MicroSoft_Tech_Services_SOO_AG32KWS130030.docx

STATEMENT OF OBJECTIVES

FOR

ANIMAL PLANT HEALTH AND INSPECTION SERVICE (APHIS)

Microsoft Technology Services

Marketing & Regulatory Programs Business Services (MRPBS) Information Technology Division (ITD)

Version 1.0 Release Date: October 25, 2012

Table of Contents

AG-XXXX-X-XX-XXXX

AG-32KW-S-13-0030

ATTACHMENT A – APHIS Security Agreement and Rules of Behavior………………...……..A1

FOR OFFICIAL USE ONLY

Attachment A - Page A1

FOR OFFICIAL USE ONLY

I. BACKGROUND

The Animal and Plant Health Inspection Service (APHIS) is responsible for protecting and promoting U.S. agricultural health, administering the Animal Welfare Act and Horse Protection Act, and carrying out wildlife damage management activities. The APHIS mission is an integral part of the U.S. Department of Agriculture (USDA) efforts to provide the Nation with a safe and affordable food supply. APHIS guards against the introduction, reemergence and spread of animal and plant pests and diseases that could limit production and/or damage export markets. Without this protection, threats to our food supply and our nation’s economy would be enormous.

As part of our protection focus, APHIS monitors for and responds to emergencies of varying types and scopes. APHIS is classified as an Emergency Response Agency. The Agency also responds to conflicts between humans and wildlife, addresses trade barriers related to animal and plant health, promotes the humane treatment of animals covered by the Animal Welfare Act and Horse Protection Act, and ensures that biotechnology-derived agricultural products are safe.

There are approximately 9,000 APHIS employees working within various program and administrative offices to provide support to achieve the APHIS mission. APHIS has over 1,000 locations spread throughout the United States and internationally.

APHIS previously used the IBM Domino platform to provide employees with e-mail, application, instant messaging, and team space services. Products included Lotus Domino/Notes, Sametime and QuickPlace. In 2011, APHIS completed converting e-mail services to a dedicated Microsoft Office 365 cloud service offering along with transitioning to Microsoft Live Meeting and Lync services for instant messaging and online meetings. The dedicated environment of Office 365 also provided a dedicated SharePoint cloud service.

Due to limitations of the cloud and other hosted SharePoint solutions, APHIS has recently implemented an on-premise SharePoint 2010 Enterprise environment that will be used to consolidate existing SharePoint 2007 sites and offer an alternate technical solution for targeted Domino applications or databases. It will also address ongoing and future application, collaboration and content management needs. The Agency has also begun investing in other application platforms for meeting business requirements. Dynamics CRM is an example of this where it is a new investment but also address part of the transition away from IBM Domino.

Web applications within APHIS that provide access to users and collaborators external to the Agency are mandated to use a centralized identity provider. The identity management service is called eAuthentication. It is implemented with Computer Associates identity and access management software suite. Because of this requirement and with the Agency’s expanding use of Microsoft products both on-premise and via cloud services, there is a need to better and more efficiently address identity management and designed use of the Microsoft applications and technologies.

II. OBJECTIVES

The objective of this contract is to obtain the necessary resources needed to assist APHIS in addressing critical infrastructure needs to design, develop, implement and support Microsoft technologies, solutions and applications to adequately enable authentication, access, integration and functional use for business requirements. Key objectives of this contract are to:

· Design and implement an Active Directory Federated Service infrastructure

· Implement authentication access for various applications

· Provide on-going technical and support services

· Provide design, development and implementation assistance for Microsoft technologies and solutions

This contract is intended to establish an external access and authentication solution that offers the means for a federated authentication service using Microsoft’s native technologies where multiple identity providers can be configured and integrated with application platforms. Additional services will be required to adequately maintain and address longer term needs.

III. TASKS TO BE PERFORMED

CLIN 0001 – Discovery and Design for Authentication and Access Infrastructure

The Contractor will

1. Perform discovery and review of the APHIS technical environment and business requirements to determine necessary information and options for designing and architecting a solution

2. Develop a documented architecture design and plan

3. Develop installation and configuration guides for the planned design

4. Identify additional follow on work requirements to extend or complete application integration

CLIN 0002 – Implementation of Authentication and Access Infrastructure

The Contractor will:

1. Execute the setup and configuration of the designed solution from CLIN 0001, or

2. Assist APHIS in the setup and configuration of the solution

CLIN 0003 – Informal Knowledge Transfer

The Contractor will:

1. Conduct informal knowledge transfer to key APHIS personnel working with Contractor personnel of the solution implemented from CLIN 0002.

2. Knowledge transfer for key APHIS personnel will include at a minimum:

a. Basic Configuration and Maintenance

b. Administration and Management

c. Monitoring of Solution

d. Configuration of Identity Providers

e. Integration for Applications

f. External Access Concepts

g. Authentication Principles

Informal Knowledge Transfer will occur through mutually prioritized and scheduled workshops. Topics discussed will be kept in a training log in Word format. Key APHIS personnel will include responsible parties for the configuration, administration and service of the solution. They will have experienced skill sets for technology administration including certain Microsoft technologies. Advanced concepts and practices for this solution are likely to be new knowledge. The estimated number of people will range from one to five depending on subject matter, solution breakdown and area of responsibility.

For CLINs 0004 - 0006 Following the initial core phase, APHIS will have the option to submit additional task orders targeting follow-on work and services. APHIS will be able to request proposals from the Contractor for a scope of work. If the funding proposal is agreed to, funding will be provided by the appropriate party requesting the task to be done.

CLIN 0004 – Technical and Support Services

Provide on-going or post implementation technical and support services for implemented Microsoft solutions and technologies.

CLIN 0005 – Application Platform Authentication and Access

Provide services to integrate and configure an application’s use of the authentication and access solution. Service types will be established based on the complexities presented by the application or platform and may include assessment, design, development, and implementation configuration work.

Applications platforms and identity providers for task order consideration include but are not limited to the following:

· Microsoft SharePoint 2010

· Microsoft Dynamics CRM

· TECHSYS Warehouse Inventory

· Computer Associates Identity Management Suite (eAuthentication)

CLIN 0006 – Design, Development and Implementation Assistance

Provide services to assist in the design, development and implementation of Microsoft technologies and solutions.

IV. SKILL SETS REQUIRED

Description of knowledge, skills and experience APHIS considers important and critical for Contractor resources to accomplish the work of this contract are listed below. Skills required will vary by task.

1. Significant experience and expertise with:

a. Microsoft Active Directory Domain Services

b. Microsoft Active Directory Federated Service v2

c. Microsoft Forefront Universal Access Gateway 2010

d. Microsoft SharePoint 2010

e. Microsoft Exchange 2010

f. Microsoft Dynamics CRM 2011

g. Microsoft SQL Server 2008

h. Microsoft Windows Server 2008

i. Microsoft Office 365

2. Advanced knowledge of:

a. Identity management concepts, standards and practices

b. Federation deployments with Active Directory Federated Service

c. Cloud-based identity federation

d. Security Assertion Markup Language

e. Claims-based identity implementations with Microsoft technologies

f. High availability designs and deployments with Microsoft software products

g. Hybrid deployments of SharePoint with Office 365

h. Authoring and publishing architectures with SharePoint

V. WORK LOCATIONS

Any necessary onsite work could be performed at the APHIS sites located in Fort Collins, CO, Minneapolis, MN, and Riverdale, MD. Following are the work location addresses.

Fort Collins, CO 80526

Minneapolis, MN 55403

Riverdale, MD 20737

APHIS technical specialists specific to this initiative are located in Minneapolis, Fort Collins, and Riverdale.

VI. PERIOD OF PERFORMANCE

The Contract’s period of performance for the base year shall be from the date of award through September 30, 2013. Following the successful completion of CLINs 0001,0002 and 0003, APHIS will have the option to submit individual task orders during the initial base year and two option years for CLINs 0004, 0005 and 0006.

VII. PROJECT MANAGEMENT

The Contractor is responsible for providing a Project Manager with a partnership management strategy. The Contractor will not direct the effort but will, instead, participate in a partnership manner with APHIS.

The Contractor will develop and maintain a project plan in Microsoft Project 2010 that includes:

· Work Breakdown Structure (WBS)

· Milestones

· Project Timeline

· Resource Requirements

· Risk Management Issues

The contractor will participate in a Project Kickoff meeting at the APHIS Fort Collins, CO location or via teleconference.

The Contractor’s Project Management responsibilities shall also include the following:

· Develop and maintain project documentation to include all decision management documents, and design and specification documents.

· Maintain configuration management for the duration of the contract.

· Provide biweekly Progress Reports to the COTR and Project Manager.

· Conduct and/or participate in all project status meetings.

VIII. FORMAT FOR ALL DOCUMENTATION DELIVERED

All written documentation will be submitted and formatted electronically using products from Microsoft Office Suite 2010. Other Microsoft products may also be used as necessary (e.g., Excel or PowerPoint). Project Management documents will be submitted in Microsoft Project format. Graphic design documents, such as flowcharts, entity relationship diagrams or Unified Modeling Language (UML) diagrams, will be submitted in Microsoft Visio format.

The Contractor will properly protect equipment and all Government data and information used, gathered or developed under this contract. All information will be treated as sensitive.

IX. PERFORMANCE REQUIREMENTS

All work products including meeting notes, presentation materials, source code, and documentation in support of this contract will become the sole property of the Government.

a. Background Investigations/Suitability Requirements The Contractor shall provide only fully qualified personnel for the work performed under this contract. Contractor personnel shall also have the appropriate background investigation known as a National Agency Check with written Inquiry and Credit (NACIC). U.S. citizenship is required for all Contractor personnel working on this order.

b. Protection of Information The component parts of this effort and reports are expected to contain highly sensitive information that could act as a guide for hostile entities to cause harm to the Federal Government’s critical infrastructure. Any information made available to the Contractor in any format shall be used only for the purpose of carrying out the provisions of this contract. Such information shall not be divulged or made known in any manner to any person. The Contractor shall immediately notify the COTR, CO, and Program Manager upon discovery of any inadvertent disclosures of information. The Contractor shall not retain any information regarding vulnerabilities, to include summaries, the actual vulnerability report, etc., at the end of the agreement, task order or performance period. All information arising from this agreement, both hard copy and electronic, shall be returned to the Government at closeout.

c. Non-Disclosure of Information The Contractor shall not disclose sensitive or proprietary information of the Federal Government or any of its operating units, contractors or business partners to unauthorized persons. The Contractor will be subject to any and all penalties imposed by law for unlawful disclosure of Federal Government information.

d. Security of Remote Connectivity Contractor equipment that is used to remotely connect to the Government network must have current anti-virus and/or firewall protection and be properly safeguarded to avoid access to systems by unauthorized persons. Remote access shall be coordinated with the Government or a designated representative and in accordance with the appropriate directive(s).

The Contractor shall provide completed copies of the form found in Attachment A, APHIS Security Agreement and Rules of Behavior, for each employee working on this contract. Each Contractor employee is required to complete a security training course. Other requirements for secure access to Government resources may be required.

X. ACCEPTANCE CRITERIA

APHIS will have ten working days after delivery to provide written comments on deliverables. The Contractor will have ten working days to provide a revised deliverable based upon the APHIS comments. APHIS will then have five working days to review the revised deliverable and accept or provide further comments.

XI. GOVERNMENT ROLES AND RESPONSIBILITIES

Contracting Officer (CO): All contract related issues shall be addressed with the following contact.

Bonnie Simpson 2150 Centre Avenue, Building B Fort Collins, CO 80526 Voice: (970) 494-7179 E-Mail: Bonnie.K.Simpson@aphis.usda.gov

Contracting Officer Technical Representative (COTR): COTR contacts are the only persons authorized to interact with the Contractor under this contract for technical related issues.

Cheryl Johnson 2150 Centre Avenue, Building B Fort Collins, CO 80526 Voice: (970) 494-7121 E-Mail: Cheryl.J.Johnson@aphis.usda.gov

Project Manager (PM): The contact listed is the only persons authorized to interact with the CO and COTR under this contract for project management related issues including final acceptance.

Blaine Crussell 2150 Centre Avenue, Building B Fort Collins, CO 80526 Voice: (970) 494-7100 E-Mail: Blaine.Crussell@aphis.usda.gov

XII. GOVERNMENT FURNISHED PROPERTY

All software licensing and hardware products targeted to be addressed have been purchased or are already owned by the Government. No additional requirements are anticipated at this time in this area. Any new requirements in this area will be the responsibility of the Government and not the Contractor.

The Contractor shall be able to independently perform work tasks not related to infrastructure server configuration, testing and deployment. APHIS server infrastructure and test equipment will be made available for coordinated and approved work to be performed.

XIII. GOVERNMENT FURNISHED FACILITY AND/OR PLACE OF PERFORMANCE

Office space will be provided to the Contractor as needed according to the requirements of the work to be performed onsite. Onsite visits and work must be coordinated and approved in advance by the Project Manager and COTR to allow for facility access.

XIV. TECHNOLOGY REFRESHMENT CLAUSE

After the contract award and throughout the contract life, the Contractor shall offer the Government new and/or enhanced technologically advanced products/services, including system upgrades.

XV. INVOICE REQUIREMENTS

The Contractor shall submit invoices to the CO after the deliverables have been accepted by the Government. Prior to submitting invoices, a written detailed list of accomplishments that is collaborated with the biweekly progress reports shall be provided to the COTR. The Contractor’s invoice will be processed only after meeting the performance standards of the deliverables.

XVI. TRAVEL

Travel may be required to fulfill the requirements of this contract. Since locations and duration of travel cannot be established at this time, APHIS will modify the contract to allow for additional funding at that time. All travel must be approved in advance by the COTR. In the event travel is required, the cost of transportation, lodging, subsistence and incidental expenses (per diem) incurred by Contractor personnel in the performance of this task order shall be in accordance with the limitations as set forth in FAR 31.205-46 and the Federal Travel Regulations (FTR). The Contractor will be required to provide receipts (i.e., hotel, airline, car rental, etc.) for all travel required in the performance of this contract.

FOR OFFICIAL USE ONLY

ATTACHMENT A

APHIS

Security Agreement and Rules of Behavior

An agreement between _______________________________________________ (your printed name) and the Animal and Plant Health Inspection Service.

PURPOSE. This document is meant to obtain an individual agreement to abide by security requirements and procedures needed to protect APHIS and customer information resources. It is also intended to help raise security awareness and inform workers about security policies and procedures and to provide workers an opportunity for asking questions about these matters.

AUTHORITIES. National policy requirements regarding information systems are stated in the Federal Information Security Management Act (Title Ill of the E-Government Act of 2002); the Computer Fraud and Abuse Act (18 U.S.C. Sec. 1030 [1993]); Office of Management and Budget (OMB) Circular No. A-123, Management Accountability and Control; and OMB Circular A-130, Management of Federal Information Resources. These documents along with USDA security policies prescribe and set standards for establishing and maintaining a comprehensive information security program and use of information systems.

SCOPE. This agreement applies to APHIS employees (and contractors) who operate, maintain, and/or use APHIS Information Technology (IT) systems.

UNDERSTANDING AND AGREEMENTS. As a user of APHIS IT systems, I:

· Will protect APHIS computer systems in accordance with Federal, USDA, and APHIS policies.

· Will use USDA and/or APHIS computer systems (e.g., computers, systems, laptops, networks, etc.) only for authorized purposes. If using the computer systems and networks for nonofficial purposes, I will do so within the bounds allowed by USDA policy, supervisor approval, and without interfering with official business.

· Will protect systems and all sensitive information from electronic or physical access by unauthorized personnel. I will protect computer equipment, media, telecommunications, and similar assets from theft, fraud, misuse, loss, unauthorized modification, and unauthorized denial of use. I will make every effort to avoid action/inaction that could jeopardize mission success, customer rights, individual privacy, or the reputation of the agency.

· Understand that systems and other information resources, including electronic mail and Internet access, are primarily intended for official business and may be monitored. Although USDA policy permits limited personal use, I understand that my personal use must not interfere with official business and that I have no expectation of personal privacy when using these systems.

· Will not intentionally access, delete or alter files, operating systems or programs, except as specifically authorized for official business.

· Will not leave APHIS computers in an operational state (e.g., "logged on") while unattended. I will either: turn off the computer system, manually lock the screen, or set a time activated password-protected screen saver.

· Will abide by software copyright licenses and restrictions. I will not load any unapproved software (e.g., software from home, games, etc.) or install hardware or peripheral devices (e.g., external hard drives, docking stations, thumb drives, etc.) on APHIS systems without my supervisor’s permission.

· Will not download file-sharing software (e.g., MP3 music, video files, etc.), peer-to-peer software (e.g., Kazaa, Napster, etc.), or games onto APHIS systems or networks.

· Acknowledge that I will receive user identifiers (user IDs) and passwords to authenticate my computer account. After receiving them, I will:

· Immediately change the password.

· Protect and not share or publicly post my password. (If my password has been compromised, I will report the issue to my supervisor or security personnel.)

· Not store my password on any processor, microcomputer, personal digital assistant (PDA), personal electronic device (PED) or other media unless approved by security personnel.

· Be responsible for all activity that occurs on my individual account once my password has been used to log on. If I am a member of a group account, I am responsible for all activity when logged on a system with that account.

· Ensure my password is changed regularly or if compromised.

· Ensure my password meets USDA complexity requirements.

· Will use anti-virus software in an effective way to prevent damage or disruption to APHIS operations. I will scan all removable media (e.g., disks, CDs, thumb drives, etc.) for malicious software (e.g., viruses, worms, etc.) before using it on any APHIS computer system or network.

· Will take appropriate steps to protect important data from loss (e.g., backups).

· Will not use APHIS computers, networks, or IT services for purposes that violate ethical standards, including harassment, threats, sending or accessing sexually explicit material, racially or ethnically demeaning material, gambling, chain letters, for-profit activities, political activities, promotion or solicitation of activities prohibited by law, and so forth. If I use APHIS computer systems and networks for nonofficial purposes, I will do so within the bounds allowed by USDA policy and supervisor approval and without interfering with official business.

· Will not try to disable or subvert APHIS security controls or monitoring mechanisms.

· Will not attempt to break into any computer, whether Federal, USDA, APHIS, or private, for which access is not authorized. Attempted break-ins may be authorized by my organization’s Information System Security Program Manager (ISSPM) only for functions such as approved security tests, approved attempts to recover a system after a password is lost/forgotten, and similar functions.

· Will practice good housekeeping with all electronic equipment, including keeping food, beverages, or other contaminants away from computers and data storage media.

· Will report suspected/actual security incidents and other security concerns to my supervisor and my organization’s ISSPM.

· Will stay abreast of security issues through education and awareness products distributed throughout USDA. I will attend at least one (1) security awareness session each year.

· Will not disclose sensitive data. In the course of performing work at APHIS I realize it may be necessary for me to have access to sensitive information, which includes:

· Proprietary information - technical information or trade secrets that is proprietary to USDA/APHIS.

· Privacy information - information protected under the provisions of the Privacy Act of 1974.

· Privileged information - financial or commercial information that must be restricted from disclosure on the basis of Federal law or contractual agreement.

· Government information - information or data stored, processed or handled in providing services under any APHIS contract.

NOTE: Signature Agreement on the next page.

I have read and understand the APHIS Security Agreement on the use of government Information Technology (IT) systems. I understand that unauthorized or inappropriate use of government IT systems may result in the loss or limitation of my privilege. I also understand that I could face administrative action ranging from counseling to removal from the agency, as well as any criminal penalties or financial liability, depending on the severity of the misuse.

EFFECTIVE DATE. This agreement becomes effective when signed and dated. Refusal to sign may result in being denied use of any or all APHIS information systems, including e-mail and network access to the Internet. Refusal to sign does not relieve the individual of responsibility to abide by the standards set forth in this and related documents. (Supervisor/COR/COTR: If the worker refuses to sign, note that fact on the signature line and retain this document.)

**If you need to connect remotely to the APHIS network, please initial the following statement:

_____ My duties will require me to connect to the APHIS network remotely and I hereby request remote access authorization.

Signature: ____________________________________ Date: __________ Are you a: Federal Employee: [ ] Contractor: [ ] (check one) If Federal Employee, your organization: __________________ (Provide one of the following: AC, BRS, IS, LPA, MRPBS, PPD, PPQ, VS, WS, OA (Office of the Administrator))

If Contractor- Company Employed By: ______________________________________

Supervisor/

OR/COTR

Signature: _______________________________________ Date: _______________ Supervisor/COR

FOR OFFICIAL USE ONLY

Attachment A - Page A1

FOR OFFICIAL USE ONLY

Attachment A - Page A3 image1.jpeg