Exhibit I USHMM RFP 95476726R0071 IT MANAGED SERVICES.pdf

Exhibit I: IT MANAGED SERVICES

USHMM RFP 95476726R0071

Performance Work Statement – IT Managed Services

I. INTRODUCTION

The United States Holocaust Memorial Museum (USHMM or the Museum) requires IT managed services from an innovative managed service provider (MSP) to support its mission. The Museum expects high-quality, customer-oriented technical support that encompasses all personnel, including employees, volunteers, and contracting staff. Services must utilize an ITSM framework or equivalent.

A. Museum Locations & Network Users

The Contractor shall support approximately 700 network users at the locations defined below:

Table 1: Museum Locations & Network Users

*Regional Offices Support: The Museum maintains regional offices and/or staff in Highland Park, IL; New York, NY; Boca Raton, FL; and Los Angeles, CA. Major upgrades or technical support for annual fundraising events at these locations shall require Contractor visits.

II. KEY PERSONNEL

The Contractor shall provide staff meeting the following requirements:

● Service Desk Manager: Primary lead for the Technical Service Desk; responsible for the lifecycle of IT Incidents and Problems. Requires practical experience in ITIL 4 Framework and Service Operation. Must possess an ITIL 4 Foundations certification.

● Tier 3 System Administrator Lead: Responsible for operational integrity of all servers (on-prem, virtual, and cloud). Expertise in Linux/Windows administration and shell scripting is required.

● Tier 3 Network Lead: Responsible for the performance of wireless and wired infrastructure. Requires expert-level knowledge of routing/switching and SolarWinds. CCNP is a required certification.

1 | Page

Site Location Approximate Network Users

The Museum 100 Raoul Wallenberg Place SW (Washington DC)

Ross Administrative Center Adjacent to Museum 100 Raoul Wallenberg Place SW (Washington DC)

Portals 1201 Maryland Avenue and 12th Street NW (Washington DC)

Shapell Center 4800 Marconi Drive (Bowie, Maryland) 75

Regional Offices* (multiple) 30

Remote (remote teleworkers) 125

All contractor staff must remain in compliance with Museum’s annual suitability requirements for badging, network accounts and training.

III. IT MANAGED SERVICE REQUIREMENTS

A. Infrastructure Monitoring and Management

The Contractor shall provide monitoring, incident management, problem management, change management, and IT operations. The Contractor shall perform all tasks and deliverables under the direction of the Museum Technical Monitor(s), providing monitoring, incident management, problem management. The Contractor shall perform the following:

● Manage availability, capacity, environmental, and performance events.

● Provide real-time incident detection, classification, notification, and tracking.

● Provide problem detection, classification, notification, and tracking.

● Conduct incident and problem investigation, diagnosis, resolution, and recovery.

● Provide service trend reports and proactive recommendations based on service health.

● Manage configuration events.

● Manage the change management process.

● Execute patch management to keep systems current on security and functional baselines.

● Own, track, and communicate with third-party providers to restore service and identify root cause.

● Align with Museum change management processes for significant upgrades and consult vendors as required.

● Perform hardware/software upgrades, updates, and bug fixes using the Museum approved software list.

● Coordinate all service outages and updates with the Museum Change Control Board (CCB).

● Provide activity schedules and progress reports for new equipment installations or upgrades.

● Provide documentation on all processes, changes, and implementations.

● Correlate data center alerts (application availability, OS health, memory use) and report adverse situations immediately.

● Provide routine reporting on disk volumes, server utilization, uptime, and health.

● Asset Management: Manage the full lifecycle of IT assets, including inventory receipt, tracking end-of-life inventory, and license audit support.

● Manage and support the cloud-based VoIP infrastructure under the direction of the Museum Technical

Monitor(s). This includes the provisioning, configuration, and troubleshooting of both physical handsets (hard phones) and software-based applications (soft phones) as they are phased in during the contract lifecycle.

● Provide technical support for the Museum Shop’s IT operations, ensuring stable network connectivity and hardware functionality for point-of-sale (POS) environments.

B. Cloud and Web Services

The Museum operates a mixed environment with some on-premise services and cloud-hosted services. The Contractor shall assist in managing current Google Workspace, Amazon Web Services (AWS) environments and other cloud-based subscriptions.

Table 2: Cloud and Web Services

2 | Page

C. IT Managed Service Desk

The Contractor shall provide a customer service desk to respond to calls from Museum users. If this service is provided off-site, the Contractor must also integrate with on-site support and Museum Staff/IT Security Teams. The Contractor shall provide a dedicated, cloud-based Information Technology Service Management (ITSM) solution (e.g., ServiceNow, BMC Helix, or equivalent) to manage all Museum service desk activities.

● Dedicated Instance: The Museum requires a separate, dedicated instance of the proposed software. This instance must be logically or physically isolated from the Contractor’s other client data to ensure data sovereignty, security, and ease of future migration.

● Administrative Access: The Contractor must grant full administrative and Tier 3 access to up to 24 designated Museum staff members. This includes the ability to configure workflows, manage user permissions, and oversee all incident lifecycles.

● Data Transparency & Auditing: The Museum shall maintain full ownership of all data housed within the instance. The Contractor must provide Museum personnel with direct access to the system to perform independent audits, generate custom reports, and conduct compliance reviews.

● Third-Party Collaboration: The instance must support a multi-provider environment, allowing for the onboarding of authorized third-party support teams as identified by the Museum, ensuring a 'Single Pane of Glass' for all technical operations.

The Contractor shall endeavor to resolve tickets (both incidents and service requests) by their operations center. The contractor support should be heavily oriented onsite. Every opportunity to ensure work is performed by onsite technicians first is essential. Incident and Service Request Management will consist of end-to-end coverage of services which are tracked against. comprehensive agreed-upon performance-based Service Level Agreements (SLAs) and Key Performance Indicators (KPIs). All user requests must be documented in the ticketing system at the point of contact.

● Ticketing System: The Contractor may use the proposed ticketing system provided Museum management has full access to the database.

● Service Orientation: Support should be heavily oriented onsite, ensuring work is performed by onsite technicians first whenever possible.

● Scope of Responsibilities:

○ Receive incidents via email, phone, walk-ins, or self-service portal.

3 | Page

Includes monitoring and patching of these systems:

● AWS-related services:

○ Virtual Private Cloud environments (VPCs) Servers (Amazon Linux and Microsoft

Windows).

○ Amazon Machine Instances running in EC2 AWS RDS for MySQL and MS-SQL

Server Simple Storage Services (S3).

○ Amazon Glacier Storage for long-term archival storage.

○ Identity Authentication Management including Windows Active Directory and ADFS infrastructure.

○ Amazon CloudFront content delivery network.

○ AWS service connectivity to third party services (as needed).

● Additional cloud-based services:

○ Google Workspace.

○ Other Museum-supported cloud solutions.

○ All user requests must be documented with the creation of a ticket in the ticketing system at the point of contact.

○ Provide first-call resolution within established SLAs.

○ Perform call logging to document all customer problems and resolutions.

○ Develop and enhance a knowledge database.

○ Escalate all security-related calls to the Museum CISO or IT Security Team.

○ Perform customer quality assurance surveys on all closed tickets.

○ Manage user accounts in AD, including new hire testing and reconcile monthly inactivity reports.

● Knowledge Base: Maintain a web-based knowledge base for self-help and troubleshooting.

● Service Catalog: Maintain a Service Catalog and Self-Service Portal for software and service requests.

● Classify, and prioritize all Customer Incidents and Service Requests.

● Provide first call resolution of Incidents and Service Requests within established SLAs as provided in Table 4 below. If Offeror cannot meet these SLA they should propose an alternative.

● The Contractor shall maintain a knowledge base that enables the sharing of information (such as self-help, troubleshooting, and task resolution articles in web-based, shareable KBs).

● The Contractor shall develop and maintain a Service Catalog to provide users with Self-Service Portals where the Museum customers can request catalog items, such as service, software and product offerings.

● The Contractor shall develop and maintain a Self-Service Portal that supports self-service by the Museum user community. This should include unlocking accounts, password resets or temporary OTP tokens.

The Contractor shall implement a formal Problem Management process to reduce the volume of repeat incidents and minimize the impact of infrastructure failures.

● Root Cause Analysis (RCA): The Contractor shall initiate a Problem Record for any Major Incident (Priority 1 or 2) or for any trend indicating recurring Tier 1-3 issues.

● Proactive Problem Management: The Contractor shall analyze incident data to identify patterns and underlying causes before they result in service interruptions.

● Documentation: Every Problem Record must include a documented Root Cause, a workaround (if applicable), and a permanent "Known Error" entry in the system’s Knowledge Base.

Table 3: Tier 1 End Point Support Numbers and Ticket Numbers / Types

Table 4: SLA Resolution Timeframe

SLA DESCRIPTION TARGET

RESPONSE

TARGET

RESOLUTION

4 | Page

Average Ticket Numbers and Types: (12 months)

● Total Average Monthly Tickets – 1,000

○ Break fix monthly average - 650

○ Service request monthly average – 350

Priority 1 (critical) Business Down: Entire office is offline, server is down, or security breach.

15 minutes 4 hour resolution

Priority 2 (high) Department Down: A group of people can't work; key software is broken.

1 hour 8 hour resolution

Priority 3 (medium) Individual Issue: A single user is hampered but can still do some work.

4 hours 24 hour resolution

Priority 4 (low) Request/Change: New user setup, password resets, software requests, or general questions.

8 hours 72 hour resolution

D. ONSITE SUPPORT REQUIREMENTS

● Onsite support consists of the following:

○ Diagnose, repair and or replace staff members deskside hardware devices.

○ Provide the Museum staff desktop upgrades as necessary or as scheduled due to hardware refresh cycles.

○ Provide onsite printer support to solve printer malfunctions and or consumable replacements.

○ Maintain staged pre-configured inventory levels of staff replacement workstations.

○ Coordinate and prepare any new onboarding staff with their credentials, tokens and workstations.

○ Work with Museum Operations for any staff office moves and upgrades with respect to IT furnished assets.

○ Service and close any on site required incident and service request help desk service tickets.

○ Take receipt of any inventory delivered on site and confirm accuracy of equipment against purchase order.

○ Track and deliver end of life IT inventory to the Museum's operations department.

○ Perform any deskside or onsite staff training as needed.

○ Provide local troubleshooting and support of Museum’s public facing computers.

○ Provide data center physical hardware maintenance for servers, switches, routers, devices and appliances to include failed hardware replacement, physical reconfiguration, deployment, decommission and connection to the network of these devices.

○ Image new hardware using Museum provided standards.

○ Requests for service management (loaner equipment, etc.).

○ Provide periodic training based upon incident trends and commonly known issues.

E. After-Hours and Weekend Support (24x7x365)

Outside of the Standard Business Hours listed above, the Contractor is responsible for maintaining Enterprise Operations and Data Center stability on a 24x7x365 basis.

● Priority 1, 2, 3 Incidents: The Contractor shall provide remote support for all incoming incidents and service requests during after-hours, weekends, and Federal holidays. The Contractor is expected to resolve

5 | Page tickets within these tiers remotely whenever possible.

● Escalation: If a Priority 1 or 2 incident cannot be resolved after hours, it must be escalated immediately.

● Priority 4 Incident Triage: The Contractor shall perform initial triage, document the findings in the ITSM tool, and initiate the provide comprehensive case notes to ensure a seamless hand-off to onsite technicians.

● Critical Infrastructure: Any failure impacting the Data Center, AWS cloud instances, or core networking must be treated as a Priority 1 incident, requiring immediate response or escalation regardless of the hour.

Table 5: On Site Service Hours

F. INFRASTRUCTURE AND EQUIPMENT SUPPORT REQUIREMENTS

The Contractor is responsible for the comprehensive operations and maintenance of the Museum’s on-site infrastructure, including its data center, network, systems, and endpoint hardware. To ensure mission-critical services remain available on a 24 hour x 7 day x 365 week basis, the MSP must provide a combination of on-site and remote monitoring, utilizing an ITSM framework to manage the full lifecycle of incidents and service requests.

While the Museum defines the high-level architecture and security policies, such as the Standard Operation Environment (SOE) and NIST-compliant security controls, the Contractor executes the technical upkeep, including proactive patch management, firmware upgrades, and hardware failure resolution. This partnership ensures that advanced technical skills are applied to incident investigation and recovery across diverse environments, including physical and virtual servers, cloud-based instances, and complex storage solutions like PowerScale and Cohesity.

Table 6: Network, Infrastructure and WAN connectivity

6 | Page

Location Hours/Days

Museum / Ross / Portals 7AM to 6PM Monday - Friday

(Service Desk Manager and Tier 1 and 2 Technicians Onsite)

Shapell Center 8AM to 4PM Monday – Friday

(Tier 1 Technician Onsite)

Regional offices (Remote Support unless otherwise specified)

Enterprise Operations/Data Center

24 x 7 x 365 (After-hours support)

Systems Devices Includes monitoring, management, backup, restore and recovery of the following network systems and devices.

High Speed Network Systems ● 2 Core switches of Cisco Nexus 9504

● 6 TOR switches of Nexus 9K

● 52 Floor switches of Cisco 9300

● 6 External switches of Cisco 9200/9300/9500

● 2 Internet routers of ASR 1000-HX

● 3 ReadingRoom switches of Cisco 1300

● 6 Regional office switches of Cisco 1200/9200/9300

Table 7: Storage, Backup and Recovery

7 | Page

Wi-Fi Systems ● 16 Wi-Fi Switches of Aruba CX6300

● 270 Wireless APs of Aruba IAP-734/735

● HPE Aruba Central Wi-Fi Cloud Management

WAN management to include all WAN connections to and from the Museum (MSP will contact providers on outages and handle restoration of services with after-action reports see item (i) above) WAN/Internet ● ISP connection (6 Internet links)

● Metro Ethernet (among 3 campus sites)

● WAN Connectivity to cloud services (Comcast/Megaport)

● Service provider connections (IBC/Department of Interior)

DAS Support ● Support USHMM DAS (distributed antenna system) in the Museum/Ross and Shapell Center campus

General Functional Expertise (GFE) tools to be provided with full access to Contractor and Museum IT Staff GFE Tools ● Cisco Switch/Router CLI

● HP Switch CLI

● Aruba Central

● TACACS+

● Solarwinds Orion

● Wireshark

Systems Devices

Includes monitoring and management of these systems.

Physical Storage Devices ● Dell PowerScale NAS

● Dell Unity Unified Hybrid Storage Arrays

● LibSafe/LibData Preservation Storage

● EVO Media Storage System for Mac users

(video-graphers and photographers)

● QNAP (EVO Backup)

● Locally attached server storage (QNAP 1 & 20TB device and various USB Drives)

Backup, Restore and Recovery ● Cohesity and associated storage S3 and Glacier management

General Functional Expertise tools to be provided with full access to Contractor and Museum IT Staff .

General Functional Expertise Tools ● OneFS PowerScale Storage Management System

● Cohesity Helios SaaS Management tool

Table 8: Servers and Active Directory

Table 9: Tier 1 End Point Devices

8 | Page

Systems Devices

Includes monitoring, management, backup, restore and recovery of the following systems and devices.

Physical Server ● Dell Servers - physical servers running Windows and Linux

Virtual Servers ● Windows and Linux server

● VMWare hosts - Physical hosts running ESXi managed by VCenter

Database Servers ● Microsoft SQL cluster, database servers and SQL instances

● MySQL database servers

● Oracle Database Servers

Certificate Server ● (3) Certificate Servers

Active Directory Domain Controllers ● (3) Read/Write (Main Museum)

● (2) Read Only (Main Museum)

● (2) Read/Write (Facilities)

Systems Devices

End Point Supported Devices ●Windows PC – 800

● Mac OS Devices – 100

● Network Printers - 96 (HP M651 Series, Canon MFP)

● Desktop Printers (Local)- 20 (HP / Dell Desktop)

● iOS Devices – 150 (iPhones and iPads IOS 13.x)

FUNCTIONAL RESPONSIBILITY MATRIX

The following table outlines the tasks and Subject Matter Expertise (SME) requirements for the MSP laid out against the Museum’s responsibilities:

Table 10: Network Operations Responsibilities Matrix

FUNCTION MSP USHMM DESCRIPTION OF FUNCTION TASKS SUBJECT MATTER EXPERTISE

Active Directory user account management x Provisioning new user accounts;

Disabling accounts, deprovisioning accounts; security group management; supervisory/relational updates.

• Creating new accounts.

• Disabling accounts of departed persons.

• Adding/Removing account to Security and Distribution lists.

• Updating account information (including personal and organization related).

• Password resets.

• Museum-provided SOP, training and guidance.

Active Directory group policy x Develop and maintain GPOs for

Windows devices (onsite + AWS) and

Windows endpoints; auditing.

• GPO Lifecycle & Baseline Development.

• GPO Conflict & Inheritance Optimization.

• GPO Integrity & Security Auditing.

• GPMC

• GPResult

• RSOP

Active Directory monitoring x Monitor AD for user/group/computer object creation and changes.

• Real-Time Object Lifecycle Tracking (Monitoring the creation, modification, and deletion of user, group, and computer objects).

• Privileged Membership Change Alerting (Immediate detection of unauthorized additions to sensitive groups like

Domain Admins).

• Automated Daily CIO Compliance Reporting (Compiling audit logs into a high-level summary of all directory changes for executive review).

• ADAudit Plus

Active Directory service and admin account management x Administrative, service and resource account creation and modification;

any account with elevated privileges.

• Administrative Account Lifecycle.

• Administrative Role-Based Access (RBAC) Mapping.

• Tiered Administrative Model Enforcement.

• Privileged Account De-provisioning & Revocation.

• Service & Resource Account Management.

• Domain Admin & Enterprise Admin Membership Audit.

• Secondary Account (Admin-only) Requirement

• Museum-approved Active

Directory standards and SOP.

9 | Page

Enforcement.

• Stale/Inactive Admin Account Identification.

Active Directory system and server management x System health (FSMO, domain controller redundancy, servers).

• FSMO Role Health & Availability Verification.

• Domain Controller Replication & SYSVOL Integrity Checks.

• DNS & SRV Record Validation for DC Discovery.

• Domain Controller Redundancy & Site Topology Audit.

• Directory Services Database (NTDS.dit) & Log

Maintenance.

AWS Management x To provide operational management, performance optimization, and administrative support for the AWS

Cloud environment, ensuring high availability and cost-efficiency of compute and storage resources.

• Instance Management: Patching, scaling, and lifecycle management of Linux EC2 instances.

• Storage Administration: Management of S3 bucket policies

(non-security), lifecycle rules, and data retrieval optimization.

• Connectivity & Traffic: Management of Route 53 DNS records, health checks, and VPC routing tables.

• Serverless Ops: Monitoring Lambda execution, managing concurrency limits, and troubleshooting code timeouts.

• Workload Monitoring: Real-time performance monitoring

(CloudWatch) and proactive remediation of resource bottlenecks.

• Account Hygiene: Identity and Access Management (IAM) execution (adding/removing users based on approved requests).

• AWS SysOps Administrator level proficiency.

• Linux Systems Administration

(Advanced command-line troubleshooting, shell scripting).

AWS Security

Management x To define the security posture, govern compliance frameworks, and oversee the defensive architecture to protect data integrity and organizational assets.

• Policy Generation: Creation and auditing of Service Control

Policies (SCPs) and high-level IAM permissions.

• Edge Defense: Configuration and rule-tuning for AWS WAF, Shield, and Network Firewalls.

• Vulnerability Management: Overseeing vulnerability scanners (e.g., Inspector, Qualys) and prioritizing the remediation list for the MSP to execute.

• Security Tooling: Management of GuardDuty, Security

Hub, and CloudTrail logging/retention.

• Third-Party Assessments: Coordinating annual penetration tests and SOC2/ISO audits.

• Incident Response: Leading the investigation into security

• AWS Certified Security –

Specialty or equivalent

CISSP-level knowledge.

• Compliance Governance:

Expertise in HIPAA, PCI-DSS, or

NIST frameworks.

• Threat Modeling: Ability to design secure architectures and perform ""well-architected"" security reviews."

10 | Page breaches or unauthorized access attempts.

Backup operations x Scheduling, monitoring, restoring by requests. Annual disaster recovery

(DR) planning exercises, including bare metal recovery of a server. Device maintenance - replacement of failed hardware and firmware upgrades.

Scheduling & Daily Administration:

• Backup Job Window Configuration

• Policy-Based Retention Scheduling

• Deduplication Schedule Optimization

• Copy Job & Offsite Synchronization

Monitoring & Health Checks:

• Daily Backup Success/Failure Review.

• Deduplication Ratio & Space Savings Tracking.

• Data Ingestion & Bandwidth Monitoring.

• Alert Threshold & Notification Tuning.

Restoration & Request Fulfillment:

• File-Level Recovery (FLR) Requests.

• Database & Application Object Restores.

• Instant VM Recovery Orchestration.

• Point-in-Time Data Rollbacks.

Restore Throughput & SLA Validation:

• Annual DR & Bare Metal Recovery (BMR).

• Full-Site Disaster Recovery Exercise.

Bare Metal Recovery (BMR) to Dissimilar Hardware:

• ISO/WinPE Boot Media Creation & Testing.

• Target Host Driver Injection & Alignment.

• Network & Security Re-IP Post-Recovery.

• DR Runbook Validation & Update.

Device & Hardware Maintenance:

• Failed Drive & Power Supply Replacement.

• Controller & Motherboard Swaps.

• Storage Appliance Firmware Upgrades.

• BIOS & HBA Driver Patching.

• Physical Component Health Diagnostics.

• Vendor RMA Coordination & Logistics.

• VCenter

• PowerScale

• OneFS

• EBaaS Cohesity

• CloudSync Solarwinds

• AWS

11 | Page

Cabling maintenance x Cable management for LAN, WAN, and

Internet.

• LAN: Cable runs / replacements for network connections.

• WAN: Circuits monitoring and troubleshooting among

Museum, Portals, and Shapell buildings.

• Internet: Monitor and troubleshoot Internet circuits from

Museum and Shapell buildings, also Public Wi-Fi circuits.

• Call Numbers with accounts

• Solarwinds

DAS framework x Architecture, design and implementation to include ensuring the security specifications and continuous implementation validation.

• Designs network architecture and capacity.

• Plans network coverage.

• Continuous validations.

• Call Numbers with accounts

• Solarwinds

Data Center

Management x Equipment racking, wire management, proper labelling, decommissioning, updating related documentation.

• Standardized Hardware Racking & Mounting (Ensuring all servers, storage, and networking gear are securely installed according to thermal and weight distribution best practices).

• High-Density Wire Management & Dressing (Organizing data and power cabling using horizontal/vertical managers to maintain airflow and prevent accidental disconnects).

• Comprehensive Component & Port Labeling (Applying persistent, standardized tags to all physical assets, patch panels, and power circuits for rapid identification).

• Secure Asset Decommissioning & Data Sanitization

(Executing the physical removal of legacy hardware, including NIST-compliant disk wiping and updated disposal logging).

• Unified Infrastructure Documentation Maintenance

(Updating rack elevation diagrams, port maps, and asset inventories in real-time to reflect all physical changes).

Data Center support x Failed hardware replacement, working with vendors for RMA, equipment and cable labeling. Coordinating all changes with Museum IT staff.

• Hardware Lifecycle & Fault Remediation (Identifying, troubleshooting, and replacing failed physical components including drives, power supplies, and system boards).

• Vendor RMA & Logistics Management.

• Asset Labeling & Cable Management (Maintaining standardized physical identification for all rack-mounted equipment, ports, and cabling to ensure rapid identification during outages).

• ITO Change Coordination & Communication (Scheduling and obtaining approval from museum IT Operations staff for

12 | Page all physical data center modifications to prevent unannounced service disruptions).

• Environment & Rack Capacity Monitoring.

• Assisting ITO staff with Data Center Management (provide support when requested).

Distributed

Antenna System

(DAS) maintenance x Provide day-to-day network operations support, monitor the network’s actual performance and ensure it meets expected service levels.

• Monitor and Manage all DAS systems in the Museum campus and Shapell campus.

• Troubleshooting with vendor on issues that might occur with DAS system.

• Assist with new projects.

• Call Numbers with accounts

• Solarwinds

Endpoint deployment x

Adding baseline image to devices and handing off to customers.

• MSP will create, Manage and Update Baseline Image for all Windows Devices.

• MSP will validate all configured Windows devices Prior to device deployment to users.

• MSP will return all non-assigned devices to the ACR (Asset

Control Room).

Endpoint image creation + maintenance x Creating base image according to

Museum's Standard Operation

Environment (SOE), testing of the proper licensing, sysprepping

Windows and Mac images.

• MSP will create, test, and deploy Windows image using IT

Office standard methodology.

• MSP will create windows image in compliance with

Museum's SOE.

Endpoint maintenance x Troubleshooting and resolving issues with endpoint devices

• MSP will create tickets in the ticketing system to track the progress of the resolution and document trouble shooting.

• Create KB articles when appropriate in ticketing system.

Endpoint security management x Setting IT security recommendations for baseline images.

• MSSP will manage Security Posture of Museum devices to include servers, IOS devices and Mac OS devices and

Windows devices.

• MSSP will be responsible for security tool update notifications.

13 | Page

Incident monitoring + reporting x To act as the primary Technical Service

Desk, responsible for the end-to-end lifecycle of all IT Incidents and

Problems across the global network, including on-premises hardware, WAN/LAN connectivity, and cloud environments, to include ticket assignment and fulfillment.

Incident Management:

• Event Management: Continuous monitoring of SolarWinds and AWS CloudWatch; filtering "noise" from actionable events to prevent alert fatigue.

• Incident Lifecycle Management: Logging & Categorization:

Capturing all incidents in the ITSM tool with standard ITIL classifications.

• Escalation: Ensuring seamless handoffs between Tier 1, Tier 2 /Tier 3 and Vendors.

Problem Management:

• Proactive: Analyzing SolarWinds trend data to identify

"flapping" interfaces or degrading hardware before they cause a failure.

• Reactive: Leading the post-incident investigation for any

Priority 1 or Priority 2 outages.

• Knowledge Management: Maintaining a "Known Error

Database" (KEDB) to speed up resolution times for recurring network issues.

• Major Incident Handling: Facilitating conference bridge participation for critical outages, providing real-time updates to stakeholders until service is restored.

• ITIL 4 Framework: Practical experience in Service Transition and Service Operation.

• Network Infrastructure:

Expert-level knowledge of routing/switching.

• SolarWinds Proficiency: Ability to configure "Alert

Dependencies". An example of this is that there wouldn't be alerts for downstream devices if the core switch went down.

iOS device updates x Security, policy, iOS updates for iPads and iPhones.

•Utilize Museum-approved system (e.g. Jamf) to manage

MacOS and iOS devices

• CCreate standard image/configurations for Mac/iOS devices.

• Manage iOS /OS updates.

• Manage Security standards for Apple devices.

LAN / WAN

framework x Architecture, design and implementation to include ensuring the security specifications and continuous implementation validation.

• Designs network architecture and capacity.

• Plans network coverage.

• Ensure security requirements.

• Defines performance standards (speed, latency).

• Implementation configurations.

• Continuous validations.

• Call Numbers with accounts

• Solarwinds

14 | Page

LAN / WAN

maintenance x Provide day-to-day network operations support, monitor the network’s actual performance and ensure it meets expected service levels.

• Install and configure switches.

• Monitor LAN performance, bandwidth usage, and device health.

• Apply firmware and software updates to switches.

• Diagnose and resolve LAN outages, latency, connectivity issues, hardware.

• Monitor WAN/Internet latency, jitter, packet loss, and throughput.

• Diagnose and resolve WAN outages, routing loops, ISP issues, hardware issues.

• Coordinate with ISPs for circuit installation, upgrades, and troubleshooting.

• Assist with new projects.

• Maintain documentation of all circuits and providers.

• LAN accounts

• Cisco

• Solarwinds

LAN / WAN

security x Provide security recommendations based on industry and government standards.

• Define Security Recommendations.

• Security assessment report.

• Gap analysis vs standards.

• Prioritized recommendation list.

• Call Numbers with accounts

• Solarwinds

Mobile Device

Management x Device enrollment and configuration, application management, compliance and monitoring, and security enforcement.

• Utilize approved systems (e.g. Jamf, Apple Configurator) to create and deploy configuration profiles that mandate encryption, complex passwords, and security settings.

• Ensuring operating systems and applications are updated / patched to resolve vulnerabilities.

• Tracking device locations using GPS / MDM and enforcing remote wipe capabilities.

• Jamf level 300 course certified.

Mobile Device

Technical Support x Assist users with Mobile device issues, providing technical support. Report

Lost or damaged equipment.

Configure MDM profiles on mobile devices in line with organizational standards.

• Create incident tickets for all reported issues with mobile devices

• Track issue until issues is resolved

• Escalate issues to MSSP when appropriate with all relative information documented in the ticket.

15 | Page

Other application server support x To provide comprehensive technical management of third-party hosted applications and vendor-supported systems. This includes maintaining the underlying server infrastructure, executing vendor-supplied updates, and serving as the primary technical liaison to ensure system availability, security compliance, and seamless integration between external software providers and internal business operations.

System Liaison:

• Act as technical lead for 3rd-party vendor calls.

• Manage vendor remote access/VPN.

• Execute annual/quarterly vendor updates.

• Manage SSL certificates and domain renewals.

• Perform OS-level patching and hardening.

• Database Administration:

Understanding of SQL Server for manual update scripts.

• Middleware & Web Services:

Expertise in managing the application tier (IIS, Apache, or

JBoss).

PAM maintenance x To define and enforce the framework for securing, managing, and monitoring escalated accounts and privileges. This role focuses on the

Zero Trust principle of "Least Privilege" and ensuring that all administrative actions are attributable and audited.

• Policy & Architecture: Defining the criteria for what constitutes a "privileged account" (e.g., Domain Admins, AWS Root, Database Superusers).

• Administration: Management of the PAM tool itself including secure storage and rotation policies.

• Access Governance: Conducting monthly or quarterly

"Access Certification" reviews to ensure users haven't retained permissions they no longer need.

• Session Auditing: Reviewing recorded sessions and logs for suspicious activity or policy violations.

• Just-in-Time (JIT) Workflow: Designing the approval workflows where access is granted only for a specific window of time.

• Identity & Access Management

(IAM) Specialist: Deep understanding of SAML, OIDC, Active Directory, and LDAP.

• PAM Tool Certification.

• Regulatory Compliance:

Knowledge of SOX, HIPAA, or

PCI-DSS requirements for

"Administrative Access Control."

Printer and scanner Lifecycle

Management x Manage Asset Audit, Device

Assessment, Configuration

Standardation.

• Capturing all printer models and location.

• Validate printer configurations.

• Manage Printer/Scanner Warranty expiration and renewal.

Printers maintenance x Provide technical support and maintenance for Museum printers to include trouble shooting and configuration.

• MSP will engage existing contract support (maintenance contract for network printers) for toner and printer repairs and supplies.

• MSP will create tickets for all reported issues with

Museum Network printers.

• MSP will utilize the ticketing system to capture all incidents regarding Museum Network Printers.

16 | Page

Scanners and

Printer Support x Provide technical support and maintenance for Museum scanners and printers to include installation, configuration and troubleshooting.

MSP will create tickets to track all printer and scanner issues.

• MSP will create tickets for all reported printer issues.

• MSP will trouble shoot printer issues, update ticket, and update client on status. This Support includes Museum

Network printers, Museum Local printers, Museum Regional office printers.

• Install and configure Museum network printers in line with

Museum standard.

Server deployment x Deploying baseline image, documenting the deployment including all related information (IP, owner, expiration for test instances).

Physical Server Deployment:

• Hardware Rack & Stack.

• Cable Management & Labeling.

• PDU & UPS Power Integration.

• RAID Configuration.

• iDRAC/ILO/IPMI Setup.

• OS Bare-Metal Installation.

• Firmware/BIOS Baselining.

Virtual Server Deployment:

• Resource Allocation (vCPU/RAM).

• Guest OS Template Provisioning.

• VLAN & Virtual Switch Mapping.

• Hypervisor Integration Tools Install.

• Snapshot Baseline Creation.

Cloud Server Deployment (IaaS):

• Instance/VM Size Selection.

• VPC/VNet Subnet Assignment.

• Storage Volume (EBS/Managed Disk) Attachment.

• Public/Private IP Allocation.

Post-Deployment (All Types):

• Hostname & Domain Join.

• Static IP/DNS Registration.

• Security Baseline Hardening.

• Backup Policy Association.

• Documentation & Asset Tagging.

• VMware

• Microsoft Windows Server OS

• Linux

• AWS

17 | Page

Server imaging x Creating baseline image according to

Museum's Standard Operation

Environment (SOE), testing of the proper licensing, sysprepping

Windows and Linux images.

• Baseline SOE Image Development (Building standardized gold images for Windows and Linux based on museum-specific configurations).

• Software Licensing & Activation Validation (Testing and verifying KMS, MAK, or subscription-based licensing integrity within the image).

• OS Generalization & Sysprep Execution (Preparing

Windows and Linux images for deployment by stripping unique identifiers and SID information).

• Driver & Firmware Integration (Injecting hardware-specific drivers to ensure baseline compatibility across physical and virtual platforms).

• Image Integrity & Security Hardening (Applying final security patches and museum-mandated policies prior to final image capture).

• Museum-approved imaging system

• Sysprep

Server maintenance x Upkeep end-to-end operational integrity of all servers in the

Museum's ecosystem to include on-prem, virtual and cloud-based systems.

• Operating System Patching.

• Storage Capacity Monitoring.

• Hardware maintenance.

• Critical Service Restart & Validation.

• Backup Success Verification.

• SSL Certificate Renewal.

• Firmware & BIOS Updates.

• Security Vulnerability Remediation according to MSSP guides.

• Align with Museum server infrastructure.

Server security management x Upkeep security controls in accordance with NIST 800-53, to include setting security requirements for baseline image. Provide immediate notifications to CIO and MSP in case of security incidents leading to server isolation.

• NIST 800-53 Control Mapping & Implementation.

• Baseline Security Image Hardening.

• Continuous Vulnerability Assessment & Remediation.

• Incident Response & Isolation Protocol Execution.

• High-Priority Security Incident Notification.

18 | Page

Share Drives

Architecture and

Provisioning x

How they are designed, named, and provisioned for users.

• Hierarchical Namespace & Folder Structure Design

(Architecting a standardized, scalable directory tree that aligns with Museum departments and cross-functional project workflows).

• Standardized Naming Convention Enforcement

(Developing and applying consistent, intuitive naming syntax for shares and folders to ensure ease of navigation and automated indexing).

• Automated Permission-Based Provisioning (Utilizing

Access-Based Enumeration (ABE) and security group mapping to dynamically present shares to authorized users upon logon).

• Active Directory

• NTFS and Share security

• Group Policy

• Scripting

Share Drives

Security x Audit and remediate shared drive permissions to restrict explicit user-level ACLs, ensuring all access is managed exclusively through security groups to maintain least privileged access.

• Explicit User-Level ACL Auditing & Removal.

• Security Group-Based Permission Mapping (Ensuring all

Read, Change, and Full Control permissions are assigned exclusively to Active Directory Security Groups).

• Least Privilege Access Baseline Enforcement.

• Recursive Permission Integrity Verification (Identifying and fixing "broken" inheritance or orphaned ACLs to maintain a consistent security posture across the directory tree).

• Active Directory

• NTFS and Share security

Share Drives support x Maintain proper user access to shared resources, troubleshoot and resolve access issues.

• Access Entitlement & Permission Fulfillment (Processing requests for folder access by applying the appropriate

Security Groups according to established RBAC policies).

• Cross-Protocol Access Troubleshooting (Resolving connectivity and permission issues across SMB, NFS, and

DFS namespaces, including "Access Denied" errors).

• Effective Permissions Audit & Remediation (Investigating and fixing discrepancies between NTFS and Share-level permissions to ensure expected user access).

• Active Directory

• NTFS and Share security

Storage Framework x Selection of a storage platform, defining core partitions and designations. Planning and expanding capacity as needed.

• Storage Platform Selection & Architecture Design.

• Core Partitioning & Volume Designation Mapping.

• Proactive Capacity Planning & Forecasting.

• Non-Disruptive Storage Expansion Execution.

• Performance Baseline & Resource Optimization.

• Cohesity

• Industry trends and solutions.

19 | Page

Storage maintenance x Monitoring, access provisioning according to least-required principle, maintaining proper access control list.

Monitoring & Health Oversight:

• Storage Array Performance Analysis.

• IOPS & Latency Trend Monitoring.

• Available Capacity & Thin Provisioning Tracking.

• Hardware Component (Disk/Controller) Status Review.

• Deduplication & Compression Ratio Monitoring.

• System Log & Event Audit Review.

Access Provisioning & Least Privilege:

• iSCSI Target & Initiator IQN Mapping.

• Role-Based Access Control (RBAC) Implementation.

• Stale Account & Orphaned Access Removal.

ACL & Permission Management:

• NTFS/UNIX Permission Granularity Review.

• Inheritance Breakage & Cleanup Operations.

• Recursive Folder Permission Auditing.

• Security Group Nesting Optimization.

• Root & Admin Share Access Restriction.

• VCenter

• PowerScale

• OneFS

• Cohesity

• Digital Preservation Storage

Array

• Management Console

• Solarwinds

Storage Security monitoring x Monitor storage for excessive and improper ACL. Report findings to CIO.

• Automated ACL Drift & Excess Detection.

• Improper Access & "Everyone" Group Auditing.

• Privileged Data Access Logging & Review.

• Inheritance & Permission Consistency Checks.

• CIO Security Posture Reporting.

• Storage Architecture & File

Systems

• Identity & Access Management

(IAM)

• Automation & Scripting

Wi-Fi Framework x Architecture, design and implementation to include ensuring the security specifications and continuous implementation validation.

• Designs network architecture and capacity.

• Plans coverage (no dead zones).

• Ensure security requirements.

• Defines performance standards (speed, latency).

• Continuous validations.

• Aruba Central

Wi-Fi Operations x Provide day-to-day network operation support, monitor the network’s actual performance and ensure it meets expected service levels.

• Maintain wireless infrastructure.

• Monitor wireless performance, client behavior, and AP health.

• Diagnose and resolve connectivity issues, authentication failures, RF interference, Hardware issues.

• Apply firmware and software updates to switches/WAPs.

• Aruba Central Cloud

Management.

• Solarwinds.

20 | Page

• Maintain wireless network diagrams, RF maps, and configuration records.

• Assist with new projects.

• Report security issues to CISO.

Wi-Fi Security x Provide security recommendations based on industry and government standards

• Define Security Recommendations.

• Security assessment report.

• Gap analysis vs standards.

• Prioritized recommendation list.

• Aruba Central

21 | Page

IV. Museum Technical Monitoring And Oversight The Museum will designate one or multiple Technical Monitors (TMs) to serve as the primary points of contact and provide technical oversight of the Contractor’s performance.

1. Area of Responsibility:

○ The Museum reserves the right to assign separate Technical Monitors based on specific areas of responsibility (e.g., On-Site Infrastructure, Network Operations, or Endpoint Management). The Contractor shall coordinate with the specific TM assigned to the relevant functional area.

2. Oversight and Coordination:

○ The TM(s) will facilitate coordination between the Contractor and other Museum units, including the IT Security and Disaster Recovery teams, to ensure the Contractor provides necessary access, logs, and system information required for those specialized functions.

3. Change Control and Review:

○ The TM shall review all Contractor-submitted change requests for technical accuracy and potential impact prior to their presentation to the Museum’s Change Control Board (CCB).

4. Performance Verification:

○ The TM will perform periodic audits of the Contractor’s adherence to the software whitelist, patch management baselines, and maintenance schedules to ensure alignment with Museum standards.

5. Contractor Accountability:

○ While the Contractor maintains ownership of incidents and third-party provider tracking, the TM shall be the final authority on whether a resolution meets the Museum’s operational standards and functional requirements.

6. Communication Bridge:

○ The TM will serve as the escalation point for the Contractor when third-party maintenance providers (e.g., Dell, HP, Microsoft) fail to meet the objectives associated with the data center, network, or endpoint services.

V. GENERAL DELIVERABLES

The following describes general deliverables required under this performance-based contract for IT Managed Services. All deliverables shall be provided in electronic format using the Museum’s standard software packages. The Contractor shall maintain an electronic copy of each deliverable on a shared drive that is accessible to the Museum Contracting Representative (COR) or delegate. This drive will contain a separate directory established as a repository for all deliverables.

1. Daily Status Update

○ Objective: Intention is to have the Service Desk Manager provide a daily mid-day status report on the top three issues being encountered by the Service Desk so far that day.

○ Content Requirements: The report needs to identify and describe the top three issue types, citing ticket numbers, user names and timeframes.

○ Data Points: The report will be provided textually via email to the CIO and other identified parties.

2. Weekly Action Tracking Reports

○ Objective: To ensure that change request KPIs are met and that all items are completed within Museum project timelines and policy guidelines.

○ Content Requirements: The report must group items by "Completion" or "Pending" status.

○ Data Points: For each item, the Contractor shall include the change request action item, the date initiated by the Museum COR, the assigned team member, the target completion date, and the actual implementation date.

3. Monthly Labor Summary Reports

22 | Page

○ Objective: To ensure support hour expectations are met, facilitate the audit and payment of invoices, and assist in forecasting future headcount needs based on demand.

○ Format: The report must be submitted in a spreadsheet format providing hours worked for the month.

○ Categorization: Hours must be broken out into three sections: Regular Hours Billed, Extended Hours Billed, and the distribution of each individual employee’s hours across varying service areas.

○ Required Attachments: The Contractor must attach Daily Time and Attendance Sheets and Sign-In/Sign-Out Logs for the month to verify the totals.

○ Discrepancy Reporting: The Contractor must note and provide explanations for any discrepancies between summary reports and daily attendance logs.

4. Monthly Status Reports

○ Objective: To track the status of tasks and projects to ensure deadlines and performance-based contract requirements are satisfied.

○ Workload Statistics: The report must detail significant activities by technical area and include specific service statistics for telephone calls, walk-in customers, on-site support, equipment loans, and product evaluations.

○ Deliverable Tracking: Include a list of deliverables submitted for review, those currently outstanding, and those due in the next reporting period.

○ Staffing & Issues: Document any staff changes or development, significant problems encountered or resolved, and proactive recommendations for improving service.

○ Comparative Analysis: The report shall include appropriate graphical representations of data, comparing the current month's figures to cumulative year-to-date statistics and prior-year data.

5. Ticket Tracking System Modifications and Trend Analysis

○ System Maintenance: The Contractor shall routinely modify the proposed Ticket Tracking

System to improve service management, including updates to programs, data entry screens, and report formats.

○ Trend Analysis Report: At the conclusion of each contract year, the Contractor shall provide a report containing graphs and narratives depicting the number of reports of contact by month, contacts by problem category, and specific recommendations for infrastructure improvement.

VI. PROJECT DELIVERABLES

A. Project Management Plan (PMP)

The comprehensive PMP is due within one week of contract award and must serve as the primary mechanism for measuring performance against the Service Level Agreement (SLA). The plan shall include the following six critical sections:

1. Project Management & Organization Section:

○ Organizational Chart: A detailed chart identifying all managerial positions, including Title, Name, area of responsibility, and authority levels.

○ Communication Lines: Defined methods for ensuring timely support from management and specific identification of managers authorized to discuss performance issues with the Museum

COR.

○ Progress Monitoring: Descriptions of communication protocols, including the frequency and format of meetings and progress reports.

23 | Page

○ Security & Suitability: Procedures to ensure all staff comply with Museum-specific personnel security and suitability requirements.

2. Workload Management Section:

○ Methodologies: Comprehensive narratives describing the methodologies for assigning, performing, and ensuring the completion of work in each technical area.

○ Work Breakdown Structure (WBS): A detailed WBS identifying all tasks, subtasks, and interdependencies across all technical service areas.

○ Constraints: Explicit identification of assumptions and constraints relative to the work performed.

3. Staffing Section:

○ Leadership Structure: Identification of Supervisor or Team Leader positions, including their specific authorities and backup procedures for handling unscheduled absences.

○ Resource Loading Chart: A matrix identifying personnel by name, position, and labor category, including total hours and a breakout of…