Attachment_1_-_Performance_Work_Statement_V4.doc

OFFICE OF THE COMPTROLLER OF THE CURRENCY

Performance Work Statement for Managed Enterprise Email Services

September 30, 2015

TABLE OF CONTENTS

A.

INTRODUCTION

4B.

Current occ Enterprise Email service overview

4B.1 Current OCC Email Service Capability

7B.2 Current OCC Email Security Capability

8B.3 Current OCC Email Disaster Recovery Capability

9B.4 Current OCC Primary Email Production Environment

9B.5 Current OCC Secondary/Disaster Recovery (DR) Email Environment

11C.

PERFORMANCE WORK STATEMENT FOR new email serviceS

11C.1 Email Solution Implementation Options

12Option 1: Cloud-Based Fully FedRAMP Certified Solution –

12Option 2: On-Premise FISMA ATO-Capable Solution

14C.2 Email Service Performance Requirements

23C.3 Disaster Recovery Requirements

24C.4 Information Security Requirements

26C.5 IT Security Assessment and Authorization (SA&A) Requirements

31C.6 Requirements Traceability Matrix

31C.7 IT Accessibility Requirements

33D.

DELIVERABLES

33D.1 Submission of Deliverables

33D.2 Document Review Process

34D.3 Review Times

34D.4 Number of Reviewers

34D.5 Importance of the Draft Review Version

34D.6 Remediation of Unacceptable Deliverables

35D.7 Required Deliverables

38E.

LIST OF ATTACHMENTS

40F.

Performance Requirement Summary

A.

INTRODUCTION

The Office of the Comptroller of the Currency (OCC) is a non-appropriated bureau of the U.S. Department of the Treasury. Its primary mission is to charter, regulate, and supervise all national banks and Federal savings associations to ensure that these entities operate in a safe and sound manner, as well as in compliance with prevailing laws requiring fair treatment and access to credit and financial products. The OCC Comptroller is appointed by the President of the United States and serves a 5-year term.

Headquartered in Washington, D.C., at 400 7th Street, S.W., the OCC has four district offices (New York, Chicago, Denver, and Dallas), over 60 field offices, an Office of the Ombudsman in Houston, as well as an office in London, England.

There are four business objectives in the OCC mission:

· Ensure the safety and soundness of the national system of banks and savings associations

· Foster competition by allowing banks to offer new products and services

· Improve the efficiency and effectiveness of OCC supervision, including reducing financial regulatory burdens

· Ensure fair and equal access to financial services for all Americans.

The OCC employs bank examiners, economists, financial industry risk experts, attorneys, congressional liaison, as well as support teams of information technology, training, and human resource specialists. Together, the OCC professional work force conduct on-site reviews of national banks and Federal savings associations and Federal thrifts, provide sustained supervision of these institutions’ operations, analyze overall risks such as loan and investment portfolios, funds management, capital, earnings, liquidity, sensitivity to market conditions for all national banks and Federal thrifts. Consequently, the OCC has enormous public trust responsibilities to safeguard and protect the privacy and confidentiality of information collected or discussed regarding the risk and health of the supervised banks and thrifts institutions.

The OCC Chief Information Officer (CIO) directs the Information Technology Services (ITS) organization to support the OCC mission by developing, operating, and maintaining the agency’s information service technology infrastructure, applications, and data management. The Telecommunication and Messaging Operations (TMO) branch of the ITS Infrastructure and Operations Department is responsible for enterprise email operations.

B. Current occ Enterprise Email service overview The OCC’s IT enterprise has undergone significant changes over the past several years, including the integration of another Federal agency’s IT infrastructure, applications, and staff into the OCC. In addition, three legacy data centers have been consolidated into a single OCC Production Data Center that is housed within a Tier-3 commercial data center facility in Ashburn, Virginia operated by Federal Realty under contract to the OCC.

B.1 Current OCC Email Service Capability

The current OCC enterprise email solution is a FISMA-Moderate system provided by HP Enterprise Services under a managed-email service contract. This service provides the following features and capabilities:

1. The primary email production environment is located in the OCC data center in Ashburn, Virginia.

2. The secondary environment is the Disaster Recovery (DR) email production environment, which is located in an HP-operated data center in Charleston, West Virginia.

3. The current solution utilizes Microsoft Exchange 2010 Service Pack 3 with approximately 6,000 mailboxes (4,100 individual, 400 executive, and 1,500 shared) running on Windows 7 OS laptops and desktops with Outlook client software. The number of mailboxes is growing at a rate of approximately 5% per year.

Please note: OCC user desktops and laptops have encrypted hard disk drives and end point protection to encrypt all attached USB devices.

4. The current solution utilizes Microsoft Active Directory 2008 Revision 2 and event calendar services for all email users.

Please note: OCC has initiated efforts to upgrade from AD 2008 to AD 2012, tentatively planned for completion by mid-2016.

5. Current mailbox size limits are 1 GB for individual, 2 GBs for executives, and 16 GBs for shared mailboxes.

6. The current typical weekly messaging volume is as follows:

a. 690,000 internal emails (i.e., OCC users sending to OCC users, within the OCC network)

b. 450,000 outbound emails (i.e., OCC users sending to users outside of the OCC network)

c. 25,000 inbound emails (i.e., OCC users receiving from users outside of the OCC network)

d. Messaging volumes will steadily increase by 5% each year, but could also vary by +/- 25% during specific limited durations, depending upon local or national events.

7. The current solution has an average monthly system availability of 99.99% (as measured across 24 hours a day, 30 days per month) under the following parameters:

a. The current primary email production environment, with sufficient on-site server and storage array capacity and redundancy, is managed by the Microsoft high-availability Database Availability Group (DAG), to overcome individual server or storage component failures.

b. The current primary email production environment can accommodate routine and necessary planned maintenance outages of individual servers for patch upgrades and change management, while still sustaining continuous, uninterrupted email services overall. This is performed by first switching production email operations from the primary to the secondary/DR email environment, and later returning production operations back to the primary email environment.

c. Demand for high availability of email services is based on the following OCC business functions and information services operations:

i. OCC officials must maintain communications with other Federal regulators (such as the Department of the Treasury, Federal Deposit Insurance Corporation [FDIC], and Federal Reserve Board [FRB]) for consultative decision-making and time-sensitive bank resolution and regulatory matters.

ii. The OCC uses email services as its principle means of communications during crisis management, Continuity of Operations, and Disaster Recovery.

iii. OCC IT operational management uses email relay as its principle means to communicate network, server, and appliance health monitoring.

iv. The OCC uses email services as a means of communicating cyber security incident reporting and security event alerts.

8. The current solution has typical response times for email functions (as measured from a user laptop that is LAN-connected to the OCC network infrastructure) as follows:

a. 1.1 seconds to view an email without attachment

b. 3.7 seconds to send an email without attachment

c. 5.1 seconds to view an email with a 9-MB attachment

d. 11.2 seconds to send an email with a 1-MB attachment

e. 26.8 seconds to send an email with a 4-MB attachment.

9. Current solution has typical response times for calendar functions (as measured from a user laptop that is LAN-connected to the OCC network infrastructure) as follows:

a. 2.6 seconds to access a calendar with no shared calendars

b. 5.0 seconds to access a calendar with five (5) shared calendars.

10. The OCC currently has approximately 2,700 Blackberry Bold devices, supported by a redundant suite of Blackberry Enterprise Servers located at the primary and the secondary/DR email production sites, providing access to Microsoft Exchange, calendar, directory services, and voice texting services.

Please note: The OCC has initiated a project to replace the Blackberry devices with a set of Android and iOS mobile devices using Microsoft Exchange ActiveSync to access email, calendar, and directory services. This Android/iOS device deployment is scheduled for completion by December 2015.

11. The current solution supports remote email and application access from outside of OCC facilities using the Cisco Virtual Private Network (VPN) client on the OCC laptops, Citrix XenDesktop/XenApp, and Outlook Web Access (OWA).

12. The current solution supports on-line fax send/receive services using eFAX and NET SatisFAXtion servers.

13. The current solution supports SMTP (Simple Mail Transport Protocol) mail relay services support alerts and notifications generated by 100+ of the approximately 1,000 application servers and all of the 300 scanners. The server and scanner population has a growth rate of approximately 5% annually.

14. The current solution uses Microsoft System Center Operations Manager to perform continuous monitoring of the following aspects of system health and performance status:

a. Number of email users logged on

b. Messages received and messages sent per second

c. Mailbox delivery queue size

d. Mailbox, Client Access, Hub Transport, and Edge servers health and utilization

e. Lightweight Directory Access Protocol (LDAP) search time

f. Average sent latency

g. Average receive latency.

15. Current mailbox content backup procedures include:

a. Daily incremental

b. Weekly full

c. 30-day tape rotation.

16.

The current solution provides limited email journaling for approximately 400 OCC Executive staff for seven (7) year retention.

17.

Current OCC IT operational monitoring, incident reporting, and service request support services operate as follows:

a.

OCC IT customer service contractors operate a Tier-1 Service Desk to receive, record, dispatch, and track progress for all IT incident and service requests. The current Tier 1 Service Desk on duty hours are Monday to Friday, 6 AM to midnight, EST, as well as Saturday and Sunday, 8 AM to midnight, EST (including holidays).

b.

The OCC Network Operations Center (NOC) provides enterprise systems health and security monitoring and response service, with operations staff on duty 24 x 7 (including holidays).

c.

The OCC’s current email solution provider operates an on-site (at OCC HQ) Tier-2 call triage service to identify the nature and urgency of a Service Desk call, as well as an on-site Tier-3 email application subject-matter expert (SME) support. The on-site duty hours for email Tier-2 triage and Tier-3 SMEs are Monday through Friday, 6 AM to 7 PM, Easter Standard Time (EST), except during Federal holidays or building closures.

d.

The OCC’s current email solution provider provides on-call service during off-duty hours (7 PM to 6 AM on weekdays, weekends, Federal holidays, or when the OCC headquarters building is closed due to local events) to respond to VIP customer requests or email-related issues, Exchange system health alerts are reported by either the IT Service Desk or the Network Operations Center.

e.

All ticket receipt, dispatch, response, progress, escalation, and closure actions are recorded and reported using the ServiceNow dispatch management system.

18. The current OCC email service hardware and software suite will be due for a major technology refresh in approximately 18 to 24 months.

19.

The current OCC email service has a “drag-and-drop” feature for users to easily export email content into the OCC electronic document system (currently an OpenText/eDoc solution).

B.2 Current OCC Email Security Capability

Security for the OCC’s email solution utilizes the following components and supports the following operational parameters.

1.

User authentication for network login and/or application access is established through the mandatory use of GSA-approved HSPD-12 PIV card and PIN;

2.

Trust for user authentication to external applications is established through SAML-based single sign-on. The OCC currently uses SiteMinder to federate user authentications with external cloud-based applications.

3.

Secure encrypted email is transmitted using ZixMail and/or a Transport Layer Security (TLS) implementation.

4.

NIST-compliant data encryption is utilized as follows:

a.

Encrypt all intra-OCC wide-area network traffic in transit

b. Encrypt all OCC email traffic in transit between Exchange servers and clients

c. All ActiveSync traffic between mobile smartphones and Exchange servers are encrypted.

5.

Email hygiene and security protections are applied as follows:

a. Anti-SPAM and content-filtering appliances block up to 99% of all incoming spam and inappropriate-content emails

b. Anti-virus appliances with continuous knowledge updates are used to mitigate known threats.

6.

All OCC inbound and outbound internet web and email traffic is routed through mandatory Treasury Trusted Internet Connections (TICs) and subject to Government-level (e.g. Department of Homeland Security [DHS]) cyber security protection. The Treasury’s Bureau of Fiscal Services (BFS) hosts the TIC for the OCC.

B.3 Current OCC Email Disaster Recovery Capability

Disaster recovery for the OCC’s email solution utilizes the following components and supports the following operational parameters.

1. Two identical email system environments, separated by more than 200 miles, are in production use. The primary environment is in the OCC’s data center in Ashburn, Virginia. The secondary/DR environment is located in a contractor-owned data center in Charleston, West Virginia . (See B.4 and B.5 for more information about those sites.)

2. Email servers from the primary and secondary/DR email environments are mirrored, and data are replicated between the primary and the secondary/DR email environments in real time.

3. The OCC has successfully executed routine weekly and periodic security patching and other scheduled maintenance on the primary email environment by switching total and full load production email services to the secondary/DR email environment.

4. OCC has successfully conducted annual, full-scale disaster recovery exercises by switching total production email services from the primary to the secondary/DR email environment and sustaining full email services from the secondary/DR environment for the weeklong duration of the DR exercise.

B.4 Current OCC Primary Email Production Environment

The current OCC primary email environment resides in the OCC data center in Ashburn, Virginia, and utilizes the following components:

1. Microsoft Exchange 2010 Service Pack3

2. Three (3) virtual mailbox servers running Microsoft 2008 R2 operating system (OS)

3. Four (4) virtual Hub Transport/Client Access Server (CAS) running Microsoft 2008 R2 operating system (OS)

4. A total of 12,000 public folders for sharing documents, calendars, contacts, and other data

5. Two (2) ZixMail secure email encryption servers

6. Two (2) Symantec Messaging Gateways (SMGs) for anti-virus and anti-SPAM

7. Two (2) ClearSwift content-filtering servers

8. A centralized Storage Area Network (SAN), with approximately 60 TBs of allocated storage for email operations

9. Two (2) dedicated Active Directory 2010 domain controllers

10. A load balancer (F5 Big IP)

11. Seven (7) Blackberry Enterprise Servers

12. SiteMinder for SAML-based federated certificate authentication exchanges with external cloud-based applications.

B.5 Current OCC Secondary/Disaster Recovery (DR) Email Environment

The current OCC secondary/DR email environment resides in the contractor-owned and -operated data center in Charleston, West Virginia, and utilizes the following components:

1. Microsoft Exchange 2010 Service Pack3

2. Three (3) virtual mailbox servers running the Microsoft 2008 R2 operating system

3. Four (4) virtual Hub Transport/Client Access servers running the Microsoft 2008 R2 operating system

4. A total of 12,000 public folders for sharing documents, calendars, contacts, and other data

5. Two (2) ZixMail secure email encryption servers

6. Two 92) Symantec Messaging Gateways (SMGs) for anti-virus and anti-SPAM

7. Two (2) ClearSwift content-filtering servers

8. An eFax server for faxing on-line from Microsoft Outlook

9. A centralized Storage Area Network (SAN), with approximately 60 TBs of allocated storage for email operations

10. Two (2) dedicated Active Directory domain controllers

11. A load balancer (F5 Big IP)

12. Seven (7) Blackberry Enterprise Servers

13. Two (2) Email Transport Layer Security (TLS) – Edge transport servers

14. SiteMinder for SAML-based federated certificate authentication exchanges with external cloud-based applications.

Figure 1 depicts the OCC’s two email service environments.

Figure 1: OCC Primary and Secondary/Disaster Recovery Production Email Service Environments

C. PERFORMANCE WORK STATEMENT FOR new email serviceS C.1 Email Solution Implementation Options The OCC is seeking a low-risk, best-value email solution that can obtain an OCC-issued ATO as a FISMA-Moderate system to begin full-scale operation before the end of the current email service contract in 2016.

The proposed solution can be either a cloud-based, fully FedRAMP-certified email service, or an on-premise FISMA ATO-capable email service. The Offeror shall specify in its proposal which implementation option it proposes to deliver to the OCC.

TABLE 1. Implementation Options 1 and 2

Option 1: Cloud-Based Fully FedRAMP Certified Solution –

For Option 1, the Offeror shall provide a cloud-based infrastructure and software solution, integrated with user support services, to meet the OCC email performance requirements in this PWS.

As part of its proposal submission, the Offeror shall show proof that all cloud-based primary and secondary/DR components in the proposed email solution – to include Infrastructure as a Service (IaaS) and Software as a Service (SaaS) – are currently certified as Federal Risk and Authorization Management Program (FedRAMP)-compliant. Specifically, this means that the IaaS and SaaS shall all have: (a) current FedRAMP Joint Authorization Board (JAB) Provisional Authorization to Operate (ATO), or (b) a current FedRAMP ATO issued by another Federal agency and made available to other Federal agencies via FedRAMP. The Offeror shall also show proof that the proposed secondary/DR site is at least 200 miles away from the proposed primary site.

Proposals that omit proof of existing FedRAMP compliance as defined above and do not propose a secondary/DR site that is at least 200 miles away from the proposed primary site will be deemed non-responsive and may be excluded from evaluation.

After contract award, the proposed cloud-based email solution shall be able to obtain the OCC ATOs prior to pilot testing and prior to full-scale production. The Offeror shall meet the OCC ATO Request Package deliverable deadlines (described in Section D – Deliverables) and be subject to all applicable late delivery dis-incentives (described in Section F – Performance Requirement Summary).

Option 2: On-Premise FISMA ATO-Capable Solution For Option 2, the Offeror may propose a combination of non-cloud/on-premise FISMA-compliant infrastructure for the primary site, with a cloud-based FedRAMP-compliant infrastructure (or a non-cloud/on-premise FISMA-compliant infrastructure) for the secondary/DR site, all of which are integrated with email application software and user support services. This option would also meet the OCC email service performance requirements described in this PWS.

As part of its proposal submission,, the Offeror shall show proof of existing FISMA and/or FedRAMP compliance certifications corresponding to all proposed infrastructure components. Specifically, this means that the primary email site shall be an on-premise infrastructure implemented within the OCC data center located in Ashburn, Virginia, leveraging the existing OCC-certified FISMA-compliant infrastructure. The secondary/DR email solution shall be a managed service identical in functionality to that of the primary site, but implemented within: (a) a JAB or agency-certified FedRAMP compliant cloud infrastructure, (b) an OCC-certified FISMA-compliant on-premise infrastructure, or (c) an agency-certified FISMA compliant on-premise infrastructure. The Offeror shall also show proof that the proposed secondary/DR site is at least 200 miles away from the proposed primary site.

Proposals that omit proof of existing FISMA and/or FedRAMP compliance certifications relevant to the proposed infrastructures and do not propose a secondary/DR site that is at least 200 miles away from the proposed primary site will be deemed non-responsive and may be excluded from evaluation.

Since the proposed on-premise FISMA solution may not have current Federal compliance certification for the new email application software (such as Microsoft Exchange 2013) at the time of bid submission, the Offeror shall alternatively provide written assurance as follows:

After contract award, the proposed on-premise infrastructure and software solution in total (at the Primary and Secondary/DR sites) shall be able to obtain OCC ATOs prior to pilot testing, and prior to full-scale production, while meeting the OCC ATO Request Package deliverable deadlines (described in Section D – Deliverables), and be subject to all applicable late delivery disincentives (described in Section F – Performance Requirement Summary).

In general, a “Cloud Service” (as defined by NIST SP 800-145, page 2) has five (5) essential characteristics:

· On-demand self-service - A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

· Broad network access - Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource pooling - The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth.

· Rapid elasticity - Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and in any quantity at any time.

· Measured service - Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage are monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

The types of clouds are defined as:

· Private cloud - The cloud infrastructure is for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be own, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.

· Community cloud - The cloud infrastructure is for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be own, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.

· Hybrid cloud. The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data C.2 Email Service Performance Requirements

1. To meet the OCC’s email performance and security compliance requirements, the proposed solution shall be the latest production release of either Microsoft Exchange 2013 or Microsoft Office 365 email application software, and hosted within U.S.-based data centers.

2. The proposed solution shall support 6,000 mailboxes (4,100 individual, 400 executive, and 1,500 shared), with a growth rate of approximately 5% in mailbox numbers annually.

3. The proposed solution shall interface email services with the OCC’s Active Directory 2008 directory service and event calendar services for all email users. (Please note: The OCC has initiated efforts to upgrade from AD 2008 to AD 2012, tentatively planned for completion by mid-2016. The proposed email solution must interface with either AD 2008 or AD 2012 directory services during email system implementation.)

4. The proposed solution shall provide a mailbox size of five (5) GBs for individual, ten (10) GBs for executive, sixteen (16) GBs for shared mailboxes, with sufficient SAN storage allocated for email operations and able to rapidly change mailbox size limits when operationally needed or when requested by the OCC.

5. The proposed solution shall accommodate typical anticipated weekly volumes of:

a. 690,000 internal emails (i.e., OCC users sending to OCC users, within the OCC enterprise network)

b. 450,000 outbound emails (i.e., OCC users sending to recipients residing outside of the OCC enterprise network)

c. 25,000 inbound emails (i.e., OCC users receiving from senders residing outside of the OCC enterprise network) All messaging volumes would steadily increase by 5% each year, but could also vary by +/- 25% during specific limited durations, depending upon local or national events.

6. The Offeror shall provide email support services for:

a. Backup and restore

b. Blocked email

c. Calendaring

d. Archiving

e. Search and retrieval from email archives

f. Conversion and/or migration of legacy (existing mailboxes, archive, journal, or PST) email content into the new email solution for seamless transition to the new email solution

g. If directed by OCC, conversion and/or migration of legacy or new (existing mailboxes, archive, journal, or PST) email content into the OCC electronic document management system (currently an OpnText/eDoc solution) to enable electronic search, retrieval, and reporting of selected email content

h. Creation and deletion of mailboxes

i. Creation and deletion of email distribution lists

j. Support for application email relay functions

k. eFAX account creation and services

l. Microsoft Skype for Business accounts creation

m. Transport Layer Security (TLS) connection setup

n. New email feature testing

o. Litigation response

p. Freedom of Information Act (FOIA) response

q. Backup software configuration

r. Media vault storage

s. Email-related production and data-storage support.

7. The Offeror shall provide email support services for employee and contractor Global Address List (GAL) updates.

8. The proposed solution shall have average monthly (measured across 24 hours per day, 30 days per month) availability of 99.99% up time with no service disruption or outages for all of the hosted application services during the contract period of performance.

9. The proposed solution shall provide a set of industry best-practice benchmarks, as well as built-in tools or techniques, to measure, report, and validate that the average response time for new email system functions on OCC user devices (i.e., desktop, laptops, or mobile devices) meet or exceed the current email service performance levels identified in Section B.1.6 and Section C.2 of this PWS.

10. The proposed solution shall provide rapid and elastic capacity to support the addition, deletion, and change of mailbox accounts, directory data, storage size, as well as swings in email volume.

11. The proposed solution shall accommodate current means of email access with mandatory use of GSA-approved HSPD-12 PIV card and PIN:

a. Logging locally into the OCC network from within OCC facilities, or remotely into the OCC network from outside OCC facilities

b. Using OCC-issued PC/laptops, a user’s own PC/laptop, or Android/iOS mobile devices

c. Running Cisco VPN client, Citrix XenDesktop/XenApps, Outlook Web Access (OWA), or Exchange ActiveSync

d. Exchanging SAML-based user authentication with external cloud-based email application (if proposed) to establish Single Sign On.

12. The proposed solution shall support on-line fax send/receive capabilities using eFAX and NET SatisFAXtion servers (or a functionally equivalent alternative). The eFax servers and telecommunications fax lines are provided as optional Government Furnished Equipment (GFE) hosted at the OCC Production Data Center in Ashburn, Virginia. The Offeror may propose a functionally equivalent alternative eFAX solution without using the OCC’s GFE.

13. The proposed solution shall provide integration engineering and support for 3,000 mobile Android and iOS devices, with the ability to scale support for up to 6000 mobile devices, to access email, perform event calendaring, and provide directory services using Exchange ActiveSync SSL connections. The server certificate for SSL shall support Treasury/OCC-issued certificates. ActiveSync authentication should support all of the following: OCC Active Directory-based username/password, OCC user certificates (with certificate revocation list [CRL] check), and SAML assertions with OCC as identified provider.

14. The proposed solution shall provide SMTP mail relay services for application alerts or notifications generated by 300 scanners (multi-functional devices) and approximately 100 of the 1,000+ application servers. The server and scanner population has a growth rate of approximately 5% annually.

15. The proposed email solution shall provide the OCC with visibility into the email services through a real-time, web-based “dashboard” capability that facilitates viewing and printing reports of the key performance indicators under the current email service operation. Specifically, the proposed solution shall provide automated, continuous monitoring using Microsoft System Center Operations Manager (SCOM), as well as provide a real-time data feed of email security or hygiene events to the OCC’s McAfee Security Information and Event Management (SIEM) tool to capture, record, analyze, and report point-in-time snapshots, as well as trends over time, of the following aspects of system health and performance status:

a. Number of email users logged on

b. Messages received and messages sent per second

c. Mailbox delivery queue size

d. Mailbox, Client Access, Hub Transport, and Edge servers health and utilization

e. LDAP search time

f. Average sent latency

g. Average receive latency.

16. The proposed solution shall perform daily incremental and weekly full email solution backups, and retain backup media for six (6) months, for all production software and data at the Primary and the Secondary/DR site.

17. The proposed solution shall provide email archiving and centralized email journaling with the following capabilities:

a. Journaling and retention of all internal, inbound, and outbound emails for ten (10) years for all OCC mailboxes. The email journaling repositories have no storage limit. The Comptroller’s mailbox journaling shall have permanent retention.

b. Journaling and retention of instant messaging (currently a Microsoft Skype for Business solution) for one (1) year for all OCC users (employees and contractors). The instant messaging journaling repositories have no storage limit. The Comptroller’s instant messaging shall have permanent retention.

c. Archival mailbox setup for each operational mailbox to allow users to easily drag-and-drop older email contents from the standard mailbox into the archive mailbox. The archival mailboxes have no retention time limit or size limit.

d. Compatibility with the OCC’s enterprise electronic document management system (currently an OpenText/eDOC solution) to allow easy drag-and-drop of emails into the document management system.

e. Importing of legacy PST files, via easy drag-and-drop techniques, into the new email solution standard or archive mailboxes. This will help to eliminate the use or need for PST files.

f. To comply with management directives, court orders, litigation hold, or Freedom of Information Act (FOIA) requests, this email solution shall provide built-in feature, or third party tool bundled with email solution, to conduct rapid and sophisticated full-text search and discovery (using industry best practice search techniques such as single or multiple compound words, phrases, or words proximity) of all OCC email repositories (including standard, archived, and/or journaling mailboxes).

g. Apply industry best practices for storage optimization (such as compression and/or de-duplication at the hardware and/or application level) to reduce storage cost and increase access efficiency of all OCC email repositories.

18. The proposed solution shall include technical support to manage and administer Exchange public folders used for sharing documents, calendars, contacts, and tasks for archiving distribution lists.

19. The proposed solution shall support Unified Communications and Unified Messaging platforms (used for Microsoft Skype for Business) to indicate user availability/presence status.

20. The proposed solution shall provide email clients for mobile devices that support Hypertext Markup Language (HTML 5).

21. The proposed solution shall provide 24 hours per day x 7 days per week email Tier-2 (call triage) and Tier-3 (email SME) operations support and customer services, including:

a. Provide on-site support at OCC headquarters from 6 AM until 9 PM EST, Monday through Friday. The extended support hours are necessary to accommodate the OCC’s staff working outside the Eastern Time zone.

b. Provide on-call (off-site) support during off-duty hours, including weekends, holidays, or OCC HQ building closures.

c. Generate and update work progress for email-related requests or incidents using OCC-furnished ServiceNow accounts.

d. Use OCC-furnished Service Now accounts to accept and/or respond to email-related incidents and service requests routed via Service Now by the OCC Help Desk Tier-1 staff (call dispatch).

e. After help desk ticket assignment to the Email Operations Tier II and/or Ticket III work queue (process belonging to the Offeror’s Email Technical Support Services), the Offeror shall accept, resolve, and close those assigned ServiceNow incidents or service requests within two (2) hours for non-VIP users and 30 minutes for VIP users. (Please note: The OCC will supply the list of approximately 50 VIP users after contract award.)

f. Develop and implement escalation procedures for all email-related problems, incidents, and requests.

g. Develop knowledge-based articles to enhance Tier-1 problem-solving capabilities and reduce the administrative burden and dependency on Tier-2 and Tier-3 staff.

h. Provide training to OCC Tier-1 personnel for resolving frequently encountered email issues

i. If transition of email solution provider is required, the incoming provider shall perform knowledge transfer to observe, learn, document, and continue the best practices and lesson learned from the outgoing email service provider.

22. The Offeror shall integrate its services with the OCC Change Management process for planning and executing email solution changes. Implementation of email solution changes shall include documenting the following information: the reason for the change; a risk-impact assessment of the change, including the impact to the OCC if the proposed change is not implemented; the proposed schedule and duration for implementing the change; any email service outages anticipated because of the change; progress tracking of the change; test scripts to implement the change, and trouble-reporting associated with the change.

23. The Offeror shall manage the OCC Windows 7-based, Microsoft Outlook email clients, as well as integration support between email and Microsoft Skype for Business.

24. The Offeror shall propose and provide all hardware, software, and technical support services to meet all of the email service performance requirements in this solicitation. The Offeror shall be responsible for all maintenance, repairs, security patches, functionality updates, technology refresh, and product upgrades for the supplied hardware and software.

For Option 2 On-Premise solution requiring use of OCC Data Center, the Offeror shall apply the following server and/or storage configuration baselines:

· Microsoft 2012R2 OS, or a more current commercially available release at time of contract award that is compatible with the OCC production environment in the OCC Data Center in Ashburn, Virginia; and

· Prevailing NIST server and storage system-hardening baselines as established in the U.S. Government Baseline Configuration (USGBC).

25. For Option 2 On-Premise solution requiring use of OCC Data Center, the Offeror shall observe the following general system readiness, rules of behavior, and facility access requirements: (Please note: These requirements are supplements to, and do not preempt, the FISMA or FedRAMP ATO compliance controls)

a. Any version or deviations from the OCC approved Microsoft OS and NIST baseline, must be documented and approved by the OCC CSO and SSO prior to deployment. Any further deviations after deployment must also be reviewed and approved by OCC prior to deployment

b. Offeror MUST update their environment on a regular bases as new NIST standards are released.

c. Offeror MUST comply with OCC patching policies, applying all MS security patches within 31 days of release from MS.

d. All patchable vulnerabilities must be remediated within 31 days of release from the respected application vendor

e. All non-patchable vulnerabilities must be remediated within 31 days of release from the respected application vendor

f. All zero day patches as deemed by OCC must be applied within 48 hours or within the time limit set by OCC

g. All firmware must be kept at a level that is compatible with OCC infrastructure and on the support matrix from the respective vendors.

h. All network and storage area network interfaces must adhere to the OCC standards

i. Offeror is responsible for all required translation or interconnectivity issues between Offeror equipment and OCC infrastructure. (I.E. All OCC Multimode fiber is ST connections, OCC data center infrastructure is OM4 fiber and CAT6A , dongles to attach server to KVM, etc)

j. Access to the OCC data center requires 48 hour notice unless it is a production outage. Production outage responses are handed on a case by case basis.

k. All equipment and peripherals (including keyboard, monitor screen, and pointing devices) installed in the OCC Data Center must be of data center quality and capable of being mounted entirely within a standard 19” rack. Racks measure are 24” by 48” overall. The exceptions are for enterprise SAN or other specialized bundled appliances. Those San or specialized appliances shall be handled on a case by case basis.

l. All equipment installed in the OCC data center must have dual power and dual network connectivity.

m. The OCC Data Center is operated as a lights out facility

n. Contractors shall only use wireless internet connections to connect with non-OCC networks.

o. Contractors shall only use OCC-issued and configured laptops for accessing and administering the production environment.

p. Contractors cannot bridge two networks by simultaneously logging into the OCC network and another non-OCC network on the same end user computing device.

q. All internet access must be connected through the OCC network gateways and cyber defenses. Servers do not have separate internet connections outside of the OCC network connection.

26. The Offeror shall incorporate hardware technology refresh and upgrades at a minimum every three years during the contract period of performance, beginning at 36 months after contract award. The hardware components shall include:

a. Server’s CPU, internal RAM, and firmware

b. Storage Area Network

c. Local Area Network Devices

d. Wide Area Network Devices

e. Email-specific operational appliances

After each system component change, the Offeror shall update the corresponding ATO artifacts for configuration management and compliance update reporting.

26. The Offeror shall apply software patching, revisions upgrades, and/or bug fixes within 30 calendar days after those items are commercially available for General Distribution.

After each system component change, the Offeror shall immediately update the corresponding ATO artifacts for configuration management and compliance update reporting.

27. The Offeror shall migrate all existing individual, executive, and shared mailbox content, calendar content, directories, and desired-PST files on shared or local hard drives into the new email solution without any service interruptions. The Offeror shall perform migration work during non-business hours (i.e., weekdays from 9 PM through 6 AM, on weekends, and during Federal holidays) to minimize the impact to users.

28. The Offeror shall develop and execute a Production Transition Plan that includes technical procedures, user communications, security controls validations, and data integrity verifications to manage, track, and report the full-scale migration and transition of the existing OCC email system to the new email system. This plan shall include:

a. Hardware and software installation;

b. Identify and migrate all existing mailbox, calendar, directories, and user-desired PST data;

c. Staffing technical support service roles; and

d. Knowledge transfer from incumbent service providers.

29. The Offeror shall provide all necessary communications (e.g., user instructions, schedule information, Help Desk procedures, and troubleshooting guidance) for OCC staff and management. The Offeror shall provide user training, including training materials, before starting mailbox transition, during the mailbox transition, and at the completion of mailbox transition to facilitate a positive customer experience.

30. The Offeror shall migrate all existing archiving and journaling mailboxes from the current version of OCC Exchange software, mailbox servers to the proposed hosted solution. The OCC currently has approximately 400 archiving mailboxes, each 50GB in size, as well as an email journaling mailbox that is approximately 700 GB as of September 2015.

31. After obtaining the OCC-issued Authority To Operate (see Section C.5 below), the Offeror shall immediately commence full-scale production email operations, as well as Tier-2 call triage and Tier-3 SME support in collaboration with the OCC’s Tier-1 customer service.

32. The Offeror shall provide two key personnel for the proposed email solution:

a. Email Operations Project Manager, with the following duties:

i. Develop, track updates, and report on project plans, costs, and milestones;

ii. Respond to OCC on contract performance and/or cost issues; and

iii. Supervise Offeror’s staff and subcontractor performance in achieving project plans and milestones.

b. Email Subject Matter Expert (SME), with the following duties:

i. Design, implement, troubleshoot, resolve issues, and performance tuning the production operations Offeror’s email solutions;

ii. Collaborate with Offeror’s risk assessment organization to prepare, revise, and update ATO request packages;

iii. Conduct capacity planning and technology refresh cycle; and

iv. Develop knowledge transfer communications to foster problem resolution expertise among all OCC user help desk personnel.

C.3 Disaster Recovery Requirements

1. The proposed solution shall have an operational secondary/DR email service that is located at least 200 miles away from, and is fully redundant in all aspects of the email service provisioning as those of, the primary email service.

2. The proposed solution’s secondary/DR email service shall use email database replication, in real time, with the primary email service.

3. The proposed solution’s disaster recovery capability shall provide an email service Recovery Time Objective (RTO) of under sixty (60) minutes and a Recovery Point Objective (RPO) of under thirty (30) minutes.

4. The proposed solution’s secondary/DR email site shall be capable of running in parallel or tandem with the primary email service to serve as enhanced load balancing and to increase the ability to meet the OCC RTO and RPO requirement (as stated above).

5. The Offeror shall provide an annual statement to the OCC assuring that the DR solution is fully operational and has been successfully tested to carry full scale production email service load from the primary email environment, and met the email performance benchmarks as stated in Sections B.1.8 and B.1.9, for at least one week per year.

C.4 Information Security Requirements

1. The Offeror’s proposed solution shall include providing email hygiene services as follows:

a. Apply commercial-off-the-shelf anti-malware, anti-SPAM, content-filtering capabilities and data loss prevention to block up to 99% of all incoming spam, adware, malware, and viruses.

b. Integrate with, and provide real-time feed to, the OCC Microsoft System Center Operations Manager (SCOM) and the OCC Security Information Event Management solution (SIEM, currently a McAfee solution) for triggered event reporting.

c. Apply best-practice techniques to ensure that attachments and hyperlinks are safe to open. At a minimum, this shall include sandbox and detonation chambers to safely open and/or dispose of malware without harming production operations.

d. Email hygiene services shall perform with the same operational availability as that of the email services (as defined in Section C.2.8).

2. The proposed solution shall provide secure email transmissions using ZixMail and Transport Layer Security (TLS). The OCC currently uses a ZixMail appliance for encrypting outgoing emails. ZixMail encryption is an optional, built-in feature of Outlook. Transport Layer Security (TLS) provides alternate email encryption capability. OCC uses TLS for secure email communications with selected banks. The OCC currently has about 30 TLS connections in production and expects this figure to grow by a rate of 20% per year.

3. The proposed solution shall apply NIST FIPS-compliant encryption and industry best practices, tools, and techniques compatible with Microsoft Outlook to protect the confidentiality, integrity, and accessibility of:

a. All email, calendar, and directory data at rest on email servers such that email contents are not stored in plain text and can only be accessed by authorized users in plain text after decryption, and

b. End-to-end transmission of all email data in motion such that email contents are not transmitted in plain text and can only be accessed by authorized users in plain text after decryption.

4. The proposed solution shall provide user authentication to support Single Sign-On using two-factor logins as follows:

a. Support two-factor authentication utilizing user ID, password, and an RSA timed token generating random-digit login codes (“something you have”) that are combined with a user-selected PIN (“something you know”) for login

b. Support two-factor authentication utilizing a HSPD-12 compliant, PIV-card digital certificate and user-selected PIN for login

c. Support two-factor authentication utilizing an OCC user certificate (i.e., a soft certificate derived from the PIV card) and a user-selected PIN for login

d. Support SAML assertions with the OCC as the identified…