CORHQ-25-Q-0392.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-25-Q-0392

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section C - Description/Specifications/Work Statement

Attachments for this section start after this page.

Section C - Description/Specifications/Work Statement PAGE 3 OF 13

1 8/13/2025

FDIC

Federal Deposit Insurance Corporation Division of Information Technology

Request for Information - Device as a Service

“THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This request for information does not commit the Government to contract for any supply or service whatsoever. Further, the FDIC is not seeking proposals at this time and will not accept unsolicited proposals. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.”

PLEASE DO NOT SUBMIT ANY PRICING INFORMATION.

1. Purpose

The Federal Deposit Insurance Corporation (FDIC) requests information related to the evolution of its current Device as a Service (DaaS) approach. The FDIC released a DaaS RFI in 2021 and awarded a DaaS contract in June 2023 to provide laptops and device management services to the FDIC employees and contractors. The FDIC desires information and descriptions of the potential services provided under a DaaS model, service components ranging from basic to complex services, and various tiers and levels of service.

The goal of this RFI is to provide market research on recommended capabilities and innovative approaches for the FDIC to leverage should a DaaS model continue to be utilized. A key consideration is the FDIC’s desire to avoid budget spikes necessitated by periodic replacement of large numbers of devices. It is the FDIC’s desire to implement a technical refresh strategy over a multi-year contract that eliminates such budget spikes and delivers technology refreshes as needed under a relatively stable, predictable spending pattern. FDIC is also considering a hardware-only strategy, as well as a services-only strategy, with hardware being procured from a Government-Wide Acquisition Contract or GSA schedule. Upon receiving the responses to the RFIs, FDIC will review the information to understand the market space, capabilities and levels of service available, to help shape our requirements and acquisition approach.

In addition to this RFI, the FDIC may conduct additional market research engagements. The need and use of these additional market research engagements will be determined at the sole discretion of the

FDIC.

2. Background

The FDIC preserves and promotes public confidence in the U.S. financial system by insuring deposits in banks and thrift institutions for at least $250,000; by identifying, monitoring and addressing risks to the deposit insurance funds; and by limiting the effect on the economy and the

Section C - Description/Specifications/Work Statement PAGE 4 OF 13

2 8/13/2025 financial system when a bank or thrift institution fails.

The FDIC has approximately 8,500 employees and contractors who are highly mobile, in locations throughout the United States. FDIC employees and assets reside at the headquarters office in Washington, D.C. and Arlington, VA; and six regional offices in Atlanta, Chicago, Dallas, Kansas City, New York and San Francisco. The FDIC also operates 82 field offices in cities throughout the continental United States and Puerto Rico. Additionally, FDIC has a small number of remote workers.

The FDIC currently has more than 8,000 laptops and tablets, including general computing and special-purpose devices. We use Microsoft Intune to deploy the workstation image, including all applications.

For more information on current FDIC device usage, see Attachment 1.

4. DaaS Objectives

The FDIC is requesting information to implement a new, a multi-year, multi-refresh (between four and eight years) contract that provides optimum value for end-user devices. A contract could include device management services only with devices purchased separately, device leasing plus device management services, or devices only. FDIC is considering the following approaches, scope areas, and objectives for inclusion in a future DaaS acquisition.

a. Acquisition Approach

i. Sources of supply for DaaS services

ii. Contract type

1. BOA with Task Orders

2. IDIQ

3. Single award contract

4. Other

iii. Objectives

1. Devices

a. Lease

b. Buy

c. Devices procured under a separate contract (i.e., GSA)

2. Services

a. No services (hardware only)

b. Select services (components of Section C below)

c. Full lifecycle (all non-duplicative services in Section C below)

d. Bundled services (services as a package)

e. A la carte (select services for different groups of devices)

iv. Drivers of performance objectives

1. SLAs

2. Penalties

3. Incentives

Section C - Description/Specifications/Work Statement PAGE 5 OF 13

3 8/13/2025

b. Devices

i. Device types, including Laptops, Desktops and Tablets

ii. Custom devices vs. Standard devices

iii. Special-purpose devices (small quantities)

iv. Peripherals

1. Standard

2. Special purpose

v. Loaner and Travel devices

c. Scope of Services

i. Engineering services and timeline

1. Image Customization

2. In-Factory Configuration

3. Cloud Provisioning

4. Pre-installation of standard FDIC image and/or integration with Microsoft

Intune, Autopilot (or other) solution for automated deployment

ii. Device management services

1. Asset tagging

2. Logistics/Shipping and delivery of devices to FDIC locations and end users

3. Deployment of devices to end users

4. Ongoing device management and patching

5. Endpoint security

6. Warranty coverage

7. Refresh/device swap

8. Install/Move/Add/Change

9. Break/fix support and device replacement

10. Asset deinstallation

11. Collect and return devices at end of life/end of contract

12. Device disposal/recycling

13. Hard drive replacement and sanitization

14. Media protection

15. Inventory options

a. Surge requirements

b. Reduction in required quantity (leased devices)

c. Mitigate supply chain interruptions and price fluctuations

d. Model upgrades

e. Vendor-managed inventory

16. Dynamic reporting for asset and inventory management

a. Integrate with the FDIC’s Information Technology Service

Management system

b. Stand-alone portal

17. Refresh

a. Enable device delivery and refresh to occur in an FDIC office or at

Section C - Description/Specifications/Work Statement PAGE 6 OF 13

4 8/13/2025 an alternate worksite

b. Refresh services provided and involvement of FDIC personnel in the refresh process

d. Transition

i. Recommended transition time or overlap (if any) of existing DaaS contract and new DaaS contract

ii. Lessons learned and key risks in transition

e. Cybersecurity

i. Approach to handling evolving federal cybersecurity requirements

ii. Ability to integrate with the FDIC’s current security stack

5. RFI Response Requirements In the context of the above list, please respond to the following questions for responders.

Questions on the RFI are due no later than 10:00 AM ET August 25, 2025 and responses to the RFI are due no later than 10:00 AM ET September 17, 2025. All questions and responses shall be emailed to the Contracting Officer: Ellisha Smith (ellismith@FDIC.gov). All submitters will receive a confirmation email within 72 hours. If you do not receive a confirmation email, please follow up with the Contracting Officer.

Please note this is not a Request for Proposal (RFP) and any response provided will not be considered an offer; therefore, pricing information should not accompany responses to this RFI. If a decision is made to pursue an acquisition, information obtained through this RFI may be used to frame a future requirement. This request does not obligate the FDIC to issue a solicitation or RFP, to contract for products or services, or to guarantee inclusion of your firm in any potential solicitation list.

The FDIC is not liable for any costs that might be incurred or associated with the preparation of responses. All submissions made in response to the FDIC’s market research will be protected and properly disposed of after a potential solicitation list is established.

It is highly encouraged that concise responses are provided and contain no extraneous information (e.g., marketing material) or any “Background Information” and “Business Knowledge” sections.

Proprietary information, if any, should be minimized and must be clearly marked. Responses that do not address the specifics of this RFI will not be assessed.

RFI responses are limited to 12 pages measuring 8.5 by 11 inches with normal margins and a typeface no smaller than 12 point. Submit your response as a PDF file not exceeding 5MB in file size. The e-mail shall be titled “(insert Company Name) - FDIC Device as a Service RFI Response.”

Company Overview and Capabilities

• Provide company name, local contact mailing address, phone number, fax number, e-mail address of designated point of contact, and DUNS number.

• Provide address of your headquarters.

• Describe your company’s ability to provide the hardware and services described in this RFI.

Device as a Service Model

• Provide feedback, lessons learned and current industry best practices on the Acquisition

Section C - Description/Specifications/Work Statement PAGE 7 OF 13 mailto:hgroves@FDIC.gov

5 8/13/2025

Approach topics listed above to help inform FDIC’s acquisition planning for DaaS services.

• Describe what CLIN structure and pricing arrangement (e.g., Firm Fixed Price, Time &

Materials, Cost Plus Fixed Fee, Cost Plus Incentive Fee, Hybrid, or others) is preferable for implementation of the range of services and products described in this RFI.

• Describe options for the Device categories listed above to address a wide range of standard and custom computing needs.

• For the Scope of Services listed above, describe the spectrum or tiers of service available for the scope areas, from the least amount of service available (hardware only) to the most (full lifecycle device support) and a basic description of what is included. Without providing a price, characterize the relative cost of different service amounts/options.

• Provide feedback on the Transition topics above and describe important milestones in your company’s approach to delivery of end-user computing products and services.

• What is a typical timeline to transition into the services listed in this RFI for a similar footprint of devices (~8,500)?

• Describe how your company integrates with existing customer operations that follow an ITIL 4 framework to provide break/fix and device-related tier 2 and tier 3 support. Describe how your company’s DaaS offering incorporates the principles and modern approaches of an ITIL 4 framework.

• Describe how your company meets specific customer operational requirements, including asset management, shipping vendors, inventory volumes, etc. List the operational aspects that your company can modify to align with customer needs. Are there any operational aspects of your service that are not flexible?

• Describe innovative concepts and approaches your company can/does provide that increase the efficiency and/or effectiveness of device and service offerings.

• Describe risks and issues encountered with Federal implementations of your DaaS capability. Briefly describe mitigation actions taken.

• Describe typical Service Level Agreements utilized to manage and monitor performance of DaaS implementations, and any other effective mechanisms to ensure performance.

• What emergency, disaster recovery, supply chain resilience, and cost containment capabilities are included as part of your model to mitigate the effects of external events (e.g.

natural disasters, supply chain issues, pandemics, etc.) that may hinder your ability to meet contract performance requirements?

Existing Federal Implementations of DaaS

• Provide a list of Federal contracts where you are currently providing end-user devices and services and identify which capabilities you provide.

• Provide a customer Point of Contact with whom FDIC can engage to discuss the implementation of your DaaS capabilities in a Federal environment.

• Provide a client POC who can speak authoritatively on the Government’s approach to implement cybersecurity requirements on your DaaS model.

Supply Chain Risk Management

• Describe your company’s approach to meeting federal requirements for Supply Chain Risk

Management for your DaaS capabilities.

• Describe if your offering is Trade Agreements Act (TAA) compliant and aligns with the NDAA

2019 Section 889 A and B supply chain requirements.

Security Posture and Approach

Section C - Description/Specifications/Work Statement PAGE 8 OF 13

6 8/13/2025

• Provide feedback on the Cybersecurity topics above and note lessons learned and key risks.

• Identify if your DaaS offering completed a System Security Authorization process with one of your Federal clients where the client issued an Authority to Operate (ATO) covering the capabilities described above.

• For Federal Implementations, how do you comply with Information Security and Privacy requirements without affecting your DaaS offering/performance?

• For Federal Implementations, please identify the Federal Authorizing Official with whom the FDIC may discuss our operating environment.

APGM 2.105(e) Contractor Meetings and Product Demonstrations In order to obtain information about the goods and services in the commercial marketplace, the Program Office and Contracting Officer may:

(1) Conduct face-to-face meetings with contractors to discuss specific products and services to attain a better understanding of the available products and services;

(2) Have suppliers provide product demonstrations to better understand the functionality of the available products and services; and

(3) Have the contractor provide equipment, hardware, or software for testing or evaluation. The contractor and FDIC must sign a memorandum of understanding (MOU) before testing or evaluation. The Contracting Officer signs the document on behalf of FDIC. (See MOU template.) Legal review and approval of the MOU by the FDIC Contracts and Risk Management Unit (CRMU) is required, prior to signing, if the language is changed from how it appears in the template.

Section C - Description/Specifications/Work Statement PAGE 9 OF 13

7 8/13/2025

Attachment 1 – Current Environment

FDIC IT services are managed and provided by a mix of federal and contractor staff. DaaS hardware and some services are provided by an external vendor. Troubleshooting and end-user support are provided by federal staff and a contractor-provided service desk.

FDIC utilizes Microsoft Intune for endpoint and application management. This capability allows the FDIC to leverage Windows Autopilot to streamline the image setup of Windows devices. Intune is used to enforce modern security policies, deploy FDIC Division-specific applications, and maintain compliance across endpoints. Operating system patches are updated as part of Microsoft’s cumulative monthly patching requirements. Microsoft Active Directory is utilized for user and workstation authentication.

The FDIC corporate-ready image includes at a minimum:

• Microsoft Windows 11 Operating System with UEFI BIOS

• Microsoft Bitlocker

• Microsoft Defender

• CrowdStrike

• Microsoft Office 365 applications (Office, Teams, OneDrive, PowerApps)

• Microsoft Security Patches (most up to date)

• Palo Alto Global Protect VPN

• Smartcard software

In addition, the image contains a host of enterprise-wide applications (in-house and COTS) which are common to each user. The FDIC is made up of several divisions and as a result, the larger divisions utilize applications that are not utilized by others, therefore, the image using a GUI interface provides IT staff the ability to select the division of the end user of the workstation. Once the division is selected, during the initial image process, applications or menu links to applications for the selected division are then included in the build process.

The end user, upon receiving the new equipment, may add Limited Use Software (LUS) using Microsoft Company Portal. A standard workstation is configured so that the user does not have administrative rights to download and install software outside of the designed process.

FDIC uses Microsoft Active Directory for user and workstation authentication and intends to continue to use this directory service. Microsoft Intune, as previously described, is the tool that is used to deploy the image, including all applications. Microsoft Intune is the tool that is used to deploy the latest OS patches. The latest patches are then included in the image within 30 days.

Inventory controls are in place for managing the inventory of hardware throughout the FDIC. All equipment is tagged with an FDIC Asset Tag and uploaded into our Asset Management system.

Standard hand receipts are completed when equipment is assigned to the end user. These completed hand receipts are then uploaded into our Asset Management system. Verification of inventory is

Section C - Description/Specifications/Work Statement PAGE 10 OF 13

8 8/13/2025 performed annually to ensure compliance.

Internal policies and procedures are in place for managing hard drives. All deployed laptop hard drives must be encrypted. The FDIC has historically purchased the additional Hard Drive Warranty from the vendor to avoid returning inoperable hard drives to the vendor. The hard drives of departing employees are generally removed and held no less than 30 days, then are sanitized and can be re-purposed as needed. In some cases, hard drives are removed and placed on “Legal Hold” for an indefinite period.

Section C - Description/Specifications/Work Statement PAGE 11 OF 13

9 8/13/2025

Section C - Description/Specifications/Work Statement PAGE 12 OF 13

Section J - List of Attachments

The table below lists all of the attachments for Section J which start on the following page

Order of Appearance Name

Attachments C-1 Request for Information

No attachments were added for this section.

Section J - List of Attachments PAGE 13 OF 13

Section J - List of Attachments

DOA/ASB

3501 Fairfax Drive, E-4003 Arlington, VA 22226 ellismith@fdic.gov

(703) 562-6255 ellismith@fdic.gov

DOFAPInvoice@fdic.gov