Attachment_2_-_PWS_R10_MRITTS_1.pdf

U.S. Environmental Protection Agency

Environmental Protection Agency (EPA) Region 10 Multi-Regional Information

Technology Support Services (MRITSS) Performance Work Statement

Table of Contents

Environmental Protection Agency (EPA) Region 10 MRITSS 1 Performance Work Statement

1. INTRODUCTION

1.1 Overview

1.2 Background

1.3 Document Layout

1.3.1 Performance Work Statement Structure

1. Introduction

3. Performance Objectives and Measures

1.3.2 Technical Exhibits

2. SCOPE OF WORK

2.1 Work Description

2.2 Customers

2.3 Place of Performance

2.4 Hours of Operation

2.5 Government Provisions

2.5.1 Government Furnished Property

2.6 Travel

2.7 Cross-Cutting Principles [Not Separately Priced]

2.7.1 Government-Retained Authorities

2.7.2 Quality

2.7.3 Documentation

2.7.3 Knowledge Management

2.7.4 Reporting

2.7.5 Enterprise IT Service Integration

3 PERFORMANCE OBJECTIVES AND MEASURES

3.1 GENERAL REQUIREMENTS

3.1.1 Regional Information Technology Management Support

3.1.1.2 Procedure Development

3.1.1.3 Strategic Planning

3.1.1.4 Resource Management

3.1.1.5 Change Management

3.1.2 Security Requirements

3.1.2.1 Security Clearance

3.1.2.2 Personnel Identification and Facility Access

3.1.2.3 Physical Security

3.1.2.4 Data Protection

3.1.2.5 Systems Access and Authorization

3.1.2.6 Oversight and Compliance

3.1.2.7 Information Security Training

3.1.2.8 Documentation and Reporting

3.1.2.9 Subcontract Flow Down

3.1.3 Service Management, Monitoring and Reporting

3.1.4 Key Personnel

3.1.4.1 Staffing and Personnel

3.1.4.2 Surge Staffing

3.1.4.3 Service Level Agreements

3.1.4.4 Operations Status Report

3.1.4.5 Financial Management

3.1.5 Closeout

3.2 REGIONAL IT SUPPORT SERVICES

3.2.1 TASK 1: SERVICE DESK SUPPORT

3.2.1.1 Customers

3.2.1.2 Mobility Support

3.2.1.3 Incident Support

3.2.1.4 Workstation Management

3.2.1.5 IT Facilities Management and IT Physical Security

3.2.1.6 IT Equipment Support

3.2.1.7 IT Software Support

3.2.1.8 IT Procurement Support

3.2.1.9 Maintenance, Support, and Service Agreements Management

3.2.1.10 Audio, Video, and Web Conferencing

3.2.1.11 Wireless Services

3.2.1.12 Voice and Data Services

3.2.2 TASK 2: USER TRAINING

3.2.3 TASK 3: NETWORK ADMINISTRATION

3.2.3.1 Network Configuration, Installation, Maintenance, Repairs, and Upgrades

3.2.3.2 Server Administration

3.2.3.3 Server Installation, Maintenance, Repairs, and Upgrades

3.2.4 TASK 4: INVENTORY CONTROL

3.2.5 TASK 5: SPECIAL PROJECTS

3.2.6 TASK 6: EMERGENCY SUPPORT

1. INTRODUCTION

1.1 Overview

This document is a Performance Work Statement (PWS) for a performance-based support services contract for the provision of non-personnel services to provide Information Technology (IT) Support Services. The purpose of this PWS is to describe the performance objectives for the Environmental Protection Agency’s Multi-Regional Information Technology Support Services for the Environmental Protection Agency at Regional 10 Site(s). All functions and activities will be task driven, and all work performed must be in accordance with all applicable regulations and guidelines as set forth in Appendix B: Technical Library or as instructed by the Contracting Officer’s Representative (COR) subject to specific requirements.

For purposes of this document, the term “Service Provider (SP)” refers to the private sector organization that will develop, assemble, and execute solutions to the IT service requirements outlined in this PWS. This document contains information available at the time of publication relating to administrative and technical responsibilities, performance requirements, and workload estimates for EPA Regional IT Support Services.

The SP shall exercise management and operational control over and retain full responsibility for performance requirements set forth in this PWS. Offerors are encouraged to incorporate process improvements and industry best practices in their proposals. The SP may introduce new technologies and processes in partnership with customers to deliver the best value products or services. The scope of this PWS includes the workload and efforts of IT support contractors currently performing the respective requirements across multiple locations. For this solicitation, Offerors should bid to the entire workload as described in Appendix #Historical Workload Estimates and/or Current Services Summary. The SP will not assume full responsibility for workload upon Order award. The SP will assume responsibility of requirements currently performed by other IT support contractors on a phased-in basis, to be determined by the COR.

1.2 Background

The Environmental Protection Agency (EPA) Region 10 is tasked with environmental protection matters. EPA Region 10 conducts environmental assessment, research, and education. It has the responsibility of maintaining and enforcing national standards under a variety of environmental laws, in consultation with state, tribal, and local governments. EPA Region 10 employs approximately 650 Federal and private sector contractor employees at complexes that consist of Regional Field Offices, National Laboratories and special- purpose offices in the four states of Alaska, Idaho, Oregon, and Washington.

The Environmental Protection Agency (EPA) is committed to enhancing operational efficiency and service delivery through innovative technological solutions. Consistent with section 2.7.6 of the Performance Work Statement (PWS) for the EPA MRITSS multiple award vehicle of Blanket Purchase Agreements (BPA), most of the IT services delivered under this contract require ongoing interoperation of both technology and service delivery with agency-wide shared services. The SP shall work collaboratively with EPA’s national IT service providers to: ensure compliance with agency standards for IT configurations; ensure ongoing interoperation and integration with shared services; efficiently support the integration with new agency-wide shared services; and ensure efficient and timely resolution of issues and incidents requiring joint problem resolution. Additionally, it is encouraged and expected to work with other Regional federal and/or contractor IT staff in collaborative spaces on common IT issues to achieve efficient results for the Region and Agency. As part of this vision, the EPA is focusing on consolidating its non-touch IT support services by leveraging the capabilities of the Enterprise IT Helpdesk (EISD). This strategic initiative aims to streamline IT support processes, reduce response times, and improve user satisfaction across the agency. By utilizing advanced IT management tools, the EPA seeks to create a seamless, integrated support system that effectively addresses the diverse technological needs of its workforce, while promoting sustainability and resource optimization. This collaboration will be guided by the MRITSS Contracting Officer Representatives (CORs), who will work in tandem with EISD CORs to ensure seamless coordination. The SP may be tasked with generating reports on the tickets they manage, actively participating in operational meetings, reviewing joint Standard Operating Procedures (SOPs), and providing insightful feedback on Memorandums of Understanding (MOUs) as the EPA progresses towards this consolidated state. As services are scaled to integrate with EISD, the SP will retain access to all tools essential for supporting the functions outlined in the Performance Work Statement (PWS). They will be expected to continue fulfilling their designated responsibilities. Sharing of tools must be coordinated through the task order appointed COR. This approach is designed to foster a cooperative environment that supports the EPA's strategic goals while maintaining operational integrity and efficiency.

For more information on EPA, see the EPA Website @ https://www.epa.gov/aboutepa/epa-region-10-pacific-northwest

1.3 Document Layout

The following indicates the structure of the PWS.

1.3.1 Performance Work Statement Structure

This PWS is structured according to sections and relevant TEs and Appendices as follows:

1. Introduction

2. Scope of Work-

TE 2-1: Users by Regional Office/Physical Location TE 2-2: Security Clearance Requirements TE 2-3: Current Services Summary TE 2-4: Regional Emergency Operations Centers (REOC) TE 2-5: EPA Cybersecurity Task Summary

3. Performance Objectives and Measures TE 3-1: Historical Workload Estimates TE 3-2: Performance Requirements Summary TE 3-3: EPA User Environment Technologies TE 3-4: EPA Application Technology Environment TE 3-5: EPA Infrastructure Management Technologies TE 3-6: EPA Network and Telecommunications Technologies TE 3-7: Staffing Plan and Key Personnel

Appendix A: Technical Library (Definitions/Acronyms) Appendix B: Technical Library (Regulations/Directives)

1.3.2 Technical Exhibits

Technical Exhibits are used to provide supplementary information and can be in the form of tables, graphs, maps, etc.

Technical Exhibits provided in this PWS may be referenced from any section and are identified by the letters “TE” followed by a space, the related section number, a dash, and sequence number of the individual TE from that section (e.g., TE 3-1). To enhance readability, TEs are referenced by italics, followed by a colon, and the name of the TE (e.g., TE 3-1: Historical Workload Estimates).

2. SCOPE OF WORK

2.1 Work Description

The SP shall support EPA’s Regional Information Technology Support Services (MRITSS) needs to provide Service Desk support services and coordinate information technology (IT) activities for approximately 650 staff for EPA Region 10 in various locations, including but not limited to all locations described in the paragraphs below. There are approximately 650 computers that consist primarily of laptops. For informational purposes only, note that historically, the Service Desk has been staffed with 9 full-time employees (FTEs), which includes the manager and dedicated emergency operations technician.

2.2 Customers

The scope of IT support provided under this PWS will be limited to Federal employees, support contractors and EPA special program personnel who occupy Federal space and/or require the same IT support as the Federal employees.

The EPA has a highly mobile workforce and service support shall include support for remote users working outside of EPA operated facilities and may not be connected directly to the EPA Network. The SP shall provide IT support services with a customer-oriented approach. Information on the IT users across EPA regions is presented in TE X:

Users by Regional Office/Physical Location.

https://www.epa.gov/aboutepa/epa-region-10-pacific-northwest

2.3 Place of Performance

Workload to be performed by the SP under this Contract is required for the following Field Organizations:

• Region 10 HQ in Seattle, Washington with approximately 520 staff

• Operations office in Anchorage, Alaska with approximately 32 staff

• Operations office in Boise, Idaho with approximately 23 staff

• Operations office in Portland, Oregon with approximately 26 staff

• Operations office in Lacey, Washington with approximately 11 staff

• Manchester Laboratory located in Manchester, Washington with approximately 31 staff

• A remote office at Hanford in Richland, Washington with approximately 6 staff

More information on performance locations presented in TE 2.1: Users by Regional Office/Physical Location. SP personnel may be required to perform contract duties at an alternate CONUS location in support of emergency response activities and special mission requirements as directed.

[As determined by Regional COR] The Government may permit situational telework by Contractor employees when determined to be in the best interest of the Government, as directed. Telework will be at no additional cost to the Government.

2.4 Hours of Operation

All services shall be provided on all Federal business days or as otherwise specified. In the event of an environmental emergency or operational crisis where emergency services may be requested, the Agency may require extended Contractor support.

2.5 Government Provisions

The SP shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform IT services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property, facilities, equipment, and supplies.

2.5.1 Government Furnished Property

• Laptop

• Keyboard

• Mouse

• Docking Station

• Monitor

• Mobile Device

As long as the furnished items indicated above are not removed from EPA’s site, it is not considered to be government-furnished equipment or property as defined under, or subject to, the requirements of FAR 52.245-1 Government Property or EPAAR 1552.245-70 Government Property. In the event any furnished items are removed from the Government’s site, FAR 52.245-1 and EPAAR 1552.245-70 will apply.

2.6 Travel

Travel may be required in the performance of regional information technology support services under this PWS.

Travel may include but is not limited to travel to Program offices, Regional Offices, field offices or other work locations as determined by the needs of the EPA. This may include travel within the local commuting area. The cost for travel is reimbursable as Other Direct Cost (ODC) to the contract in accordance with the Federal Travel Regulations.

The contractor will follow all EPA and Federal Government travel policies, procedures and restrictions when traveling for official business.

2.7 Cross-Cutting Principles [Not Separately Priced]

Throughout the performance of this requirement, the Contractor shall incorporate Cross-Cutting Principles. Cross- Cutting Principles are not separately priced but should be incorporated into all service activities in this PWS, they include-

2.7.1 Government-Retained Authorities

The Government will retain a set of key authorities that encompass the overall service strategy and service design related to Enterprise and Regional IT support services. The Government will also retain authority for all demand management, governance, and approval functions associated with the tasks described in this PWS.

2.7.2 Quality

The Government expects the service provider (SP) to propose and implement IT support services at the highest level of quality. The SP shall include the daily practice of delivering solutions that fulfill the EPA’s Regional IT Support needs and meet or exceed expectations across several dimensions: accurate and timely deliverables; adherence to established standards, policies, and procedures; frequent and candid communications; and outstanding service excellence. The SP shall ensure compliance with applicable Federal mandates, contractual performance standards, and industry best practices. The SP shall consider as part of its Quality Control Plan (QCP) standard approaches toward quality such as the International Standards Organization (ISO), the Information Technology Infrastructure Library (ITIL), the Project Management Body of Knowledge (PMBOK), and Agile processes.

2.7.3 Documentation

The SP shall be responsible for the documentation of all efforts to include, but not limited to, contract provisions, service level agreements and any documentation associated with Section 3: Performance Objectives and Measures. Requirements associated with documentation may be task driven. EPA's records management is governed by federal laws and regulations set forward by the National Archived and Records Administration, for more information on the applicable laws and regulations relevant to documentation, see https://www.archives.gov/about/laws. For EPA Records Management Policy, see Records Management Policy (CIO 2155.5) and Records Schedules.

2.7.3 Knowledge Management

The SP shall be responsible for providing and maintaining KM information exclusive to the IT performance requirements under this PWS. The SP shall consider any intellectual, structural, or customer capital, that is understood, contained, or generated in the execution of any order as KM information. The information held by the individuals responsible for such execution shall become shared non-exclusive intellectual property between the SP and the EPA.

2.7.4 Reporting

The SP shall be responsible for complying with reporting requirements exclusive to the IT performance requirements under this PWS.

2.7.5 Enterprise IT Service Integration

Most of the IT services delivered under this contract require ongoing interoperation of both technology and service delivery with agency-wide shared services. The SP shall work collaboratively with EPA’s national IT service providers to: ensure compliance with agency standards for IT configurations; ensure ongoing interoperation and integration with shared services; efficiently support the integration with new agency-wide shared services; and ensure efficient and timely resolution of issues and incidents requiring joint problem resolution.

3 PERFORMANCE OBJECTIVES AND MEASURES

The SP shall perform the requirements provided in accordance with the instructions as noted in Appendix 1:

Performance Requirements Summary (PRS), which will determine requirements, adequacy, security, and reliability.

The task areas that are included in this PWS are checked below:

https://www.archives.gov/about/laws https://www.epa.gov/system/files/documents/2021-08/records_management_policy.pdf https://www.epa.gov/system/files/documents/2021-08/records_management_policy.pdf https://www.epa.gov/records/epa-record-schedules

GENERAL REQUIREMENTS

☒ 3.1.1 REGIONAL INFORMATION TECHNOLOGY MANAGEMEN SUPPORT

☒ 3.1.2 SECURITY REQUIREMENTS

☒ 3.1.3 SERVICE MANAGEMENT, MONITORING AND REPORTING

☒ 3.1.4 KEY PERSONNEL

☒ 3.1.5 CLOSEOUT

REGIONAL IT SUPPORT SERVICES

☒ 3.2.1 TASK 1: SERVICE DESK SUPPORT

☒ 3.2.2 TASK 2: USER TRAINING

☒ 3.2.3 TASK 3: NETWORK ADMINISTRATION SUPPORT

☒ 3.2.4 TASK 4: INVENTORY CONTROL

☒ 3.2.5 TASK 5: SPECIAL PROJECTS

☒ 3.2.6 TASK 6: EMERGENCY SUPPORT

3.1 GENERAL REQUIREMENTS

The general requirements section outlines activities that will be completed by the SP for this requirement. The activities in this section include:

3.1.1 Regional Information Technology Management Support

3.1.2 Security Requirements

3.1.3 Project Management, Monitoring and Reporting

3.1.4 Key Personnel

3.1.5 Closeout

The need for these requirements and the amount of information/level or effort required are outlined below.

3.1.1 Regional Information Technology Management Support

The following subsections detail specific SP responsibilities pertaining to Regional IT Management Support within the EPA organization including sensitive, classified, and unclassified information systems.

In support of Regional IT Management activities, the SP shall comply with professional project management discipline, the Clinger-Cohen Act, Paperwork Reduction Act, Government Paper Elimination Act (GPEA), Computer Security Act, Presidential Decision Directive (PDD) # 63, the Government Performance and Results Act (GPRA), Section 508, and other applicable laws and regulations. The SP shall provide expert IT consultation and perform IT related work in response to business and mission needs at Regional Offices and Field Organizations outlined in PWS Section 2.3. IT Management tasks for this requirement include-

3.1.1.2 Procedure Development

The SP shall assist in the drafting and implementation of Regional and Multi-Regional IT manuals, procedures, Standard Operating Procedures (SOPs), and guidelines, as required and submit for approval and dissemination. The SP shall review, critique, and provide recommendations to draft manuals, orders, procedures, SOPs, and guidelines.

3.1.1.3 Strategic Planning

The SP shall provide input to the development of Regional IT Strategic Plans to include supported Program/Staff Offices and Field Organizations. The SP shall make recommendations for service improvement and optimization where appropriate. The SP shall assist the Regional Offices with efforts to develop and implement a multi-regional approach to support services and to develop guidelines and processes to ensure consistent support across regions.

3.1.1.4 Resource Management

The SP shall perform resource management activities in response to specific orders for the approval by the COR to include, but not limited to, assisting with efforts to: analyze and track budget expenditures; support the IT budget process; coordinate resource management and information systems efforts that support the implementation of EPA and other IT Management related regulations.

Resource Management tasks for this requirement include-

3.1.1.5 Change Management

The SP shall perform change management activities in response to specific orders for the approval by the COR in accordance with ISO 20000-1, Infrastructure Library (ITIL) and industry best practices. Activities may include but are not limited to supporting change enablement processes (change opportunity identification, requests, planning and implementation/release management) and risk management.

3.1.2 Security Requirements

The SP shall comply with all Government security regulations and requirements. EPA IT security requirements outlined in EPA IT Directives and this PWS both in managing the execution of the Contract, as well as the delivery of services to end users. Consider the language in this PWS as authoritative for any IT Security requirements that are not explicitly cited in the applicable documents list referenced in Appendix B: Technical Library (Regulations/Directives, TE 2-2: Security Clearance Requirements and TE 2-5: EPA Cybersecurity Task Summary, unless superseded by additions or updates to EPA policy documentation.

While not a complete list of all IT Security requirements, the is highlighting the following IT Security requirements for managing the Contract and for fulfilling end-user services. Unless superseded by updates to policies, handbooks, Policy Decision Memoranda (PDM), or EPA standards. Failure to comply with Government security regulations and requirements shall require the SP to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for contract termination.

3.1.2.1 Security Clearance

All SP personnel performing work under this Order must have and maintain security clearance, TE 2-2:

Security Clearance Requirements.

3.1.2.2 Personnel Identification and Facility Access

The SP shall be responsible for EPA personnel background investigations, identification and access security requirements outlined in TE 2-2: Security Clearance Requirements and TE 2-5: EPA Cybersecurity Task Summary. Unless stated at the order level, SP personnel shall not begin service performance until documentation for a Personnel Background Investigation has been submitted and interim clearance has been issued. An Identification (ID) badge and Personal Identity Verification (PIV) card are required for access to Government computer databases and entering EPA facilities. If a background investigation results in an unfavorable finding, the SP will be notified and the SP employee will not be able to perform services at the facility, and must return all identification badges, PIV cards, and other items issued previously issued by the Government.

The SP shall comply with the local facility and Personnel Security Branch (PSB) personnel identification and access requirements. The SP is responsible for absences of Contractor personnel due to expired identification and access documents. SP personnel shall wear a visible Security badge ID when required.

Contractor shall turn in all issued badges, PIV, and identification cards to the EPA upon termination of their services. The SP shall immediately report any lost or stolen badges or PIV to the EPA.

3.1.2.3 Physical Security

The SP shall be responsible for safeguarding all government equipment, information, and property provided for SP personnel use during service performance. Government facilities, equipment, and materials shall be https://www.epa.gov/irmpoli8/current-information-directives#security secured at the end of each work period. Specific security procedures for this requirement will be provided by the EPA COR post award.

3.1.2.4 Data Protection

The SP shall be responsible for data protection both in managing the execution of the Order, as well as the delivery of services to end users in accordance with this PWS and TE 2-5: EPA Cybersecurity Task Summary, primary tasks have been summarized below-

a. Comply with information protection requirements in accordance with EPA Privacy Policy and

Procedural Requirements and assess all information collections to ensure compliance with federal regulations and privacy protection requirements.

b. Comply with FAR 52.224-1, Privacy Act Notification and FAR 52.224-2, Privacy Act clauses when the Contractor is required to design, develop, or operate a system of records on individuals to accomplish an Agency function, and ensure their employees comply with the requirements of the EPA Privacy Management Program.

c. Protect all sensitive information in accordance with Executive Order 13556 Controlled Unclassified Information and EPA Policy.

d. Protect all Personally Identifiable Information (PII) - as defined in OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information and National Institute of Standards and Technology Special Publication (NIST SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations.

e. Provide a plan for the proper handling and protection of Sensitive Information to prevent unauthorized disclosure. At a minimum, this plan must address the following-

(1) Proper marking, control, storage, and handling of Sensitive Information residing on electronic media, including computers and removable media, and on paper documents.

(2) Proper control and storage of mobile technology, portable data storage devices, and communication devices.

(3) Proper use of Federal Information Processing Standards (FIPS) 140-2 compliant encryption modules to protect Sensitive Information while at rest and in transit throughout EPA, Contractor, and/or subcontractor networks, and on host and client platforms.

(4) Proper use of FIPS 140-2 compliant encryption modules to protect Sensitive Information in email attachments, including policy that passwords must not be communicated in the same email as the attachment.

(5) Information Security Incident Response Plan

f. Obtain written approval by the Chief Information Officer (CIO) or designee prior to the use or storage of EPA Sensitive Information or sharing of EPA Sensitive Information by the SP with any subcontractor, person, or entity other than the EPA.

g. Report Information Security Incidents and Privacy Breaches in accordance with EPA Policy.

Failure to report Information Security Incidents may result in termination in accordance with EPA Requirement Termination for Default – Failure to Report Information Security Incident.

h. In the event of an Information Security Incident, the Government may suspend or revoke an existing Authorization to Operate (ATO) (either in part or in whole). If an ATO is suspended or revoked in accordance with this requirement, the Contracting Officer may direct the SP to take additional security measures to secure Sensitive Information. These measures may include restricting access to Sensitive Information on the Contractor IT systems. Restricting access may include disconnecting the system processing, storing, or transmitting the Sensitive Information from the internet or other networks, or applying additional security controls.

3.1.2.5 Systems Access and Authorization

The SP shall be responsible for systems access and authorization tasks both in managing the execution of the Order as well as the delivery of services to end users in accordance with this PWS, EPA IT Directives, and TE 2-5: EPA Cybersecurity Task Summary, primary tasks have been summarized below-

a. Comply with the access, authentication, and registration requirements as defined in EPA Information Security-

Access Control Procedures:

i. Manage user accounts as directed for SP supported IT systems and applications, using the EPA Access Management Program (AM) using Oracle Access Manager.

ii. Provide application authentication and authorization support, including coordinating with the EPA

Enterprise EISD team to ensure that an asset workflow is established for each user- authenticated system and application supported by the SP.

iii. Work exclusively on the EPA LAN/WAN network. SP is not allowed to work or connect to their corporate network(s) without advanced approval from the EPA COR and the Information Security Officer. The SP is not allowed to run / execute any network tools or utilities that scan, map, or document any part of the EPA LAN/WAN network, whether active or passive.

iv. Request EPA approval to run any non-standard software

v. Configure commercial off-the-shelf (COTS) products in accordance with EPA, NIST, Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) or Center for Internet Security (CIS) standards. If standards do not exist from one of these sources, the contractor shall coordinate with EPA to develop a configuration.

3.1.2.6 Oversight and Compliance

The SP shall-

a. Comply with information security requirements as identified in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations, which provides the EPA and GAO the authority to conduct site reviews for compliance validation and will conduct security reviews on a periodic and event-driven basis for the life of the contract. Full cooperation by the Contractor is required for audits and forensics.

b. Comply with Information Security Continuous Monitoring (ISCM) and Reporting as identified in OMB Memorandum M-14-03, Enhancing the Security of Federal Information and Information Systems.

c. On request, provide EPA access to the Contractor’s facilities, installations, operations, documentation, databases, IT systems and devices, and personnel used in performance of the contract, regardless of the location. In addition, EPA reserves the right to perform ISCM and IT security scanning of Contractor systems with tools and infrastructure of EPA’s choosing.

d. All Contractor systems used in the performance of the contract must perform monthly vulnerability scanning as defined by EPA IT and Security Policy, and the Contractor must provide scanning reports to the Contracting Officer (CO), who will forward them to the EPA CIO or designee monthly.

e. All Contractor systems used in the performance of the contract must participate in the implementation of automated security controls testing mechanisms and provide automated test results in Security Compliant Automation Protocol (SCAP) compliant data to the Contracting Officer, who will forward to the EPA CIO or designee monthly.

3.1.2.7 Information Security Training

https://www.epa.gov/irmpoli8/information-security-policy-procedures-and-standards https://www.epa.gov/irmpoli8/information-security-policy-procedures-and-standards https://www.epa.gov/irmpoli8/information-security-policy-procedures-and-standards

The SP Shall-

a. Comply with information security training requirements as identified in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations.

i. Ensure that all SP personnel complete EPA-provided mandatory security and privacy training prior to gaining access to EPA information systems. Non- compliance may result in denial of system access. Reference: EPA Information Security – Awareness and Training (AT) Procedure

ii. Ensure all SP personnel complete EPA-provided mandatory refresher security and privacy training on an annual basis. Non-compliance may result in revoking of system access.

iii. Ensure that each SP employee review and sign the EPA Rules of Behavior pertaining to appropriate use of EPA information systems prior to gaining access to EPA information systems. Non-compliance may result in denial of system access. Ensure all SP personnel review the EPA Rules of Behavior on an annual basis. Non-compliance may result in revoking of system access.

iv. Ensure that SP personnel with significant information security responsibilities complete specialized information security training based on the requirements defined in the EPA role-based training program. The SP is required to report training completed to ensure competencies are addressed. The SP must ensure employee training hours are satisfied in accordance with EPA Security and Privacy Training Standards. The EPA will provide additional information for specialized information security training based on specific requirements.

3.1.2.8 Documentation and Reporting

The SP Shall-

a. Comply with the Federal Information Security Modernization Act (FISMA) 44 USC Section 3541 reporting requirements.

i. Ensure the timely submittal of annual and quarterly FISMA data, as directed by the Office of Management and Budget (OMB) and the EPA. FISMA reporting requirements may change for each reporting period.

ii. Ensure SP systems compliance with monthly data feed requirements, as directed by as directed by the OMB and the EPA.

3.1.2.9 Subcontract Flow Down

The SP shall insert in each subcontract or consultant agreement placed hereunder, provisions which shall conform substantially to the language of Section 3.1.2 Security Requirements, unless otherwise authorized by the Contracting Officer.

3.1.3 Service Management, Monitoring and Reporting

The following subsections detail specific SP responsibilities pertaining to Regional and Multi-Regional IT Service Management, Monitoring and Reporting. Activities mandated under the contract may include but are not limited to the provision of key personnel; establishing/updating service level agreements as specified;

preparing monthly operations status reports; preparing and submitting invoices; attending project meetings as specified; and submitting ad-hoc reports during the projects as requested by the project manager.

3.1.4 Key Personnel

The SP shall provide Key Personnel (KP) to support Service Management in accordance with this PWS.

I. Service Management Lead https://www.epa.gov/system/files/documents/2023-06/information_security_awareness%20and%20training%20_procedure.pdf https://www.epa.gov/system/files/documents/2023-06/information_security_awareness%20and%20training%20_procedure.pdf https://www.epa.gov/system/files/documents/2023-06/information_security_awareness%20and%20training%20_procedure.pdf

The SP will provide a Service Management Lead who shall be the primary liaison to the Government.

The EPA anticipates the designation of Service Management Lead (SML) under this vehicle.

Responsibilities of the individual holding the position: Oversees IT support service (and related ITIL) processes to make sure they are being effectively executed; leads continual improvement of processes and manages the lifecycle of services; provides oversight and guidance for the implementation of service processes, procedures, work instructions, and associated tools; oversees knowledge management, training and education programs; aligns service processes and activities to the ISO 20000 Information Technology – Service Management standard; assigns a named technical representative for each service processes; collaborates with service managers and functional leaders including engineering, operations, and service desk, as well as other EPA contractors and service providers to enable seamless service execution across the service area.

Activities may include but are not limited to-

a. Provide contract Draft and Final Transition Plans.

b. Provide Staffing Management Plan of all assigned contractor staff.

c. Provide Monthly Operational Status Report that captures or summarizes completed tasks, staffing status, financials (to include labor, travel and equipment ODC funds), and any issues/challenges encountered.

d. Provide Project planning and facilitate implementation of government-approved projects.

e. Participate in authorized on-site meetings; prepare and present briefings on progress of work, prepare and present debriefings on progress of work, prepare white papers and draft responses to IT-related data calls, as requested by Government COR.

f. Develop and maintain SOPs to identify collaborative opportunities and support process interaction with other Government and contractor IT groups.

g. Present SOPs to CORs for review and approval prior to implementation

h. Facilitate integration with established EPA processes and procedures

3.1.4.1 Staffing and Personnel

The SP shall provide personnel to support Regional IT Support Services. A list of anticipated personnel is available for reference in TE 3-6: Staffing Plan and Personnel. SP personnel requirements include but are not limited to-

a. Conduct: SP personnel are often expected to uphold integrity, responsibility, and professionalism during work, to include, but not limited to-

i. Support the implementation of, and encourage compliance with, appropriate standards and procedures for the effective governance and management of information systems and technology, including audit, control, security and risk management.

ii. Perform their duties with objectivity, due diligence and professional care, in accordance with professional standards.

iii. Maintain the privacy and confidentiality of information obtained during their activities unless disclosure is required by legal authority. Such information shall not be used for personal benefit or released to inappropriate parties.

iv. Maintain competency in their respective fields and agree to undertake only those activities they can reasonably expect to complete with the necessary skills, knowledge and competence.

v. Inform appropriate parties of the results of work performed including the disclosure of all significant facts known to them that, if not disclosed, may distort the reporting of the results.

*The above was adapted from the ISACA Code of Ethics

b. Qualifications: SP shall provide personnel with strong verbal and written communication skills and have the requisite experience and qualifications to complete service tasks within the parameters agreed to.

https://www.isaca.org/credentialing/code-of-professional-ethics

c. Security: SP shall provide personnel who possess and maintain the necessary security clearance level. Prior to the assignment of any SP personnel to service tasks the SP must submit personnel security clearance validation as per TE 2-2: Security Clearance Requirements. Changes in personnel security clearance status of SP employees shall be reported to the EPA in writing.

When hiring personnel, the SP shall keep in mind the stability and continuity of the work force at the requisite security clearance level are essential.

d. Key Personnel (KP) will be (a) identified in the offer as key individual(s) to be assigned for participation in the performance of the TO; (b) personnel whose resumes were submitted with the quote; (c) or personnel who are designated as key personnel by agreement of the Government and the Contractor during negotiations.

3.1.4.2 Surge Staffing

Based on EPA Mission needs as directed by this order the SP shall provide surge staffing. All contract personnel positions are inclusive and subject to surge upon approved EPA COR request. Surge SP staff must have the requisite experience and qualifications to complete respective tasks. Surge activities are limited to tasks within the scope of the contract.

3.1.4.3 Service Level Agreements

The SP shall provide support for Service Level Agreements, in accordance with EPA and industry standards

(ITIL4).

Service Level Agreement: Describes the services to be provided and their expected service levels.

Service Level Agreements should at minimum provide the following information-

i. Service description. A detailed summary of the agreement, parties involved, and services provided

ii. Quality of the service. Details of the standard of the service

iii. Responsiveness of the service. Details of how quickly the service will be delivered

iv. Performance measuring. List of metrics that need to be measured, including how they are measured

v. Duties and responsibilities of both the SP and the Government

vi. Remedies/penalties for failure to meet the agreed-on terms

vii. A protocol for adding, changing, and removing metrics

3.1.4.4 Operations Status Report

The SP shall provide an operations status report, as directed by this PWS. The type of information and documentation to be provided in an operational status report may include but is not limited to a summary of activities that the contractor performed for each task during the reporting period; incident volume history; an incident trend analysis; summary of completed tasks; staffing status; financials (to include labor, travel, and equipment ODC funds); future planned activities; issues and concerns.

3.1.4.5 Financial Management

The SP shall perform all business and financial functions necessary to fulfill the requirements of this PWS and integrate these functions across all areas of performance. In performing these functions, the SP shall:

• Provide ongoing business analysis and respond to requests and inquiries from the Government related to budget

• Tracking and manage requests for invoice or service asset discrepancies identified by the

Government and report them monthly.

• Presenting monthly invoices in accordance with the invoicing clause of the contract.

• Aiding the Government with external audits or review mechanisms.

3.1.5 Closeout

The SP shall close out this Order in accordance with the following PWS requirements. Activities include-the return of documents to EPA or other document repositories, file sanitization, and preparation of a close-out report. Activities for cybersecurity and protecting sensitive information should be conducted in accordance with TE #: EPA Cybersecurity Task Summary, these activities include but are not limited to-

a. Personally Identifiable Information Contract Closeout

At the end of contract performance period or a time approved by EPA. The SP as part of closeout shall submit a Certification of Sanitization of EPA-provided and EPA-Activity-Related Files and Information to the Contracting Officer and the Contracting Officer’s Representative (COR) following the template provided in Appendix G of National Institute of Standards and Technology (NIST) Special Publication 800-88, Guidelines for Media Sanitization Revision 1. Certification shall be reviewed by the EPA Senior Agency Official for Privacy (SAOP).

b. Contractor Return of all EPA-Provided and EPA-Activity-Related Information

At the end of contract performance period or a time approved by EPA. The SP as part of closeout must return all originals of all EPA-provided and EPA- Activity-Related Information (including but not limited to all records, files, and metadata in electronic or hardcopy format).

c. Verified Secure Destruction of All EPA-Provided and EPA-Activity-Related Information

At the end of contract performance period or at a time approved by the EPA. The SP shall execute and document the secure destruction (either by the SP or third-party firm approved in advance by EPA) of all existing active and archived originals and/or copies of all EPA-provided and EPA- Activity-Related files and information (including but not limited to all records, files, and metadata in electronic or hardcopy format). This information includes but is not limited to information obtained by the SP while conducting activities in accordance with the contract with EPA; or distributed for any purpose by the SP to any other related organization and/or any other component or separate business entity; or received from the SP by any other related organization and/or any other component or separate business entity. Destruction Methods shall be by procedures approved by EPA in advance in writing.

d. Contractor Return of all EPA-Owned and Leased Computing and Information Storage Equipment

At the end of contract performance period or at a time approved by the EPA. The SP shall return all EPA-owned and leased computing and information storage equipment to EPA.

a. Subcontract Flow Down

The SP shall insert in each subcontract or consultant agreement placed hereunder, provisions which shall conform substantially to the language of Section 3.1.5 requirements a-d, unless otherwise authorized by the Contracting Officer.

3.2 REGIONAL IT SUPPORT SERVICES

The Regional IT Support Services section outlines Tasks that will be completed, as directed by this PWS, by the SP for Region 10 IT Support Services. The SP shall employ Information Technology Infrastructure Library (ITIL) Service Management Framework (Version 4 and any subsequent revisions) to guide the provision of services, processes, functions, and other capabilities needed to support EPA Regional needs.

Cybersecurity: The SP shall be responsible for all EPA identified cybersecurity tasks both in managing individual services, as well as the delivery of services to end users, in accordance with this PWS, EPA IT Directives, and TE 2- 5: EPA Cybersecurity Task Summary.

Tasks in this section include:

3.2.1 TASK 1: SERVICE DESK SUPPORT

Service Desk Support provides a cost-effective and efficient solution that helps manage large volumes of tickets/contacts with an optimal set of staff members. Regional Service Desk personnel will provide end-to-end customer support and just-in-time training support for the EPA regional users and other designated authorized users of IT services. The objective is to handle incidents with a goal of incident elimination within the service desk authority level. The SP will own all incidents Customer Relationship Management (CRM) at the regional service level as assigned and will verify that requests are completed and communicates with users and the organization in a timely manner in accordance with expected service levels. The SP will document all incidents that are escalated by SP personnel to other support levels/ pathways as part of their workflow processes.

The SP shall provide Service Desk Support to users, to include, but not limited to, help by telephone, remote control, and in person support at the desktop/problem area. The scope of Service Desk Support includes software application support, operating system support, file maintenance, workstation and laptop configuration, network configuration, network communications, remote access, peripheral support (printers, monitors, scanners etc.), mobile devices, video teleconference (VTC) and general end user incident and request management.

In addition, The SP shall support EPA requirements for remote access, perform new user set-ups, account termination, telecommunication services, and the set-up of peripheral/portable devices. The SP shall perform inventory control and management. Equipment identified for disposal shall be processed in accordance with Section 3.2.4: Task 4: Inventory Control. The SP shall perform problem resolution, manage desktop hardware and software assignments, and address warranty problems. The SP shall provide environment orientation, overview training, and group training on an as needed basis. The SP shall record, analyze, maintain, and prepare and submit required reports regarding problem resolution occurrences and trends. The SP shall develop self-help training aids (e.g., tips & tricks, FAQ’s) for recurring problems as needed or required.

3.2.1.1 Customers

The scope of SP Service Desk Support provided under this Order will be limited to Federal employees, and support contractors, who occupy Federal space and/or require the same IT support as the Federal employees in Region 10, to include-

A. VIP Customers- Approximately 5% of the user population is considered VIPs and therefore require expedited services beyond what is required normally by applicable service level agreements (SLAs). These VIPs will be identified in a listing that will be updated as necessary.

SLAs will incorporate service terms as they apply to identified VIPs.

B. Teleworkers, Travelers, and Off-Site Users- The EPA has a highly mobile workforce. The scope of

SP service desk support shall include support for remote users working outside of EPA operated facilities and not be connected directly to the EPA Network.

3.2.1.2 Mobility Support

The SP shall perform mobility support to include, but not limited to, incident response for Teleworkers, Travelers, and Off-Site Users, shipping of properly configured hardware and software (SP to cover all associated costs), providing maintenance support for travelers to SP supported Region.

3.2.1.3 Incident Support

The SP shall employ Information Technology Infrastructure Library (ITIL) Service Management Framework (Version 4 and any subsequent revisions) to guide the provision of services, processes, functions, and other capabilities needed to provide Regional and Multi- Regional IT Service Incident

Support for IT service end-users within Region 10 designated service area. The SP will utilize the EPA’s enterprise IT service management software (ITSM) to conduct service management activities include pre-service activities, during service activities, post-service activities, and customer feedback program to include surveys, follow-ups, and liaison with the customer.

a. Incident Tiers

The EPA applies a tiered support model to enable workflows. Tiered levels of incident support are defined within this performance workstation document as follows-

Tier 0 End-user self-service Tier 1 Single point of contact (SPOC) for live support Tier 2 Escalation to internal or external service owners (e.g., incident management by a locally staffed non-specialist federal or contractor employee)

Tier 3 Escalation to internal or external service owners (e.g., incident management by a staffed expert level federal or contractor employee)

Tier 4 Escalation to EPA Engineering/ Specialized Support Reference:…