DOI_Helpdesk_Remote_Assistance_RFI_1.pdf

DOI FY25 Enterprise Remote Assistance – RFI 26 MARCH2025

Request for Information (RFI) for Enterprise Remote Support Software

A. Introduction

The Department of Interior seeks a single solution for providing IT support operations with efficient, secure, and scalable remote support capabilities. This RFI aims to gain market capability information of COTS products that can provide interactive remote desktop support services, enabling IT professionals to remotely assist both attended and unattended laptops, workstations, and servers.

Please note that this Request for Information (RFI) is for informational purposes only, and no contract will be awarded as a result. A firm or organization’s response to the RFI —or lack thereof—will have no impact on the evaluation of responses to any subsequent Request for Proposals (RFP) or Invitation to Bid (ITB) released. Responses will be used solely for information and planning purposes.

Please note that all responses will be public record. Do not submit confidential information in your response.

B. Background

The U.S. Department of the Interior (DOI) consists of 11 bureaus. The U.S.

Geological Survey (USGS) implemented Bomgar, a remote desktop solution, in 2008. Bomgar was later acquired by BeyondTrust and is now known as BeyondTrust Remote Support (BTRS). USGS currently hosts the on-premises version of BTRS in Amazon Web Services (AWS), supporting multiple DOI bureaus, including USGS, Bureau of Land Management (BLM), Bureau of Ocean Energy Management (BOEM), Bureau of Safety and Environmental Enforcement (BSEE), Office and Natural Resource Revenue (ONRR), Bureau of Indian Affairs (BIA), DOI, and Office of Surface Mining Reclamation and Enforcement (OSMRE). The system is deployed across three servers (primary, warm backup, and test/upgrade) and has a total of 714 users, with 600 active in the last 30 days. The platform utilizes 160 concurrent licenses out of 254 available, with approximately 60,000 devices having the client installed.

DOI is in the process of migrating from an Active Directory/Microsoft Entra ID hybrid environment to a full Entra ID/Intune setup. Currently, most computers are Active Directory-joined, while newly configured devices are Entra ID-joined. This migration is expected to take several years. All standard user accounts are created in Active Directory and synchronized with Microsoft Entra ID.

DOI follows best practices for credential separation, maintaining distinct privileged accounts for Active Directory-joined and Entra ID-joined computers.

The primary authentication model relies on two-factor authentication via smartcards. Each IT professional uses a single smartcard to authenticate multiple accounts through the Password Hint field. If no specification is provided in the Password Hint, the default non-privileged account is used. The current solution also supports smartcard authentication credential passthrough from the support professional to the target computer. Since the target computer is doing the authentication, the password hint field is available and works.

C. Remote Support Solution Requirements

a. Mandatory Minimum Requirements

i. Interactive Remote Desktop Support for Windows and macOS

1. The solution must enable support professionals to remotely access and control Windows and macOS devices.

2. Remote access should include attended (user-present) and unattended (user-absent) support capabilities.

3. The solution should provide a seamless experience with minimal impact on system performance.

ii. Cross-Platform Support for Remote Assistance

1. Support professionals should be able to initiate remote sessions from either a Windows or macOS device.

2. The solution must be compatible with a wide range of operating system versions.

3. Functionality should include screen sharing, file transfer, and remote command execution where permitted.

iii. Authentication via DOI Microsoft Entra Security Assertion Markup Language (SAML)

1. Support professionals must authenticate using DOI’s Microsoft Entra SAML-based Single Sign-On (SSO).

2. This ensures secure identity verification, reducing the risk of unauthorized access.

3. The solution must integrate with DOI’s existing Microsoft Entra security policies.

iv. Privileged Account Requirement for Elevated Support Tasks

1. Support professionals must use their individual privileged accounts when performing tasks that require elevated permissions.

2. The solution should not allow shared privileged accounts, ensuring accountability and compliance with security policies.

v. Controlled Execution of Predefined Scripts

1. A limited number of pre-approved and controlled scripts may be executed with system-level privileges.

2. These scripts should be managed centrally to prevent unauthorized modifications.

3. Execution logs should be maintained for audit purposes.

vi. Smartcard or Entra ID-Supported Authentication to Target Systems

1. The solution must allow support professionals to pass their authentication credentials from their workstation to the target system.

2. Smartcard authentication is the preferred method, but the solution should also support other Microsoft Entra ID authentication methods.

vii. Basic Support for Devices Without a Required Client

1. The solution should allow limited support capabilities for devices that do not have a pre-installed client application.

2. This can include web-based remote access or temporary client deployment for ad-hoc support sessions.

viii. Federal Information Processing Standards (FIPS) Compliance

1. The solution must comply with FIPS 140-2 or higher to ensure data encryption and security requirements are met.

2. Compliance with U.S. government cryptographic standards is mandatory for data protection.

ix. FedRAMP Approval for SaaS Solutions

1. If the solution is cloud-based (Software-as-a-Service), it must be FedRAMP-approved.

2. This ensures compliance with federal security requirements for cloud services.

x. Logical Separation and Grouping of Bureau Devices

1. The solution must support logical separation of devices by bureau, ensuring support professionals only have access to authorized devices.

2. Access control policies should be enforced to prevent cross-bureau access unless explicitly authorized.

xi. Support for IPv4 and IPv6

1. The solution must support both IPv4 and IPv6 network protocols.

2. This ensures compatibility with modern network infrastructures and facilitates future-proofing.

xii. Availability of features must be configurable based on identified groups of people, preferably based on EntraID groups.

b. Optional Value Add Items

i. Interactive Remote Support for Linux, Android, and iOS

1. Linux: Full remote control for major distributions.

2. Android: Remote access, screen sharing, and diagnostics.

3. iOS: Screen sharing and guided troubleshooting within

Apple’s security limitations.

ii. File Transfer - Support professionals should be able to securely send and receive files during remote sessions with:

1. Bidirectional transfer and drag-and-drop functionality.

2. Permission controls to prevent unauthorized transfers.

3. Logging and auditing for compliance.

iii. Defined Scripts or Automation - The solution must allow the execution of pre-approved scripts to streamline support tasks, including:

1. System account execution for privileged operations.

2. Automation workflows for repetitive tasks.

3. Centralized management to ensure security and compliance.

iv. Customer Chat / Video Chat - Integrated communication tools may enable:

1. Real-time text chat during support sessions.

2. Optional voice and video calls for better troubleshooting.

3. Chat logs and file sharing for documentation and guidance.

D. Deliverables

The following deliverables will be provided:

a. Capabilities matrix – Document including identified requirements and other features not mentioned.

b. Software Implementation Plan – Document outlining how software can meet requirements, integration, and configuration details.

c. User Access & Security Configuration – Document explaining how Role-based access control is done.

d. Integration Report – Documentation of integrations with ITSM or other relevant systems.

e. Training Materials – User guides, FAQs, and recorded training sessions.

f. Features Gap – Documents explaining how any of the requirements are unreasonable and would prevent your company from bidding in this potential requirement. Also include any features the Government should be asking for and how it would benefit.

E. Submission Instructions

Vendors interested in providing a response for the Enterprise Helpdesk Remote

Support RFI must adhere to the following submission instructions to ensure their proposal is considered:

a. Proposal Format: All proposals must be submitted in PDF format using a standard font (e.g., Arial or Times New Roman) with a font size of 12 points. The proposal should not exceed 30 pages, excluding the cover page, table of contents, and appendices.

b. Required Components: The proposal must include the following sections:

i. Cover Letter: A brief cover letter introducing your company and summarizing your interest in this project.

ii. Company Overview: A description of your company, including capabilities, experience with remote support services, and any relevant certifications or partnerships.

iii. Technical Approach: A detailed explanation of your technical capabilities and suggestions of meeting the requirements.

iv. Pricing Structure: Pricing Structure Vendors must provide a transparent breakdown of pricing for all proposed offerings. Base this in 275 Concurrent Licenses or 600 named support professionals. Additionally, DOI is expected to have 110,000 devices being accessed.

v. Compliance Assurance: Describe how your services will meet regulatory and security compliance requirements.

vi. Submission Deadline: All proposals must be submitted by 5:00 PM PST on June 2, 2025. Late submissions will not be considered.

vii. Submission Method: Proposals must be submitted electronically via email to sdcox@usgs.gov with the subject line "Commodity Internet Service Proposal - [Your Company Name]."

viii. Questions and Clarifications: Any inquiries regarding this SOW should be directed to Scott Cox at sdcox@usgs.gov All questions must be submitted by May 23. 2025, and responses will be communicated via email to all interested vendors.