Attachment_3_-_Requirements_Traceability_Matrix_Amendment_4.docx

RFP CC16HQR0001

Attachment 3: Requirements Traceability Matrix

Requirements Traceability Matrix (RTM) This matrix includes all technical and functional requirements that must be fully addressed by the Offeror’s proposed solution.[footnoteRef:1] To complete the RTM for submission as part of its quotation, the Offeror should identify in the Requirement Met? column whether its solution fully meets (F), partially meets (P), or does not meet (N) each requirement. For each requirement whose status is “P,” the Comments column should be used to describe any work-arounds that can be implemented to bridge the gap between the Offeror’s solution and the OCC’s requirement. If the Offeror wishes to provide additional information regarding why its solution does not meet a given requirement, the Comments column can also be completed for requirements whose status is “N.” [1: The requirements in the RTM are related to the technical and functional capabilities of the solution (i.e., “the proposed solution shall . . . “). Any requirements regarding the way the Offeror must deliver its services (i.e., “the offeror shall . . .”) are discussed in the body of the PWS. However, they are not included in this RTM as they are not technical or functional requirements of the solution itself. Nevertheless, the offeror-services requirements must also be addressed in the Offeror’s proposal in order to demonstrate that its technical approach meets (or exceeds) all the requirements specified by the OCC.]

Table 1 Requirements Traceability Matrix

a. 690,000 internal emails (i.e., OCC users sending to OCC users, within the OCC enterprise network)

b. 450,000 outbound emails (i.e., OCC users sending to recipients residing outside of the OCC enterprise network)

c. 25,000 inbound emails (i.e., OCC users receiving from senders residing outside of the OCC enterprise network)

All messaging volumes would steadily increase by 5% each year, but could also vary by +/- 25% during specific limited durations, depending upon local or national events.

a. Backup and restore

b. Blocked email

c. Calendaring

d. Archiving

e. Search and retrieval from email archives

f. Contractor-assisted and user-initiated conversion and/or migration of legacy (existing mailboxes, archive, journal, or PST) email content into the new email solution for seamless transition to the new email solution

g. If directed by OCC, conversion and/or migration of legacy or new (existing mailboxes, archive, journal, or PST) email content into the OCC electronic document management system (currently an OpenText/eDoc solution) to enable electronic search, retrieval, and reporting of selected email content

h. Creation and deletion of mailboxes

i. Creation and deletion of email distribution lists

j. Support for application email relay functions

k. eFAX account creation and services

l. Microsoft Skype for Business accounts creation

m. Transport Layer Security (TLS) connection setup

n. New email feature testing

o. Litigation response

p. Freedom of Information Act (FOIA) response

q. Backup software configuration

r. Media vault storage

s. Email-related production and data-storage support.

a. Logging locally into the OCC network from within OCC facilities, or remotely into the OCC network from outside OCC facilities

b. Using OCC-issued PC/laptops, a user’s own PC/laptop, or Android/iOS mobile devices

c. Running Cisco VPN client, Citrix XenDesktop/XenApps, Outlook Web Access (OWA), or Exchange ActiveSync

d. Exchanging SAML-based user authentication with external cloud-based email application (if proposed) to establish Single Sign On.

a. Number of email users logged on

b. Messages received and messages sent per second

c. Mailbox delivery queue size

d. Mailbox, Client Access, Hub Transport, and Edge servers health and utilization

e. LDAP search time

f. Average sent latency

g. Average receive latency.

a. Journaling and retention of all internal, inbound, and outbound emails for ten (10) years for all OCC mailboxes. The email journaling repositories have no storage limit. The Comptroller’s mailbox journaling shall have permanent retention.

b. Journaling and retention of instant messaging (currently a Microsoft Skype for Business solution) for one (1) year for all OCC users (employees and contractors). The instant messaging journaling repositories have no storage limit. The Comptroller’s instant messaging shall have permanent retention.

c. Archival mailbox setup for each operational mailbox to allow users to easily drag-and-drop older email contents from the standard mailbox into the archive mailbox. The archival mailboxes have no retention time limit or size limit.

d. Compatibility with the OCC’s enterprise electronic document management system (currently an OpenText/eDOC solution) to allow easy drag-and-drop of emails into the document management system.

e. User-initiated importing of legacy PST files, via easy drag-and-drop techniques, into the new email solution standard or archive mailboxes. This will help to eliminate the use or need for PST files.

f. To comply with management directives, court orders, litigation hold, or Freedom of Information Act (FOIA) requests, this email solution shall provide built-in feature, or third party tool bundled with email solution, to conduct rapid and sophisticated full-text search and discovery (using industry best practice search techniques such as single or multiple compound words, phrases, or words proximity) of all OCC email repositories (including standard, archived, and/or journaling mailboxes). For email attachments in text format, support for keyword searches is required.

g. Apply industry best practices for storage optimization (such as compression and/or de-duplication at the hardware and/or application level) to reduce storage cost and increase access efficiency of all OCC email repositories.

h. Verify digitally signed emails and search for text in digitally signed, unencrypted emails

i. Support “chain of custody” reporting as part of the event logging and reporting feature(s) for searches executed against the central email archives.

a. Provide on-site support at OCC headquarters from 6 AM until 9 PM EST, Monday through Friday. The extended support hours are necessary to accommodate the OCC’s staff working outside the Eastern Time zone.

b. Provide on-call (off-site) support during off-duty hours, including weekends, holidays, or OCC HQ building closures.

c. Generate and update work progress for email-related requests or incidents using OCC-furnished ServiceNow accounts.

d. Use OCC-furnished Service Now accounts to accept and/or respond to email-related incidents and service requests routed via Service Now by the OCC Help Desk Tier-1 staff (call dispatch).

e. After help desk ticket assignment to the Email Operations Tier II and/or Ticket III work queue (process belonging to the Offeror’s Email Technical Support Services), the Offeror shall accept, resolve, and close those assigned ServiceNow incidents or service requests within two (2) hours for non-VIP users and 30 minutes for VIP users. (Please note: The OCC will supply the list of approximately 50 VIP users after contract award.)

f. Develop and implement escalation procedures for all email-related problems, incidents, and requests.

g. Develop knowledge-based articles to enhance Tier-1 problem-solving capabilities and reduce the administrative burden and dependency on Tier-2 and Tier-3 staff.

h. Provide training to OCC Tier-1 personnel for resolving frequently encountered email issues

i. If transition of email solution provider is required, the incoming provider shall perform knowledge transfer to observe, learn, document, and continue the best practices and lesson learned from the outgoing email service provider.

a. Apply commercial-off-the-shelf (or functionally equivalent) anti-malware, anti-SPAM, content-filtering capabilities and data loss prevention to block up to 99% of all incoming spam, adware, malware, and viruses.

b. Integrate with, and provide real-time feed to, the OCC Microsoft System Center Operations Manager (SCOM) and the OCC Security Information Event Management solution (SIEM, currently a McAfee solution) for triggered event reporting.

c. Apply best-practice techniques to ensure that attachments and hyperlinks are safe to open. At a minimum, this shall include sandbox and detonation chambers to safely open and/or dispose of malware without harming production operations.

d. Email hygiene services shall perform with the same operational availability as that of the email services (as defined in Section C.2.8).

a) All email, calendar, and directory data at rest on email servers such that email contents are not stored in plain text and can only be accessed by authorized users in plain text after decryption, and

b) End-to-end transmission of all email data in motion such that email contents are not transmitted in plain text

a. Support two-factor authentication utilizing user ID, password, and an RSA timed token generating random-digit login codes (“something you have”) that are combined with a user-selected PIN (“something you know”) for login

b. Support two-factor authentication utilizing a HSPD-12 compliant, PIV-card digital certificate and user-selected PIN for login

c. Support two-factor authentication utilizing an OCC user certificate (i.e., a soft certificate derived from the PIV card) and a user-selected PIN for login

d. Support SAML assertions with the OCC as the identified provider to exchange user access trusts with external or cloud-based solutions.

a. Immediate response to user-reported or system-detected email security incidents, and reporting to the OCC Cyber Security Operations Point of Contact within one (1) hour after receipt of such incidents.

b. Provide scheduled and on-demand security status reporting with data search and retrieval capabilities for event-specific reports.