Draft CBOSS 2.0 Master Scope of Work 9_1_2023.pdf

CUI//SP-PROCURE

Controlled by: The U.S. Department of Energy (301) 903-3455

U.S. Department of Energy

CIO Business Operations Support Services (CBOSS)

Blanket Purchase Agreement

Master Scope of Work

1000 Independence Avenue, SW

Washington D.C. 20585

Table of Contents

Table of Contents

Section C: Blanket Purchase Agreement (BPA) Scope of Work

C-1. Background

C-1.1 General

C-1.2 Enterprise-wide Collaboration and Solutions

C-1.3 Partnering Philosophy

C-2. Objectives

C-2.1 Cloud-Based Services

C-2.2 Cybersecurity

C-2.3 Customer-Centric Solutions

C-3. Scope

C-3.1 Shared Services

C-3.1.1 Managed Seat Services

C-3.1.2 Managed Print Services

C-3.1.3 Collaboration Services

C-3.1.4 UC Web or Video Teleconferencing

C-3.1.5 UC Voice

C-3.1.6 Web Conferencing

C-3.1.7 Service Desk

C-3.1.8 Networking

C-3.1.9 Infrastructure Services

C-3.1.10 Security Operations Support

C-3.1.11 Identity, Credential, and Access Management (ICAM)

C-3.1.12 Secure Information Messaging

C-3.2 General IT Support Services

C-3.2.1 Program Management

C-3.2.2 Project Management Support

C-3.2.3 Direct Materials Purchasing Support

C-3.2.4 Software and Hardware Asset Management Support

C-3.2.5 Legacy Support

C-3.2.6 Mainframe Support

C-3.2.7 Enterprise Architecture Support

C-3.2.8 Infrastructure Modernization

C-3.2.9 Technology Migration Planning

C-3.2.10 Solutions Planning

C-3.2.11 Data Center Optimization

C-3.2.12 DevOps Support

C-3.2.13 Software Development and Maintenance Support

C-3.2.14 Software Testing Support

C-3.2.15 Security Assessment and Authorization (A&A) Support

C-3.2.16 Continuity of Operations and Emergency Management Support

C-3.2.17 DOE-AWARe Operations and Maintenance Support

C-3.2.18 Website Development

C-3.2.19 Systems Engineering Support

C-3.2.20 Systems Integration Support

C-3.2.21 Database Administration

C-3.2.22 End User Training

C-3.3 Telecommunications

C-3.3.1 Audio Conferencing

C-3.3.2 Mobile Communications Services

C-3.3.3 Mobile Devices

C-3.4 Cybersecurity

C-3.4.1 Cybersecurity Strategy and Program Management Support

C-3.4.2 Federal Cybersecurity Initiatives

C-3.4.3 High Value Asset Program Support

C-3.4.4 Cyber Risk Management Support

C-3.4.5 Information Assurance

C-3.4.6 Information Security Continuous Monitoring

C-3.4.7 Supply Chain Risk Management Support

C-3.4.8 Cybersecurity Awareness and Training Support

C-3.4.9 Cybersecurity Analysis and Reporting Support

C-3.4.10 Department Cybersecurity Operations

C-3.4.11 Cybersecurity Automation Support

C-3.4.12 iJC3 Unclassified Situational Awareness

C-3.4.13 Enterprise Assurance Incident Response Team

C-3.4.14 Headquarters Network Security Team

C-3.5 Technology Strategy and Innovation

C-3.5.1 Readiness Analysis

C-3.5.2 Business Process Engineering/Strategy

C-3.5.3 Customer Innovations

C-3.5.4 Requirement Analysis Support

C-3.5.5 Special Studies

C-3.5.6 Data Analytics & Insights

C-3.5.7 Change Management

C-3.5.8 Digital Strategy

C-3.5.9 Human-Centered Discovery

C-3.5.10 Ideal State Roadmap

C-3.5.11 Future Vision Strategy

C-3.5.12 UX/UI Design

C-3.5.13 Rapid Prototyping

C-4. General Requirements

C-4.1 Key Personnel

C-4.2 Transition Management

C-4.3 Subcontractor Management

C-4.4 Subcontractor Information Security Services

C-4.5 Onsite and Offsite Support

C-4.6 Identification of Contractor Employees

C-4.7 Work Integration Management

C-4.8 Quality Assurance

C-4.9 Quality Standards

C-4.10 Financial Management

C-4.11 Staff Time Tracking and Reporting

C-4.12 Contractor Upkeep and Training Requirements

Section C: Blanket Purchase Agreement (BPA) Scope of Work

C-1. Background

C-0.0 General

The U.S. Department of Energy’s (DOE) mission spans a diverse range of portfolios across the enterprise ranging from nuclear security, open science research, power administration, to environmental management. This enterprise comprises 97 entities - spread across 27 states - divided among 10 Program Offices, 19 Staff Offices, 4 Power Marketing Administrations, 19 Field Sites, 17 National Laboratories, and 4 Technology Centers - each uniquely structured to perform distinct missions.

This BPA, CIO Business Operations Support Services (CBOSS), will encompass a substantial part of the Information Technology Support Services (ITSS) acquisition for DOE. CBOSS offers support services in five

(5) areas:

Shared Services

General IT Support Services

Telecommunications

Cybersecurity

Analysis and Studies

Each represents a general category of services. This structure is provided to broadly define the scope of potential BPA Orders to be issued under the BPA.

This BPA provides a flexible ordering mechanism that any entity within DOE may use to create a customized BPA Order to fulfill their requirements, regardless of the area in which those requirements are grouped in this Master Scope of Work. By utilizing this BPA, the DOE will gain heightened awareness and visibility of IT services spanning across the agency. This enhanced awareness empowers the government to strategically optimize IT operations, drive down costs through the utilization of economies of scale, promote standardizations, and eliminate redundancies. Each BPA Order comprises a Performance Work Statement (PWS), Statement of Work (SOW), or Statement of Objectives (SOO) and a Quality Assurance Surveillance Plan (QASP) that together will define specific performance standards, Service Level Agreements (SLAs), and Operational Level Agreements (OLAs). The Government reserves the right to procure similar services from other sources during the performance of this BPA.

C-0.1 Enterprise-wide Collaboration and Solutions

To meet the challenges of the rapidly evolving cyber landscape, DOE has crafted a comprehensive cyber and service strategy aimed at cloud-based, fully managed, enterprise level service offerings that enhance security, accessibility, accountability, and transparency. The contractor will be required to assist DOE’s

Office of the CIO (OCIO) in assessing current states, defining goal states, and developing implementation plans across the entire spectrum of IT functions, products and services. This requirement will also include supporting the OCIO in analyzing and developing responses to directives and guidance from Federal organizations outside DOE (e.g., OMB, OFPP, etc.). The contractor will be required to utilize a traditional or nontraditional platform like ITIL.

Therefore, DOE anticipates the Contractor to actively solicit opinions/data from and collaborate with the DOE enterprise including field sites, National Laboratory personnel, Power Administration personnel, and other relevant DOE stakeholders in the development and execution of service solutions. The Contractor may be required to work directly with National Laboratory personnel within Integrated Project Teams (IPTs) as enterprise-wide IT solutions are developed, tested, and implemented.

C-0.2 Partnering Philosophy

DOE’s OCIO desires to develop an open and strong working relationship with a contractor to perform a systems integration role based on a shared vision and purpose. Therefore, the primary objective of the CBOSS BPA is to create a strategic “partnership” between the Government and the Contractor. DOE intends to structure this BPA in such a manner that ensures that the Contractor’s goals and objectives are in alignment with those of DOE, while concurrently upholding the Enterprise’s best interest throughout the entirety of the engagement. Superior performance on the Contractor’s part will directly influence superior mission accomplishment on the Government’s part through the economic and efficient use of information technology. Within the context of the Government/Contractor partnership, the terms “partner” and “partnership” are not intended as legal terms. The Government/Contractor partnership will reflect the attributes of a transparent, collaborative, outcome-oriented, and professional relationship.

DOE anticipates the Contractor to use best practices, lessons learned, and past experiences to act as a guide in all specified and implied actions incumbent within every BPA Order, project, initiative, and task assigned to the Contractor.

C-2. Objectives

Part of DOE headquarters (HQ) operations, the DOE Office of the Chief Information Officer (OCIO) is the primary user of the CBOSS BPA. OCIO comprises several divisions and offices, each of which manages different aspects of the IT lifecycle within a Cabinet-level agency. CBOSS provides the OCIO the means to outsource these services, including all requisite enabling services, to a qualified service provider. The OCIO provides a substantial portion of these services to Enterprise customers using a cost-recovery model and must therefore maintain accurate cost-tracking when outsourcing these IT services.

The CBOSS BPA includes requirements to migrate customers from a legacy IT environment to a future environment. As an example, Energy Information Technology Services (EITS), the branded name for services provisioned through the OCIO’s Enterprise Operations and Shared Services office, intends to continue to move from an on-premises, contractor support labor-intensive IT environment to commercially available, FedRAMP authorized, off-premises, cloud-based, where appropriate, fully managed services. The CBOSS

BPA provides the framework and structure to continue this migration and make other technology improvements possible.

Executive leadership has identified critical performance objectives the Contractor shall address in order to provide a level of service that satisfies DOE’s vision in the following areas:

Maximize use of cloud-based services

Enhance cybersecurity posture

Solutions designed to optimize the overall Customer Experience.

Enterprise-level service offerings

DOE anticipates the Contractor to support increases in user capacity, improvements in IT flexibility, and an overall reduction of redundant infrastructure and commodity services, while simultaneously strengthening the overall security of DOE’s IT environment.

C-2.1 Cloud-Based Services

The DOE OCIO intends to continue to migrate DOE from an on-premises, contractor-intensive service model to a comprehensive, cloud-based, managed services IT service(s) model based heavily upon commercially available, FedRAMP authorized, products and services.

This migration is defined by the following objectives:

DOE IT solutions should emphasize a preventative approach to operations and maintenance by shifting from an on premise, DOE-owned-and-operated services model, to an outsourced fee-for-service model.

In order to take advantage of economies of scale, DOE requires a partner able to implement commercially available, scalable, managed solutions that satisfy the needs of stakeholders throughout the DOE enterprise through a thorough understanding of those stakeholders’ missions and use cases/personas.

DOE requires that the Contractor respond to the needs of customers with IT service delivery of consistently high quality, demonstrated through mutually agreed upon published SLAs, & KPIs.

DOE requires that the Contractor be accountable for the services, processes, standards, and tools it supports.

Standardize the DOE polycloud offering to include automation of account provisioning and assignment of resources to DOE customers.

Meet the over-arching goals of the “Report to the President on Federal IT Modernization” (draft), dated 2017 (see Attachment L: Reference Library)

The intended migration and on-going maintenance shall occur steadily from the point at which the Contractor adopts the complete management of as-is IT services upon issuance of the initial BPA Orders and pursues methods for moving each service to a managed services model according to a well-defined plan.

Migration planning will be proposed by the Contractor and approved by the Federal Government at the BPA Order level.

The proposed migration shall be scalable, implementing solutions capable of meeting the needs of stakeholders throughout the Enterprise, allowing DOE replacement of duplicative owned-and-operated services with minimum service interruption.

C-2.2 Cybersecurity

To meet the challenges of the rapidly evolving cyber landscape, DOE has crafted a comprehensive cyber strategy rooted in enterprise-wide collaboration, accountability, and transparency. DOE defines the following objectives in the management of DOE’s cybersecurity posture:

DOE intends to strengthen continuous monitoring capabilities across the Enterprise such that both threat detection performance and incident response are elevated to the highest possible degree.

DOE requires a disciplined approach to identify and use current, new, and emerging technologies and industry best practices that are best suited to the DOE context to protect DOE information assets.

DOE requires strengthened ties among all DOE programs, offices, sites, sub-agencies, national laboratories, power marketing administrations, and vendors, such that awareness of security threats, compliance with security policy, implementation of security measures, and reporting of security metrics comprise a unified, Department-wide effort.

The contractor may be required to provide expert guidance in providing executive-level cybersecurity support for the Chief Information Security Officer (CISO), CIO, and the Secretary of Energy.

C-2.3 Customer-Centric Solutions

DOE requires that the Contractor bring a high level of quality in its end-user support services and all underlying IT operations and maintenance activities. With respect to customer-centric solutions, quality is defined by meeting the following objectives:

The Contractor shall help set customer expectations and shall respond to the needs of customers with agile, flexible, IT service delivery, meeting or exceeding established standards of timeliness and responsiveness.

The Contractor shall consider the customer experience and relevant customer inputs in the design, development, and roll out of any new product, service, or business process.

The Contractor shall regularly collect and provide all customer feedback on all end user products and services in a tool which will consistently measure the effectiveness of the products and services using both quantitative and qualitative rating mechanisms. The Contractor shall regularly incorporate customer feedback and other lessons learned into improvements of those end user products and services.

C-3. Scope

The following service support areas encompass the planning, day-to-day operations, and continuous maintenance/support for Cybersecurity and Enterprise IT services. Performance Requirements identify specific services the Contractor must provide, and may include standards that the service delivery must meet.

Further details on specific performance requirements will be provided at the BPA Order level. The purpose of this document and section is to provide the scope of potential work to be issued under subsequent BPA Orders.

C-3.1 Shared Services

C-3.1.1 Managed Seat Services

The Contractor may be required to provide IT services within a managed seat style service environment.

Services shall follow industry standard approaches - ITIL 4, Configuration Maturity Model Integration (CMMI) dev, CMMI svc, ISO/IEC 20000-1:2011, ISO/IEC 27001, or a comparable service delivery methodology - with the goal of continuous improvement. The Contractor may be required to propose, subject to Government approval, the methodology or methodologies it will follow for each service performed at the BPA Order level.

These services may include any of the following requirements:

Provide zero client or thin client, desktop, laptop, and virtual high-performance end user computing services.

Provide remote access for all seat service end users.

Provide comprehensive customer service, including remote support, deskside support, self-service, and walk-up service with the opportunity to receive loaner equipment.

Provide access to customer support through a wide variety of channels including email, internet, chat (including mobile), and telephone.

Act as a broker or managed service provider to provide FedRAMP-authorized cloud infrastructure.

Ensure that end users have secure access to the DOE network, and access to the requisite cloud and on-premises shared resources and services.

Provide Identity, Credential, and Access Management (ICAM) services.

Provide Voice over Internet Protocol (VoIP) phones and associated services.

Provide end user training prior to deploying new technologies and service offerings, and continuous training throughout the life of a service offering

Provide an offsite delivery center capability for handling the day-to-day logistics of deploying packaged solutions, including, but not limited to the scheduling, provisioning, imaging, patching, securing, sanitizing, testing, tracking, distribution, storage, and transportation of assets.

Handle the full asset management lifecycle from acquisition to disposition in accordance with DOE policies.

Provide comprehensive tracking and reporting of the performance metrics that measure the quality of seat service delivery.

C-3.1.2 Managed Print Services

The Contractor may be required to manage all aspects of DOE printing devices, including printers, scanners, fax machines, and copiers. This service may include the following requirements:

Identify and provide a fully managed print and fax service that supports secure on-premises and virtual use.

Analyze printing needs and provide the appropriate devices to optimize efficiency and minimize cost of resources.

Repair or replace devices as needed.

Deliver necessary supplies such as paper, toner cartridges, and incidentals.

C-3.1.3 Collaboration Services

The Contractor may be required to support DOE’s collaboration services, which include Microsoft SharePoint sites (including the Energy Hub), Powerpedia, Huddle, iPortal, Documentum, DOE wikis, Cisco Webex, and any collaboration service DOE may acquire in the future. The Contractor may also be required to support and maintain DOE’s collaborative messaging services such as Skype for Business, IM, Presence, and email messaging through Microsoft Office 365, as well as Global Address List synchronization and other email-related services. Requirements may include:

Provide operational and maintenance support of collaboration infrastructure, including evaluating and upgrading future releases, and ensuring all collaboration sites are stable and secure.

Perform setup, testing, and migration of the customer’s current data repositories to the collaboration environment, or to another service as required.

Provide backup and restoration services.

Provide service desk support, troubleshooting, and problem resolution to end users using collaboration services.

As required, the Contractor shall support the implementation of Microsoft Project Server as a part of SharePoint service.

C-3.1.4 UC Web or Video Teleconferencing

The Contractor may be required to provide such UC (Unified Communications) web or video teleconferencing services as:

Management of any on-premises DOE teleconferencing equipment, including placement, setup, and maintenance.

Testing and troubleshooting of any on-premises teleconferencing equipment to ensure its proper operation.

Asset management of any on-premises teleconferencing equipment.

Repair or replacement of inoperable on-premises teleconferencing equipment.

End user support and training for teleconferencing users.

Teleconferencing hosting capability to support connections by multiple simultaneous participants, including conference room conferencing, desktop conferencing, and internal and external connections.

C-3.1.5 UC Voice

The Contractor may be required to provide Unified Collaboration (UC) enterprise class voice services, including:

Management of existing on-premises DOE IP voice equipment, including placement, setup, and maintenance.

Administration, configuration, testing, and troubleshooting of voice equipment to ensure its proper operation.

Asset management of voice equipment.

Repair or replacement of inoperable voice equipment.

End user support for voice users.

Installation, operation, and management of software or web interface that enables end users to manage their voice services from either their computer or their voice equipment. Supported services include:

o Setting, activating, and deactivating of out-of-office messages o Forwarding calls to another number o Transferring calls to another number/follow me functions o Activating and deactivating Do-Not-Disturb o DOE telephone directory lookup

C-3.1.6 Web Conferencing

The Contractor may be required to provide web conferencing services, including:

Screen sharing and collaboration by multiple simultaneous participants.

End user support for web conferencing users.

Web conference hosting capability to support dial-in by multiple simultaneous participants, using toll-free or toll-based service.

Access to government-rate web conferencing capabilities on non-government carrier networks.

C-3.1.7 Service Desk

Service Desk provides full end user support during normal business hours coast-to-coast, with lesser service after normal business hours. Specific hours and closure requirements will be specified at the BPA Order level.

The Contractor’s standard Service Desk support may include, but not be limited to, the following requirements:

Establish end user support operations or provide a fully managed service to accommodate the geographic dispersal and diverse IT infrastructure requirements of customers distributed throughout

DOE.

Provide courteous, prompt, high-quality end user support services. Both the appropriate level of technical expertise and the presence of professional demeanor shall define the Contractor’s end user support personnel.

Develop and maintain support practices that elevate Service Desk activity to the level of a first-class service provider.

Provide a Service Desk Tier 1 capability using the Information Technology Infrastructure Library (ITIL) management framework, providing IT support services and call triage, including routing for support services beyond the scope of CBOSS requirements.

Provide a Service Desk Tier 2 and/or Tier 3 capability using the ITIL management framework, providing IT support services and call triage where such Tier 2 and/or Tier 3 support services are within the scope of CBOSS BPA Order requirements.

Provide an integrated approach to incident, problem, and event management for service operations.

Such an approach emphasizes and demonstrates the cross cooperation among service teams from Tier 1, Tier 2, and Tier 3 support services.

The Contractor’s Service Desk support shall be located within the continental United States. The Contractor shall have the ability to provide geographically diverse call center functionality when needed, for continuity of operations/disaster recovery, when needed

Ensure customer satisfaction by performing the following:

o Provide a customer satisfaction tracking and reporting capability that surveys customer satisfaction, tracks customer feedback, and compiles results.

o Provide a method to receive, investigate, and correct end user complaints.

The Contractor may be required to provide Executive-level Service Desk support “around-the-clock” (24 hours/day, 7 days/week, 365 days/year). This support shall include availability for reasonably immediate technical support and elevated SLA metrics, in addition to any remote support capabilities provided under the contract. Executive-level support shall be available to all executive customers and—for an additional fee—standard customers who require elevated service.

C-3.1.8 Networking

The Contractor may be required to perform the following requirements in order to support network infrastructure and security:

Maintain a Network Operations Center (NOC) capability that supports network communications, including data, voice, and video services, at DOE locations throughout the continental United States.

Manage and operate DOE’s NOC and move to a commercially-operated NOC facility according to a schedule outlined in the Contractor’s technology migration plan. See Section C-3.2.9, Technology Migration Planning, for more information.

Provide continuous (24 hours/day, 7 days/week) network performance monitoring, incident detection, response, and problem resolution.

Maintain network services that meet the bandwidth needs of the as-is environment and are able to scale appropriately in the event of a surge.

Research and evaluate the requirements needed to leverage the bandwidth and capabilities of ESnet or any other identified DOE network for increased departmental use.

Configure and maintain network routing tables to ensure efficient flow of data.

Manage installs, moves, adds, changes, and de-installs (IMACD) on EITS-managed DOE networks.

Maintain DOE network infrastructure, in accordance with current technology standards and all applicable Federal and Department regulations.

If required, perform cabling activities to accommodate O&M changes, primarily break/fix, in EITS-managed DOE physical infrastructure.

Provide managed wide area network (WAN) services, encompassing access layer, distribution layer, and network core components. The Contractor shall provide the network configuration for WAN services for EITS-managed DOE networks.

Provide managed metropolitan area network (MAN) services for EITS-managed DOE networks.

Provide managed local area network (LAN) services for EITS-managed DOE networks. This support shall include but not be limited to addition and maintenance of infrastructure, network configuration services, network monitoring and management, and incident management and response.

Provide managed wireless LAN services, including guest Internet access within headquarters locations at Washington, D.C. and Germantown, Maryland and in other locations throughout the United States (to be specified at the order level). The Contractor shall maintain and monitor all wireless infrastructure in accordance with all Technical Security requirements and guidelines.

Provide virtual private network (VPN) services that support DOE-provided (GFE) computers, and mobile devices. The Contractor shall ensure that VPN access requires two-factor authentication and is appropriately secure, and that it provides access only to appropriate, authorized network-based resources.

Maintain Internet services through a Trusted Internet Connection Access Point (TICAP) or Managed Trusted Internet Protocol Services (MTIPS) solution that are in compliance with all applicable requirements.

For each of these services, the Contractor shall engage in continuous troubleshooting, evaluation, and improvement of capabilities in order to provide a continuously improving network environment.

C-3.1.9 Infrastructure Services

The Contractor may be required to provide solutions to provide and/or support solutions capable of supporting physical and virtual servers for DOE’s application and data storage needs, to potentially include datacenter-as-a-service (DaaS) and FedRAMP-authorized commercial cloud capabilities.

In providing this solution, the Contractor shall perform the following requirements:

Ensure the solution can scale compute capabilities appropriately in terms of central processing unit (CPU) processing power, available memory, and available storage space, in order to accommodate surges in usage or data.

Provide server management at the, Operating System (OS), and virtualization/hypervisor layer.

Management expectations include installation, configuration, maintenance, upgrades, database administration, and refresh (of on-premises implementations).

Provide security management, including virus protection, host intrusion protection, infrastructure A&A, compliance review and auditing, vulnerability scanning and reporting, and incident response and management.

Include Unix/AIX servers, Linux servers, and Windows servers.

Ensure that all Desktop as A Service (DaaS) needs are adequately provided including, but not limited to cooling, power supply, server components, backups, disaster recovery, bandwidth, capacity, and storage, ideally via a fully managed service.

Support data center metering, energy efficiency, and risk assessments for any IaaS or PaaS offerings.

Support the development of data center optimization and consolidation strategy, if necessary for any remaining on-premises data center components.

Support data center infrastructure management, if needed for non-managed service offerings or for any remaining on-premises data centers.

Support the Department’s data center cloud migration strategy.

When providing FedRAMP authorized cloud capabilities, the Contractor shall perform the following:

Provide FedRAMP cloud-based file and data storage for DOE end users, with ability to access files remotely, across devices, and offline.

Provide FedRAMP cloud virtual machine services.

Provide FedRAMP cloud physical dedicated machine services.

All systems are currently at the Moderate level based on FIPS 199 categorization. However, the Government expects to have a FISMA-High environment as a part of the longer-term solution.

With respect to assuming the as-is operating environment, the Contractor shall satisfy the following requirements:

Accommodate 100% of the operating environment, including but not limited to file storage requirements, print services requirements, database application requirements, web application requirements, and all system appliance requirements.

Ensure all hosted servers are maintained according to the most current vendor release levels, and that all hosted servers comply with Federal and Departmental standards for cybersecurity.

Support the timely, ongoing deployment of security patches for all networks and server applications.

Build a practice of preventive maintenance by identifying potential-for-error conditions or gaps in server security and taking action to mend the hosted server environment.

Ensure that vigilant monitoring standards apply to all hosted servers, and actively engage in maintenance of hosted server environments.

C-3.1.10 Security Operations Support

DOE requires Security Operations Center support and security operations and compliance support. The Contractor may be required to perform the following security operations requirements:

Maintain a Security Operations Center (SOC) capability to monitor and respond to security risks and issues, identify and mitigate risks, and protect DOE information that is stored on or transmitted by the network infrastructure. Manage and operate DOE’s SOC and migrate to a commercially available SOC facility according to a schedule outlined in the Contractor’s technology migration plan. See Section C-3.2.9, Technology Migration Planning, for more information.

Provide continuous (24 hours/day, 7 days/week) monitoring of network activity to identify potential threats and respond with the appropriate incident response and problem management activities.

Conduct regular risk assessments and take action to mitigate risks to the network.

Configure network firewalls to prevent access by unauthorized users.

Ensure that all IT systems within the Contractor’s managed services solution comply with all applicable Federal regulations and guidelines for IT operations, cybersecurity, and information sharing and safeguarding.

Ensure that all IT systems within its managed services solution comply with all applicable DOE guidelines, plans, and policies, notably DOE Order 205.1D, Department of Energy Cyber Security Program.

Ensure that all IT systems within its managed services solution integrate with DOE information assurance processes and systems, to provide DOE with complete transparency into the status of the operating environment.

C-3.1.11 Identity, Credential, and Access Management (ICAM)

The Contractor may be required to support Federal-compliant Identity, Credential, and Access Management (ICAM) services for the management of digital identities, credentials, and access to DOE systems and applications. These services shall include the following requirements:

Support the development and implementation of a Single Sign-On (SSO) user authentication solution for end users. This solution shall use a phishing resistant multifactor authentication (MFA) process to grant the user access to the DOE network, as well as linked applications such as DOE email account and document storage. The Contractor shall ensure the security of the authentication process. Although many DOE-developed applications may not support SSO, the Government may request the Contractor to assess the difficulty of adapting these applications to fit the SSO framework.

Support a Role-Based Access Control (RBAC) user authentication solution for end users, which grants levels of access to users based on their position within DOE.

Support the public key infrastructure (PKI) that enables a trust model of internally issued PKI certificates for secure websites, web services authentication, code signing, and any other necessary uses.

Support the provisioning of customers with PKI tokens enabling secure remote access to the public key infrastructure.

Support the Zero Trust Architecture (ZTA) initiatives to include implementation of the OneKey solutions providing phishing resistant tokens to include derived PIV credentials for mobile.

Support the Enterprise Entitlements Management Service (EEMS), an enterprise-wide solution that centrally manages the identity, entitlements, and roles of DOE personnel.

Support application programming interface (API) security with strong API authentication, controlled access to APIs, API traffic management, and any other necessary measures.

Work with customers to integrate systems and applications with ICAM capabilities. This shall include integration design, implementation of security policies, and deployment of ICAM software in the customer environment.

C-3.1.12 Secure Information Messaging

The Contractor may be required to perform all operations and maintenance services associated with Secure Information Management and Exchange (SIMEX) messaging. These requirements may include:

Provide onsite and offsite service maintenance, and upgrades and repairs of hardware and software associated with the secure information messaging system.

Perform regular security testing and evaluation.

Perform vulnerability scanning, patch management, and continuous monitoring.

Maintain detailed system architecture diagrams, configuration settings documentation, and backup images.

Act as the network Information System Security Officer (ISSO) for the DOE secure messaging service, and perform all required services for maintaining all certifications and accreditations required for the secure messaging solution.

C-3.2 General IT Support Services

C-3.2.1 Program Management

Program management comprises the overarching responsibilities the Contractor performs in the course of delivering IT services, including strategic planning and general management requirements. This includes the management and oversight of all activities performed by Contractor personnel, including Contractor Teaming Arrangement (CTA) members and subcontractors. The Contractor shall identify a Program Manager, who shall provide leadership, risk management, contract administration, and quality assurance.

For more information on the Program Manager, see CIO Business Operations Support Services (CBOSS) Performance Work Statement Labor Categories and Descriptions.

C-3.2.1.1 Program Management Planning The Contractor may be required to perform the following program management requirements:

Form a Project Management Office (PMO) to ensure quality of service, compliance with Federal and DOE regulations and policies, DOE Order 415 (Project Execution Methodology), agile methodology, customer satisfaction, and SLA performance. The PMO shall be headed by a Program Manager and will interface with the Contracting Officer (CO), Contracting Officer’s Representatives (CORs), Technical Monitors (TMs), and Quality Assurance Evaluators (QAEs), with an emphasis on continuous collaboration and improvement. Specific responsibilities and roles of these positions will be defined at the BPA Order level.

Develop and execute a Program Management Plan. The Contractor shall provide updates to the plan throughout the BPA performance period as changes in strategies or priorities occur. The Project Management Plan shall include plans for management of cost, schedule, risk, personnel, and quality, as well as cost estimates, milestones, and a summary of the project management approach.

Propose a comprehensive set of Service Level Agreements (SLAs) that define key performance indicators for the services performed under the CBOSS BPA Orders. These measures shall be rolled up and provided in an executive level dashboard for all services as performed under CBOSS BPA Orders.

C-3.2.1.2 Program Management Implementa�on The Contractor may be required to perform the following Program Management requirements:

Implement and operate a PMO consistent with the requirements outlined in Section C-3.2.1.1 Program Management Planning.

Monitor Contractor performance according to established SLAs, AQLs, OLAs (Operating Level Agreements) and other performance metrics. When performance quality falls below standard, develop and implement a performance improvement plan.

Perform trend analysis on performance data. Upon identifying trends that indicate risks to performance, implement appropriate mitigation strategies.

Regularly provide a high-level briefing of BPA health, including financial status, progress toward milestones, status of performance measured against SLAs and metrics, and any changes, issues, or risks. This briefing may take the form of an in-person presentation or a written report.

Continuously analyze and evaluate the resources required to provide IT services, and propose upgrades and innovations that will improve performance and security while lowering costs.

Ensure customer satisfaction by performing the following:

o Provide a customer satisfaction tracking and reporting tool to continually survey customer satisfaction, track customer feedback, and compile results.

o Provide a method to receive, investigate, and correct end user complaints.

At all times remain aware of customer needs, and cultivate an attitude of customer service among Contractor personnel.

C-3.2.1.3 ITSM Service Delivery Provide ITIL Service Portfolio Management functions and processes to include, but not limited to:

incident management, problem management, change management, release management, event management, and configuration management.

Configuration management support to include a logical (application layer) and physical/virtual (data layer) Configuration Management Database (CMDB) capability for IT Service Delivery with auto-populated/updated Configuration Items (CI) and attributes when available

C-3.2.1.4 Solu�on Planning Services In addition to the Program Management Plan, the Contractor may be required to develop plans that define how the Contractor’s IT solution will operate and adapt to changes throughout the course of BPA performance. The Contractor may be required to provide the following:

A plan for the Contractor’s solution to operate with a minimum surge capacity of current operating volume, to be determined at the BPA Order level.

A comprehensive supply chain management plan that will ensure the quality, availability, and security of all resources the Contractor procures.

A work integration plan describing how the Contractor will work together with other contractors providing service to DOE, in order to provide seamless service delivery with respect to CBOSS requirements.

A personnel training plan addressing personnel responsibilities in all areas of work that satisfy CBOSS requirements at the beginning of and ongoing during performance periods

A communication plan to ensure the lines of communication between the Contractor and the Government remain open and available, to include regular and ad hoc reports, meetings, and briefings with OCIO stakeholders.

A Disaster Recovery (DR) plan and a Continuity of Operations (COOP) plan to ensure support for essential functions and activities during a DR or COOP event.

Establish process documentation (e.g., Playbooks, Standard Operating Procedures (SOPs), desk instructions as necessary)

C-3.2.2 Project Management Support

IT projects are initiated on an as-needed basis. The Contractor may be required to provide Project Management support to ensure that Government and contractor-assigned projects are managed for timely and resource-efficient execution. The Contractor shall:

Develop project plans to accomplish specified projects. Depending on the type of project and Government’s needs for transparency and coordination, project plans may include:

o Description of the work to be performed.

o Schedule of activities, including significant milestones, with delineation of responsibilities and planned deliverable completion dates.

o Budget projections for work to be performed.

o List of anticipated project risks and issues, with strategies for actions to be taken to mitigate, avoid, or accept risks and actions to be taken in the event of risk occurrence.

o Registry of project stakeholders, including their involvement or ability to influence project performance.

o Communications plan to keep all stakeholders informed of project status and issues with emphasis on customer collaboration.

Provide project execution monitoring and progress reporting, including:

o Coordination of project activities based on the project plan and budget.

o Management of contractor personnel responsible for performing project activities and timely notification to Government personnel as needed to support project work.

o Routine reporting of project status and activities on a regularly scheduled basis, as determined by the Government.

o Ad hoc reporting of emergent project issues to keep the Government informed of problems and enable timely decision-making by the Government.

o Timely update of project dashboards and information radiators to support ongoing project oversight.

o Ongoing updates to risk and issues logs to identify emerging risks and issues and to plan risk management responses.

Conduct project close-out activities, including:

o Implementation of project results into the DOE environment, as appropriate.

o Publication of final project deliverables as specified by the Government.

o Release of resources allocated to the project for reuse or disposal, as appropriate.

o Archival of project data and results, as directed by the Government.

Comply with all Federal and Departmental guidelines, most notably DOE O 415.1, which gives direction for Information Technology project management. Project managers for Exhibit 53 and Exhibit 300 investments shall comply with all training, reporting, and deliverable requirements required for the level of the investment.

The Contractor shall be responsible for preparing and entering Electronic Capital Planning and Investment Control (eCPIC) documentation into the eCPIC system in accordance with reporting requirements that will be associated with execution of each project, per the Office of Management and Budget (OMB) Management and Oversight of Federal Information Technology (FITARA) memorandum dated 10 June 2015, the Department of Energy (DOE) Agency IT Portfolio Summary Reporting (ITPS) and the DOE Major Information Technology Business Case and Standard IT Investment Reporting (MITBC) guidance documents. This documentation and its data shall be reported at intervals specified in the ITPS and MITBC guidance.

Implement an efficient procurement management capability which ensures selection of competent suppliers, recommends unbiased purchase decisions, establishes compliant contracts, and negotiates competitive prices for goods and services.

C-3.2.3 Direct Materials Purchasing Support

The Government may require the Contractor to perform Direct Materials purchasing on behalf of the Government (in other words, direct purchasing of IT-related equipment / hardware / software licenses which would be the primary purpose of a BPA Order) in support of Departmental activities. This will require the Contractor to implement an efficient procurement management process with the capability to support, at a minimum, $60 million a year of Direct Material purchases. The Contractor’s processes and procedures will ensure the selection of competent suppliers, recommend unbiased purchase decisions, establish compliant contracts, and negotiate competitive prices for goods and services as authorized by the Government in a cost-effective manner and in accordance with public law and applicable regulations. The Contractor may be required to coordinate with vendors on Government commercial terms and conditions.

End User License Agreements (EULAs) will only be considered on a case-by-case basis when the Government’s commercial terms and conditions do not address a situation that has been documented and presented to the Government for review.

C-3.2.4 Software and Hardware Asset Management Support

DOE requires complete hardware and software asset management solutions that account for all assets supporting the operating environment. The Contractor may be required to perform the following:

Document and track the hardware DOE uses during the performance of CBOSS BPA Orders, including what hardware is in use, where it is deployed, and how it is configured. The Contractor shall maintain an accurate hardware inventory.

Provide access to asset management documentation and data including: regular reports of equipment assignment data, supply levels of necessary bench stock hardware, inventory lifecycle management data, and equipment repair data. The Contractor shall use report data to perform trend analyses on DOE resources.

Perform hardware lifecycle management, including property receipt, inventory control, equipment staging and distribution, warranty repair coordination, erasure and cleansing, and transfer or destruction of hardware assets.

Perform hardware lifecycle asset services, including packing, labeling, and transportation.

Maintain physical security property and asset lockdown kits. Manage asset lockdown kit distribution and implementation.

Perform software lifecycle management, including monitoring for end of life/outdated software, purchasing, license inventory management, license and support acquisition and renewal, requirements gathering, systems analysis, manual and automated distribution, patch and update management, removal, and auditing activities for compliance and performance optimization.

Provide automated software detection and license monitoring services for all software.

Provide automated software installations, upgrades, and patches to individual end user workstations. This service shall include configuration, compatibility, and integration testing in advance, and all necessary remediation services in the event an upgrade or patch fails.

Provide software maintenance and renewal reports that document software in need of maintenance or license renewal, and that note software or applications that would benefit from upgrade, with a cost/benefit analysis for each upgrade.

Provide software security reports that details software patch information and an assessment of the associated vulnerabilities to be patched.

Document all software asset management processes and procedures.

Integrate hardware and software asset management components, which will allow the Contractor to track which software assets are being used on specific hardware assets.

C-3.2.5 Legacy Support

The Contractor may be required to assume responsibility of the current, Government-owned end user environment, which shall include IT infrastructure and services. Requirements for supporting the current environment shall include:

Manage and maintain existing infrastructure.

Ensure legacy IT systems and business applications interoperate and work seamlessly with Contractor-provided services.

Maintain established SLAs and ensure end users receive the same high level of service.

Provide housing for existing servers owned by the Government.

Any organization across DOE may require legacy support; however, OCIO is the primary user of the CBOSS BPA vehicle. Information on the as-is environment of other DOE customers will be included in their specific BPA Orders.

C-3.2.6 Mainframe Support

The Contractor may be required to provide support for mainframe-based applications to include the following requirements:

Provide fully managed storage services.

Provide continuous (24 hour/day, 7 days/week) system and network monitoring and support.

Provide application data recovery support.

Provide systems engineering services, including operating system and system utilities maintenance, troubleshooting, and problem resolution.

C-3.2.7 Enterprise Architecture Support

The Contractor may be required to provide Enterprise Architecture support, to include the following requirements:

Support external efforts and the implementation of federal policy initiatives.

Define and maintain Enterprise Architecture principles, standards, and policies.

Identify service domains.

Work with Enterprise Architects to analyze the current architecture and business needs and to identify deficiencies.

Issue recommendations on new and emerging trends in the information technology industry and the Federal Government.

Identify and develops new service domains for DOE, analyzing the impact on current IT infrastructure and identifying new service opportunities.

Plan and develop Enterprise Architecture artifacts.

Analyze and form direction regarding technology and industry trends.

Draft information, technology, security, and application architectures artifacts.

Leverage Enterprise Architecture standards such as the Federal Enterprise Architecture Framework (FEAF) and the National Information Exchange Model (NIEM).

Create a consolidated view of future state architecture and an EA roadmap.

C-3.2.8 Infrastructure Modernization

Fiber Cable Plant Upgrade - Bring 10 Gbps fiber into mechanical closets located in the Forrestal building (FORS) in Washington, D.C., and the Germantown MD main campus (GTN), and other designated locations to support growing VoIP and data demand.

SONET Ring Upgrade - Add new connections to provide…