ATTACHMENT 1 - EITOM-PWS_Bridge_Draft - NOI sole source.pdf

Performance Work Statement

Indian Health Service Enterprise IT Operations and Maintenance (EIT O&M) Services

CONTENTS

2 Purpose

3 Background

3.1 Division of IT Operations

3.2 Division of Customer Experience

3.3 Contract Objectives

4 Scope of Requirements

4.1 Contract Type

4.2 Period of Performance

4.3 Place of Performance

4.4 Travel

5 Standard Investment Support Tasks

5.1 IT Management

5.2 Data Center Services

5.3 End User Services

5.4 Storage Services

5.5 Compute Services

5.6 Application Services

5.7 Network Services

5.8 Security & Compliance Services

6 Contract Administration

6.1 Authorities of Government Personnel

6.2 Technical Monitoring, Inspection and Acceptance

6.3 Contract Transition Plan

6.4 Special Terms and Conditions

6.5 Contract Deliverables:

Appendix A: Physical Equipment Inventory

Appendix B: Reference Materials and Technical standards

Appendix C: Service Level Agreements

2 PURPOSE

The Indian Health Service (IHS) requires Enterprise IT Operations and Maintenance (EIT O&M) support to ensure the availability, integrity, security and confidentiality of critical IT services provided by the IHS Office of Information Technology (OIT). The IHS OIT operates two primary Data Centers and requires both on-site and off-site contractor staff resources to provide systems engineering and administration for IT Operations and Maintenance, staffed with experienced IT specialists to maintain the existing functionality and to design, implement and support new network technologies. The contractor shall furnish the necessary technical and administrative staff and staffing facilities to meet the IHS program objectives. This support is to include the sustainment support for a variety of hardware, software, and IT services to include

Server Administration, Active Directory (AD) Infrastructure, Storage Area Networks, Virtualized Data Center management, Hybrid Cloud services, Enterprise Patch Management, Enterprise Antivirus Protection, Multi-Factor Authentication (MFA), Global Address Directory

Synchronization, Identity and Access Management, Internet Proxy with URL Filtering/

Reporting, Endpoint Encryption Management, Device Certificate Management, and Virtual

Private Network (VPN) Remote Access. The IHS requires highly knowledgeable and experienced contractor IT Subject Matter Experts to sustain the existing IHS IT infrastructure and provide support for new emerging technologies.

3 BACKGROUND

The Indian Health Service, an operating division of the United States Department of Health and

Human Services, is a geographically diverse agency with 623 locations across the United States serving 566 federally recognized Tribes (sovereign nations). IHS is the second-largest agency under the Department of Health and Human Services (HHS) supporting 20,231 users. IHS provides a comprehensive health service delivery system for approximately 2.2 million of the nation’s estimated 2.4 million American Indians and Alaska Natives. IHS strives for maximum tribal involvement in meeting the needs of its service population, most of who live on or near reservations and in rural communities in 35 states—mostly in the western area of the continental

United States and Alaska. IHS also has programs that provide access to care for American

Indians and Alaska Natives who live in urban areas. The IHS mission is to work in partnership with American Indian and Alaska Native people to raise their physical, mental, social, and spiritual health to the highest possible level. The IHS OIT is required to support and maintain the availability, integrity, and confidentiality of the IT systems that support the IHS mission.

The IHS Fact Sheet web site gives more statistics on the IHS supported services:

https://www.ihs.gov/newsroom/factsheets/ . The IHS Headquarters, Office of Information

Technology website provides additional information regarding IT Services at:

https://www.ihs.gov/OIT/aboutus/ .

3.1 DIVISION OF IT OPERATIONS

The IHS Headquarters OIT Division of Information Technology Operations (DITO) manages technologies deployed for use across the agency in support of the IHS Mission. DITO is https://www.ihs.gov/newsroom/factsheets/ https://www.ihs.gov/OIT/aboutus/ committed to providing reliable customer services and technically relevant solutions and support for the IHS information technology services to all Federal Employees and Contractors across

IHS. The DITO Division Director oversees all areas for IT Operations to include additional services not included within this PWS. Additional information regarding the support provided through the DITO can be found at https://www.ihs.gov/OIT/operations/

In accordance with Office of Management and Budget (OMB) guidance

(https://www.whitehouse.gov/wp-content/uploads/2018/06/fy-2020-it-budget-guidance.pdf) and the Presidents Management Agenda

(https://www.performance.gov/PMA/Presidents_Management_Agenda.pdf), the support services listed within this PWS are broken down into the specific Technology Business Management

(TBM) IT “towers” to include standard investments and cost pools in order to allow for reporting across each of the cost sources. The TBM is a value-management framework instituted by CIOs, CTOs, and other technology leaders in order to gain alignment between IT, Finance, and

Business Unit leaders and to provide a standard taxonomy of all cost sources, technologies, IT resources (IT towers), applications, and services.

3.2 DIVISION OF CUSTOMER EXPERIENCE

Contract Bridge Mod01 (12/12/2025): The IHS HQ OIT Division of Customer Experience

(DCX) manages enterprise support services and communications used across the agency in support of the IHS Mission to include end user devices, communications regarding service changes and triage of support requests for all Enterprise IT services. The DCX is to provide exceptional customer experiences that reflect compassion, cultural respect, and responsiveness while empowering American Indian and Alaska Native providers, Tribal partners, patients and families to focus on the improvements to their health and support journey. The DCX will be expected to provide direct end user support in collaboration with the integration vendor for IHS sites as they transition to the new Health IT system, Oracle Cerner, Patients at the Heart

Electronic Health Record (PathEHR). For more information, see the IHS Health IT

Modernization site.

3.3 CONTRACT OBJECTIVES

Mission: To provide IHS staff and health service providers supporting the agency mission with excellent, reliable, and efficient enterprise IT infrastructure through contracted operations and sustainment services to ensure the delivery of effective healthcare through information technology.

Vision: To provide a people-focused approach to meeting next generation IT requirements using cutting edge techniques and technologies.

This support contract is to provide the IHS with highly skilled, knowledgeable, and professional

IT support resources who shall perform IT O&M services in support of the IHS mission to raise the physical, mental, social, and spiritual health of American Indians and Alaska Natives to the highest level. The Contract staff shall be proficient in various enterprise applications, IT services, and federal security policies and procedures. Specifically, the key objectives for this contract include the need to:

• Align all cost reporting and work performed with the TBM IT Cost Pools and IT Towers https://www.ihs.gov/OIT/operations/ https://www.whitehouse.gov/wp-content/uploads/2018/06/fy-2020-it-budget-guidance.pdf https://www.performance.gov/PMA/Presidents_Management_Agenda.pdf https://www.ihs.gov/hit/path-ehr/ https://www.ihs.gov/hit/path-ehr/

• Maintain current operational capabilities of the IHS infrastructure and HQ Data centers

• Maintain and enhance the security and resiliency of critical services within the IHS

Headquarters OIT security boundary.

• Maintain and improve support for the IHS Active Directory and Enterprise services

• Maintain and improve user access to data and ensure data integrity

• Maintain and improve support for standard IHS applications

• Maintain and improve Service Desk IT Support services

• Provide Tier 1 desktop support for HQ on-site employees in Albuquerque, NM and

Rockville, MD and Tier 2 and Tier 3 desktop support for HQ teleworkers

• Provide Tier 3 technical support services for all of IHS

• Maintain and improve documentation of each system and IT service

• Support of all IT project activities and initiatives to include oversight and routine reviews of Risk Management, Change Management and Resource Management.

• Maintain and improve the program management of all IT Projects according to the established IHS standards and HHS Enterprise Performance Life Cycle (EPLC) standards and roles (https://www.hhs.gov/digitalstrategy/hhs-ocio-cpic-policy-2016.html#roles) where applicable (https://www.ihs.gov/CPIC/lifecycle/).

• To provide for the modernization and security of IT operations of the DITO services in support of new technologies, priorities and services to include new Enterprise applications, Disaster Recovery, CDM and Hybrid Cloud Service Management.

• Contract Bridge Mod01 (12/12/2025): Add To provide expert technical support for

Enterprise end user workstations, imaging, troubleshooting and standard configurations.

• Contract Bridge Mod01 (12/12/2025): Add To provide an IT Call Center technical support triage and limited enterprise services for all IHS domain locations and related

Customer groups in support of the new Oracle Cerner Cloud Electronic Health Record.

• Contract Bridge Mod01 (12/12/2025): Add To provide application user support services as part of the new Oracle Cerner HealthIT system implementation to begin August 2026.

4 SCOPE OF REQUIREMENTS

The Contractor shall provide skilled, experienced and highly knowledgeable technical support resources for the IHS Enterprise level IT operations and maintenance services for the

Headquarters (HQ, OIT) Data Centers and the Enterprise IT systems (both limited Health IT and non-Health IT) that support the IHS mission. This includes the maintenance and improvement of the availability, integrity and confidentiality of the IT architecture and engineering, systems administration, Data Center infrastructure systems and storage, desktop and service desk services for the HQ user base as well as Tier 3 support of critical Enterprise infrastructure services to the

IHS Regional Areas and facilities.

The tasks included as part of this Performance Work Statement (PWS) includes the Operations support and systems administration of all physical infrastructure hardware, virtual systems and interconnected devices within the Headquarters Data Center (s) (see Appendix A for scope of the two IHS Data Centers) to include disaster recovery, Enterprise Active Directory administration and application services and operational security support for IHS. These functions include but https://www.hhs.gov/digitalstrategy/hhs-ocio-cpic-policy-2016.html#roles https://www.ihs.gov/CPIC/lifecycle/ are not limited to operating systems, virtual infrastructure, network equipment and connectivity, Active Directory Management, Enterprise infrastructure applications and services, Virtual

Private Networking (VPN), URL filtering services, Device Certificate management, Endpoint encryption, the IHS IT Service Desk as well as Local and remote desktop support for

Headquarters employees and contractors. Additionally, the contractor is tasked to provide support resources for business analytics, Enterprise licensing, Rural Health Care

Telecommunications and documentation services to produce the systems configuration reports, Standard Operating Procedures and metrics reporting as required by the agency and supported by the DITO and the DCX.

4.1 CONTRACT TYPE

The contract type awarded is a Firm Fixed Price (FFP) Contract.

4.2 PERIOD OF PERFORMANCE

The period of performance for Operations and Maintenance and service support shall be one (1) six (6)-month base period with nine (9) six (6)-month option periods.

The Contractor shall perform all requirements of this Performance Work Statement (PWS) in accordance with IHS and Department of Health and Human Services (HHS) policies, procedures, and directives as referenced in the Appendix B of this PWS.

4.3 PLACE OF PERFORMANCE

Related tasks within this PWS are to be performed onsite for the HQ OIT Data Center locations as follows:

• OIT Rockville (Rockville Data Center (RDC) and HQ Service Desk): 5600 Fishers Lane, Rockville, MD 20857

• OIT Albuquerque Data Center (ADC): 1011 Indian School Rd NW, Albuquerque, NM

87104.

All other support locations are to be provided at the Contractor location or on-site at the IHS location as indicated in the following table:

Place and Hours of Performance (**Contract Mod10 NEW** (10/24/2023) Updated for Contact

Call Center; Contract Bridge Mod01 (12/12/2025): Updated for PathEHR 24/7 Support

Minor deviations in start and end times are likely to be acceptable, especially those which tend to increase the hours during which coverage is available. Such deviations must be approved by the

Contracting Officer Representative (COR).

Emergency Call Back:

The Contractor shall provide irregular, off hours (Weekends, Weekdays and Holidays, 24/7) critical enterprise support remotely via approved remote software tools/applications. On site

Data Center critical support may also be required as issues or emergencies are identified.

Estimated hours per contract year for each area of support are provided as follows:

• Data Center, Storage, Compute Services: 60 hours

• Application Services: 120 hours

Emergency troubleshooting or repair work is occasionally required for unplanned outages or major issues impacting production services. Work may need to be performed on site or remotely during non-business hours. All scheduled maintenance work causing system outages must be performed during non-business hours.

The contractor shall provide a call-back within 60 minutes of any after-hours contact from the government. This ensures timely support and continuity of operations during emergency or critical incidents. The contractor shall maintain a reliable and efficient communication protocol to meet this response time.

Holidays:

All federal holidays are observed. The only exception would be the support for critical support services or outages. Contractor personnel shall not report to work nor remain at the work locations any time the Government unexpectedly closes their offices with the exception of emergency support required. The contractor will not be compensated for these Government closures. The contractor is responsible for all notifications of their contractor staff during times of closure. During office closures, the contractor may elect to reschedule work hours during the same pay period.

11/27/2020: No Cost Mod **NEW**COVID-19 Telework Guidance: The contractor is to submit an alternative Telework Plan for approval to the CO/COR for the duration of the expected remote support availability. Updates may be required as part of a transition plan to return to the

Duties Work Performed At: Estimated Hours: Scope of Support:

IT Management Contractor Location M-F, 8am - 5pm MST Major, minor and technical projects

Data Center Services-Albuquerque IHS Albuquerque Location* M-F, 8am - 5pm MST 1000 servers and appliances

Data Center Services - Rockville IHS Rockville Location* M-F, 8am - 5pm EST 300 servers and appliances

Storage, Network and Compute Contractor Location M-F, 8am - 5pm local time Remote support for both HQ Data Centers

End User Services - Tier 1-3 Contractor Location M-Sat, 6:00 am - 8:30 pm MST 20,000 IHS employees Nationwide

End User Services - Contact Center Contractor Location

7 days/week, 24 hrs/day MST

(includes Holidays) 20,000 IHS employees Nationwide

End User Services - Tier 1 & 2 IHS Rockville Location* M-F, 6:30am - 5pm EST 800 HQ users, local and remote

Application Services Contractor Location M-F, 8am - 5pm MST Active Directory Infrastructure

- PathEHR HealthIT Application Support Contractor Location M-F, 6:00 am - 8:30 pm MST Pilot site to start in August 2025

Security and Compliance Services Contractor Location M-F, 8am - 5pm MST

Cybersecurity tools, Audit & Compliance, Vulnerability Management

*Minimal office availability, remainder of staff will be required to work at Contractor location established office space while maintaining staff safety. Approvals of modifications will be provided by the CO/COR via email.

Current federal holidays:

New Year’s Day January 1st

Martin Luther King’s Birthday 3rd Monday in January

Presidents’ Day 3rd Monday in February

Memorial Day Last Monday in May

Juneteenth June 19th

Independence Day July 4th

Labor Day 1st Monday in September

Columbus Day 2nd Monday in October

Veterans’ Day November 11

Thanksgiving Day 4th Thursday in November

Christmas Day December 25

4.4 TRAVEL

Travel within the continental United States is required in support of the tasks within this PWS.

Two personnel supporting End User Services are required to travel and support an annual 3-day conference hosted by OIT. The conference may be held at various cities throughout the life of this contract. Other travel may be required for mission critical support in very rare circumstances.

5 STANDARD INVESTMENT SUPPORT TASKS

5.1 IT MANAGEMENT

High Level Objective: IHS seeks administrative support, project, and program management, to deliver new technology and capabilities to IHS while efficiently sustaining existing capabilities and services.

5.1.1 Administrative Support

The Contractor shall assist the COR with administrative work related to IT Project management, information security and Area facility coordination activities related to deployment of applications and services, or other support activities as required by national IHS and HHS initiatives. This includes, but is not limited to: data collection related to user and information security, involvement in the annual Certification & Accreditation (Continuous Authorization) document completion, Data Call coordination in support of the Operational Analysis and other

HHS data reporting needs, Equipment management in coordination with the Property Office to locate equipment, support for systems lifecycle management and other various related Agency administrative support activities. The following additional administrative services and support shall be provided for all areas of the PWS:

5.1.1.1 Contract Management Plan: The contractor shall submit a contract management plan to include each of the tasks in the PWS. The contract management plan will be approved by IHS to ensure contract expectations and requirements are clearly understood. The contract management plan shall be prepared for IHS review and approval no more than ten (10) days after the task order award.

5.1.1.2 Quality Control and Quality Assurance Surveillance Plans: The Contractor shall prepare, implement and adhere to a Quality Control Plan (QCP). The Contractor shall submit the Draft QCP with the proposal and shall update the QCP within 10 days after award. The QCP shall document how the Contractor will meet and comply with the quality standards established in this statement of work. The QCP must include a self-inspection plan and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, and customer satisfaction. The Government will monitor the Contractors’ performance under this contract according to the SLAs and the

Quality Assurance Surveillance Plans (QASP). Yearly reporting will be provided within the CPARS reporting system.

5.1.1.3 Service Level Management: The Contractor shall document the baseline Service Level

Agreements (SLA) for the tasks described in the PWS within 30 business days of contract award. The monitoring and reporting of the SLAs associated with each standard investment will require approval by IHS. The Contractor shall provide for continuous monitoring of their performance to meet the SLAs and report conformance results on a monthly basis.

5.1.1.4 Investment Reporting: The Contractor shall assess and report on the costs of the services and support of each standard investment support task included within this PWS and according to the deliverable schedule identified in order to be in compliance with

TBM standard investment cost reporting requirements. This will include the use of

PlanView for both project level reporting and sustainment support against all labor categories for resource utilization reporting.

5.1.1.5 DITO Tactical Operation Plan: The Contractor shall track all key activities and tasks within this PWS to include the status tracking of key activities and projects for reporting to the COR and DITO management on a monthly basis. This would include technical implementation projects such as major software upgrades, hardware replacements, technical alternative assessments, new processes or technical changes to be implemented within HQ OIT and/or across IHS.

5.1.2 Project Management

The Contractor shall provide complete project management for all IT project activities and initiatives on behalf of the Division of IT Operations in a manner that meets OMB and HHS requirements (following HHS EPLC standards). This includes current operational project upgrades/replacements and any future major IT projects (technology modernization and enhancements). These projects are generally implementations of commercial-off-the-shelf applications, cloud services, or IT infrastructure. The scope of project management support excludes Health IT software development or enhancements to Health Information Technology applications (e.g. Electronic Health Records system). The Contractor shall support the IHS

Capital Planning and Investment Control (CPIC) Management team, the IT Project peer reviews and each of the required stage gate reviews (https://www.ihs.gov/CPIC/ ).

5.1.2.1 The Contractor shall provide support for the following EPLC project related activities and deliverables required for each major IT project included as part of this task:

a. Identification and capturing of all project requirements.

b. Cost and resource estimates for all major IT Projects.

c. Creation of all IT Project documentation deliverables.

d. Management of staffing resources for each initiative.

e. Management of project due dates, risks, issues, deliverables and general reporting.

f. Business Needs and Business Case requests for IT governance approvals.

g. Project Management Plans – including Project Charters, Change Management, Risk

Management and Communication plans.

h. Post Implementation Reports and Lessons Learned reviews.

5.1.2.2 The Contractor shall provide timely project management status reports on all contracted activities to include:

a. Performance assessment reports on all contract activities and improvement opportunities

b. Assist with support to Federal Managers on the completion of the detailed project related documents for approved IT projects using approved Project Management tools such as PlanView (https://www.planview.com/products/planview-enterprise/), or Microsoft Project for managing, planning, and tracking the resources and costs for new IT projects as well as Operations and management reporting and maintenance.

c. Weekly contract labor resource reports to show the number of hours worked on

DITO projects per resource type.

d. The Contractor shall document measurements for meeting project milestones and track all issues and risks as part of the monthly reporting to the COR.

5.1.3 Program Management

The Contractor shall provide Program Management support, IT technical documentation support and other Information Technology Infrastructure Library (ITIL) related services that are required for effective management and sustainment of IHS IT services. This shall include the management and oversight of the following functions:

5.1.3.1 Knowledge Management

a. The Contractor shall provide knowledgeable, experienced IT Technical documentation support for all systems engineering work to include:

• The creation and maintenance of all System Administrator Guides, process descriptions, implementation plans, contingency procedures, design documents, and workflows.

• The Contractor shall present draft materials to the COR in ongoing cycles of review, discussion, and improvement. Documentation modifications are required at various stages of the system’s lifecycle and are to be up to date.

b. The Contractor shall maintain and update all internal documentation to include:

• Configuration management documents for each major system https://www.ihs.gov/CPIC/ https://www.planview.com/products/planview-enterprise/

• Enterprise Services Architectural Designs

• Standard Operating Procedures (SOPs), test plans and implementation plans must be maintained and updated for upgrades, replacements, and new product installations.

• Maintain current Data Center diagrams which include hardware, server locations, racks, cabling placement, power and other relevant data. This includes maintaining updated network diagrams, VLANS and switch configurations including switch ports and other relevant data. All Standard Operating

Procedures must follow IHS naming convention guidelines and format.

• Customer facing technical notes, user guides and frequently asked questions and updates to the ITSM solution (Service Now) or internal SharePoint.

• Operations plan updates of key activities

• All documentation (contract related, metrics, and technical documentation and baseline procedures) must be stored in a federally approved IHS storage location as an accessible document repository location for reference to include version management and an updated document catalog. All content will remain as government property.

c. The Contractor shall maintain the following documentation according to OIT procedures. Documentation is used for planning and failover/recovery capabilities.

• Service Interruption Documentation and Notices

• Monthly uptime report for all critical data center services, Change Management

Events, maintenance notices, issues log and risk logs

• Monthly IHS Dashboard metrics reports (including Uptime reports, Antivirus compliance, Patch Management compliance, Service Desk tickets and customer satisfaction surveys)

• Network Device Inventory List, Location Diagrams and baseline Device

Configurations

• Static IP Address Management reports

• Server, appliances, rack and peripherals Inventory

• System Configurations for critical systems

• Data Center Hardware Lifecycle Reports

• Licensing utilization and Inventory Reports

• Active Directory metrics and health status reports

• Desktop Inventory, Laptop and Peripherals Inventory List

• Security Compliance Reports

d. The Contractor shall provide support for the Quarterly OIT Newsletter to include meeting attendance, formatting, 508 compliance and presenting to CIO for approval.

e. The Contractor shall provide support and content management of multiple

SharePoint sites for all areas identified within this PWS. The Contractor shall ensure that all contract related SharePoint sites support the capabilities for dashboards, graphics, workflows and reporting based on the Enterprise Client

Access Licensing (ECAL) available to IHS.

f. All Contractors will be evaluated on the effectiveness, clarity, professionalism, and timely submission of Project related documents, technical systems designs, implementation plans and other applicable documents.

5.1.3.2 Service Strategy: The Contractor shall provide recommendations to assist the COR and

Federal Managers with the development of strategic goals and objectives regarding technical architecture, database design, Customer support improvement opportunities according to ITIL best practices, identity access management, security configurations and use of emerging technologies to improve service level agreements, Data Center support, Enterprise Application availability, Tier 3 support and overall Enterprise

Architecture.

5.1.3.3 Service Design: The Contractor shall assist with the assessment of new technologies and determine if a technology will support/satisfy new requirements, enhance the security posture of the IHS network, integrate into existing architecture and tool sets and can be properly accredited and authorized for use within IHS. The Contractor shall ensure that any new systems, applications and improvements are developed following

IHS CPIC and EPLC standard processes for IT Governance and approvals. An IT

Technical Review Board shall verify that the requirements are clearly defined and provide approvals to proceed with the next stage of the project lifecycle. The

Contractor shall NOT commence any production implementation until all research and design work for new projects, upgrades, and systems improvements are approved. The

Contractor shall complete all preliminary cost analysis, design documentation, risk assessments, and testing before IHS determines if a project is feasible, meets agency goals and objectives, and fits enterprise architecture and performance plans. The COR will submit requests for new IT projects for IT Governance approval. The Contractors' analysis and design work shall follow IHS Enterprise Architecture, Agency and ISAC priorities, IHS IT Strategic Planning, Division IT Tactical planning goals and objectives, and IHS Mission plans, where available.

5.1.3.4 Risk Management:

The Contractor shall assess for risks associated with all tasks within this PWS to include the degree to which the risks associated with the support activities impact the success of deliverables, resources, IHS funding availability, and IHS IT services integration. All identified risks are to be assessed for probability, severity and impact along with planned mitigation recommendations for review and approval.

5.1.3.5 Service Transition: The Contractor shall provide for the operations and management for service transition to include change management, asset management, configuration management and release and final deployment of new services.

5.1.3.6 Change Management: The Contractor shall develop documented baselines and maintain all major equipment modifications, software changes and Enterprise changes in an acceptable change management database.

a. The Contractor shall provide routine communication to the IHS IT Service Desk regarding any necessary changes to existing features and functionality of Enterprise services that may impact end users due to any activities performed by the contractor or required by IHS as identified within the internal Change Control Board (CCB) process and procedural documentation.

b. The Contractor shall be required to perform all maintenance, patching and service changes for production systems during a predetermined maintenance window and during data center off peak hours to the maximum extent possible.

c. The Contractor shall ensure to require notifications of changes and assessment of any potential impact from all Sysadmins, System Owners and Database administrators which should be provided at least three business days in advance of planned maintenance activities.

d. The Contractor shall document all changes in an approved Change Management database with reporting capabilities.

5.1.3.7 Asset Management: The Contractor shall document, validate and manage various service assets used within IHS to include hardware, software, knowledge management systems, Active Directory objects, policies, certificates, etc.

5.1.3.8 Configuration Management: The Contractor shall maintain data and information on systems in use within DITO in an approved configuration management database.

5.1.3.9 Release and Deployment Management: The Contractor shall ensure that all analysis and development work follow the IHS Enterprise Architecture, IHS IT Strategic Planning, IT Tactical goals and objectives, IT Security policies and the IHS Mission. Therefore, the Contractor is to follow the ITIL guidelines for planning, scheduling, documenting and controlling the release of patches, versions, upgrades, and new applications. Test plans must be prepared and completed with approvals to proceed prior to implementation of major upgrades.

5.1.3.10 Service Operation: The Contractor shall ensure that all incident and problem management procedures are followed. This includes maintaining production infrastructure to prevent service interruptions and efficiently deliver IT services. The contractor shall recommend hardware and software changes for problem solving, capacity limitations, performance “tuning,” system improvements, and process improvements. This includes the identification of where load balancing may improve system performance, reporting problem resolutions and developing a Trend Analysis and Recommendations report for review. For any identified incidences, all emergency system and network changes must be reported to the COR within 1 hour and take corrective action to restore to operational capabilities within 4 hours (this may depend on the criticality of the service and associated SLAs). The Contractor shall report when corrective actions are complete to the COR within 24 hours. Notification of any unplanned outages are required to be provided to the COR and Federal Manager immediately upon identification.

5.1.3.11 Continuous Service Improvements: Assigned contractor personnel shall be knowledgeable of industry best practices related to the processes and procedures used to develop new systems and to recommend and implement system improvements for an enterprise IT operations center. The Contractor shall be familiar with all aspects of the

ITIL Service Management framework to assist with improving the effectiveness and efficiency of IT services and support to the business and mission of the Indian Health

Service for both the internal and external customers. The Contractor shall develop and document best practices to promote continuous improvement to the IHS Active

Directory, Headquarters Data Centers, Service Desk, User Support, Applications support and other Administrative support with the ultimate goal of providing a higher level of service maturity and improved customer satisfaction.

5.1.3.12 Contract Staff Management:

a. The Contractor shall prepare a staffing management plan to include recruitment and retention of key personnel and support staff and present to the COR for approval.

b. Staff Security: The Contractor shall monitor and track all staffing Personal

Identification Verification (PIV) cards and certificate expirations and ensure that renewal documentation and certificate updates are completed in a timely manner according to HHS HSPD-12 policies and renewal requirements.

c. At least 30 days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result of leaving the employ of the Contractor), the Contractor shall notify the

Contracting Officer and shall submit comprehensive justification for the diversion or replacement request (including proposed substitutions for key personnel) to permit evaluation by the Government of the impact on performance under this contract.

d. Staff Training:

• The contractor shall ensure that each contractor/subcontractor employee has completed the IHS Computer Security Awareness Training course

(www.ihs.gov/issa ) to include the associated role based training prior to performing any contract work, and thereafter completing the IHS-specified fiscal year refresher course prior to the due date identified.

• The Contractor shall ensure that all staff supported within this contract attend

ITIL Foundations training to include certification within three months of onboarding within IHS.

• The Contractor shall be required to attend and document the completion of various IHS mandated trainings identified throughout the contract period.

• The Contractor shall maintain a listing by name and title of each contractor and subcontractor employee working under this PWS of all trainings completed during the course of the contract. Any revisions to this listing as a result of staffing changes shall be submitted with next required technical progress report.

• The Contractor shall provide any necessary technical training relating to applications, services and support being provided as part of this PWS for all contract staff in order to remain technically relevant and authoritative for all services. The contractor shall maintain an up to date listing of all trainings completed during the course of the contract for each technical resource. Some trainings may be provided by IHS for critical projects, applications and systems as funding is available.

5.1.3.13 Consultation: The Contractor shall provide consultation for solving complex problems, design reviews, emerging technologies and systems analysis to Area Offices and field locations on an as needed basis.

5.1.3.14 End User Training Support: The Contractor shall provide as needed application training for IHS users and lower-level admins in new commercial application implementation http://www.ihs.gov/issa plans to include training end users and lower-level system administrators for developed production systems. The Contractor shall provide training online, audio conferencing, offsite, or occasionally in an IHS supported training room. These trainings may be scheduled or unscheduled, as needed based on end user support needs.

5.1.3.15 Meetings and Conferences: The Contractor staff shall attend local and virtual meetings and conferences as directed by IHS staff for technical input, project guidance, etc.

5.1.3.16 Interagency Development and Support: The Contractor shall provide support for any development and implementation of specific technical solutions that may be required by the HHS and will require interagency project coordination and outside agency resource sharing management. The Contractor shall provide analysis, design, complex troubleshooting, and implementation services for work related to these outside entities.

5.2 DATA CENTER SERVICES

High Level Objective: IHS seeks to ensure the security, availability, and lifecycle management of the physical and virtual infrastructure in support of IHS critical Enterprise services.

The Contractor shall provide Data Center Management services for the Albuquerque, NM and

Rockville, MD Data Center Infrastructures. Contract staff must be available for on-site support on a rotational basis during standard support hours as well as irregular (on-call) support for critical alerts and monitoring. Standard support hours are to be from 8 am to 5pm, local time, M-

F. This includes availability for urgent support after hours for all Federal Holidays & weekends.

Support is to include the assessment and provisioning of the appropriate rack space, power, network connectivity, cable management, and various other elements for Data Center

Management and support of all IHS hardware.

5.2.1 Facilities Support

5.2.1.1 The Contractor shall interface with local Data Center Facility Management Staff on IHS infrastructure needs including conditioned computer room space, telecom, power, cooling, etc. and attend all monthly Data Center Management meetings. This may require some troubleshooting and reporting of all data center infrastructure concerns and issues to the Federal Manager.

5.2.1.2 The Contractor shall also conform to all Data Center Facility infrastructure requirements for design, cabling, equipment listing, operability, security, change management, etc. Server racks are to be locked at all times when not under active maintenance.

5.2.1.3 The Contractor shall ensure that the server rooms and work areas are kept clear of debris for safety purposes according to the Facility Safety policies.

5.2.2 Vendor Coordination

The contractor’s onsite data center staff shall ensure secure access to IHS racks to include the supervision, monitoring and support of any vendor performing work on the IHS equipment or infrastructure within the Data Centers. This would include but is not limited to: vendors installing or upgrading hardware components, or telecommunication providers installing or troubleshooting telecommunication circuits or other onsite support.

5.2.3 Hardware Lifecycle Management

The Contractor shall provide support for the physical and virtual infrastructure, Application servers, File Servers, Terminal Servers, VPN devices, Network appliances, various Storage environments, Backup devices and National Data Warehouse environments. A listing of all specific hardware platforms included as part of this PWS are contained within the Appendix A.

The Contractor shall assess and recommend hardware and software solutions to replace end of life systems and support modernization efforts. The Contractor shall prepare for, install, cable, and connect all infrastructure hardware in coordination with associated vendors.

5.2.4 Hardware Inventory

The Contractor shall ensure that new equipment that is placed on the network is properly labeled and configured per IHS policy and inventory lists managed to include Make/Model, SN, Barcodes, warranty dates, system owners, NetBIOS name, etc. The inventory of all systems is to be kept up to date within three days of any changes into an approved inventory/configuration management database and available for COR/Federal Manager review.

The Contractor shall provide support for yearly equipment inventory reviews in collaboration with the IHS Property Management staff to include escorting and assisting with identification, tracking of missing items, verification of overages, etc. Equipment inventory reports are to be provided as requested with recommendations supplied for yearly technology refresh or warranty renewal requirements as requested by Data Center management to ensure efficient operations.

Support for the completion of all equipment transfer forms shall be provided to the COR for the

IHS property management staff.

The Contractor shall provide a list of all surplus equipment that the contractor removes from production to the IHS Federal Manager/COR for inventory control and to ensure proper disposal.

The Contractor shall assist with and ensure that all hard drives are wiped according to IHS policies with documentation provided to Federal Manager.

5.2.5 IP Address Management

The Contractor shall maintain an accurate account of static IP addresses used with the IHS Data

Center to include the list of subnets, VLANs, assigned group, etc. in coordination with the IHS

Network support team.

5.2.6 Network Cabling

The Contractor shall provide O&M support for inside plant telecommunications cabling for server rooms, patch panels, and telecommunication closets. The scope of this support is to perform minor add/remove/change tasks and not implement major cabling projects. Additional support includes:

5.2.6.1 Work with vendors to coordinate the installation of additional networking equipment.

5.2.6.2 Install cabling within and between racks to connect Ethernet and Fiber Channel devices.

5.2.6.3 Install network equipment in racks and wiring closets.

5.2.7 Disaster Recovery Management

5.2.7.1 The Contractor shall provide experienced, knowledgeable technical support for the integration with Cloud Service Provider (CSP) vendors for implementation of Disaster

Recovery (DR) services as part of the HQ Cloud Strategic Plan. NOTE: this effort is dependent on the IHS Cloud Strategic Plan and identified projects for HQ Data Center integration.

5.2.7.2 The Contractor shall assess, recommend, implement and provide for routine testing of a

Disaster Recovery Plan for the Headquarters Data Centers. This includes a Disaster

Recovery technical subject matter expert/SME to negotiate the priorities and recovery time objective (RTO), and to develop, build out, document, test and provide support for data/system recovery validation.

5.2.7.3 The Contractor shall document the baseline Disaster Recovery plans for critical infrastructure services and Enterprise applications and then provide the follow on maintenance and improvement all Disaster Recovery plans for the Enterprise IT critical services to include design, configuration, testing and validation reporting on a yearly basis.

5.2.7.4 The Contractor shall ensure that all identified critical services and applications are maintained according to service level agreements in alignment with the High

Availability and failover requirements identified in coordination with the IHS HQ DR site identified.

5.2.7.5 The Contractor shall lead technical efforts to provide support for application owners and system owners to assess and implement the redundancy of services hosted and supported within the control of DITO.

5.2.7.6 The Contract staff shall participate in any Incident Response and Emergency

Management Plan exercises as required.

5.2.8 Cloud/Hybrid Implementation

IHS will implement several FedRAMP approved Cloud Services to comply with multiple federal policies established in 2018. Specifically, IHS will improve citizen-facing services through the increased use of cloud-based solutions to align with the 2018 President’s Management Agenda.

IHS will also align with the HHS Information Technology Strategic Plan

(https://www.hhs.gov/sites/default/files/hhs-it-strategic-plan-final-fy2017-2020.pdf ). The

Contractor shall design, test, implement, operate, and technically maintain Cloud services supporting the IHS (dependent on service agreement with Cloud Provider).

https://www.hhs.gov/sites/default/files/hhs-it-strategic-plan-final-fy2017-2020.pdf

5.2.8.1 The Contractor shall provide experienced, knowledgeable technical support for the integration with any IHS approved, FEDRAMP Authorized Government Cloud Service

Provider (CSP) vendors and the IHS private cloud environment as part of the HQ Cloud

Strategic Plan and in alignment with NIST SP 800-145.

5.2.8.2 The Contractor shall assist in the assessment and identification of both the business and technical requirements, architectural requirements, use case identification, security and design reviews for the HQ Hybrid Cloud infrastructure implementation and integration with approved Cloud Service Providers (CSP). This includes providing and/or recommending solutions as well as to provide for the implementation and management support for cloud integration and brokering services.

5.2.8.3 The Contractor shall develop and implement the proof of concept testing and validation of technical designs and processes needed to support a Cloud/hybrid infrastructure in collaboration with various OIT business partners and vendors.

5.2.8.4 The Contractor shall provide a dedicated, knowledgeable, experienced support resource that would lead efforts to integrate IHS services to a FedRAMP authorized CSP.

5.2.8.5 The Contractor shall ensure integration of critical IHS infrastructure requirements such as Active Directory, MultiFactor Authentication (MFA) and various support tools such as VMware are part of the IHS Hybrid Cloud management plan.

5.2.8.6 The Contractor shall assist with the tracking of all cloud activities in use across the

Agency through the use of IHS tools. Reports are to include what is consumed, what is

FedRAMP approved and to facilitate the migration of existing services from non-approved sources to an approved IHS authorized, FedRAMP service.

5.2.8.7 The Contractor shall identify, implement and document all network, storage, and process changes and dependencies required for the testing and sustained use of an

Infrastructure as a Service offering with a CSP according to IHS policies and security practices.

5.3 END USER SERVICES

High Level Objective: IHS seeks to promptly resolve end user IT related issues in order to reduce service disruptions and to minimize the impact to IHS services in a timely manner.

The Contractor shall provide an IT service desk as well and direct an expert technical End user support team for both HQ facilities (approximately 1000 employees and contractors) as well as to provide for escalated support of all IHS Enterprise IT support requests via a tiered Service support structure as defined at https://www.ihs.gov/Helpdesk/ . The following table represents current support statistics for each of the sub tasks:

IT Call Center Total IT End User Support Total

# of Incident Tickets/year 22,000 # of Incident Tickets/year 2,000

# of Catalog Tasks/year 3,000 # of Catalog Tasks/year 3,000 https://www.ihs.gov/Helpdesk/

Totals: 22,300 5,000

5.3.1 HQ IT End User Support

Providing excellent customer service is the IHS priority. The Contractor shall provide remote

Tier 1 and Tier 2 onsite IT support services to approximately 800 Headquarters employees and contractors at the Headquarters location in Rockville, MD as well as remote support to IHS

Headquarters Federal Employees and contractors operating from telework locations throughout the country (nationwide). Remote support can be located at the contractor’s discretion. On site

Tier 2 support hours are to be from 7am to 5pm, EST, M-F (excludes Holidays) at the Rockville, MD location.

5.3.1.1 The contractor shall provide a Tier 1 Service Desk (call center) to manage all HQ incident, problem, change, and service requests from IHS Headquarters staff. The

Contractor shall primarily perform the Tier 1 Service Desk capabilities from the

Contractor facility. The Contractor shall provide first call resolution (FCR) for common tasks such as password resets, Active Directory group membership changes, Outlook Address Book updates, and other services through well-defined procedures.

The Tier 1 Service Desk is to log all requests into the IHS ITSM Solution (ServiceNow) and is the primary interface between IHS customers and IT staff providing support. The

Tier 1 Service Desk shall monitor the lifecycle of tickets and ensure IHS meets established service level agreements. The Contractor shall coordinate activities across all IT Tiers and cross-organizational boundaries to resolve tickets. The Tier 1 Service

Desk also provides information to users on the status of services, answers questions about IT procedures, and educates users about best practices on the use of Desktop technologies.

5.3.1.2 11/27/2020: No Cost Mod **REMOVE** this…