The file's text, extracted by GovTribe without its formatting.
RFP CC16HQR0001
Attachment 3: Requirements Traceability Matrix
Requirement Traceability Matrix (RTM) In the attached matrix, the key architecture requirements of the MDM solution are identified. To complete the RTM for submission as part of its quotation, the Offeror should identify in the Requirement Met? column whether its solution fully meets (F), partially meets (P), or does not meet (N) each requirement. For each requirement whose status is “P,” the Comments column should be used to describe any work-arounds that can be implemented to bridge the gap between the Offeror’s solution and the OCC’s requirement. If the Offeror wishes to provide additional information regarding why its solution does not meet a given requirement, the Comments column can also be completed for requirements whose status is “N.”
Table 1 Requirements Traceability Matrix
| ID |
| Requirement Description |
| Requirement Met? |
| Proposal Reference |
| Comments |
| C.1 |
| Email Service Performance Requirements |
| C.1.1 |
| Proposed solution shall utilize a private enclave cloud, federated private (e.g. Government Community) cloud, Government-leased facility, or any combination thereof, cloud infrastructure to host the OCC email service solution. |
| C.1.2 |
| Proposed solution shall be the latest production release of either Microsoft Exchange 2013 or Microsoft Office 365 email application software hosted within US-based cloud. infrastructure |
| C.1.3 |
| Proposed solution shall support a total of 6,000 (4,100 individual, 400 executive, and 1,500 shared) mailboxes, with approximately 5% growth in mailbox numbers each year. |
| C.1.4 |
| Proposed solution shall interface email service with OCC’s Active Directory 2008 directory service and event calendar services for all email users. (Please note: OCC has initiated efforts to upgrade from AD 2008 to AD 2012, tentatively planned for completion by mid-2016. The proposed email solution has to interface with either AD 2008 or AD 2012 directory service during email system implementation). |
| C.1.5 |
| The proposed solution shall provide mailbox size of at least five (5) GB for individual, ten (10) GB for executive, and sixteen (16) GB for shared mailboxes, with the ability for the email service provider to rapidly adjust mailbox size limits as needed; |
| C.1.6 |
| Proposed solution shall accommodate typical and anticipated weekly volumes of: 690,000 internal emails (OCC users sending to OCC users, within OCC enterprise network), 450,000 outbound emails (OCC users sending to Recipients residing outside of OCC enterprise network), 25,000 inbound emails (OCC users receiving from Senders residing outside of OCC enterprise network); and all messaging volumes are anticipated to steadily increase by 5% each year, but could also vary by +/- 25% occasionally depending upon local or national events. |
| C.1.7 |
| Proposed solution shall provide built-in tools or to measure and report to OCC the availability of proposed email services. |
| C.1.8 |
| Proposed enterprise email solution shall have 99.99% up time with no service disruption and outages for hosted services and Offeror’s managed services over period of performance of this contract, 24 hours a day, 365 days a year. |
| C.1.9 |
| Proposed enterprise email solution shall have a full redundancy capability, and load balancing at the primary proposed data center and full failover capability to the proposed Disaster Recovery (DR) data center. The proposed enterprise email solution shall have real-time replication between primary and DR sites to support OCC-required email services and its availability. |
| C.1.10 |
| Proposed solution shall provide a set of industry best practice benchmarks, as well as built-in tools or techniques, to measure and report to OCC that the average response time for new email system functions on OCC user devices (desktop, laptops, or mobile devices) meets or exceeds current OCC email service performances as stated in previous section on “Current OCC Email Services.” |
| C.1.11 |
| Proposed solution shall provide rapid and elastic capacity to add/delete/change/accommodate mailbox accounts, directory data, storage size, and email volume swings. |
| C.1.12 |
| Proposed solution shall provide email access for OCC users logging remotely into the OCC network from outside of OCC facilities using cisco Virtual Private Network (VPN) client on OCC issued laptop, Citrix XenDesktop XenApps, Outlook Web Access (OWA), and/or equivalent products. |
| C.1.13 |
| Proposed solution shall support on-line fax send/receive using eFAX and NET SatisFAXtion server, or functionally equivalent alternative. The eFax servers and telecommunications fax lines are provided as Government Furnished Equipment (GFE) hosted at the OCC own data center |
| C.1.14 |
| Proposed solution shall provide support for over 3000 mobile devices such as Android and iOS accessing email, event calendaring, and directory services using Exchange ActiveSync connections. |
| C.1.15 |
| Proposed solution shall provide SMTP (Simple Mail Transport Protocol) mail relay services for application alerts or notifications generated by 300 scanners (mutlti-functional devices) and approximately 100 of the 1,000+ application servers. The server and scanner population has an approximate 5% annual growth rate; |
| C.1.16 |
| Proposed solution shall provide continuous monitoring using automated central operations monitoring application such as Microsoft System Center Operations Manager (SCOM) to capture, record, analyze, and report the “snap shot” as well as “trend over time” of the following system health and performance status: Number of email users logged on; Messages received and Message sent per second; Mailbox delivery queue size; Mailbox, Client Access, Hub Transport, and Edge servers health and utilization; LDAP search time; Average sent latency; and Average receive latency. |
| C.1.17 |
| Proposed solution shall perform email data backup and archiving to comply with prevailing policy of weekly full and daily incremental backups for all mailbox contents. |
| C.1.18 |
| Proposed solution shall perform centralized email archiving and journaling for all OCC employees, contractors, and shared mailboxes. The solution shall include Exchange emails and Instant Messaging such Microsoft Lync (Skype) archiving and journaling. . |
| C.1.19 |
| Proposed solution shall provide 24 x 7 enterprise email Tier 2 (Call Triage) and Tier 3 (Email Subject Matter Expert) operations support and customer services. accept and respond to email-related service request via telephone, fax, email, or text messages from OCC Customer Service Tier 1 or Tier 2; OCC Tier 1 Help Desk (Call Dispatch) send via ServiceNow tickets/requests with two (2) hours for non-VIP and 30 minutes for VIP users. The OCC will supply the VIP Users List. |
| C.1.20 |
| The Offeror shall propose a best practice method to coordinate and communicate with the OCC Change Management process for change proposal, risk impact assessment, advance notification, and progress tracking. |
| C.2 |
| Information Security and Disaster Recovery Performance |
| C.2.1.a |
| Proposed email solution shall apply commercially-off-the-shelf email hygiene to include anti-malware, anti-SPAM, and content-filtering systems blocking up to 99% of all incoming spam and viruses. |
| C.2.1.b |
| Proposed email solution shall apply known techniques to ensure that attachments and hyperlinks are safe to open. |
| C.2.2 |
| Proposed solution shall provide secure email transmissions using ZixMail and Transport Layer Security (TLS). OCC currently use ZIX mail appliance for encrypting outgoing emails. Using ZIX mail encryption is built-in in Outlook and is optional. The Transport Layer Security (TLS) provide alternate email encryptions capability. TLS is primarily used for selected banks secure email communications. Now there are 30 TLS connections in productions. TLS expected to growth by 20% per year. |
| C.2.3 |
| Proposed solution shall apply NIST-compliant encryption, at a minimum AES 256-bit or stronger, to protect all email, calendar, and directory data at rest, as well as end-to-end transmission of all email traffic to and from OCC mailbox users. |
| C.2.4 |
| Proposed solution shall provide user authentication for single sign-on using one-factor and/or two-factor login: (a) Support one-factor authentication using user ID with password; (b) Support two factor authentication using User ID, password, RSA Timed Token generating random digit login code (“something you have”) that is combined with a user-selected PIN for remote login (“something you know”); and (c) Support two-factor authentication using PIV-card digital certificate when OCC implements HSPD-12 PIV-card (“something you have”) and user-selected PIN (“something you know”) for logical access in late 2016. |
| C.2.5 |
| Proposed solution shall provide sufficient network connectivity and internal resource allocation to accommodate the mandatory federal requirement of routing all inbound and outbound emails and web access through Government’s Trusted Internet Connections (TIC). |
| C.2.6.a |
| Email service solution shall contain built-in redundancy, load balancing, and disaster recovery capability and be capable to automatically recover from unplanned email resource outage to furnish an overall uninterrupted email, calendar, and directory services for OCC email service users. |
| C.2.6.b |
| Email service solution provider shall comply with OCC’s annual system certification and accreditation requirements by furnishing up-to-date artifacts demonstrating current system disaster recovery capability. |
| C.2.7 |
| Proposed solution shall provide Email Security Incident Reporting: Immediate reporting of user-reported or system-detected email security incident to OCC Cyber Security Operations POC; and Provide regular or ad-hoc security status reporting, including the capability to produce event-specific search, retrieval, and reporting. |
| C.3 |
| Implementation Performance Requirements |
| C.3.1 |
| Offeror shall develop and deliver a low-risk “OCC Enterprise Email Implementation and Migration Project Plan” consisting of, but not limited to, the following work breakdown structure, schedule, and resource loading to reach critical milestones: (a) Deliver email performance measurement tools or techniques; (b) Deliver 200-user Pilot Test Plan and phase-gate criteria; (c) Deliver full function, operation-ready email system and begin Pilot testing; (d) Complete Pilot Test Issues; (e) Resolve Pilot Test Issues; (f) Deliver full function email system ready for ATO Conduct C&A and Resolve POAM Issues;certification; (g) Obtain ATO; (h) Complete mailbox setup and content migration; and (i) Begin production operation. |
| C.3.2 |
| Offeror shall conduct a 200-user Pilot Test that will demonstrate successful operation of: (a) Migration of 200 pilot users mailbox from Exchange 2010, or Exchange 2013, to the proposed hosted solution; (b) Pilot users access to their mailbox, PSTs, and Public Folders without loss of data; (c) Mail flow send and receive of internal and external email including secure mails, incoming, and outgoing emails with various attachment sizes; (d) Access and use calendaring and public folders; (e) Synchronization with mobile devices; (f) Application of email hygiene protection; (g) Coordination of Offeror’s Tier 2 Email Call Triage and Tier 3 Email Subject Matter Expert customer service with the OCC Tier 1 IT Customer Service; and (h) Successfully pass or resolve other Pilot Test phase-gate criteria such as system performance tuning and configuration adjustments to maximize performance. |
| C.3.3 |
| Offeror shall deliver all of the other solution milestones indicated in the deliverable “OCC Enterprise Email Implementation and Migration Project Plan”. |
| C.3.4 |
| Offeror shall migrate all existing Exchange 2010, or Exchange 2013, individual, executive, and shared mailbox content, directory, PST files on shared or local hard drives, and calendar content to the new email solution without any service interruptions. |
| C.3.5 |
| Offeror shall migrate all journal mailboxes from the Exchange 2010, or Exchange 2013, mailbox servers to the purposed hosted solution. OCC currently has approximately 400 journal mailboxes, each is 50 GB. |
| C.3.6 |
| After obtaining OCC-issued ATO, the Offeror shall commence full-scale production email operations, as well as Tier 2 Email Call Triage and Tier 3 email subject matter expert support in collaboration with the OCC existing Tier 1 and customer service. |
| C.4 |
| Certification & Accreditation Requirements |
| C.4.1 |
| At the time of bid submission, the offeror must provide proof of having obtained one of the following Federal Risk and Risk Authorization Management Program (FedRAMP) compliant security certifications for the Infrastructure component (such as data center and internet connectivity) to be used for the proposed email solution: (a) Joint Authorization Board (JAB)-issued Provisional FedRAMP Authorization; (b) Agency-issued FedRAMP Authorization; or (c) Agency-issued Authority To Operate based on completion of FISMA Moderate System Certification and Accreditation process. |
| C.4.2 |
| At the time of bid submission, the offeror shall, if available, provide proof of having obtained one of the following Federal Risk and Risk Authorization Management Program (FedRAMP) compliant security certifications for the Email Application Software component (such as Exchange 2013 or Microsoft Office 365 application software) to be used for the proposed email solution: (a) Joint Authorization Board (JAB)-issued Provisional FedRAMP Authorization; (b) Agency-issued FedRAMP Authorization; or (c) Agency-issued Authority To Operate based on completion of FISMA Moderate System Certification and Accreditation process. |
| C.4.3 |
| If the offeror has certification for the proposed infrastructure component certification but does not, or not yet, have certification for the proposed email application software component, then the offeror must provide written assurance that the entire proposed email solution will receive FedRAMP or ATO within 120 calendar days after contract signing. The Offeror shall agree to forfeit 120 days of contract award fees if the proposed email application software cannot receive FedRAMP or ATO certification within the promised timeframe. |
| C.4.4 |
| Offeror shall cooperate with OCC security compliance staff to conduct email system certification and accreditation to obtain OCC-issued Authority To Operate (ATO) leveraging upon any existing FedRAMP and/or Agency-issued certification, prior to commencing production and intake of live production email data traffic. Table 1 below shows the OCC ATO process and timeframe; anda. |
| C.4.5 |
| Offeror shall hire a GSA FedRAMP PMO-approved Third Party Assessment Organization (3PAO) to: (a) Verify Offeror’ s FedRAMP and/or ATO certification artifacts; (b) Work with OCC to identify OCC-designated security controls; (c ) Conduct gap analysis and risk assessment of the entire proposed email solution against OCC-designated security controls; (d) Produce Plan Of Action and Milestones (POAMs); (e) Coordinate, track, and report Offeror’s progress to resolve all POAMs; and (f) Assist the offeror to obtain OCC-issued ATO. |