project priorities.

• Communicate with executive stakeholders.

• When expansion of workstreams are requested by Project Sponsor, begins coordination with MSFT team to plan for changes in roles and assignments required to support the change.

Technical team lead

• Provide the estimated engagement commitment of 20 hours per week

• Serve as primary technical point of contact.

• Take ownership of technical architecture, design and code deliverables.

Lead business analyst • Provide the estimated engagement commitment of 8 hours per week

• Serve as primary functional point of contact for the team that is responsible for functional business analysis.

Microsoft

Role Responsibilities

Digital Advisor /

Solution Architect

• Provide guidance and Microsoft recommended practices for the overall IA

MCS workstream efforts; roll up results for regular review by IA leaders.

• Work with IA to assist with design and execution of the new cloud strategy, methodology, and documentation based upon principles from Microsoft

Cloud Adoption Framework and PROSCI Adoption Change Management

(ACM) and Azure Migration standards.

• Assist in developing targeted Training Plans for major cloud service, Proof of Concept, or migration, specific to various IA audiences and engineers.

• Assist with Project workstreams.

• Assist with technical architecture advice and guidance for in-scope.

Microsoft products and technologies based on Microsoft recommended practices.

• Assist with overall strategic direction, assistance, Cloud Adoption

Framework planning and execution, and adoption change management.

Consultants

• Assist with development and execution of server upgrades and deployments in the Cloud. Cybersecurity improvements, new Cloud-based monitoring and management tools, Disaster Recovery and Backups from and to the Cloud.

• Assist with guidance on training, documentation and hands-on keyboard assistance work during the migrations of systems and data.

• Assist with Azure Active Directory and hybrid join and Multifactor

Authentication (MFA).

• Provide guidance during calls with DOI OCIO and IA ACIO Identity, Intune, and Azure engineers.

• Assist with improving turnaround and response to Azure and M365 platform security, policy, and compliance reporting (including patching reports).

• Assist in education and Microsoft recommended practices for cybersecurity and increasing higher security scores and meeting compliance requirements for IA.

• Assist with developing new patching modernization plans and executing on these plans using Cloud technologies.

• Provide guidance and recommendations for developing Azure Resource

Management (ARM) templates to help standardize IA servers’ configurations in the cloud.

• Assist with meeting DOI regulations and requirements for workstations and servers more effectively.

• Assist with build-out of Privileged Access Workstation (PAW) cloud administration workstation, including exploration of use of Azure Virtual

Desktop (AVD).

• Assist in education and Microsoft recommended practices for standardization of endpoint configuration.

Role Responsibilities

Account Delivery

Manager/Project

Manager

• Manage and coordinate the Microsoft team.

• Serve as a single point of contact for escalations, billing issues, personnel matters, and contract extensions.

• Assist customer Project Manager with logistics, tracking MCS team hours, Status Reports, and updates to project plans as directed by IA Project

Manager.

4. Customer responsibilities and engagement assumptions

4.1. Customer responsibilities

In addition to Customer activities defined in the Approach section, the Customer is also required to:

• Provide information:

o This includes accurate, timely (within three business days or as mutually agreed-upon), and complete information.

• Provide access to people and resources.

o This includes access to knowledgeable customer personnel, including business user representatives.

• Provide access to systems.

o This includes access to all necessary customer work locations, networks, systems, and applications (remote and onsite) as needed to complete the work assigned to the Microsoft consultant.

• Provide a work environment.

o This consists of suitable work spaces, meeting rooms, including desks, chairs, and Internet access.

• Manage non-Microsoft resources.

o The customer will assume responsibility for the management of all customer personnel and vendors.

• Manage external dependencies.

o The customer will facilitate any interactions with related projects or programs in order to manage external project dependencies.

• Obtaining requisite clearance.

• Holding requisite clearances or submitting Microsoft Consultants / Engineers identified to support this effort into the clearance process. To include any additional resources that may be required to support this effort.

4.2. Engagement assumptions

The engagement scope, services, fees, timeline, and Microsoft detailed solution are based on the information provided by the Customer to date. During the engagement, the information and assumptions in this SOW will be validated, and if a material difference is present, this could result in Microsoft initiating a change request to cover additional work or extend the engagement duration. In addition, the following assumptions have been made:

• Workday:

o The standard workday for the Microsoft team is between 8 AM and 5 PM, Monday through

Friday.

• Standard holidays:

o Observance of consultants’ country-of-residence holidays is assumed and has been factored into the engagement timeline.

• Remote working:

o The Microsoft team will primarily perform services remotely. Travel money is set aside as part of this proposal, which allow one monthly visit by the Digital Advisor and when requested up a mutually agreed upon number of visits by Senior Consultants on-site at the BIA Datacenter located in Albuquerque, New Mexico, or at the Microsoft Technical Center in Denver, Colorado. If travel funding is not used up, IA can request a change modification to switch it to additional Consulting hours.

o If the Microsoft team is required to be present at the customer location on a weekly basis, resources will typically be on site for three nights and four days, arriving on a Monday and leaving on a Thursday.

• Language:

o All engagement communications and documentation will be in English. Local language support and translations will be provided by the Customer.

• Staffing:

o If necessary, Microsoft will make staffing changes. These can include, but are not limited to, the number of resources, individuals, and engagement roles.

o Microsoft will engage the specific resources as deemed necessary by Microsoft to support a specific technical area. This could require multiple individuals engaged to support the engagement, based on technical specialty.

o Microsoft reserves the right to utilize whichever labor categories in whatever quantities we determine, in our sole discretion, are appropriate to perform the services.

o All resources will have the appropriate level of security access required to complete engagement-related efforts or customers will submit individuals for the appropriate level of security access.

o Work performed remotely and not of a classified nature will be performed by U.S. Citizens.

Full customer clearance is not required.

o Microsoft will require at least four weeks’ lead time to (1) identify resources to staff the roles on this project and (2) adjust the resource staffing mix based on changes requested by the customer or changes judge by Microsoft to be needed to meet customer direction.

• Informal knowledge transfer: Customer staff members who work alongside Microsoft staff will be provided with information knowledge transfer throughout the engagement. No formal training materials will be developed or delivered as part of this informal knowledge transfer.

• Other assumptions:

o Activities surrounding the customer’s processes have not been factored into the schedule nor pricing. If the customer expects Microsoft to attend meetings / boards for C&A and security plans and / or participate in the creation of artifacts for the customer’s internal process, then a change will need to be executed to extend the Period of Performance and to add funding.

o Microsoft will not provide services beyond the funded amount. The funded amount is calculated based upon the current hourly rates for labor categories defined in the Price

Proposal.

o All work is to be contiguously scheduled. Any breaks in the engagement calendar must be scheduled four weeks in advance or will be billed without interruption.

o Lab and / or development facility is available.

o Any delay on delivering customer required items could impact the delivery schedule.

1.3. Areas out of scope

2.5. Engagement completion