Attachment 5 - PWS Template.docx

Table of Contents

Volume I: IT Security Compliance < Volume 1 – Security Compliance > IT Security Compliance Assumptions and Constraints

(a) < assumption or constraint 1>

(b) < assumption or constraint 2> Federal IT Security Policies < Insert response> Common Security Configuration Certification < Insert response> Privacy < Insert response> Physical Security < Insert response> Information Assurance Reporting and Continuous Monitoring < Insert response> Information Security Compliance Questionnaire <The Offeror shall complete and return Attachment 4 – Information Security Compliance. Additional information should be inserted here as necessary.>

Volume II: Technical and Management Approach < Volume 2 – Technical and Management Approach > Section 1: Technical Approach < Insert Response > Technical Assumptions and Constraints

(a) < assumption or constraint 1>

(b) < assumption or constraint 2> Cloud Architecture < Insert Response > Network < Insert Response > Interoperability < Insert Response > Single-Sign-On (SOO) < Insert Response > Blackberry Enterprise Service (BES) - Cloud Services < Insert Response > Provisioning < Insert Response > Unified Communications < Insert Response > Features and Functions <The Offeror shall complete and return Attachment 2 – Features & Functions Matrix. Additional information should be inserted here as necessary.> User Migration < Insert Response > Transition-Out Strategy (Technical) < Insert Response >

Section 2: Management Approach Management Assumptions and Constraints <Include assumptions and constraints that are general to the management approach in this section. Project Phase Assumptions and Constraints shall be entered within the appropriate sections of 3.2.5> Assumptions and constraints for this task include the following:

1. <assumption/constraint specific to this task>

2. <assumption/constraint specific to this task> Corporate Stability/Capability < Insert response > Team Structure < Insert response > Key Personnel < Include the resume of the individual(s) identified as key personnel > Program Management, Change Management, Policy, Stakeholder Engagement and Strategic Communication Plan < Insert response> Migration Approach < Insert response> Transition-Out Strategy < Insert response > Project Phases (Tasks – Sub-Tasks) <Using the following outline as a guide, identify the Tasks/Sub-Tasks to be performed under the Contract that relate to each phase, and the goals to be achieved for each. To the extent possible, limit the description to what must be done or produced, and define the expected outputs or outcomes. Include the responsible party(ies) (i.e. Integrator, CSP, government) for each task/sub-task.> The following Tasks/Sub-Tasks will be performed under this Contract for each of the following phases (all dates are expressed in calendars days):

Phase I - Government’s Operational Readiness Testing (ORT) Phase II – Migration (Optional Task) Phase III - Steady-State Phase (Optional Task) Phase IV - Termination Phase (Optional Task) Period of Performance The base period of performance is for one year from contract award with six, one-year options.

Phase I: Government Operational Readiness Testing (ORT) < Using the following template structure, describe the activities related to ORT that meet the milestones stated in SOO. > Task 1: <Title of Task> The key objective(s) of this Task is to …<fill in key objectives together with a description of the task and an explanation of how the task outcomes will fulfill the stated objectives> Task 1 Assumptions and Constraints Assumptions and constraints for this task include the following:

1. <assumption/constraint specific to this task>

2. <assumption/constraint specific to this task> Task 1 Milestones Milestones for this Task are:

(Acceptance Criteria)

<X> days after Award.

<MM/DD/YY>

Task 1 Roles and Responsibilities Roles and Responsibilities for this Task are:

<Insert additional tasks and subtasks following the above format as necessary> Phase II: Migration (Optional) < Using the following template structure, describe the activities related to planning, implementing and migrating to the Cloud Services.> Task 1: <Title of Task> The key objective(s) of this Task is to …<fill in key objectives together with a description of the task and an explanation of how the task outcomes will fulfill the stated objectives> Task 1 Assumptions and Constraints Assumptions and constraints for this task include the following:

1. <assumption/constraint specific to this task>

2. <assumption/constraint specific to this task> Task 1 Milestones Milestones for this Task are:

<X> days after Award.

<MM/DD/YY>

Phase III: Steady-State Operations (Optional) Phase III is the full implementation and steady-state operations of the cloud-based email and collaboration services.

<As part of the steady state activities, address the activities and deliverables stated in Section 7.2 Information Assurance Reporting and Continuous Monitoring of the SOO.> Task 1: <Title of Task> The key objective(s) of this Task is to …<fill in key objectives together with a description of the task and an explanation of how the task outcomes will fulfill the stated objectives> Task 1 Assumptions and Constraints Assumptions and constraints for this task include the following:

1. <assumption/constraint specific to this task>

2. <assumption/constraint specific to this task> Task 1 Milestones Milestones for this Task are:

<X> days after Award.

<MM/DD/YY>

Phase IV: Termination (Optional) < Using the following template structure, describe the activities related to transitioning DOL out of the cloud services environment. > Task 1: <Title of Task> The key objective(s) of this Task is to …<fill in key objectives together with a description of the task and an explanation of how the task outcomes will fulfill the stated objectives> Task 1 Assumptions and Constraints Assumptions and constraints for this task include the following:

1. <assumption/constraint specific to this task>

2. <assumption/constraint specific to this task> Task 1 Milestones Milestones for this Task are:

<X> days after Award.

<MM/DD/YY>

Standard Support < Insert Response > Service Level Agreements (SLA) < Insert Response > Measuring SLA Performance < Insert Response > SLA Enforcement Mechanisms < Insert Response > Roles and Responsibilities < Insert Response > Service Management < Insert Response > Service Monitoring < Insert Response > Billing and Reporting < Insert Response > Conflict of Interest < Insert Response >

Section 3: Relevant Experience

Volume III: Past Performance

Volume IV: Price Price Assumptions and Constraints

(a) < assumption or constraint 1>

(b) < assumption or constraint 2> Price Proposal <The Offeror shall complete and return Attachment 1 – Pricing Tables. Additional information should be inserted here as necessary.> Price Supporting Documentation <Insert Response>

Volume V: Criminal Justice Information Services (CJIS) Division systems and OIG Compliance

Information Exchange <Insert Response> Security Awareness Training <Insert Response> Reporting Information Security Events <Insert Response> Auditable Events and Content (Information Systems) <Insert Response> Response to Audit Processing Failures <Insert Response> Audit Monitoring, Analysis, and Reporting <Insert Response> Time Stamps <Insert Response> Protection of Audit Information <Insert Response> Audit Record Retention <Insert Response> Account Management <Insert Response> Access Enforcement <Insert Response> Unsuccessful Login Attempts <Insert Response> System Use Notification <Insert Response> Session Lock <Insert Response> Remote Access <Insert Response> Wireless Access Restrictions <Insert Response> Identification and Authentication <Insert Response> Authentication Policy and Procedures <Insert Response> Identifier Management <Insert Response> Authenticator Management <Insert Response> Assertions <Insert Response> Configuration Management <Insert Response> Media Protection <Insert Response> System and Communications Protection and Information Integrity <Insert Response> Formal Audits

Volume VI: Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA) and BLS Compliance

Volume VII: Accessibility – Section 508 Compliance

Volume VIII: Additional Technical Services Application Integration < Insert response > Assumptions and Constraints < Insert response should the additional information be different than information presented in the technical response> Terms of Service (TOS) and Service Level Agreement (SLA) < Insert response should the additional information be different than information presented in the technical response > Roles and Responsibilities < Insert response should the additional information be different than information presented in the technical response > Information Security and Regulatory Compliance < address FISMA Moderate Level ATO and Data Locality should the system not reside in the ATO boundaries of the main offering> Government Furnished Resources and Equipment < For GFE include hardware/software requirements, and for DOL resources include role, level of effort, duration, and skills. > Mobility and Mobile Device Management < Insert response > Assumptions and Constraints < Insert response should the additional information be different than information presented in the technical response> Terms of Service (TOS) and Service Level Agreement (SLA) < Insert response should the additional information be different than information presented in the technical response > Roles and Responsibilities < Insert response should the additional information be different than information presented in the technical response > Information Security and Regulatory Compliance < address FISMA Moderate Level ATO and Data Locality should the system not reside in the ATO boundaries of the main offering> Government Furnished Resources and Equipment < For GFE include hardware/software requirements, and for DOL resources include role, level of effort, duration, and skills. > Device Plans and Wireless Service Plans < Insert response > Assumptions and Constraints < Insert response should the additional information be different than information presented in the technical response> Terms of Service (TOS) and Service Level Agreement (SLA) < Insert response should the additional information be different than information presented in the technical response > Roles and Responsibilities < Insert response should the additional information be different than information presented in the technical response > Information Security and Regulatory Compliance < address FISMA Moderate Level ATO and Data Locality should the system not reside in the ATO boundaries of the main offering> Government Furnished Resources and Equipment < For GFE include hardware/software requirements, and for DOL resources include role, level of effort, duration, and skills. > Content and Document Management < Insert response > Records Management < Insert response > Document Management < Insert response > Workflow < Insert response > Reporting < Insert response > Search < Insert response > People Management < Insert response > Security < Insert response > Internal and External Interfaces < Insert response > Assumptions and Constraints < Insert response should the additional information be different than information presented in the technical response> Terms of Service (TOS) and Service Level Agreement (SLA) < Insert response should the additional information be different than information presented in the technical response > Roles and Responsibilities < Insert response should the additional information be different than information presented in the technical response > Information Security and Regulatory Compliance < address FISMA Moderate Level ATO and Data Locality should the system not reside in the ATO boundaries of the main offering> Government Furnished Resources and Equipment < For GFE include hardware/software requirements, and for DOL resources include role, level of effort, duration, and skills. > Enhanced Support < Insert response > Assumptions and Constraints < Insert response should the additional information be different than information presented in the technical response> Terms of Service (TOS) and Service Level Agreement (SLA) < Insert response should the additional information be different than information presented in the technical response > Roles and Responsibilities < Insert response should the additional information be different than information presented in the technical response > Information Security and Regulatory Compliance < address FISMA Moderate Level ATO and Data Locality should the system not reside in the ATO boundaries of the main offering> Government Furnished Resources and Equipment < For GFE include hardware/software requirements, and for DOL resources include role, level of effort, duration, and skills. > Vendor Proposed Additional Services The following services are in addition to the base services offering. .

< Complete the following for each service offering > Service Offering: <Service Offering 1> < Insert response > Service Name and Description < Insert response > Assumptions and Constraints < Insert response > Terms of Service (TOS) and Service Level Agreement (SLA) < Insert response > Roles and Responsibilities < Insert response > Information Security and Regulatory Compliance < address FISMA Moderate Level ATO and Data Locality > Government Furnished Resources and Equipment < For GFE include hardware/software requirements, and for DOL resources include role, level of effort, duration, and skills. > Related CLIN < Identify the CLIN(s) associated with service offering. DO NOT INCLUDE PRICING INFORMATION – ONLY CLIN NUMBER>

Volume IX: CONTRACT INFORMATION VOLUME REQUIREMENTS < Insert response >