RFP Final 9.4.12.docx

United States Department of Agriculture

REQUEST FOR PROPOSAL &

PERFORMANCE WORK STATEMENT USDA

INTERNATIONAL TECHNOLOGY SERVICES NEXT GENERATION MOBILITY

Version 2.1.1 September 2012

SCMI IOL Document Title Here Prepared by:

OCIO International Technology Services Infrastructure Operations Division

type of contrAct

The United States Department of Agriculture (hereafter known as the “Government” or “USDA”) plans to award one (1) single-award blanket purchase agreement (BPA).

Contractors must submit a quotation inclusive of ALL of the categories of the Next Generation Mobility in order to be considered for award. The Government reserves the right to structure awards as it deems necessary when it is determined to be within the best interest of the Government. (The Government does not intend to award any BPAs on a multiple-award BPA basis, i.e., a BPA award to multiple vendors wherein all vendors compete for each BPA call.)

The Government is obligated only to the extent of authorized BPA Calls actually placed against the BPA. Each BPA Call (Delivery Order (OF-347) or Government Purchase Card order) will be issued based upon the BPA’s firm-fixed price list. Contractor performance will be measured based upon specified performance metrics. The performance metrics shall be known as the BPA Performance Delivery Summary (PDS). See Exhibit 2.

No funds are obligated by issuance of this BPA. Funds will only be obligated upon issuance of BPA Calls against the BPA. The total amount of funds obligated against any single-award BPA (i.e., the total amount of all BPA Calls) shall not exceed $20,000,000.00 over the five year term of the BPA. The Government has the option to increase or decrease this amount at any time during the performance period for any specific single-award BPA.

All orders under this BPA will be issued on a firm, fixed-price basis.

Intended Use of the BPA

The Government intends to use this BPA primarily as a means to accomplish multiple acquisitions, or BPA Calls, for mobility device management throughout the fiscal year period of October 1st through September 30th. Immediately following BPA award, the Government will provide to its offices a catalog listing of approved supplies/services available for purchase under the BPA.

BPA Calls will be issued by a warranted Contracting Officer of the USDA, Office of Procurement and Property Management, Procurement Operations Division and miscellaneous BPA calls may be executed by ITS-authorized personnel via Government Purchase Card and/or delivery orders.

This BPA is a USDA-wide authorized BPA and will provide the ability to acquire these products and services for use by the 3500 Field Service Center Agencies (SCA) of the United States Department of Agriculture (hereafter referred to as the “Government” or “USDA”) and other agencies, agency offices, or agency divisions of USDA that are supported by the Office of the Chief Information Officer (OCIO) and OCIO, Information Technology Services (ITS). This also includes the Departmental Administration Staff Offices (DASO) of USDA. The SCAs include, but are not limited to, the following agencies: the Farm Service Agency (FSA), the Natural Resource Conservation Service (NRCS), and the Rural Development (RD). The scope of this BPA shall include any additional agencies, agency offices, or agency divisions of USDA that may become supported by the ITS during the life of the BPA.

General Information Introduction In this new era of mobile computing, powerful hand held devices, wireless communications and cloud services, new boundaries are being established within USDA that support the mobilization of our workforce and that blur the lines between personal computing and corporate resources. USDA needs to stay on the forefront of these technical trends with a well-thought out strategy and a solution that encompasses a flexible architecture that will enable us to manage and operate these transformational opportunities in business delivery.

The consumerization of technology and in particular mobile devices is forcing the use of personal devices into the corporate world, significantly increasing the speed, flexibility, and agility with which the workforce can react to change. As mobility moves beyond wireless access to email, contacts, and calendars, USDA must create a unified strategy for managing its mobile computing environment.

Rapid adoption to new technologies and devices is becoming the new norm as we seek centralized management and control over these new trends. In this rapidly changing environment, IT must create an environment that is secure, reliable, scalable, and enables users at the intersection of mobility and cloud services. Everything must appear “seamless” to end-users while delivering significant business value in a secure manner.

To best use the opportunities provided through mobile computing, USDA needs to build a solid foundation for executing a mobile strategy, combining device management, application delivery, and Bring-Your-Own-Device (BYOD) concepts to empower mobile users while improving IT insight, gaining control, and cutting costs.

ITS (International Technology Services) is responsible for managing mobile devices within USDA. While the number of devices supported today is slightly more than 3,000, it is expected that the number of devices (both Government owned and personally owned), will grow to over 100,000 in the next few years however the rate and timeframe for that growth is unknown and will be based on the future needs of the department. ITS does not seek to assume the role of the integrator for all the proposed solutions. We are looking for an integrated solution(s) that allows us to efficiently support a wide range of devices, manage mobile applications, and maintain security boundaries between personal and Government data.

ITS encourages all vendors to submit proposals to this RFP for all options that the Vendor(s) can technically support. We realize that the field of Mobile Computing is changing rapidly, and standards continue to be formed within the Vendor community. It is expected that many proposals may consist of solutions from multiple Vendors. The proposals must include integration and architecture services that allow Vendor solutions to work seamlessly with each other and within our environment.

ITS Organizational Chart

SCOPE

USDA desires a solution for the following core Mobility Management components: Mobile Device Management (MDM), Mobile Application Management (MAM, Enterprise App Store) and Container Solution (to protect applications and data on GFE and BYOD devices).

USDA has identified the following possible solutions. Vendors are encouraged to respond to any of the following options or introduce other similar solutions that may fit the scope of this project. A single solution that addresses all aspects of this proposal is required. The vendor may submit an alternate proposal as well, however it must also meet each of the requirements stated in this solicitation. Each will be evaluated independently along with other submitted proposals for consideration.

1. On-Premise Solution

2. Cloud Solution

3. Hybrid Solution

For the purposes of this solicitation an On-Premise solution is defined as all HW/SW (virtual or physical hardware may be proposed based on vendor’s recommendation of which is most practical) components running completely within USDA data centers and network. After installation, USDA will be responsible for operating the infrastructure and devices, app store and container management. The offeror will provide recommended hardware specifications for the On-Premise solution and the USDA will provide the hardware specified. The offeror will price and make available through the proposal for license all required SW. The offeror will price any associated consulting services deemed necessary to fast-track installation, configuration and quick start for the software configuration and hardware tuning. USDA will provide based on the offeror’s specifications all computing infrastructure and network connectivity.

For the purposes of this solicitation a Cloud Only solution will be defined as all HW/SW components of the solution will run in the offeror’s cloud data center. The offeror will provide all required hardware to the network edge of their cloud data center. The offeror is responsible for all aspects of system and software performance for solution components within their cloud data center.

For the purposes of this solicitation a Hybrid solution is defined as a solution where the components are distributed across USDA data centers and the offeror’s cloud data center. It is expected that the offeror will provide all required hardware to the network edge of their cloud data center. The offeror will clearly define and price all HW/SW components that will be within USDA data center and those components within the offeror’s cloud data center. The offeror is responsible for all aspects of system and software performance for solution components within their cloud data center.

NOTE! Regardless of the option chosen, USDA will perform all device, app store and container management via the provided console. This includes performing the day to day administrative functions associated with administering mobile devices (enrollment, setting policies, wiping devices, etc.), applications and container services. For example, USDA designated personnel will register, wipe, lock, create policies and other functions that are part of the MDM solution. Similarly, for MAM and the container, USDA will operate the software and perform the functions inherent in the software tools.

USDA is requesting a complete, end-to-end, solution from a single Vendor. Vendors may propose a proprietary solution or one built through partnerships with other providers.

USDA/ITS is seeking pricing by user or by device, based on tiering.

Mobile Device Management (MDM) USDA is seeking a Mobile Device Management solution that enforces defined security policy requirements, scales to manage our current footprint of 3,000 devices to over 100,000 devices, and can provide support for constantly changing technology in industry supplied mobile devices. Any proposed MDM solution must include features such as OTA (over the air administration), logging and tracking, inventory management, and role based management.

Enterprise App Store, MAM (Mobile Application Management) USDA is seeking a MAM solution with the ability to deploy both in-house and commercially developed applications. The MAM solution at a minimum must include the following application delivery lifecycle managed functionality; securing (requiring only authenticated and authorized users to view or manage apps), deploying, updating, and removing both in-house and commercially developed applications. In addition to that, application integrity should provide users and administrators ability to know if an app has been tampered with (i.e. md5 or similar). The Mobile Application Manager (MAM) should integrate into the MDM solution.

Container Solution As mobile devices have become prominent for personal use, there is a need to manage Government data and information on personal devices. In order to accommodate this changing business model, Government data must be encrypted and maintained within secure boundaries that are isolated from personal data and information. USDA is seeking a solution that allows Government data to be securely isolated from personal data, will allow containered applications to execute even when the device is in a disconnect state, and can be managed from the MDM solution. Data in the secure “container” must be bi-directionally synced to USDA-dedicated servers, where the information can then be backed up or archived. Capabilities also need to include the ability to remotely wipe the Government Data/Information container, in case the personal device is compromised, lost or stolen.

Environment Description Current State USDA’s Current Mobility environment includes:

The USDA is made up of multiple disparate Active Directory forests that contain 17 different agencies of approximately 130,000 users in 3,000 office locations around the globe. This setup is not to block external access. Most agencies maintain their own network and firewalls but all are connect via a central backbone called USDA UTN. USDA utilizes F5 load balancers in our DMZ. Many of our backend servers use VMWare vSphere 5 for virtualization. Below is a detailed diagram of the current private cloud network:

The Department utilizes Microsoft’s Online Service Office 365 Dedicated ITAR (BPOS, Version F) for Messaging Collaboration which includes both email and managing Microsoft Office documents. All agencies decommissioned their email system and migrated to the private cloud which has a UTN node. USDA’s Office 365 Dedicated ITARhas no direct access to the internet and all traffic (i.e. ActiveSync) must come through a USDA proxy located in St. Louis and Kansas City (managed by USDA)except Blackberry. Both Blackberry and Microsoft ActiveSync are used for the synchronization of email. Blackberry servers are hosted and managed by Microsoft as part of Office 365 Dedicated ITAR and USDA has limited access to those servers. The only access USDA has to the Blackberry servers is via the console and no connections are allowed to SQL directly. There are approximately 12,000 managed Blackberries with no current need to have them managed by the vendor’s solution proposed in this solicitation.

Two years ago USDA purchased McAfee’s Enterprise Mobility Manager (EMM) to manage mobile devices throughout the Department. Today EMM manages 3600 mobile devices (phones and tablets) which consist of iOS, Android 2.2+ and some Windows 7. EMM utilizes LDAP connectors to authenticate users and assign security policies. The USDA utilizes the McAfee EMM solution to issue and distribute necessary certs and VeriSign certificates required to encrypt ActiveSync connections. EMM also acts as an Active Sync proxy to facilitate mail sync back to Office 365 Dedicated ITAR. No mobile devices have the ability to connect directly from the internet to the Office 365 Dedicated ITAR infrastructure in the private cloud so EMM facilitates the connection.

EMM is hosted in 2 facilities in passive/active implementation. St. Louis, Missouri houses the current active datacenter that handles all EMM mobile traffic including the mobile Office 365 Dedicated ITAR connections. Kansas City, Missouri houses the backup datacenter that will go live in the event of a St. Louis failure. A DNS record is utilized to control the cutover to the backup datacenter.

All agencies are assigned an individual EMM security policy which they own and manage. The agencies also have access to the EMM console to support their own devices to enroll, track, wipe, etc...

The chart below indicate the current number of mobile devices by OS and device type currently deployed:

The below logical diagram depicts a high level view of EMM and USDA infrastructure.

Future State In the near future USDA will go through a major consolidation of all agency Active Directories to a single forest keeping AD onsite and on-premise. While the current state has multiple Active Directories, USDA will be looking for a mobile solution can adapt as users are migrated to the single forest.

The number of users will stay relatively stable in the coming years but the number of mobile devices is anticipated to increase significantly. The number of blackberries should stay flat or reduce but it is expected that iOS/Android/Windows 8 devices combined will see an increase up to 100,000 devices. Although currently the USDA averages one device per user, it is projected that the average will increase to 1½ devices per user and in some cases the user may have 2 devices. It is unknown at this time if any of the Department’s phones are utilizing satellite links, however it can be assumed in the future that USDA will implement satellite phones and expect to be managed by this solution.

While GFE mobile devices will increase, most growth should come from BYOD. USDA has an initiative to implement a mobile solution that will allow for BYOD. The solution will be a container based approach that can utilize for both GFE as well as BYOD. The number of and/or projections for BYOD across the Department is not known at this time.

USDA will offer a mobile office suite of applications that will allow for increased productivity and flexibility. The office suite will be offered inside a container that can be installed on a GFE or BYOD device. The applications will have the ability to integrate with Office 365 Dedicated ITAR for email and SharePoint access.

USDA will also offer an Enterprise App Store and Catalog while still allowing for individual apps to be purchased via public app stores. User profiles or policies will be used to assign various applications based on role. USDA has broken down users in 2 different types of roles:

a. Basic Mobile User

i. Container Option – Email and Secure Browser Container(GFE or BYOD)

ii. GFE MDM Option – Email only and browser via VPN (no container required)

b. Mobile Office User – Email, Browser, Office Suite, File Manager, Bi-directional Sync of data, Container(GFE or BYOD) General RequirementS This section addresses the overall requirements for the proposed solution and is broken down into proposed solution requirements and professional services that span the MDM, MAM, and Container solutions.

General Solution requirements The proposed solution shall meet the following requirements:

1. Timely (within 2 weeks of release of new OS version) support of for new devices with supported OS

2. The solution needs to be generally available (24x7) to all approved users that require access.

3. A fully functional thirty day pilot with vendor support will be required within 30 days of award, ready to support a minimum of 3,000 mobile devices as specified in this solicitation

4. The solutions must, at a minimum, support iOS (4.x and up), Android (2.2 and up), and Windows (8 and up when available on smartphones and tablets)

5. Cloud service must be a private cloud dedicated to USDA or a cloud dedicated to Federal Government use only or if a vendor can confirm the segregation of the physical hardware within a cloud solely for USDA’s use

6. The MDM/MAM solution must be hosted within the same cloud service.

7. Solution can be an on-premise implementation, 3rd party (cloud) implementation (devices and console managed by USDA), or combination of both. Performance of any solution cannot be impaired by physical location of infrastructure (i.e., should perform the same regardless where it is hosted)

8. For an on-premise solution, the vendor will provide the architecture for the necessary infrastructure to support an integrated solution of MDM, MAM and Container.

9. It is the vendor’s responsibility to inform and coordinate the acquisition of necessary MDM certificates. USDA will own and provide all certificates that will be used for MDM management and authentication. We reserve the right to expand this service to include digital signing and encryption for email messaging in the future. Certificates used to register devices to the MDM software are considered part of the MDM solution and should be provided by the vendor including any needed access to the certificate server will be granted.

10. User Base: Initially approximately (3,000), Vendor must be able to scale for potential growth of 100,000 or more mobile devices.

11. Must be able to support connections and authentications to multiple Active Directory infrastructures utilizing all the various forests for authentication and security policy assisgnment (multiple Forests and Domains including 14 different user Active Directory forests)

12. New system must pass Certification and Accreditation within 6 months

13. Architecture must be resilient and redundant for high availability (99.5% uptime minimum)

14. System architecture must be open for integrating with other tools not part of this solicitation but are legacy systems used withing the USDA and may require integration in the future

15. The vendor will identify in the proposal the changes necessary to meet upgrades to USDA infrastructure, such as network improvements.

Professional Services The vendor selected is required to provide initial deployment and future agency integration services as required for the proposed hosting services. These services are expected for installing, configuring, and certifying the initial deployment of the MDM, MAM and Container solutions for USDA and for additional professional services as needed, such as services for agency specific integrations or customizations.

Initial deployment services The vendor is responsible for providing steps necessary for deploying and integrating their Mobility Solution into the USDA environment. The steps included will be dependent upon whether the solution is on-premise, or cloud solution. The services required for the initial deployment of the 3 solutions include:

· Installation and configuration of the MDM, MAM, and Container solutions

· Integration with 3 Active Directories to be determined by USDA

· Integration with Office 365 Dedicated ITAR

· Deployment of basic and office containers on IOS (4.x and 5.x) and Android (2.x,3.x,4.x) devices Future Agency Deployment Services In addition to initial deployment services, future agency integrations may be required, including, but not limited to:

1. Active Directory

2. Customized Application Deployment

3. Firewall Configuration

4. Service Accounts Technical requirements Mobile Device Management (MDM) The Mobile Device Management solution will secure, monitor, manage and support mobile devices deployed across various mobile carriers and Wi-Fi networks. MDM functionality will include over-the-air (OTA) distribution of applications, data and configuration settings for all types of mobile devices, including mobile phones, smartphones and tablet computers. The functionality and control can apply to GFE and/or BYOD. The following features in this section are required features in the vendor solution.

Device Diversity The MDM tool must support the following mobile devices (phones and tablets) and mobile OS platforms in the USDA Mobile computing environment.

1. Ability to support iOS version 4.x and up

2. Ability to support Android (2.2 and up, including 3.x and 4.x)

3. Ability to support Windows 8 (both smartphones and tablets) when available Policy Enforcement The solution must provide the specified functionality that allows USDA to enforce their device management and security rules and regulations. The USDA aims to be as granular as possible when implementing security and access policies. Policies, at a minimum, need the capability to be defined by user and/or by device type (GFE vs BYOD), application and possibly by location.

1. Ability to only register approved devices

2. Ability to push and enforce policy to enrolled devices

3. Ability to limit a user by device, and the number of devices

4. Ability to enforce USDA defined password policies

5. Ability to detect OS platforms and versions

6. Ability to detect installed applications

7. Ability to detect jail-broken and compromised devices

8. Ability to restrict or prohibit access from non-compliant devices to corporate servers and data

9. Ability to whitelist and blacklist applications

10. Ability to monitor and enforce mobile communications expense policies

a. Roaming usage (Block).

b. Data service plan restrictions

c. International use (and Block)

11. If a container (BYOD) is in use, ability to restrict data in and out of container.

12. Ability to log and alert on all policy events including security events

13. Ability to configure and filter alert notifications by policy

14. Ability to provision a mail client or container on iOS

15. Ability to provision an encrypted mail client container on Android Security and Compliance A set of mechanisms to protect corporate data on a device, corporate back-end systems and preserve compliance with regulations:

1. Ability to configure strong passcode (device password) settings, compliant with USDA policy.

a. Support for > 6 alphanumeric characters

b. Custom number of tries before locking the device Custom Passcode aging

c. Custom Restrictions for passcode rotation

d. Ability to reset device passcodes

e. Ability to lock a device

2. Ability to lock the device after a custom number of minutes of inactivity

3. Ability to block non-encrypted and jailbroken devices.

4. Ability to remotely wipe the device which means removing all data on the local device, not just the encryption keys

a. Support for selective remote wipe (e.g., only corporate content);

b. Support for total remote wipe (hard wipe, data not recoverable after deletion)

5. Support for certificate distribution which includes the ability to load device and user certificates to mobile platforms that can be used for authentication purposes by applications like VPN, web apps or any apps developed in-house.

Device Administration The solution must provide the defined capabilities for IT administrators to manage mobile deployments and users.

General MDM Capabilities:

1. Secure web-based console for managing mobile devices

2. Granular Role-based access

a. Helpdesk (wipe, unlock, reset passcode, delete, etc.)

b. Policy Admin(Create, assign and administer policies)

c. MDM Admin(full admin)

3. Active Directory or LDAP Group-based actions

4. Enterprise platform integration (This depends on whether it is on-premise or cloud)

a. Office 365 Dedicated ITAR

b. Integrate with multiple Active Directories

c. Third party [USDA, VeriSign] certificate authority for pushing out Digital Signing, encryption, and authentication certificates to the device’s certificate store.

d. trouble ticketing and help desk (Remedy; no access provided to vendors) (optional)

e. network management (if device capable)

i. Wi-Fi control

ii. Roaming control

iii. VPN Management

iv. Bandwidth Management

f. Integration with SCOM (on-premise solution only)

5. Ability to enroll device into MDM environment

6. Ability for the administrator to provision a device to a user

7. Ability to limit number and type of device, device ID on a per user basis.

8. Ability to Issue a certificate to a device for device authentication.

9. Ability for the administrator to activate and deactivate a device

10. Ability to set policies and profiles on the device

11. Ability to lockdown hardware features

a. enable/disable camera

b. enable/disable removable media card

c. enable/disable infrared [IR] port

d. enable/disable Bluetooth

e. enable/disable Wi-Fi

f. enable/disable other common features

12. Ability to remove device from MDM environment (retired, lost, stolen, irreparably damaged)

13. Ability to wipe the whole device

14. Ability to selectively wipe a device

15. Ability to lock/unlock device

16. Ability to custom search, query and analyze the MDM database with built-in tools.

17. Device Based End-to-End monitoring or testing tools (connectivity and/or service verification) This should be an app on the device which performs these functions:

a. Verify network connection and performance

b. Test authentication settings

c. Verify Certificates

d. Verify DNS functionality

18. Centralized Monitoring tool based end-to-end monitoring or testing tool

a. Verify network connection and performance

b. Test authentication settings

c. Verify Certificates

d. Verify DNS functionality User Requirements:

1) Ability for the user to self-provision a device

2) Support for self-help functionality

a) Device passcode reset

b) Ability to wipe device Over-The-Air (OTA) administration (Default Requirement) The solution must include wireless (carrier or Wi-Fi) capabilities for IT administrators to manage mobile devices remotely. This includes:

1. Ability to OTA register and provision a device

2. Ability to OTA wipe the whole device

3. Ability to OTA selectively wipe a device

4. Ability to OTA installation of default apps (email, word, excel, or other applications)

5. Ability to OTA monitor and query a device

6. Ability to OTA set policies and profiles on the device

7. Ability to OTA lockdown hardware features Inventory Management The solution must include a set of mechanisms to provision, control and track devices connected to corporate applications and data:

1. Ability to inventory and asset manage devices (currently use Tivoli Endpoint Manager for asset management)

2. Ability to track device information

a. Device Manufacturer/Model

b. Carrier

c. Wireless Number

d. MAC Addresses

e. International Mobile Equipment Identity (IMEI)

f. SIM module data

g. Storage capacity

h. OS and Version

i. Device up time

j. Encryption Support (the ability for the vendor solution to identify and store if a device has the ability to be encrypted; understanding that not all devices have device or OS encryption and we want the ability to run reports on that information)

3. Ability track mobile device user information

a. User profile information

b. User Name

c. Email

d. Phone number

4. Ability to track application loaded on the device

a. Application identifier

b. Whitelist/blacklist

5. Ability to extend or expand data schema

a. Agency Abbreviation

b. USDA Unique ID

c. GFE(Government Furnished Equipment) vs. BYOD (Personal Device) Reporting The solution shall have the ability to produce four categories of reports including:

1. Audit Reports allowing real time access to monitor, reconcile, and audit the system and devices

2. Device Inventory Reports to allow for the collection of individual and aggregate device information

3. System Performance Reports comprised of metrics collection and monitoring data that are useful for understanding system usage

4. Security/Compliance Reports for providing status updates and results of monitoring activity and to collect information that will assist in the detection of fraud and ensure system security The ability to provide reporting in these areas is essential although it is not a task the Vendor must perform on a regular basis. USDA will be responsible for compiling reports as needed. In addition to the 4 categories, USDA requests the ability for customized reports on any data available in the vendor solution databases.

Audit Reports Audit reports provide data necessary to monitor, reconcile, and audit system processing and reconciliation activities. Audit reports will be run as needed, exportable and will support the following filters:

1. Administrator activity (admin actions performed, time stamps, etc.)

2. User access times and enrollments

3. Participating Agencies (number of devices by agency and across all agencies)

4. Devices (number of devices, type, OS version, etc.)

5. Console logins and functions (connections to the management console, actions performed, etc.)

6. Policy changes and versions (policy revision control and historical changes) Device inventory Reports Device Inventory reports includes all data associated with the device, OS and applications. Device reports will be run and/or exported as needed, and will support the following filters:

1. Device Models

2. Operation System and build level

3. Last Access times(access time not compliance check)

4. Application inventory

5. Last Compliance Check

6. Device Compliance (ability to report on rooted/jailbroken devices, policy, etc.)

7. Carrier

8. Network Card IDs (MAC address)

9. Agency Assignment

10. BYOD or GFE (personal device or government furnished)

11. Security Policy Assignment (policy currently applied to device)

12. Application Role Assignment(role currently applied to device) System Performance Reports System performance reports include key performance data to provide insight into the usage of the devices, reliability of the solution, and performance of devices. System performance reports will be run as needed and will support the following filters:

1. Concurrent Connections

2. Peak Time Usage

3. Total active user and device counts

4. Bandwidth utilization trends

5. End-to-End testing results

6. Authentication processing times

7. ActiveSync sync times

8. Connection Failure rate to/from device and Office 365 Dedicated ITAR Note! This requirements section pertains to on-premise solution only Security/Compliance Reports and Logs Security reports include all data relevant to the monitoring and support of the system’s vulnerabilities and defenses, including attempts at fraud. Security status reports will be run as needed and will support the following data:

1. Non-compliant devices

2. Device wipe actions

3. Passcode reset actions

4. User/Devices with failed authentication

5. Aggregate data on failed authentications

6. Devices with Blacklisted applications

7. Jailbroken devices

8. Device Anti-virus versions

9. Mobile Management Agent Enterprise App Store, MAM (Mobile Application Management) As USDA continues to adopt mobile into their business environment, we need ways to securely, efficiently and effectively manage mobile applications. The USDA is seeking a mobile application management solution that will support integration with existing services and provide employees the ability to download, deploy and manage both enterprise and public applications. The solution should allow for centralized management yet be flexible enough to support multi-agency organization of applications, and should support best practice functions, such as search capabilities, reviews, device specific applications and other important features. The USDA reserves the right to later require pre-deployment testing of applications built for the app store.

Enterprise App Store The MAM solution must support the following requirements:

1. Ability to support iOS 4.X or greater and Android 2.x and greater. Support for Windows 8 (both smartphones and tablets) should be within 1 month of release date

2. Ability to support N-tier organizations (e.g., enterprise, department, agency, etc.)

3. Ability to support customizization of each tier within the N-tier structure along with the ability to share central or shared information so that custization may include but is not limited to branding of the UI, setting app visibility, applying custom rules for deployment, white/black listing apps and custom rules for access and administration

4. Ability to specify groupings of applications

5. Ability for a user to have access to multiple groupings. For instance, a user might need several app bundles (groupings of apps) for their particular job functions

6. Ability for groupings of applications created in one tier to be able to be shared with other tiers

7. Ability to support both internally developed (enterprise) and public apps; is mobile OS aware (including version)

8. The ability to distinguishes between a tablet or a phone and present only those applications in store that are specific to that device; applications that are unsupported on that device should not be displayed

9. Ability to push applications from the enterprise app store to the user’s device, for platforms that support it

10. Ability to access the App store through both a browser user interface and native app store application for iOS and Android; Windows 8 native app should be available no later than one month after windows 8 release date

11. Ability to support integration with a third party authentication system, such as Siteminder; the app should be able to call out to web services or use form based authentication, at a minimum

12. Ability to access the app store independent from MDM enrollment, requiring no work from the MDM system regardless of originating device; we do not know the number of unenrolled devices or users that will access that app store

13. Ability to display a custom disclaimer/notification for anyone accessing the app store or downloading an app from the store; this should be configurable through a web interface that is accessible via administrative users

14. Ability to blacklist or whitelist apps, both internally or publicly provided through the app store

15. Ability to configure application management through a web interface accessible by administrative users

16. Ability to track Apps available in the store by version, size, number of downloads, description, author, date uploaded, device permissions/controls, images or videos and comments; downloads, size, version and date should be automatically handled by the app store

17. Ability to support version control: Each app upload to the store should be versioned and support a description for what’s changed in each version

18. Ability to dynamically manage (and inspect if on-premise solution) high traffic, peak loads and be easily scalable

19. Ability to support either a clustering of app stores with full sync capabilities and/or a centralized data store that can be shared across multiple app store instances; there isn’t a specific implementation requirement however the solution requires minimal maintenance and oversight from USDA’s perspective and can also scale to the numbers that are listed in the requirements; apps and users may grow and may require multiple app stores for load balancing and increased reliability; irregardless of implementation method, it must support both organization & management at multiple tiers

20. Ability to notify users on their device of updates to applications that are ready for downloading. The notification should provide an easy one click link for the user to download and install the app update.

21. Ability to automatically notify when an application has been updated via the app store

22. Ability to categorize, group or tag applications (e.g., business apps, scientific apps, etc.)

23. Ability to search for applications by category, groupings, tags or keywords. Searches should provide rudimentary filtering, such as newest first or most popular first, for example

24. Ability to review and manage volume, group or single licenses per application through a web interface. This should only by accessible by administrative users

25. Ability to integration with, and authentication through, the USDA LDAP/Active Directory with ability to support multiple AD forests. Ability to set the timeout on the authentication sessions. After users have authenticated once to the app store, they should not have to authenticate on every request

26. Ability to separate apps or app groupings to only be available to users with specific authorization. For instance, only certain apps should available to supervisors. Likewise, some apps may only be allowed for federal employees. Those apps should not be available to the general user in the system

27. All data transferred over the wire will be encrypted through SSL 128 bit or better

28. Ability to backup and restore the enterprise app store content through a provided interface in the product. For a general backup and restore, this shouldn’t require support assistance; rather, it should be provided as a facility through the product

29. Ability to have a development/sandbox area for testing of apps not ready for production

30. Ability to log app lifecycle events, such as publishing new apps, removal of apps, and updates to apps by date and time. The system should also log the user who performed the action, the date/time it was performed and any other metadata associated with the action

31. Ability to export data from reports to PDF, Word or Excel documents for printing Integration The MAM solution must support the following integration requirements:

1. Ability to integrate with USDA’s active directory and/or MDM to define roles/groups that would be assigned certain apps

2. Ability to integrate the application release management processes into the app store. Applications should be able to be placed into the app store in an automated fashion through web service calls and automatically placed into their appropriate app groupings via additional parameters

3. Ability to obtain information on licenses, users, roles, groups and apps in the enterprise app store via REST web service API’s

4. Ability to obtain data from USDA data sources and integrate them back into the MAM system such as user information, license data, authorization and other pertinent information Reporting The MAM solution must provide a set of reports including:

1. Application inventory report - List of apps in the app store with sizing, agency, category and grouping information

2. Application access report - Applications and respective access rights

3. User report - Report showing applications by user

4. Application usage report - Number of times the application is downloaded and by which agency

5. Application license report - Report for tracking applications licenses Container Solution As mobile devices have become prominent for personal use, there is a need to separately manage and secure Government data and information on personal devices. In order to accommodate this changing business model, Government data must be encrypted and maintained within secure boundaries that are isolated from personal data and applications on the device. For government furnished devices the same isolation capability will be required for those users that need an additional security layer to protect sensitive information.

USDA seeks a solution that allows for Government data to be securely isolated from personal data, will allow containerized applications to execute even when the device is in a disconnect state, and can be managed from the MDM solution. Data in the secure “container” must be bi-directionally synced to USDA-dedicated file servers, where the information can then be e-discovered, synchronized and shared with other mobile devices, backed up, and/or archived. Capabilities also need to include the ability to remotely wipe the container, in case the personal device is compromised, lost or stolen.

In a disconnected state, USDA expects that the synchronization capability will be essentially dormant until connectivity is re-established and synchronization resumes. USDA does expect the user to still have the capability to access the container and run the applications within the container itself.

Container Requirements USDA considers a container to be a capability that isolates corporate data, files, and applications on a personal device, or Government provided device. The container must meet the following requirements:

1. Be able to support IOS and Android operating systems.

2. Be able to hold a set of COTS and/or government developed applications with respective data/files in a single secured container space

3. Be able to containerize any application

4. Be able to protect access to the container through a two-factor authentication mechanism

5. The whole container including any internal mobile application wrapper must be FIPS 140-2 validated. Containers must also have AES 256 encryption or better (FIPS 140-2 certification is not required prior to award, however the software must meet FIPS 104-2 requirements day one, and the vendor must obtain NIST certification for the container within the first year post award)

6. Be able to share files between apps in the container via either a “cut and paste” method or the ability to view and/or update a common file.

7. Be able to wirelessly synchronize files between the container on the mobile device and USDA hosted file servers.

8. Be able to encrypt data transmissions into and out of the container with AES 256 Encryption which is a minimum requirement by USDA for an approved cryptographic key length.

9. Be able to sync Exchange user contacts(Outlook contacts) to the device’s native contact application. This would be the only instance the solution provides data outside the container. Populating the native contact application provides users the ability make phone calls and texting with the sync’d contacts. This feature will be required within 3 months after award.

Container Management Functions The solution must have functionality to manage the container for security purposes and to handle all device and user lifecycle events, such as lost, stolen, retired devices, and changes to employee statuses that may impact the container. The following are functions that must be available to manage the container:

1. Be able to enforce policies at the container level for:

a. Support for > 6 alphanumeric characters

b. Custom number of tries before locking the device Custom Passcode aging

c. Custom Restrictions for passcode rotation

d. Ability to reset device passcodes

e. Ability to lock the container after a set number of failed login attempts

f. Prevent copy and pasting of data outside of the container

g. Prevent data injection into the container through copy/paste

2. Be able to remotely wipe only the container and leave the personal environment intact

3. Be able to remotely wipe the container from a central management console

4. Be able to lock/wipe the container automatically after a set time period of inactivity

5. Be able to wipe or lock down the container in response to a security or compliance breach.

Container Types Out of the box, USDA envisions the need for 2 types of containers based on the capabilities of the device and business requirements of the user. The following 2 containers must be provided as standard options out of the box:

1. Basic Container – The basic container is assigned to the Basic Mobile User and must incorporate the following applications:

a. Email

b. Calendar

c. Contacts

d. Browser

2. Office Container - The office container is assigned to the Mobile Office User and must incorporate the following applications:

a. Email

b. Calendar

c. Contacts

d. Browser

e. Simple note application

f. Office tools with file editing capabilities for Word, Excel, PowerPoint

g. PDF viewer

h. SharePoint App with offline capabilities

i. File Manager with bi-directional sync MDM and MAM Integration USDA has some basic needs for integration between the container solution and the MDM and MAM solutions to efficiently and effectively manage the containers. The following MDM and MAM integration requirements must be met as part of the container solution:

1. Be able to manage and configure the container through the MDM

2. Be able to host the container application in the MAM solution and deliver the container through an MAM solution to a personal device USDA Integration To ensure that the information in the container is available to other mobile and desktop devices the user may have, as well as for business continuity, backup/restore, and e-discovery purposes, containers must provide the following functionality:

1. Be able integrate USDA’s Office 365 Dedicated ITAR exchange functionality with the Email, Calendaring and Contact apps in the container

2. Be able to bi-directional synchronize files and data between the container and file servers hosted in USDA’s data centers. The container must use a secure encrypted connection established from the container to the USDA’s file servers. Using the device VPN capabilities is not an acceptable solution.

Reporting The Container solution must have a set of reports including:

1. Which devices have a container installed

2. Type of container deployed to each device

3. Policies set for deployed containers

4. Identify container by Agency in order to track deployments for proper chargeback to individual agency

5. Track licenses for container usage Required Outcomes ITS (International Technology Services) is responsible for managing mobile devices within USDA.