B08 Attachment 0002 AESMP ITSM SaaS PWS 28 JUN 2021 v.1.pdf

ARMY ENTERPRISE SERVICE MANAGEMENT PLATFORM (AESMP)

INFORMATION TECHNOLOGY SERVICE MANAGEMENT

SOFTWARE AS A SERVICE (SaaS)

Task Order 0001

Performance Work Statement

June 28, 2021

1. CONTENTS

1. BACKGROUND

2. SCOPE OF WORK

3.0 Period of Performance

4.0 CONSTRAINTS

5.0 LOCATIONS

6.0 KEY PERSONNEL

7.0 SUPPORTED PROCESSES AND FUNCTIONS

8.0 FUNCTIONAL REQUIREMENTS

9.0 GOVERNMENT PROVIDED ACCESS

10.0 PERFORMANCE METRICS

ARMY ENTERPRISE SERVICE MANAGEMENT PLATFORM (AESMP)

INFORMATION TECHNOLOGY SERVICE MANAGEMENT

SOFTWARE AS A SERVICE (SaaS)

Task Order

Performance Work Statement

1. BACKGROUND

The Army owns, manages and operates the unclassified and classified Information Technology Service Management (ITSM) solutions that are under the direct control of ARCYBER and NETCOM supporting voice, messaging, video teleconferencing, computing, network infrastructure, customer support, Information Assurance support, and application hosting, detailed on the Command, Control, Communications, Computers, and Information Management (C4IM) services list, services listed in the Army Information Technology Service Catalog (AITSC), and various above baseline, program managed and mission support services and systems. NETCOM owns and manages the Non-classified Internet Protocol Router Network (NIPR) and Secure Internet Protocol Router (SIPR) Enterprise Service Management Systems (ESMS) and are currently providing Incident Management, Knowledge Management, Change Management, Problem Management, Service Level Management, and Asset Management with varying levels of enterprise maturity in support of ARCYBER, NETCOM, Signal Commands, Brigades, Regional Cyber Centers (RCCs), Network Enterprise Centers (NECs), and Army Enterprise Service Desks (AESD). Combatant Commands (COCOMs), Mission Support Commands (MSCs), NATO, and other mission-funded organizations also rely on and leverage the capability of the above processes.

The Army also obtains ITSM Software as a Service (SaaS) capabilities for enterprise services for Army Knowledge Online (AKO) and Defense Information Systems Agency’s (DISA’s) Enterprise email.

The Government will replace these legacy ITSM services with AESMP Information Technology Service Management (ITSM) Software as a Service (SaaS) subscription provided by the Offeror.

2. SCOPE OF WORK

a. Replace multiple current service desk ticketing systems IAW Attachment 0030 Current System and Service Profile

b. Provide global access and use of the AESMP ITSM SaaS subscription service from a DoD Provisionally Authorized Information Impact Level 4 (IIL) 4 environment supporting NIPR-based operations. Provide global access via government furnished and non-government furnished equipment using commercial internet and the DISA authorized cloud access point.

c. Provide global access to a DoD Provisionally Authorized IIL6 environment to support Army SIPR-based AESMP operations. Provide global access via government furnished equipment connected to SIPR.

d. The SaaS shall provide integration support for migration of ITSM and ticketing data (Summary data from the ITSM to enable service management reporting per page 11 of Attachment 0003 MSP PWS.) from the existing solution to the subscription service.

e. The AESMP subscription service shall provide the functionality as detailed in Section 8

– Functional Requirements.

f. Maintain the security, information assurance compliance and DoD Provisional Authorization status for the service in accordance with Risk Management Framework (RMF) and the DoD Commercial Cloud Security Requirements Guide (CCSRG).

g. Provide upgrades and updates of the service.

h. Maintain 99.8% availability for all Army environments.

i. Provide 24x7x365 support of the service. Respond to request within 30 minutes for Urgent requests, 2 hours for immediate requests, or 1 day for Routine requests from requestors authorized by the Government.

j. Provide capacity for configurable disaster recovery that supports a Recovery Point Objective of no more than 1 hour of work lost prior to the disaster and a Recovery Time Objective of no more than 4 hours after the disaster.

k. Align the service management processes, practices and tools used to support the service with the Army Enterprise Service Management Framework (AESMF) and, where possible, use commercial best practices to enable service transition, service operations, and required government oversight.

l. Create and maintain an online ‘Service Catalog’ for the service to support end-user, self-service, service development activities such as full lifecycle service procurement.

The service catalog shall detail enough detail of the service provided by the Contractor to understand the level of effort required to sustain the tools being used.

m. Provide automation (e.g. tools, scripting, etc.) to the maximum extent possible applying the configurations for the service to promote standardization, cybersecurity, and compliance IAW approved Risk Management Framework (RMF) process.

3.0 Period of Performance

The performance period required for this effort is ten (10) years. The period of performance is depicted below:

Base Period - Date of award through Month 12 (12 Month Duration)

Option Period 1 - Begins 1st Day following Base Period (1 Year Duration)

Option Period 2 - Begins 1st Day following Option Period 1 (1 Year Duration)

Option Period 3 - Begins 1st Day following Option Period 2 (1 Year Duration)

Option Period 4 - Begins 1st Day following Option Period 3 (1 Year Duration)

Option Period 5 - Begins 1st Day following Option Period 4 (1 Year Duration)

Option Period 6 - Begins 1st Day following Option Period 5 (1 Year Duration)

Option Period 7 - Begins 1st Day following Option Period 6 (1 Year Duration)

Option Period 8 - Begins 1st Day following Option Period 7 (1 Year Duration)

Option Period 9 - Begins 1st Day following Option Period 8 (1 Year Duration)

4.0 CONSTRAINTS

a. Upgrades and updates are applied to Customer’s instances and are included in the Government’s subscription price. An upgrade is a complete solution with new features or enhancements, including previously released Updates, if applicable. Updates are releases (including patches and hotfixes) that provide problem fixes or other changes, but do not generally include new functionality. A 30 day notice shall be provided prior to the Upgrade or Update.

b. The service shall require no more than 2 hours per month allotted for pre-approved maintenance. This maintenance window and downtime for approved, planned upgrades or updates will not be considered in the calculations for system availability.

c. The Service shall include procedures to protect data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access in accordance with RMF standards.

d. Access to the Service is protected by Common Access Card-based authentication and authorization mechanisms.

e. The Service shall establish and maintain sufficient controls to meet the objectives stated in ISO 27001, ISO 27018, SSAE 18 / SOC 1 and SOC 2 Type 2 (or equivalent standards)

f. The Service shall register all cloud instances into the shared Army cloud service environment (cARMY) cost and utilization management tool with any Cloud Service Provider (CSP) procurement. Cloud instances will be registered into cARMY's management tool within 15 business days of procurement.

5.0 LOCATIONS

Global availability/Cloud-based offering.

6.0 KEY PERSONNEL

A Liaison Officer shall perform the following and maintain responsibilities between the contract for the AESD Managed Service Provider (MSP) and the AESMP ITSM SaaS Task orders:

Maintain thorough knowledge of the service offering, as well as an understanding of how that impacts the other entities of contact

Monitor, coordinate, and communicate the strategic objectives of the service offering

Collaborate and communicate successfully with other entities outside of the service offering

Work with other staff members to develop a greater understanding of the service offering and any issues that arise

Develop and foster relationships with the community, stakeholders, and other entities

Collect, analyze, and utilize data and feedback to identify opportunities to improve the relationship between the service offering and the other entities

Compile reports about particular incidents, events, or updates about an important issue for the service offering

Proactively solve conflicts and address issues that could occur between the service offering and the other entity

Promptly respond to incidents and other events as necessary

The Liaison Officer shall possess the following qualifications:

5+ years of experience in a related role with the ability to:

Secret Clearance

ITIL v4 or higher Foundations or above certification

ITIL 4 Specialist Create, Deliver, and Support certification

At least 4 years overall DoD IT environment and RMF experience

At least 4 years of Software as a Service operations experience

At least 1 year of experience in planning, directing, and managing large scale

Knowledge of industry accepted standards and best practices related to Information Management operations, and with ITSM best practices

Familiarity with AR25-1 and AR25-2

Customer-oriented attitude

Excellent verbal and written communication skills

Ability to establish and nurture beneficial business relationships

Self-motivated with a willingness to take initiative and solve complex problems

Capability to negotiate with and influence others

Analytically and mathematically minded to analyze data and create necessary reports

Ability to thrive in a fast-paced and sometimes high-pressure environment

7.0 SUPPORTED PROCESSES AND FUNCTIONS

The SaaS shall be configurable to support the AESMF processes and functions (see Attachment 0021 AESMF).

8.0 FUNCTIONAL REQUIREMENTS

The AESMP ITSM SaaS shall provide the following functionality:

Requirement Description

8.1 Accessibility/Reporting

Self-Help Portal for Users to log and check progress on tickets

Ability to access a self-help portal which can be used to submit tickets and check progress

Requirement Description

Report creation and export functionality

Ability to generate reports and export data on-demand

User Creation Ability to import/synchronize users/rights from an authorized enterprise source

Accessibility on mobile devices Smartphone applications/interfaces to allow access to the tool/self-help

Dashboard views Graphical reports and role-based dashboard with configurable visualization which give at-a-glance view on service and other metrics

Proactive User Information displayed on portal/intranet

Ability to output information regarding incidents/outages etc. onto web page or internet portal for the tool

Customer Satisfaction feedback Built-in mechanism for compiling and reporting on Customer Satisfaction feedback/metrics/responses/survey, etc.

Statistical analysis/forecasting Provide modelling and trending data associated with IT Services

Statistical Analysis Provide Reliability, Availability, Maintainability (RAM) for data associated with IT Services

Graphical User Interface The ability to organize relationships using a graphical user interface

8.2 Integration/Compatibility

Email/SMS integration Integration with email/SMS, allowing the sending of notification messages

Army enterprise tools compatible Software/Tool client for users must work on enterprise platforms

Browser compatibility Any browser-based elements must work with all Army approved browsers

Integration with other helpdesk tools of partners

Tool integrates to the extent that tickets can be handed between systems and other functions such as SLAs are synchronized

Integration with authorized remote support tools

Ability to integrate with support tools that facilitate with remote support, viewing to remote user device, etc.

System monitoring integration Tool integrates completely with a monitoring application/networks and can auto-log tickets related to system events

Schedule Tracker Ability to document and communicate Projected Service Outages and Change Schedules

8.3 SLA Management

Custom SLA levels, per service or customer

Ability to configure custom SLA's for different services/customers

VIP allocation for limited number of users Functionality to flag users as VIP and automatically escalate ticket or implement different SLAs

Service Level Information Review dates Configuration reminders to alert Service Management Function when an SLA is due for review with the customer

Contract Management and SLM

Details of contracts logged in the tool, the SLA library within the tool, and associated SLA's to allocate to a service/product in the Service Catalog

SLA association Link service requests to an associated SLA

SLA status

Track/report SLAs where agreed service levels are fulfilled/unfulfilled. Ability to provide trend analysis and forecasting SLA fulfillment issues

8.4 Knowledge Management

Role Based Handling Ability to publish/subscribed to a specified audience using defined security or role-based parameters

Knowledge association Ability to associate knowledge article(s) to assets or CIs

KB article review/expiration dates System has expiry/review dates for all knowledge-based articles to prompt for review

Knowledge Categories and Attachments Ability to include specific knowledge categories and attachments (PDF, text, tables, emails, images, approved links, etc.)

Frequently Asked Questions Track knowledge article use and provide ability to access frequently Asked Questions capability

Search Function Ability to search based on date, classifications, and type of information.

Resolution Search

Provide the ability to match incident/problem descriptions against “known errors and/or problems” documents within the knowledge base based on historical records of previously resolved tickets

8.5 Request Fulfilment

Automated Request Creation The tool has the configurable ability to auto create a service request (incident, etc.) from an email submission

Role-based Capacity Limitation Ability to limit the capability to initiate a service request by; user, department, company, group, etc.

Service Request Prioritization Ability to prioritize service requests based on impact and urgency

Service request routing/categorization Ability to categorize and route service requests by activity, type, function, or CI type

8.6 Miscellaneous

Asset Management Tool has the ability to track Cis for HW/SW usage and lifecycle replacement

CI Relationship to Outage/Change impact Understand how a change to a CI will impact a service and other CI’s if a change is made or failure of specific CI or service occurs

Data Management

Pre-built and customizable secured integration (per data in motion) with external systems (report tools, APIs, programs and scripts, etc.).

Real-time chat/IM with a support personnel

End-User system/web portal has ability to chat real-time with support personnel and the ability to automate data recording of chats/IM’s and generate e-mails and/or incident tickets, etc.

Software/License audit capabilities Tool has the ability to run discovery tool(s) on assets to integrate and report on installed versions of software

Templates Ability to modify, create, or leverage OOB templates for creation of incident, problem, change, knowledge articles, etc.

Continuous Monitoring Ability to assist in IT Service Continuous Monitoring activities

Versioning

Display the last modification date, check-in and check-out status on incidents, changes, knowledge articles, SLA’s, work-flow model, etc. and includes the automatic routing/notification for approval of updates

Customization of CIs and Assets Ability to customize CI and Asset types

Asset and CI Association Ability to associate Cis to Assets

Audit Asset integrity Ability to automatically initiate routine audits to ensure integrity of assets

Asset Association Ability to track asset owners, support group(s), and users

VIP Designation

Ability to escalate routing based on a user/customer designated as a Very Important Person (VIP) for Incidents, Problem, Changes, etc.

Web Portal Automated Assistance Provide automated agent assistance to users for knowledge management, incident handling, etc.

Portability and Cloud Capable Ability to host in multiple environments with data portability (cloud-based, etc.)

Audit Capability

Ability to provide on-demand audits of all data entries associated with incident management, problem management, change management, knowledge management, etc.

8.7 Access Management

Role-based Access Role based access control within the tool for users/groups

Support DoD PKI for authentication Ability to utilize DoD PKI for authentication into the tool and the self-help portal

Authentication Logging Ability to log and track authentication and access in accordance with DoD Cyber regulatory guidance

Account Management Ability to support account management for all users/groups

8.8 Event Management

Event Integration Provide integration to SIEM/logging capability to auto generate incident tickets

Event Correlation Provide ability to link and correlate events to particular incidents, problems, and Cis, Event Status/Availability Provide CI status and availability

Event responses Provide the ability to detect incidents, changes and exceptions to improve response times

Automated event categorization Provide ability to categorize and filter events

Event Notification Automated notification of events through enterprise monitoring tools or Cis when applicable

Event Normalization Capability to normalize data received from external monitoring systems removing duplicative events

Automated event actions

Provide tool automation (condition based) to take immediate actions based on the level of risk associated with an event (i.e.

automatically disable a port, deactivate a user account, etc.)

Event ASIs Ability to suppress or flag events during periods of authorized service interruptions (ASIs)

Event Escalation Ability to allow a technician to acknowledge an alert, and if no response is entered within a defined timeframe, to escalate the alert

Event Synchronization

Ability to synchronize and support internally or interface with SLM, Information Security Management, Capacity & Availability Management, Knowledge Management, Change Management, Incident Management, Problem Management, Access Management, etc.

8.9 Ticket/Request Handling

Mechanism for approving change requests at organizational level

Organizational approval by approved POCs

Technical/SME approval of change requests

Authorization of change by approved POCs

Automated emails for ticket status updates

Email notifications of key stages in ticket lifecycle, i.e. any major updates

Event-based notifications for SLA thresholds and ticket updates

In-application and/or email notifications to alert when updates are received for tickets or at pre-defined times in the SLA timeline

Multiple ticket resolution groups Multiple groups/tickets stacks for different incident resolver groups to use in managing their queues

Ability to upload/attach screenshots, extra information etc.

Tool requires ability for any users to attach documents when logging/updating tickets for screenshots, etc.

Ability to pass between resolver/incident teams

System functionality to allow moving tickets between resolver/incident groups for additional work, etc.

Multi-Customer capability to allow differentiation of tickets from different organizations/units (post, camp, station)

Ability to log tickets on the system for particular organizations/units throughout the Army

Link tickets (including different types i.e.

Change, Problem, Incident, etc.)

Ability to link tickets in the system so that relevant tickets can be associated with each other (i.e. a change related to fixing an incident)

Automatic incident logging from email Email input into system automatically creates an incident when in pre-defined format

Auto-populated templates for submission of common issues

Tool has ability to quickly log tickets or particular types which are frequently submitted by using auto-populated templates

Auto Expiration/Deletion of Documents After a pre-defined time (i.e. 6 months) any attachments to resolve tickets are automatically deleted to save space

Templates for ticket creation Tool provides ticket templates for users to select

Automatic routing of incident tickets, dependent on CI types and priority

Tickets are auto-allocated to groups based on configurations and attributes

Incident Ticket

Provide the method to automate or manually log all relevant incident information (e.g.

date/time, incident categorization and prioritization, contact info of person(s) related to the incident, incident description, status, relationship to CIs, support analyst/group assigned, related problems and known errors, resolution activities, resolution date/time)

Portal Interface Automatically display suggestions for Self- Help to end user upon creation

Ticket Escalation Ability to calculate priority based on service request urgency and impact

Processing Procedures Support ITIL based procedures and methods when handling tickets

RFC Lifecycle Tracking Facilitate the full life-cycle of Request for Change(s) (RFCs) in a user-friendly format

Routing Supports configurable routing for work, approval, change, incident, etc.

Change Categorization/Prioritization Ability to categorize and prioritize changes and trigger the appropriate workflows associated with each

CAB Routing Accommodate CAB actions and route appropriately

8.10 IT Security Management

Security Management Must provide data in motion encryption, access control, and Role-based security

Information Security

OOB support or interface with systems supporting: SLM, Access Management, Change Management, Incident Management, Problem Management, IT Service Continuity Management, Availability Management, Capacity Management, etc.

Information Security Continuous Monitoring (ISCM)

Interface with systems supporting:

Vulnerability Scanning, Security Event Monitoring, Perimeter Countermeasures

ISCM Ability to assist in Continuous Monitoring Activities

Information Security Controls

Ability to create custom controls and import controls from control authoring organizations such as; DoDI 8510.01, DoD 5200.01, AR 25- 2, etc.

Role-based Security The ability to provide role-based security to restrict access during investigations and security incidents

8.11 Problem Management

Problem Escalation Ability for technicians to assign impact and priority codes to records

Problem Resolution Ability to flag and close a problem record as unresolved

Problem/Change Management Ability to request a system change based on a Problem and link associated documentation

Problem Documentation Ability to document root cause and lessons learned for every major problem

Problem Models Ability to create and manage Problem Models

Problem Analysis

Ability to document the technique used to analyze the situation (Chronological analysis, Technical observation post, Pain value analysis, 5-Whys, Hypothesis testing, Kepner- Tregoe, Pareto analysis, Ishikaya diagrams, Fault isolation, Affinity mapping, etc.)

Problem Resolution and Trend Analysis Ability to search for potentially related Incidents/Problems based on different criteria (e.g. Configuration Item, Description, Group)

Problem Assignment Ability to assign multiple Incidents to a Problem

Problem Resolution Provide feedback to the service desk when a problem is under investigation or resolved

Problem Management Route and assign problem records to pre-defined support staff or groups

Problem Identification Enable problem identification, recording, classification, investigation, and diagnosis

Problem Database (links to Knowledge Database)

Create a problem database to track problems and associate any identified workarounds

Problem Reporting Integrate real-time reports and dashboards to identify shared attributes (incidents, locations, etc.) to determine the root cause of a Problem

Problem Auto-Discovery

Ability to utilize auto-discovery of data repositories to detect issues (e.g. hardware, software, network) in real-time to reduce response and outage times

Problem Trending Data/Analysis Ability to categorize problems to discover trending data

Problem Resolution Knowledge Data Document resolutions and/or workarounds via knowledge articles if applicable

8.12 Incident Management

Incident Automation Ability to auto-generate incidents based on existing support processes with rule-based prompts, notifications, and views

Incident Handling Auto-generate incidents from a variety of external monitoring solutions (e.g. Cisco Works, Solar Winds, etc.)

Escalation/Assignment of Incidents Ability to escalate/assign incidents to various functional areas/queues throughout the organization

Incident Interface Interfaces to problem, change, configuration, and service level management functionality within the tool

Incident Logging

Ability to automate or manually log all relevant incident information (e.g. date/time, incident categorization and prioritization, contact info of person(s) related to the incident, incident description, status, relationship to CIs, support analyst/group assigned, related problems and known errors, resolution activities, resolution date/time)

Incident Documentation Ability to publish major incident notifications in self-service portal

Incident Models Ability to create Incident Models with predefined steps that should be taken

Incident Linkage Parent/Child ticket capability: Ability to apply bulk changes or communications on multiple incidents

Incident Correlation Ability to perform incident matching against problems and known errors

Incident Prioritization Ability to calculate the incidents priority based on urgency and impact

Incident Association Ability to associate a CI to an incident

Incident Processing Ability to create the following from an incident:

Problem, Request, Change, etc. and pass all relevant data on to the next process area

Incident Handling Automatically display suggestions for Self- Help to end user upon creation

Incident Escalation Ability to support both Functional and Hierarchic escalations

Incident Closures Ability to categorize closures (method of closure, resolution of incident, other, etc.)

Incident Survey Ability to initiate user satisfaction surveys when incident is resolved

Incident Resolution Ability for the Customer to close his/her own incident

Incident Resolution Ability to display suggested solutions based on key word searches within the incident

Incident Categorization/Grouping Ability to group multiple tickets into a common master incident ticket

Incident/SLA Alignment

Define a service level agreement between the provider and the customer regarding incident priorities, escalation paths, and response/resolution time frames

Incident Categorizations Create and assign categorizations for incident types

Incident Categorization Ability to automate process based on incident categorization (e.g. major incident response)

Incident Survey Ability to communicate with customers/users and gather feedback on service quality, reliability of equipment, etc.

Incident Alignment Ensure alignment of incident management activities and priorities in alignment with governance

Incident Standardized Processes

Facilitate standardized methods and procedures to support efficient and prompt response times, analysis, documentation, ongoing management and reporting of incidents

8.13 Change Management

Change Governance Ability to dissect Changes into multiple stages and assign/view status of each stage

Change Documentation Ability to identify and flag unauthorized or undocumented changes

Change Requests Ability to associate changes and change requests with CIs

Change Procedures Support ITIL based procedures and methods when handling changes

Change Management Governance Facilitate the full life-cycle of RFCs in a user-friendly and intuitive format

Change Management Governance

Accommodate a variety of Changes (e.g.

hardware, software, communication equipment) including access to documentation associated with the implementation, support, and maintenance of associated production and development systems

Change Processes/Procedures Manage the addition, modification, and removal of CIs

Change Management Publish Changes to a calendar (i.e. Forward Schedule of Change)

Change Management Governance Support Change approval routing

Change Management Governance

Ability to categorize changes as Standard, Emergency and Normal, etc. and trigger the appropriate approval workflows associated with each.

Change Management Documentation Ability to document Remediation Planning (back-out plan, invocation of service continuity plans, etc.)

Change Management Documentation

Ability to support and track all change management activities (planning & controlling changes, Change & release scheduling, Communications, Change decision making, Change authorization, Ensuring remediation plans are in place, Measurement and control, Management reporting, Understanding change impact, Continual improvement)

Change Management Routing Ensure configuration management system is automatically updated to reflect the impact of any changes

Change Management Reporting

Provide real-time reports and dashboards to track processes and schedules of Changes (e.g. processed changes, pending changes, unapproved changes)

8.14 Configuration Management

Configuration Governance Track various asset types and associated attributes (e.g. licenses, maintenance)

Configuration Governance Enable software license Inventory/Tracking/Reporting

Configuration Management Includes a Configuration Management Database (CMDB)

Configuration Documentation Ability to track/report infrastructure (e.g.

hardware, software, assets/properties/CIs, SLAs)

Configuration Activities

Ability to support/automate activities associated with Service Asset Configuration Management (SACM): Management & Planning, Configuration Identification, Configuration Control, Status Accounting & Reporting, and Verification & Audit.

Configuration Control Ability to create baseline profiles for assets under configuration control.

Configuration Documentation

Ability to document configuration baseline of assets or CIs prior to a release in a manner that can be utilized for subsequent checking against actual deployment

Configuration Governance Ability to support internally or interface with systems that support all ITIL process areas (Incident, Problem, Change, Request, etc.)

Configuration Classification Contains standard CI and Asset Classes OOB with the ability to easily add custom classes

Configuration Alignment Ability to automatically associate CIs to Assets

Configuration Management OOB and modifiable naming conventions

Configuration Management Ability to lifecycle of each asset

Configuration Reporting Ability to automatically initiate routine audits/reports to ensure integrity of assets

Configuration Governance Ability to track/report asset owners, support group(s), and users

Configuration Reporting Ability to auto-report (conditions-based) under-utilization and over-utilization of software assets

Configuration Reporting Ability to capture, generate reports and display information to adequately assess proposed changes

Configuration Reporting

Ability to track and produce reports that annotate interrelationships between CIs, network equipment, telecom equipment, client workstations, physical servers, clusters, virtual machines, applications, support contracts, software versioning, OS versions, development, test and production categories, peripherals, projectors, printers, scanners, SANs, sites, network closets and data centers

Configuration Data

Ability to import data (e.g., batch add of assets, CIs, and CI changes) including the ability to add CIs through use of auto-discovery (e.g. SCCM, Tanium, ACAS, etc.)

Configuration Accountability Capable of mapping services to infrastructure

Configuration Integration Integrate CMDB with change, incident, problem, and release management processes.

Configuration Reporting Provide on-demand information related to CIs

Configuration Integration Ability to integrate with Scanning products (Tanium, SCCM, ACAS, etc.)

Configuration Support Support for multiple versions of CIs (historical views)

Configuration Attributes Ability to create user-defined CI attributes

Configuration Updates Ability to auto-incorporate newly discovered information into the CMDB

Configuration Inventory Track infrastructure software inventory

Configuration Auto-Reporting Ability to flag a resource or asset (e.g. “down” or “unavailable”) and auto-generate reports on the time spent in that state

Configuration Auto-Notifications Generate auto-notifications to all CI stakeholders when the status of a CI/Asset/Application changes

8.15 Availability Management

Availability Data Capture and record data pertaining to IT component downtime (planned and unplanned)

Availability Reporting

Ability to report the following measures at a minimum:

• Availability (%)

• Reliability (mean time between service incidents)

• Maintainability (mean time to restore service)

Availability Correlation Calculate availability of IT Services relative to the availability agreed in SLAs and MOAs

Availability Failure Analysis

Ability to ingest data to support Service Failure Analysis stages (e.g. Select opportunity, Scope Assignment, Plan Assignment, Build hypothesis, Analyze data, Interview key personnel, Findings and conclusions, Recommendations, Report, Validation)

Availability Knowledge Management

Ability to incorporate the business requirements for IT availability associated with a business service into Knowledge Management Repository (access controlled by need to know)

Availability Analysis

Ability to support routine Component failure impact analysis (CFIA) activities with the ability to track: Component availability weighting

• Probability of failure

• Recovery time

• Recovery procedures

• Device independence

• CI Dependencies

Availability Integration

Ability to interface with the following:

• Service Portfolio and Service Catalog

• Service Level Management

• SACM

• Incident and Problem Management

• Capacity Management

Availability Integration Ability to interface with the Service Desk, Problem Management, and Change Management functional groups

Availability Management Ability to automate component downtime detection

Availability Interfaces

Interface with database repository tools required to support other IT Infrastructure Management processes (e.g. CMDB, Capacity Management database)

Availability Reporting Ability to produce standard reports (e.g.

monthly Availability reports, Availability Plan, SOA status reports)

Availability Reporting Ability to report on the availability of IT Services relative to the availability agreed in SLAs and MOAs

Availability Reporting Ability to report percentage of services and infrastructure components under availability monitoring

8.16 Capacity Management

Capacity Change Management Integrate interface to Change Management for capacity related changes

Capacity Management Ability to store and control versions of configurable capacity plans

Capacity Interface Interface with the Service Desk, Problem Management, and Change Management functional groups

Capacity Utilization Capture capacity utilization data and forecast reports

Capacity Management Integration Interface with enterprise capacity management systems

Capacity Modeling Support forecasting by modeling and providing trending data associated with IT Services

Capacity Automation

Enable automation through Capacity Management triggers (e.g. New/Changed services, Service breaches, events, alerts, periodic trending and modeling, threshold-based alerting)

Capacity Interface

Interface with database repository tools required to support other IT Infrastructure Management processes (Availability Management, SLM, ITSCM, Incident Management, Problem Management, Demand Management, etc.)

Capacity Management Monitor response time and throughput of applications and services

8.17 Demand Management

Demand Attributes

Ability to capture the following attributes associated with Patterns of Business Activities

(PBA):

• Classification

• Frequency

• Volume

• Location

• Duration

• Requirements (performance, security, availability, privacy, latency or tolerance for delays)

• Service Asset Requirements

Demand Integration Ability to support or interface with systems that support the following: See Attachment 0034 cArmy Common Shared Service List

Demand Actions

Ability to automatically initiate Demand activities associated with the following triggers:

• A request from a customer for a new service, or change to an existing service. This will be initiated through business relationship management and service portfolio management.

• A new service is being created to meet a strategic initiative – this will be initiated through service portfolio management.

• A service model needs to be defined, and patterns of business activity and/or user profiles must be defined.

• Utilization rates are causing potential performance issues, or a potential breach to an SLA.

• An exception has occurred to forecast patterns of business activity.

Demand Management Ability to assign a single IT point of contact for each product or service in the IT portfolio

8.18 Service Catalog

(component of Service Portfolio Management)

Service Catalog Listing Ability to display a list of the services provided by the enterprise

Service Catalog Ability to support a hierarchy of services (e.g.

customer-facing Services, supporting services)

Service Catalog Metrics

Ability to display a variety of information pertaining to services provided by the enterprise (e.g. hours, service level, service availability)

Service Catalog Attributes

Ability to document the following attributes about a Service at a minimum:

• Name

• Description

• Type

• Supporting Services

• Organization Owner(s)

• Army Unit(s)

• Service Owner(s)

• Business Impact

• Business Priority

• Service Level Agreement

• Service Hours

• Organization Contacts

• Escalation Contacts

• Service reports

• Service reviews

• Security rating

Service Catalog Interfacing

Ability to interface with systems supporting:

Demand Management, Incident Management, Service Portfolio Management, Service Catalog Management, Availability Management, Capacity Management, IT Service Continuity Management, Information Security Management

Service Catalog Automated Interfacing Self-service options customizable per specific group, unit, or permission level (Dashboard, Reports, tickets, related information)

Service Catalog Self Help User friendly Web self-service Portal (Service Request, search Knowledge base, chat, etc.)

Service Catalog Documentation

Establish and monitor status of service contracts and SLAs between the organization and its customers or third party service providers

Service Catalog Requests Ability to align requests for new services or for enhancements to Service Catalog

Service Catalog Inventory

Enable the collection of information and inventory on existing services and establish requirements to maintain those services (Business Relationship Mapping)

Service Catalog Alignment

Alignment with Service Catalog to include all services that have been approved, in development, or currently deployed, which includes Service description, Policies, SLAs

Service Catalog Repository Ability to create a service portfolio and align services to the portfolio

8.19 OPTIONAL CAPABILITIES

See “Optional capability Summary Table” below

OPTIONAL CAPABILITY FOR

ASSET DISCOVERY & SERVICE

MAPPING

Provide active asset discovery and service mapping capabilities to load the

CMDB.

OPTIONAL CAPABILITY FOR

AESMF PHASE 2 BUSINESS

MANAGEMENT PROCESSES

Provide additional AESMF processes and functions identified below.

OPTIONAL CAPABILITY FOR

SOFTWARE MANAGEMENT

Provide software asset management that enables software license management, integrates with existing discovery capabilities to identify active in-use quantities, supports license use optimization, and provides a summary dashboard of software use activities in comparison to software license positions with supporting drill-downs to individual software licenses status.

OPTIONAL CAPABILITY FOR

FIELD SERVICE MANAGEMENT

Provide enhanced mobile device and desktop workspaces enabling field service and technical management tasks to include project estimating, work order assignment to include external 3rd party work assignments, work order scheduling, dispatch and routing of service technicians, onsite equipment scanning and lookup, installation and repair checklists, work order status tracking, and an overall dispatch/work order dashboard.

OPTIONAL CAPABILITY FOR

SECURITY OPERATIONS

MANAGEMENT

Provide enhanced IT operations management orchestration that uses workflow, scripting, and automation to enable mass device changes based on CMDB data populated from discovery or other means.

Requirement Summary

9.0 GOVERNMENT PROVIDED ACCESS

The Government will provide the following:

Sponsorship in order for the Contractor to obtain NIPR/SIPR access

Access to common services (such as Enterprise Access Management Service - Army, Assured Compliance Assessment Solution,) with which AESMP ITSM SaaS needs to interface for operations and compliance

10.0 PERFORMANCE METRICS

As indicated above, the contractor shall maintain 99.8% availability for all Army environments as calculated below. In addition, the contractor shall respond to requests within 30 minutes for

Urgent requests, 2 hours for immediate requests, or 1 day for Routine requests from requestors authorized by the Government.

AESMP ITSM SaaS Availability

1. SLA SUMMARY

1A. TASK

AREA

Task 2 –

AESMP

ITSM SaaS Tool

1B.

Performance Category

Responsiveness

1C. ITEM

1 1D. SLA Name SaaS Availability

2. SLA OVERVIEW

2A. SLA DESCRIPTION SaaS availability metric is 99.8% availability on a monthly basis and measures the availability of the AESMP. Any outage caused due to the connection to the Army’s NIPR network, or not the result of events or actions within the direct management and control of the Contractor are excluded when calculating the availability.

2B. RATIONALE Incentivizes provisioning and staffing of AESMP to ensure maximum customer satisfaction.

2C. PERFORMANCE

PERIOD

This SLA is in effect on a continuous basis 24 hours per day, 7 days per week without interruption throughout the Contract period of performance

3. SLA MEASUREMENT

3A. MEASUREMENT

INTERVAL

The Measurement Interval is one (1) month

3B. MEASUREMENT

PERIOD

The Measurement Period begins at 00:01 on the first day of the month and ends at 24:00 on the last day of the month

3C. SOURCE OF

MEASUREMENT DATA

The sources of measurement data is the onscreen dashboard from the technical AESMP indicating system availability.

3D. METHOD OF

MEASUREMENT

A dashboard will be provided that details by month the total hours/minutes/seconds per month, unscheduled application downtime, availability based on unscheduled downtime, scheduled application downtime, and availability based on scheduled downtime.

3E. TIMING OF

MEASUREMENT

SLA attainment is calculated at the end of the Measurement Period

3F. METHOD OF

GOVERNMENT

SURVEILLANCE

Subject to random or planned audit by the Government or its third party designee

3G. ASSUMPTIONS/

CONDITIONS

None

3H. EXCEPTIONS None

4. SLA CALCULATION

4A. NUMERATOR Uptime minutes in month = Total minutes in month – (Regular Scheduled Maintenance with an outage and approved change requests for an outage and Force Majeure or disaster event)

– total Priority 1 (Major impact to the US Army.

Normal business operations cannot be conducted. Users are affected regionally, nationwide, or globally for an extended period of time and no Work Around is available) minutes in the month.

Monthly Availability = Uptime minutes in the month (as defined above)

DIVIDED BY

4B. DENOMINATOR (Total Minutes in Month – (Regular Maintenance and approved change requests for an outage and Force Majeure or disaster event)).

4C. DEFINITIONS None

5. SLA PERFORMANCE OBJECTIVE

5A. HOLD HARMLESS

PERIOD

Notice to Proceed until AOR plus 30 calendar days

5B. MINIMUM SERVICE

LEVEL OBJECTIVE

99.8%

5C. SERVICE LEVEL The Minimum Service Level Objectives in cell

OBJECTIVE TIMEFRAME 5B is effective as of AOR

6. KPI ADMINISTRATION

6A. REPORTING

FREQUENCY

Monthly

6B. REPORTING

COMMENCEMENT

Reporting to commence at AOR

6C. NOTES AND

COMMENTS

None