Draft Statement of Work.pdf

Draft Statement of Work (SOW)

Active Directory Support Services Software Maintenance or Equivalent Product

1.0 Introduction

Directory Services Branch (DSB) is looking for a tool set for Windows-centric enterprise management aimed at providing information technology (IT) with invisible control over various systems. Our focus is to provide innovative, customer-focused solutions for migration, administration, security and recovery of Windows systems, Active Directory, and Exchange. The software will be used by the Directory Services Branch, Infrastructure System Administrators

(ISAs), Enterprise Level Administrators (ELAs) and Cybersecurity.

DSB needs a commercial-off-the-shelf (COTS) product that supports security back up and restoration activities of Active Directory (AD) objects across multiple managed domains that provides change monitoring and notification for directory objects and attributes and provides both command line style and Graphical User Interface (GUI) access to manage directory services and all component objects, as well as allow granular delegation of those rights as needed.

2.0 Background

This legacy software, Active Roles Server and Recovery Manager for Active Directory, has been used enterprise wide for over a decade and it provides granular backup and recovery as the centralized management tool to manage Active Directory and delegate access to directory objects in supported development, test, and production domains.

DSB enterprise products currently used are deemed to be critical in the continued support of the enterprise, and therefore we must maintain adequate licensure and maintenance for the products to remain legal and functional.

DSB partners, including the Enterprise Service Desk, Deskside Support teams across the enterprise, security teams in numerous information technology (IT) organizations, server build teams, and server administrators use customized web and scripted text interfaces to perform their daily duties in user account management, server and workstation administration, and oversight research and reporting.

3.0 Scope

In order to ensure availability of functionality, the Internal Revenue Service (IRS) requires a brand name Active Roles Server and Recovery Manager for Active Directory Software

Maintenance or Equivalent Product software that is supported by the products and/or services in the line items below.

CLIN Description Quantity

Base Year

Professional Services (Hours) – See 4.2 Delivery

Requirements

Enterprise Suite 1 Year Subscription License () 140,000.00

003 Premier Support 1 Year Subscription 1.00

Option Year One

Enterprise Suite 1 Year Subscription License 140,000.00

1002 Premier Support 1 Year Subscription 1.00

Option Year Two

Enterprise Suite 1 Year Subscription License 140,000.00

2002 Premier Support 1 Year Subscription 1.00

Option Year Three

Enterprise Suite 1 Year Subscription License 140,000.00

3002 Premier Support 1 Year Subscription 1.00

4.0 Technical Requirements

The technical requirements needed to accommodate this request is the installation of an updated license file. This is a non-invasive update that would not impact any other aspect of the software instances. Other requirements are listed below:

Technical Requirements Description

Virtual Attributes (VA)

The Active Directory management tool or equivalent product will need to combine the schemas for multiple managed domains and extend that consolidated shema within the product. This would allow the Service the ability to create and manage our own virtual schema of attributes and support existing business rule automation and role fulfillment across the hybrid on prem and cloud directories.

Workflows

The product must support workflows for automation that can be scheduled or triggered via dynamic changes to objects in the managed directories.

Scheduled Tasks

Must provide an avenue for scheduled automation of product related task and script execution.

User Web Interface

Product must offer a modern web interface experience for users with general familiarity of web-based directory management tools and offer a simplified top-down view of directories, objects, and attributes managed via those interfaces.

SPML

Okler SPML technology support is desired, but can be replaced with modern capabilities like Application

Programming Interface (API) and other intake functions, to allow partner systems to send batch or otherwise automated requests for changes to objects and containers in the directories.

Deprovision/quarantine/suspend

Tool must support the ability to flag objects as no longer in use and make appropriate attribute changes to the object to prevent its use, while leaving the object in the directory for auditing and records retention. Additionally, the tool must permit an account in this state to be restored to working condition on demand of an appropriate administrator.

Dynamic groups

Business need dictates the product must accommodate and unlimited number of groups populated dynamically via a set of inclusive or exclusive memberships rules.

Powershell/ API

Powershell Command lets or a set of specific API calls that can be made from PowerShell, to aid in the configuration and administration of the product.

Managed units

Tool must provide functionality to create managed

Organizational Units (OU) or containers with objects members from across multiple native OUs based on query filtering criteria.

Change history

Product must offer a flexible change history monitoring with notification of trigger-based automated rollbacks when changes are implemented by an administrator when the change varies from specified business rules.

Load Balancing

Product must provide the capability to meet the service needs for redundancy to support business availability continuity, resumption, and disaster recovery.

Zero/low downtime

The IT Service Desk is a major partner and consumer of directory management tool services and operates 24/7/365. A tool supporting that partnership must provide for very little downtime for patches and upgrades.

Synchronization agent

Tool must provide for synchronization of data from and to multiple sources including AD/ADLDS and SQL/Oracle.

Tech Support Vendor must provide 24/7 ticketing with US-based support.

Policies

Product must offer business rule enforcement including the ability to block changes that would violate these policies.

Policies will contain rules such as naming conventions and the ability to maintain group membership after changes to relevant attributes.

Replication

(merge/mittor/AlwaysOn)

SQL or other supported database must support replication across multiple nodes.

Full replacement

Vendor's offerings should replace all current Quest software for directory management tool, Active Directory backup and restoration tool, and directory change auditing tool.

Active Directory Backup/Recovery Solution –

• The product must have the capability to perform backups of all IRS Active Directory

(AD) forests and domains and store these backups in a manner that meets both short-term and long-term record retention requirements.

• The product needs to be able to perform recovery operations at multiple levels – that is, full forest recovery in case of catastrophic failure, AD object recovery in case of objection deletion or corruption and AD object attribute recovery.

• The product must be able to store and manage multiple backup instances in its repository to allow for “point in time” recovery of objects or attributes.

• The product must perform backups on both an automated schedule and manually for “ad hoc” backup instances.

• Product backups should be recoverable up to the IRS 20 years email retention requirement and fully restore user objects as needed (including past the AD tombstone date).

• Backups must be encrypted to the government-standard level.

• Future versions of the software must retain the ability to read backups generated with prior versions of the software and functionality must transition without unresolvable issue across upgraded versions of Windows Server and supporting database components.

• The product must be able to provide status reporting as well as notification messages via email, SMS, Teams, etc.

• Product must be compliant with all federal rules and guidelines such as Section 508, Federal Information Security Management Act (FISMA).

• The product should be able to provide attestation/affirmation of restore operations for court proceedings, Freedom of Information Act (FOIA) requests, Congressional inquiries and other external requirements.

• The product should be able to perform “test” forest/domain/organizational unit level recoveries without committing the actual recovery for proof of concept and table exercises related to disaster recovery testing.

Active Directory Management Solution –

• The product must have the capability to manage multiple Active Directory (AD) instances in multiple AD forests.

• The product must have a web-based interface for customers as well as a client interface for administrators.

• The product must be able to interface with existing IRS application/databases via an

Application Programming Interface (API) or some coding ability (PowerShell, Services

Provisioning Markup Language (SPML)).

• The product must have automation capabilities to allow the software to create, modify, disable, and archive AD objects either on a schedule or based upon criteria/conditions of that or another AD object. This automation can be implemented in multiple ways, such as, product-specific or customizable workflows, embedded scripting, scheduled tasks.

• The product needs the ability to manage user objects in a manner that is compliant with all IRS rules and guidelines and meets the needs of the Service regarding deprovisioning/archival of inactive users.

• The product must be able to manage all AD objects and attributes, including any custom or extension attributes used by the Service. (Ideally, the product will have the ability create and maintain a set of product-centric objects and attributes that are only visible and manageable by the product outside of Active Directory.)

• The product needs to allow for multiple levels of access provisioning within the product.

This includes high-level access controls at the forest/domain but also granular access control at the object and attribute level.

• The product must have the capability to manage AD group membership both manually and in an automated manner.

• Product must be compliant with all federal rules and guidelines such as Section 508, FISMA.

The vendor will provide yearly onsite health inspections of all software and the software environment for the period of the maintenance contract. The vendor will provide one base year of premier support and three optional years of support thereafter.

4.1 Asset Tagging Requirements

There will be no physical hardware purchased. No asset tagging required.

4.2 Delivery Requirements

The vendor shall perform the procedures as follows:

The vendor will provide all software and related licenses and documentation upon procurement.

This will include documentation related to installation and configuration of the software. The vendor will schedule transition support and training upon procurement and should be completed no later than 45 days after the procurement. Transition activities must be completed to the satisfaction of the Directory Services Branch Chief (or his proxy) who will certify completion via email to the vendor.

All onsite transition work will be performed at the Martinsburg Computing Center in West

Virginia. Some transition support may be performed remotely via Teams or some other collaboration tools. Training will be performed at an IRS campus site conducive to participant travel and available training space. Yearly health inspections will be performed at the

Martinsburg Computing Center or other IRS site as needed.

4.2.1 Installation and Setup

License keys shall be delivered to the TPOC and/or the Program Managers.

4.2.2. Trash Removal

N/A

4.3 Delivery Documentation Requirements

5.0 Periods of Performance

The period of performance shall be a base period of 1-year (12 Months from Date of Award), with three (3) 12-month option periods after Base Period.

6.0 Security Requirements

7.0 Section 508 Requirements

Section 508 Information, Documentation and Support (Dec 2019)

In accordance with 36 CFR, Appendix C to Part 1194, the information and communication technology (ICT) products and product support services documentation furnished in performance of this contract shall be provided at no additional cost. The contractor shall provide information, documentation, and support relative to the supplies and services as described in the statement of work.

The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 6: Support Documentation and Services

_X__ 601 General

_X__ 601.1

_X__ 602 Support Documentation

_X__ 602.1 _X__ 602.2 _X__ 602.3 _X__ 602.4

_X__ 603 Support Services

_X__ 603.1 _X__ 603.2 _X__ 603.3

(End of clause)

Section 508 Conformance (Apr 2024)

Each information and communication technology (ICT) product and/or product related service delivered under the terms of this contract, at a minimum, shall conform to the applicable accessibility standards at 36 CFR, Appendix C to Part 1194 at the level of conformance as specified in the Attachment entitled, “(To Be Determined)”.

The following technical standards have been determined to be applicable to this contract:

___ Chapter 4: Hardware

___ 401 General

___ 401.1

___ 402 Closed Functionality

___ 402.1 ___ 402.2(1-6) ___ 402.3 ___ 402.4 ___ 402.5

___ 403 Biometrics

___ 403.1

___ 404 Preservation of Information Provided for Accessibility

___ 404.1

___ 405 Privacy

___ 405.1 https://www.section508.gov/ https://www.section508.gov/

___ 406 Standard Connections

___ 406.1

___ 407 Operable Parts

___ 407.1 ___ 407.2 ___ 407.3 ___ 407.4 ___ 407.5 ___ 407.6 ___ 407.7 ___

407.8

___ 408 Display Screens

___ 408.1 ___ 408.2 ___ 408.3

___ 409 Status Indictors

___ 409.1

___ 410 Color Coding

___ 410.1

___ 411 Audible Signals

___ 411.1

___ 412 ICT with Two-Way Communication

___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7

___412.8

___ 413 Closed Caption Processing Technologies

___ 413.1

___ 414 Audio Description Processing Technologies

___ 414.1

___ 415 User Controls for Captions and Audio Descriptions

___ 415.1

_X__ Chapter 5: Software

_X__ 501 General

_X__ 501.1

_X__ 502 Interoperability with Assistive Technology

_X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G)

_X__ 503 Applications

_X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4

_X__ 504 Authoring Tools

_X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4

_X__ Chapter 7: Referenced Standards

_X__ 701 General

_X__ 701.1

_X__ 702 Incorporation by Reference

_X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___ 702.7

___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria

_X__ 301 General

_X__ 301.1

_X__ 302 Functional Performance Criteria

_X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__

302.7 _X__ 302.8 _X__ 302.9

Section 508 Services (APR 2024)

All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated information and communication technology (ICT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR, Appendix C to Part 1194, and functional performance criteria in 36 CFR Chapter 3, unless an agency exception to this requirement exists at E202 General Exceptions.

The following technical standards and provisions have been determined to be applicable to this contract:

___ Chapter 4: Hardware

___ 401 General

___ 401.1

___ 402 Closed Functionality

___ 402.1 ___ 402.2(1-6) ___ 402.3 ___ 402.4 ___ 402.5

___ 403 Biometrics

___ 403.1

___ 404 Preservation of Information Provided for Accessibility

___ 404.1

___ 405 Privacy

___ 405.1

___ 406 Standard Connections

___ 406.1

___ 407 Operable Parts

___ 407.1 ___ 407.2 ___ 407.3 ___ 407.4 ___ 407.5 ___ 407.6 ___ 407.7 ___

407.8

___ 408 Display Screens https://www.access-board.gov/ict/

___ 408.1 ___ 408.2 ___ 408.3

___ 409 Status Indictors

___ 409.1

___ 410 Color Coding

___ 410.1

___ 411 Audible Signals

___ 411.1

___ 412 ICT with Two-Way Communication

___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7

___412.8

___ 413 Closed Caption Processing Technologies

___ 413.1

___ 414 Audio Description Processing Technologies

___ 414.1

___ 415 User Controls for Captions and Audio Descriptions

___ 415.1

_X__ Chapter 5: Software

_X__ 501 General

_X__ 501.1

_X__ 502 Interoperability with Assistive Technology

_X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G)

_X__ 503 Applications

_X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4

_X__ 504 Authoring Tools

_X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4

_X__ Chapter 7: Referenced Standards

_X__ 701 General

_X__ 701.1

_X__ 702 Incorporation by Reference

_X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___ 702.7

___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria

_X__ 301 General

_X__ 301.1

_X__ 302 Functional Performance Criteria

_X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__

302.7 _X__ 302.8 _X__ 302.9

8.0 IRS Contacts

Contracting Officer: To Be Determined (TBD).

Contracting Officer’s Representative: TBD.