Attachment 3.1 - Statement of Work.docx

Attachment 3.1

Attachment 3.1 - Statement of Work CIMS Support

Statement of Work:

Credential Issuance and Management System for DOT

October 2021 A. Overview The purpose of this Statement of Work (SOW) is to install a Credential Issuance and Management System (CIMS) to support smart card remote credential management, enterprise reporting and automated credential synchronization with internal directories.

B. Scope of Work The Department of Transportation (DOT) desires a Credential Issuance and Management System (CIMS) solution that enables the issuance of Public Key Infrastructure (PKI) based credentials, remote credential management, enterprise reporting, and automated credential synchronization with internal directories. DOT requires that this system must use FIPS 140-2 compliant smart cards to comply with federal mandates. DOT prefers smart cards as the Multi Factor Authentication (MFA) token for this solution because the smart card is a familiar form factor that aligns with DOT’s current environment.

The solution shall be comprised of the following technical components:

· Credential Management System (Note: DOT prefers that this system be built into the solution, rather than using third party software)

· FIPS 140-2 Compliant Smart Cards

· Smart Card Printer

· Card Management Reporting and Automation

· ActiveClient (Note: DOT already owns this software, and it does not need to be quoted in a proposal)

The Contractor will be required to complete the following phases and tasks.

Phase 1: Pilot

Phase 1 will include tasks for project support, architecture, design, installation, configuration, and training and knowledge transfer for the baseline CIMS system. Phase 1 Tasks are as follows:

· Task 1 – Professional Services

· Project Support

· Architecture review and system configuration planning

· System Installation and Configuration

· Training and Knowledge Transfer

· Task 2 – Delivery of Hardware and Licenses for 50 Smart Cards

Phase 1 Expectations and Outcomes: At the completion of Phase 1, the CIMS system shall meet the following requirements:

· The system must support a minimum of 50 smart cards, with the ability to support a maximum of up to 1,000 smart cards.

· Provide a CIMS that integrates and is compatible with ActiveClient software

· The CIMS system must be located on premise in DOT network space.

· Provide a system that is configured in a manner that supports high availability and remote credential issuance and management including remotely issuing cards, resetting card PINs, remotely disabling cards, etc.

· Issue high assurance credentials that meet or exceed security requirements for FIPS.

· Encode the credential using on premise certificate authority services.

· Encode the smart card credential to enable multi-factor authentication for windows logon, web authentication and other logical access authentication needs.

· Auto synchronize the credential issuance system with the user’s directory.

· Print a physical badge with custom DOT information.

· Provide enterprise dashboards to detail: number of credentials issued, credential history, upcoming renewals, other information relevant to the credential issuance process, users assigned to the smart cards, card serial numbers, card inventory, etc.

· Provide configuration to enable multiple certificates onto one physical smart badge.

· Provide security controls and configuration for remote credential issuance and management.

· Provide auto alerts for expiring credentials.

· Provide the installation services to rapidly install the system in a high availability architecture with the ability to perform remote issuance and management of credentials.

· Provide a reporting, automation and card management modules or software that integrates and is compatible with the proposed smart cards and native card management system.

· Provide the ability to automatically disable assigned but inactive smart cards due to inactivity.

· Provide native card management software that does not require third-party software to manage the smart card lifecycle.

Phase 1 Tasks Description

Phase 1: Task 1: Professional Services

· Project Support:

· The Contractor shall conduct a kick-off meeting with the COR and Federal stakeholders within 5 business days of award.

· The Contractor shall provide a summary of activities on a weekly basis to the DOT Federal stakeholders listed on the contract award. Report should include tasks completed during the week, tasks planned for completion on the following week, and any obstacles or risks.

· The Contractor shall provide a close out report to the DOT Federal Stakeholders once each Task is completed in Phase 1 and Phase 2. Report should include description of the work completed and any deliverables.

· Architecture review and system configuration planning

· The Contractor shall provide an architecture review of the DOT infrastructure to help determine the best placement of the issuance systems which will result in an issuance architecture specification.

· The Contractor shall coordinate with DOT to analyze the directory services and certificate authority to determine the configuration points to create an issuance model design.

· The Contractor shall assist DOT with determining the infrastructure and application requirements including those for server, database, network, firewall, high availability, certificate authority configuration and templates, workstation requirements, card printing requirements, and any other design items required to implement the CIMS system.

· System Installation and Configuration

· The Contractor shall provide support to assist DOT with the installation of the CIMS solution including the card management system, printer and the credential issuance workstation.

· The Contractor will provide environment specific configurations to connect to the existing identity repositories to provide integrated data repositories, configure the card policy and provide for fully issued credentials.

· The Contractor shall assist DOT with testing and successfully issuing smart cards from the CIMS system. The Contractor shall assist DOT with troubleshooting any issues that arise during this process.

· The Contractor shall assist DOT with configuring the Card Management System to include the Enteprise-level reporting, management, and automation.

· The Contractor shall assist DOT with successfully testing the following capabilities:

· The ability to remotely provision and disable cards

· The ability to identify and automatically disable inactive smart cards due to inactivity

· The ability to report on card certificate expirations

· The ability to report on cards (active/inactive), assigned users, card serial numbers, card inventory, card usage, etc.

· The ability to remotely reset smart card PINs for users

· The reporting, automation and management modules must integrate and be compatible with the smart cards and native card management system

· Training and Knowledge Transfer

· The Contractor will work with DOT credentialing staff to provide training in the areas of requesting, credential issuance and credential maintenance.

· The Contractor will also provide CIMS administration training to ensure the systems can be properly maintained for optimum performance.

· The Contractor will also provide training on how to use the reporting, card management system, and automation features.

Phase 1: Task 2: Delivery of Hardware and Licenses for 50 Smart Cards

· Delivery of Hardware and Licenses for 50 Smart Cards

· The Contractor shall deliver the hardware and licenses for 50 smart cards to include the cards, printer, and any required software and licenses to operate the CIMS system.

Phase 2: Expansion

During Phase 2, DOT may optionally decide to request an additional 950 smart cards in addition the original 50 cards under Phase 1.

Phase 2 Expectations and Outcomes: At the completion of Phase 2, DOT expects to receive the additional 950 Smart Cards and the associated licenses, and license keys required to support the cards in both the Card Management System and any other additional reporting and card management modules.

Phase 2 Tasks Description

· Delivery of Additional 950 Cards and Licenses

· The Contractor shall deliver the additional smart cards and licenses if requested by DOT.

A. Deliverables The Contractor must deliver services in accordance with Scope of Work and will deliver documentation according to the Final Project Schedule.

4 months after award

The Contractor shall use and adhere to the relevant document templates agreed to with the COR and Task Manager. The deliverables shall be in Microsoft Word format and the Project Schedules shall be in Microsoft Project format.

B. Period of Performance The period of performance of Phase 1 tasks is 4 months from date of award. The overall period of performance is 12 months from date of award.

C. Contract Line Items The Contractor is not authorized, under any circumstances, to exceed the total value of this contract.

D. Acceptance Criteria The Government will evaluate the work completed under this task based on the extent to which the Contractor’s overall activities are well coordinated and managed. If the Government does not believe that the quality of service is in line with the requirement, the Contracting Officer will notify the Contractor in writing. If the Government believes that there is no improvement after the timeframe specified in the written notification, the Contracting Officer will require the removal of the appropriate personnel.

E. Reporting Requirements All work will be fully coordinated with the Federal Task Manager. Issues affecting the performance of the Contractor or the achievement of objectives shall be brought to the immediate attention of the Task Manager. Deliverables under this task shall be submitted to the Task Manager. The Contractor must coordinate work plans with the Primary and/or Alternate Technical point(s) of contact, and as needed the S-83 POC. The Contractor shall bring to the immediate attention of the technical point of contact any specific issues or problems that may affect system performance, the delivery of requested products, or completion of assigned tasks.

F. Personnel The Contractor shall provide personnel to meet the requirements set forth by the Government in this Statement of Work and are qualified to perform duties outlined in the SOW. Specifically, the vendor personnel needs expertise in the following:

· CMS installation

· API implementation

· ActiveClient deployment and configuration

· Configuration for remote issuance

· Card printing configuration

· Reporting configuration and customization

· Remote user interface customization

G. Key Personnel No Personnel assigned to this task are considered Key Personnel.

H. Government Furnished Equipment The Government shall furnish all supplies, materials, documents, and equipment required for the work to be performed as described in this Statement of Work. This includes, but is not limited to:

· Adequate space to house the onsite support;

· Office furnishings, including desks, chairs, bookcases, file cabinets, at least one locking file cabinet, access to a fax machine, access to a copy machine, access to a Government provided telephone system, and general office supplies;

The Contractor should specify any required items in their proposal.

I. Place of Performance Work will be performed primarily remotely and/or at DOT Headquarters located at 1200 New Jersey Avenue, SE, Washington, DC.

J. Type of Order Firm Fixed Price (FFP).

Page | 5