FINAL CO Incorporated SOW.docx

United States Department of Agriculture

REQUEST FOR PROPOSAL &

PERFORMANCE WORK STATEMENT USDA

INTERNATIONAL TECHNOLOGY SERVICES NEXT GENERATION MOBILITY

Version 2.1.1 August 2012

SCMI IOL Document Title Here Prepared by:

OCIO International Technology Services Infrastructure Operations Division

type of contrAct

The United States Department of Agriculture (hereafter known as the “Government” or “USDA”) plans to award one (1) single-award blanket purchase agreement (BPA).

Contractors must submit a quotation inclusive of ALL of the categories of the Next Generation Mobility in order to be considered for award. The Government reserves the right to structure awards as it deems necessary when it is determined to be within the best interest of the Government. (The Government does not intend to award any BPAs on a multiple-award BPA basis, i.e., a BPA award to multiple vendors wherein all vendors compete for each BPA call.)

The Government is obligated only to the extent of authorized BPA Calls actually placed against the BPA. Each BPA Call (Delivery Order (OF-347) or Government Purchase Card order) will be issued based upon the BPA’s firm-fixed price list. Contractor performance will be measured based upon specified performance metrics. The performance metrics shall be known as the BPA Performance Delivery Summary (PDS). See Exhibit 2.

No funds are obligated by issuance of this BPA. Funds will only be obligated upon issuance of BPA Calls against the BPA. The total amount of funds obligated against any single-award BPA (i.e., the total amount of all BPA Calls) shall not exceed $20,000,000.00 over the five year term of the BPA. The Government has the option to increase or decrease this amount at any time during the performance period for any specific single-award BPA.

All orders under this BPA will be issued on a firm, fixed-price basis.

Intended Use of the BPA

The Government intends to use this BPA primarily as a means to accomplish multiple acquisitions, or BPA Calls, for mobility device management throughout the fiscal year period of October 1st through September 30th. Immediately following BPA award, the Government will provide to its offices a catalog listing of approved supplies/services available for purchase under the BPA.

BPA Calls will be issued by a warranted Contracting Officer of the USDA, Office of Procurement and Property Management, Procurement Operations Division and miscellaneous BPA calls may be executed by ITS-authorized personnel via Government Purchase Card and/or delivery orders.

This BPA is a USDA-wide authorized BPA and will provide the ability to acquire these products and services for use by the 3500 Field Service Center Agencies (SCA) of the United States Department of Agriculture (hereafter referred to as the “Government” or “USDA”) and other agencies, agency offices, or agency divisions of USDA that are supported by the Office of the Chief Information Officer (OCIO) and OCIO, Information Technology Services (ITS). This also includes the Departmental Administration Staff Offices (DASO) of USDA. The SCAs include, but are not limited to, the following agencies: the Farm Service Agency (FSA), the Natural Resource Conservation Service (NRCS), and the Rural Development (RD). The scope of this BPA shall include any additional agencies, agency offices, or agency divisions of USDA that may become supported by the ITS during the life of the BPA.

General Information Introduction In this new era of mobile computing, powerful hand held devices, wireless communications and cloud services, new boundaries are being established within USDA that support the mobilization of our workforce and that blur the lines between personal computing and corporate resources. USDA needs to stay on the forefront of these technical trends with a well-thought out strategy and a solution that encompasses a flexible architecture that will enable us to manage and operate these transformational opportunities in business delivery.

The consumerization of technology and in particular mobile devices is forcing the use of personal devices into the corporate world, significantly increasing the speed, flexibility, and agility with which the workforce can react to change. As mobility moves beyond wireless access to email, contacts, and calendars, USDA must create a unified strategy for managing its mobile computing environment.

Rapid adoption to new technologies and devices is becoming the new norm as we seek centralized management and control over these new trends. In this rapidly changing environment, IT must create an environment that is secure, reliable, scalable, and enables users at the intersection of mobility and cloud services. Everything must appear “seamless” to end-users while delivering significant business value in a secure manner.

To best use the opportunities provided through mobile computing, USDA needs to build a solid foundation for executing a mobile strategy, combining device management, application delivery, and Bring-Your-Own-Device (BYOD) concepts to empower mobile users while improving IT insight, gaining control, and cutting costs.

ITS (International Technology Services) is responsible for managing mobile devices within USDA. While the number of devices supported today is slightly more than 3,000, it is expected that the number of devices (both Government owned and personally owned), will grow to over 100,000 in the next few years. ITS does not seek to assume the role of the integrator for all the proposed solutions. We are looking for an integrated solution(s) that allows us to efficiently support a wide range of devices, manage mobile applications, and maintain security boundaries between personal and Government data.

ITS encourages all vendors to submit proposals to this RFP for all options that the Vendor(s) can technically support. We realize that the field of Mobile Computing is changing rapidly, and standards continue to be formed within the Vendor community. It is expected that many proposals may consist of solutions from multiple Vendors. The proposals must include integration and architecture services that allow Vendor solutions to work seamlessly with each other and within our environment.

SCOPE

USDA desires a solution for the following core Mobility Management components: Mobile Device Management (MDM), Mobile Application Management (MAM, Enterprise App Store) and Container Solution (to protect applications and data on GFE and BYOD devices).

USDA has identified the following possible solutions. Vendors are encouraged to respond to any of the following options or introduce other similar solutions that may fit the scope of this project.

1. On-Premise Solution

2. Cloud Solution

3. Hybrid Solution 4.

For the purposes of this solicitation an On-Premise solution is defined as all HW/SW components running completely within USDA data centers and network. After installation, USDA will be responsible for operating the infrastructure and devices, app store and container management. The offeror will provide recommended hardware specifications for the On-Premise solution. The offeror will price and make available through the proposal for license all required SW. The offeror will price any associated consulting services deemed necessary to fast-track installation, configuration and quick start for the software configuration and hardware tuning. USDA will provide based on the offeror’s specifications all computing infrastructure and network connectivity.

For the purposes of this solicitation a Cloud Only solution will be defined as all HW/SW components of the solution will run in the offeror’s cloud data center. The offeror will provide all required hardware to the network edge of their cloud data center. The offeror is responsible for all aspects of system and software performance for solution components within their cloud data center.

For the purposes of this solicitation a Hybrid solution is defined as a solution where the components are distributed across USDA data centers and the offeror’s cloud data center. It is expected that the offeror will provide all required hardware to the network edge of their cloud data center. The offeror will clearly define and price all HW/SW components that will be within USDA data center and those components within the offeror’s cloud data center. The offeror is responsible for all aspects of system and software performance for solution components within their cloud data center.

NOTE! Regardless of the option chosen, USDA will perform all device, app store and container management via the provided console. This includes performing the day to day administrative functions associated with administering mobile devices (enrollment, setting policies, wiping devices, etc.), applications and container services. For example, USDA designated personnel will register, wipe, lock, create policies and other functions that are part of the MDM solution. Similarly, for MAM and the container, USDA will operate the software and perform the functions inherent in the software tools.

USDA is requesting a complete, end-to-end, solution from a single Vendor. Vendors may propose a proprietary solution or one built through partnerships with other providers.

USDA/ITS is seeking pricing by user or by device, based on tiering.

Mobile Device Management (MDM) USDA is seeking a Mobile Device Management solution that enforces defined security policy requirements, scales to manage our current footprint of 3,000 devices to over 100,000 devices, and can provide support for constantly changing technology in industry supplied mobile devices. Any proposed MDM solution must include features such as OTA (over the air administration), logging and tracking, inventory management, and role based management.

Enterprise App Store, MAM (Mobile Application Management) USDA is seeking a MAM solution with the ability to deploy both in-house and commercially developed applications. The MAM solution at a minimum must include the following application delivery lifecycle managed functionality; securing, deploying, updating, and removing both in-house and commercially developed applications. The Mobile Application Manager (MAM) should integrate into the MDM solution.

Container Solution As mobile devices have become prominent for personal use, there is a need to manage Government data and information on personal devices. In order to accommodate this changing business model, Government data must be encrypted and maintained within secure boundaries that are isolated from personal data and information. USDA is seeking a solution that allows Government data to be securely isolated from personal data, will allow containered applications to execute even when the device is in a disconnect state, and can be managed from the MDM solution. Data in the secure “container” must be bi-directionally synced to USDA-dedicated servers, where the information can then be backed up or archived. Capabilities also need to include the ability to remotely wipe the Government Data/Information container, in case the personal device is compromised, lost or stolen.

Environment Description Current State USDA’s Current Mobility environment includes:

The USDA is made up of multiple disparate Active Directory forests that contain 17 different agencies of approximately 130,000 users in 3000 office locations around the globe. Most agencies maintain their own network and firewalls but all are connect via a central backbone called USDA UTN.

The Department utilizes Microsoft’s Online Service Office365 for Messaging Collaboration. All agencies decommissioned their email system and migrated to the private cloud. USDA’s Office365 has no direct access to the internet and all traffic (i.e. ActiveSync) must come through a USDA proxy except Blackberry. Blackberry servers are hosted and managed by Microsoft as part of Office365. Currently there are approximately 12,000 managed Blackberries. The only access USDA has to the Blackberry servers is via the console and no connections are allowed to SQL directly.

Two years ago USDA purchased McAfee’s Enterprise Mobility Manager (EMM) to manage mobile devices throughout the Department. Today EMM manages 3600 mobile devices (phones and tablets) which consist of iOS, Android 2.2+ and some Windows 7. EMM utilizes LDAP connectors to authenticate users and assign security policies. EMM also acts as an Active Sync proxy to facilitate mail sync back to Office365. No mobile devices have the ability to connect directly from the internet to the Office365 infrastructure in the private cloud so EMM facilitates the connection.

EMM is hosted in 2 facilities in passive/active implementation. St. Louis, Missouri houses the current active datacenter that handles all EMM mobile traffic including the mobile Office365 connections. Kansas City, Missouri houses the backup datacenter that will go live in the event of a St. Louis failure. A DNS record is utilized to control the cutover to the backup datacenter.

All agencies are assigned an individual EMM security policy which they own and manage. The agencies also have access to the EMM console to support their own devices to enroll, track, wipe, etc...

The below logical diagram depicts a high level view of EMM and USDA infrastructure.

Future State In the near future USDA will go through a major consolidation of all agency Active Directories to a single forest. While the current state has multiple Active Directories, USDA will be looking for a mobile solution can adapt as users are migrated to the single forest.

The number of users will stay relatively stable in the coming years but the number of mobile devices is anticipated to increase significantly. The number of blackberries should stay flat or reduce but it is expected that iOS/Android/Windows 8 devices combined will see an increase up to 100,000 devices.

While GFE mobile devices will increase, most growth should come from BYOD. USDA has an initiative to implement a mobile solution that will allow for BYOD. The solution will be a container based approach that can utilize for both GFE as well as BYOD.

USDA will offer a mobile office suite of applications that will allow for increased productivity and flexibility. The office suite will be offered inside a container that can be installed on a GFE or BYOD device. The applications will have the ability to integrate with Office365 for email and SharePoint access.

USDA will also offer an Enterprise App Store and Catalog while still allowing for individual apps to be purchased via public app stores. User profiles or policies will be used to assign various applications based on role. USDA has broken down users in 2 different types of roles:

a. Basic Mobile User

i. Container Option – Email and Secure Browser Container(GFE or BYOD)

ii. GFE MDM Option – Email only and browser via VPN

b. Mobile Office User – Email, Browser, Office Suite, File Manager, Bi-directional Sync of data, Container(GFE or BYOD) General RequirementS This section addresses the overall requirements for the proposed solution and is broken down into proposed solution requirements and professional services that span the MDM, MAM, and Container solutions.

General Solution requirements The proposed solution needs to meet the following requirements:

1. Timely (within 2 weeks) support of for new devices with supported OS

2. The solution needs to be generally available (24x7) to all approved users that require access.

3. A thirty day pilot will be required after the solution is ready for production.

4. The solutions must, at a minimum, support iOS (4.x and up), Android (2.2 and up), and Windows (8 and up when available)

5. Cloud service must be a private cloud dedicated to USDA or a cloud dedicated to Federal Government use only

6. The MDM/MAM solution must be hosted within the same cloud service.

7. Solution can be an on-premise implementation, 3rd party (cloud) implementation (devices and console managed by USDA), or combination of both. Performance of any solution cannot be impaired by physical location of infrastructure (i.e., should perform the same regardless where it is hosted)

8. For an on-premise solution, the vendor will provide the architecture for the necessary infrastructure to support an integrated solution of MDM, MAM and Container.

9. It is the vendor’s responsibility to inform and coordinate the acquisition of necessary MDM certificates. USDA will own all certificates used for MDM management and authentication.

10. User Base: Initially approximately (3,000), Vendor must be able to scale for potential growth of 100,000 or more mobile devices.

11. Must be able to support connections and authentications to multiple Active Directory infrastructures (multiple Forests and Domains)

12. New system must pass Certification and Accreditation within 6 months

13. Architecture must be resilient and redundant for high availability (99.5% uptime minimum)

14. System architecture must be open for integrating with other tools

15. The vendor will identify in the proposal the changes necessary to meet upgrades to USDA infrastructure, such as network improvements.

Professional Services The vendor selected is required to provide initial deployment and future agency integration services as required for the proposed hosting services. These services are expected for installing, configuring, and certifying the initial deployment of the MDM, MAM and Container solutions for USDA and for additional professional services as needed, such as services for agency specific integrations or customizations.

Initial deployment services The vendor is responsible for providing steps necessary for deploying and integrating their Mobility Solution into the USDA environment. The steps included will be dependent upon whether the solution is on-premise, or cloud solution. The services required for the initial deployment of the 3 solutions include:

· Installation and configuration of the MDM, MAM, and Container solutions

· Integration with 3 Active Directories to be determined by USDA

· Integration with Office365

· Deployment of basic and office containers on IOS (4.x and 5.x) and Android (2.x,3.x,4.x) devices Future Agency Deployment Services In addition to initial deployment services, future agency integrations may be required, including, but not limited to:

1. Active Directory

2. Customized Application Deployment

3. Firewall Configuration

4. Service Accounts Technical requirements Mobile Device Management (MDM) The Mobile Device Management solution will secure, monitor, manage and support mobile devices deployed across various mobile carriers and Wi-Fi networks. MDM functionality will include over-the-air (OTA) distribution of applications, data and configuration settings for all types of mobile devices, including mobile phones, smartphones and tablet computers. The functionality and control can apply to GFE and/or BYOD. The following features in this section are required features in the vendor solution.

Device Diversity The MDM tool must support the following mobile devices (phones and tablets) and mobile OS platforms in the USDA Mobile computing environment.

1. Ability to support iOS version 4.x and up

2. Ability to support Android (2.2 and up, including 3.x and 4.x)

3. Ability to support Windows 8 when available Policy Enforcement The solution must provide the specified functionality that allows USDA to enforce their device management and security rules and regulations.

1. Ability to only register approved devices

2. Ability to push and enforce policy to enrolled devices

3. Ability to limit a user by device, and the number of devices

4. Ability to enforce USDA defined password policies

5. Ability to detect OS platforms and versions

6. Ability to detect installed applications

7. Ability to detect jail-broken and compromised devices

8. Ability to restrict or prohibit access from non-compliant devices to corporate servers and data

9. Ability to whitelist and blacklist applications

10. Ability to monitor and enforce mobile communications expense policies

a. Roaming usage (Block).

b. Data service plan restrictions

c. International use (and Block)

11. If a container (BYOD) is in use, ability to restrict data in and out of container.

12. Ability to log and alert on all policy events including security events

13. Ability to configure and filter alert notifications by policy

14. Ability to provision a mail client or container on iOS

15. Ability to provision an encrypted mail client container on Android Security and Compliance A set of mechanisms to protect corporate data on a device, corporate back-end systems and preserve compliance with regulations:

1. Ability to configure strong passcode (device password) settings, compliant with USDA policy.

a. Support for > 6 alphanumeric characters

b. Custom number of tries before locking the device Custom Passcode aging

c. Custom Restrictions for passcode rotation

d. Ability to reset device passcodes

e. Ability to lock a device

2. Ability to lock the device after a custom number of minutes of inactivity

3. Ability to block non-encrypted and jailbroken devices.

4. Ability to remotely wipe the device

a. Support for selective remote wipe (e.g., only corporate content);

b. Support for total remote wipe (hard wipe, data not recoverable after deletion)

5. Support for certificate distribution Device Administration The solution must provide the defined capabilities for IT administrators to manage mobile deployments and users.

General MDM Capabilities:

1. Secure web-based console for managing mobile devices

2. Granular Role-based access

a. Helpdesk (wipe, unlock, reset passcode, delete, etc.)

b. Policy Admin(Create, assign and administer policies)

c. MDM Admin(full admin)

3. Active Directory or LDAP Group-based actions

4. Enterprise platform integration (This depends on whether it is on-premise or cloud)

a. Office365

b. Integrate with multiple Active Directories

c. Third party [USDA, VeriSign] certificate authority for pushing out Digital Signing, encryption, and authentication certificates to the device’s certificate store.

d. trouble ticketing and help desk (Remedy) (optional)

e. network management (if device capable)

i. Wi-Fi control

ii. Roaming control

iii. VPN Management

iv. Bandwidth Management

f. Integration with SCOM (on-premise solution only)

5. Ability to enroll device into MDM environment

6. Ability for the administrator to provision a device to a user

7. Ability to limit number and type of device, device ID on a per user basis.

8. Ability to Issue a certificate to a device for device authentication.

9. Ability for the administrator to activate and deactivate a device

10. Ability to set policies and profiles on the device

11. Ability to lockdown hardware features

a. enable/disable camera

b. enable/disable removable media card

c. enable/disable infrared [IR] port

d. enable/disable Bluetooth

e. enable/disable Wi-Fi

f. enable/disable other common features

12. Ability to remove device from MDM environment (retired, lost, stolen, irreparably damaged)

13. Ability to wipe the whole device

14. Ability to selectively wipe a device

15. Ability to lock/unlock device

16. Ability to custom search, query and analyze the MDM database with built-in tools.

17. Device Based End-to-End monitoring or testing tools (connectivity and/or service verification) This should be an app on the device which performs these functions:

a. Verify network connection and performance

b. Test authentication settings

c. Verify Certificates

d. Verify DNS functionality

18. Centralized Monitoring tool based end-to-end monitoring or testing tool

a. Verify network connection and performance

b. Test authentication settings

c. Verify Certificates

d. Verify DNS functionality User Requirements:

1) Ability for the user to self-provision a device

2) Support for self-help functionality

a) Device passcode reset

b) Ability to wipe device Over-The-Air (OTA) administration (Default Requirement) The solution must include wireless (carrier or Wi-Fi) capabilities for IT administrators to manage mobile devices remotely. This includes:

1. Ability to OTA register and provision a device

2. Ability to OTA wipe the whole device

3. Ability to OTA selectively wipe a device

4. Ability to OTA installation of default apps (email, word, excel, or other applications)

5. Ability to OTA monitor and query a device

6. Ability to OTA set policies and profiles on the device

7. Ability to OTA lockdown hardware features Inventory Management The solution must include a set of mechanisms to provision, control and track devices connected to corporate applications and data:

1. Ability to inventory and asset manage devices

2. Ability to track device information

a. Device Manufacturer/Model

b. Carrier

c. Wireless Number

d. MAC Addresses

e. International Mobile Equipment Identity (IMEI)

f. SIM module data

g. Storage capacity

h. OS and Version

i. Device up time

j. Encryption Capability

3. Ability track mobile device user information

a. User profile information

b. User Name

c. Email

d. Phone number

4. Ability to track application loaded on the device

a. Application identifier

b. Whitelist/blacklist

5. Ability to extend or expand data schema

a. Agency Abbreviation

b. USDA Unique ID

c. GFE(Government Furnished Equipment) vs. BYOD (Personal Device) Reporting The solution shall have the ability to produce four categories of reports including:

1. Audit Reports allowing real time access to monitor, reconcile, and audit the system and devices

2. Device Inventory Reports to allow for the collection of individual and aggregate device information

3. System Performance Reports comprised of metrics collection and monitoring data that are useful for understanding system usage

4. Security/Compliance Reports for providing status updates and results of monitoring activity and to collect information that will assist in the detection of fraud and ensure system security The ability to provide reporting in these areas is essential although it is not a task the Vendor must perform on a regular basis. USDA will be responsible for compiling reports as needed. In addition to the 4 categories, USDA requests the ability for customized reports on any data available in the vendor solution databases.

Audit Reports Audit reports provide data necessary to monitor, reconcile, and audit system processing and reconciliation activities. Audit reports will be run as needed, exportable and will support the following filters:

1. Administrator activity (admin actions performed, time stamps, etc.)

2. User access times and enrollments

3. Participating Agencies (number of devices by agency and across all agencies)

4. Devices (number of devices, type, OS version, etc.)

5. Console logins and functions (connections to the management console, actions performed, etc.)

6. Policy changes and versions (policy revision control and historical changes) Device inventory Reports Device Inventory reports includes all data associated with the device, OS and applications. Device reports will be run and/or exported as needed, and will support the following filters:

1. Device Models

2. Operation System and build level

3. Last Access times(access time not compliance check)

4. Application inventory

5. Last Compliance Check

6. Device Compliance (ability to report on rooted/jailbroken devices, policy, etc.)

7. Carrier

8. Network Card IDs (MAC address)

9. Agency Assignment

10. BYOD or GFE (personal device or government furnished)

11. Security Policy Assignment (policy currently applied to device)

12. Application Role Assignment(role currently applied to device) System Performance Reports System performance reports include key performance data to provide insight into the usage of the devices, reliability of the solution, and performance of devices. System performance reports will be run as needed and will support the following filters:

1. Concurrent Connections

2. Peak Time Usage

3. Total active user and device counts

4. Bandwidth utilization trends

5. End-to-End testing results

6. Authentication processing times

7. ActiveSync sync times

8. Connection Failure rate to/from device and Office365 Note! This requirements section pertains to on-premise solution only Security/Compliance Reports and Logs Security reports include all data relevant to the monitoring and support of the system’s vulnerabilities and defenses, including attempts at fraud. Security status reports will be run as needed and will support the following data:

1. Non-compliant devices

2. Device wipe actions

3. Passcode reset actions

4. User/Devices with failed authentication

5. Aggregate data on failed authentications

6. Devices with Blacklisted applications

7. Jailbroken devices

8. Device Anti-virus versions

9. Mobile Management Agent Enterprise App Store, MAM (Mobile Application Management) As USDA continues to adopt mobile into their business environment, we need ways to securely, efficiently and effectively manage mobile applications. The USDA is seeking a mobile application management solution that will support integration with existing services and provide employees the ability to download, deploy and manage both enterprise and public applications. The solution should allow for centralized management yet be flexible enough to support multi-agency organization of applications, and should support best practice functions, such as search capabilities, reviews, device specific applications and other important features.

Enterprise App Store The MAM solution must support the following requirements:

1. Ability to support iOS 4.X or greater and Android 2.x and greater. Support for Windows 8 should be within 1 month of release date

2. Ability to support N-tier organizations (e.g., enterprise, department, agency, etc.)

3. Ability to customize the tiering structure

4. Ability to specify groupings of applications

5. Ability for a user to have access to multiple groupings. For instance, a user might need several app bundles (groupings of apps) for their particular job functions

6. Ability for groupings of applications created in one tier to be able to be shared with other tiers

7. Ability to support both internally developed (enterprise) and public apps; is mobile OS aware (including version)

8. The ability to distinguishes between a tablet or a phone and present only those applications in store that are specific to that device; applications that are unsupported on that device should not be displayed

9. Ability to push applications from the enterprise app store to the user’s device, for platforms that support it

10. Ability to access the App store through both a browser user interface and native app store application for iOS and Android; Windows 8 native app should be available no later than one month after windows 8 release date

11. Ability to support integration with a third party authentication system, such as Siteminder; the app should be able to call out to web services or use form based authentication, at a minimum

12. Ability to access the app store independent from MDM enrollment

13. Ability to display a custom disclaimer/notification for anyone accessing the app store or downloading an app from the store; this should be configurable through a web interface that is accessible via administrative users

14. Ability to blacklist or whitelist apps, both internally or publicly provided through the app store

15. Ability to configure application management through a web interface accessible by administrative users

16. Ability to track Apps available in the store by version, size, number of downloads, description, author, date uploaded, device permissions/controls, images or videos and comments; downloads, size, version and date should be automatically handled by the app store

17. Ability to support version control: Each app upload to the store should be versioned and support a description for what’s changed in each version

18. Ability to dynamically manage high traffic, peak loads and be easily scalable

19. Ability to support either a clustering of app stores with full sync capabilities and/or a centralized data store that can be shared across multiple app store instances

20. Ability to notify users on their device of updates to applications that are ready for downloading. The notification should provide an easy one click link for the user to download and install the app update.

21. Ability to automatically notify when an application has been updated via the app store

22. Ability to categorize, group or tag applications (e.g., business apps, scientific apps, etc.)

23. Ability to search for applications by category, groupings, tags or keywords. Searches should provide rudimentary filtering, such as newest first or most popular first, for example

24. Ability to review and manage volume, group or single licenses per application through a web interface. This should only by accessible by administrative users

25. Ability to integration with, and authentication through, the USDA LDAP/Active Directory with ability to support multiple AD forests. Ability to set the timeout on the authentication sessions. After users have authenticated once to the app store, they should not have to authenticate on every request

26. Ability to separate apps or app groupings to only be available to users with specific authorization. For instance, only certain apps should available to supervisors. Likewise, some apps may only be allowed for federal employees. Those apps should not be available to the general user in the system

27. All data transferred over the wire will be encrypted through SSL 128 bit or better

28. Ability to backup and restore the enterprise app store content through a provided interface in the product. For a general backup and restore, this shouldn’t require support assistance; rather, it should be provided as a facility through the product

29. Ability to have a development/sandbox area for testing of apps not ready for production

30. Ability to log app lifecycle events, such as publishing new apps, removal of apps, and updates to apps by date and time. The system should also log the user who performed the action, the date/time it was performed and any other metadata associated with the action

31. Ability to export data from reports to PDF, Word or Excel documents for printing Integration The MAM solution must support the following integration requirements:

1. Ability to integrate with USDA’s active directory and/or MDM to define roles/groups that would be assigned certain apps

2. Ability to integrate the application release management processes into the app store. Applications should be able to be placed into the app store in an automated fashion through web service calls and automatically placed into their appropriate app groupings via additional parameters

3. Ability to obtain information on licenses, users, roles, groups and apps in the enterprise app store via REST web service API’s

4. Ability to obtain data from USDA data sources and integrate them back into the MAM system such as user information, license data, authorization and other pertinent information Reporting The MAM solution must provide a set of reports including:

1. Application inventory report - List of apps in the app store with sizing, agency, category and grouping information

2. Application access report - Applications and respective access rights

3. User report - Report showing applications by user

4. Application usage report - Number of times the application is downloaded and by which agency

5. Application license report - Report for tracking applications licenses Container Solution As mobile devices have become prominent for personal use, there is a need to separately manage and secure Government data and information on personal devices. In order to accommodate this changing business model, Government data must be encrypted and maintained within secure boundaries that are isolated from personal data and applications on the device. For government furnished devices the same isolation capability will be required for those users that need an additional security layer to protect sensitive information.

USDA is seeking a solution that allows Government data to be securely isolated from personal data, will allow containerized applications to execute even when the device is in a disconnect state, and can be managed from the MDM solution. Data in the secure “container” must be bi-directionally synced to USDA-dedicated file servers, where the information can then be e-discovered, synchronized to other mobile devices, backed up, and/or archived. Capabilities also need to include the ability to remotely wipe the container, in case the personal device is compromised, lost or stolen.

Container Requirements USDA considers a container to be a capability that isolates corporate data, files, and applications on a personal device, or Government provided device. The container must meet the following requirements:

1. Be able to support IOS and Android operating systems.

2. Be able to hold a set of COTS and/or government developed applications with respective data/files in a single secured container space

3. Be able to containerize any application

4. Be able to protect access to the container through a two-factor authentication mechanism

5. The whole container must be FIPS 140-2 certified with AES 256 encryption or better

6. Be able to share files between apps in the container

7. Be able to wirelessly synchronize files between the container on the mobile device and USDA hosted file servers.

8. Be able to encrypt data transmissions into and out of the container with AES 256 Encryption

Container Management Functions The solution must have functionality to manage the container for security purposes and to handle all device and user lifecycle events, such as lost, stolen, retired devices, and changes to employee statuses that may impact the container. The following are functions that must be available to manage the container:

1. Be able to enforce policies at the container level for:

a. Support for > 6 alphanumeric characters

b. Custom number of tries before locking the device Custom Passcode aging

c. Custom Restrictions for passcode rotation

d. Ability to reset device passcodes

e. Ability to lock the container after a set number of failed login attempts

f. Prevent copy and pasting of data outside of the container

g. Prevent data injection into the container through copy/paste

2. Be able to remotely wipe only the container and leave the personal environment intact

3. Be able to remotely wipe the container from a central management console

4. Be able to lock/wipe the container automatically after a set time period of inactivity

5. Be able to wipe or lock down the container in response to a security or compliance breach.

Container Types Out of the box, USDA envisions the need for 2 types of containers based on the capabilities of the device and business requirements of the user. The following 2 containers must be provided as standard options out of the box:

1. Basic Container – The basic container is assigned to the Basic Mobile User and must incorporate the following applications:

a. Email

b. Calendar

c. Contacts

d. Browser

2. Office Container - The office container is assigned to the Mobile Office User and must incorporate the following applications:

a. Email

b. Calendar

c. Contacts

d. Browser

e. Simple note application

f. Office tools with file editing capabilities for Word, Excel, PowerPoint

g. PDF viewer

h. SharePoint App with offline capabilities

i. File Manager with bi-directional sync MDM and MAM Integration USDA has some basic needs for integration between the container solution and the MDM and MAM solutions to efficiently and effectively manage the containers. The following MDM and MAM integration requirements must be met as part of the container solution:

1. Be able to manage and configure the container through the MDM

2. Be able to host the container application in the MAM solution and deliver the container through an MAM solution to a personal device USDA Integration To ensure that the information in the container is available to other mobile and desktop devices the user may have, as well as for business continuity, backup/restore, and e-discovery purposes, containers must provide the following functionality:

1. Be able integrate USDA’s Office365 exchange functionality with the Email, Calendaring and Contact apps in the container

2. Be able to bi-directional synchronize files and data between the container and file servers hosted in USDA’s data centers. The container must use a secure encrypted connection established from the container to the USDA’s file servers. Using the device VPN capabilities is not an acceptable solution.

Reporting The Container solution must have a set of reports including:

1. Which devices have a container installed

2. Type of container deployed to each device

3. Policies set for deployed containers

4. Identify container by Agency

5. Track licenses for container usage Required Outcomes ITS (International Technology Services) is responsible for managing mobile devices within USDA. While the number of devices supported today is slightly more than 3,000, it is expected that the number of devices (both Government owned and personally owned), will grow to over 100,000 in the next few years. ITS does not seek to assume the role of the integrator for all the proposed solutions. We are looking for an integrated solution(s) for mobile device management (MDM), Mobile Application Management (MAM), and secure container solution that allows us to efficiently support a wide range of devices, manage mobile applications, and maintain security boundaries between personal and Government data.

The vendor shall provide and demonstrate:

A fully operational, scalable to 100,000 devices and 99.5% available end-to-end system either on-premise or in a private cloud. The system shall be comprised of a fully operational MDM, MAM, and container solutions that meets the requirements as identified respective RFP sections. In addition, the system shall be integrated with USDAs existing Network architecture, Active Directory structures and Office365 solutions in a secured manner.

Support Incident Severity USDA retains the right to set the severity of any incident. Vendor retains the right to change the status but must inform USDA and continue to work on the ticket.

USDA classifies Incidents according to the following severity categories:

Incident Severity Upgrade During the process of resolving an incident, USDA may increase the severity of the incident if the USDA becomes aware of new facts that justify a higher severity. In such case, USDA shall will inform vendor and adjust the severity of the ticket.

Intervention and Solution Times Vendor shall respond to incidents and work on a resolution within the time defined in the table below.

Resolution: 80%

Resolution: 80%

Resolution: 80%

Deliverables Mobile SOLUTION DOCUMENTATION Security Policy and Configuration Vendor will provide comprehensive documentation outlining the framework and specific security architecture and configuration settings and/or policies which best protect and mitigate system vulnerabilities for the Mobility solution. This documentation shall include but is not limited to:

1. Overall Security architecture design

2. Network Security

3. Data Storage Security

4. Web Services Security

5. Incident Response Processes

6. System Auditing Processes

7. Intrusion detection Process

8. Security Component Operational Processes and Procedures

9. Anomaly Detection and Mitigation Processes

10. Risk mitigation strategies

11. Risk Analysis System Standard Operating Procedures

1. Vendor will provide a Security operations plan covering a comprehensive understanding of the processes and procedures that will be implemented to protect within the Mobility solution. Vendor will also detail any work processes that are to be performed or followed to maintain and manage the solution. The SOP will provide detailed instructions on how and when activities are to be performed to keep systems optimized and within compliance of governmental IT regulations. This document shall include but is not limited to Detailed System Design and Configuration

2. Routine Troubleshooting Solutions

3. ITIL compliant change management processes; including configuration management, change management, release management and incident management

4. System operations & maintenance processes and procedures; including account management, system upgrades, system patches, virus protection, and other standard O&M tasks

5. Data and records management; including management of the data bases, backups, restores, archiving of records, other standard data and record management tasks

6. USDA acceptable disaster recovery and business continuity processes and procedures

7. System proactive monitoring requirements; including network, hardware and application monitoring Certification & Accreditation (C&A) Certification and Accreditation (C&A) is the authorization of an IT system to process, store or transmit information granted by a management official. Accreditation is required by OMB Circular A-130. Certification provides the necessary information to a management official to formally declare that an IT system is approved to operate at an acceptable level of risk. The C&A management official for this solicitation is USDA-ITS.

The Vendor will be responsible for providing documentation and resources for the C&A process.

TRAINING

For an on-premise solution, the vendor, as part of the initial deployment services effort will be required to provide on-the-job training to a minimum of 3 government designated system administrators. The training shall cover the following topics and be accompanied with documented materials either, in PDF or MSWORD format:

· Hardware configuration steps

· Network configurations steps

· Software installation and configuration steps For both on-premise and cloud solutions, the vendor will be required to provide online training:

· For administrators, the vendor will provide online training that will cover all software management functions, including but not limited to:

· Device Policy and configuration template creation

· Device Registration

· All device Lifecycle management functions

· Application store hosting functions

· Container installation and configurations functions

· Reporting capabilities

· For Tier 1 helpdesk personnel, the vendor will provide FAQ documentation and online training. The online training needs to cover:

· How to register a device

· How to administer a device and user

· For the end-user, the vendor will provide online training for all self-service functions the end-user can perform including but not limited to:

· How to register a device

· How to load applications

· How to load the container

· How to perform self-service functionality(e.g. wipe own device, reset passcode) It is the expectation of USDA that these training modules will be made available online.

Staffing Plan Staffing Plan The vendor shall submit a plan that addresses the staffing strategy to be employed in accomplishing the work described in this RFQ.