EXIM17Q0075_Attachment_1_Statement_of_Work.pdf

Attachment 1 EXIM17Q0075 IBM Software Tool

IBM IDENTITY GOVERNANCE & INTELLIGENCE TOOL

PROFESSIONAL SERVICES

STATEMENT OF WORK

19 JULY 2017

1. General The Export-Import Bank of the United States (EXIM Bank) is an independent U.S.

Government agency that helps finance the overseas sales of U.S. goods and services. To accomplish its mission of creating and sustaining jobs through exports, the Bank provides loans, loan guarantees and insurance products. The Bank provides export credit insurance to help U.S. exporters develop and expand their overseas sales by protecting them against loss should a foreign buyer or other foreign debtor default for political or commercial reasons and assists exporters by guaranteeing term financing to creditworthy international buyers for purchases of U.S. goods and services.

EXIM Bank is currently replacing its legacy financial Application Processing System (APS) which is over 30 years old with its C3 – Case, Creation & Collaboration application, which is currently in development and is built on J2EE/Oracle architecture. C3 system will be accessible by the Bank’s external/internal customers and will provide full lifecycle workflow for authorizing Direct Loans, Loan-Guarantees, and Working Capital Guarantees.

2. Scope The Office of the Chief Information Officer (OCIO) is requesting full-time on-site professional services expertise for the installation and configuration of IBM’s Identity Governance Intelligence/Security Directory Integrator Tool for secured internal/external user provisioning in C3 application and over the shoulder training/transition for EXIM’s IT staff.

3. Task Requirements

Contractor shall:

1) Architecture

a. Develop IGI on premise architecture that compliments C3 requirements.

b. Architecture will include IGI/SDS integration with ISAM/AD/LDAP/WebSphere

Application Server (WAS)

c. Architecture should include EXIM licensed software like Database, VMWare, WAS, ISAM, AD, ODSEE, ISDS.

2) Build POC Test Environment and Production Environment.

a. Build a test IGI/SDS environment where IGI will connect with Database, Servers, ISAM, WAS, LDAP, AD server.

b. Implement Provisioning and De-provisioning Workflows.

c. Enforce identity management governance to manage internal/external user’s identity lifecycle from start to finish in an effective and efficient manner

d. Implement Approval, Denial and Delegation Workflows.

e. Implement Sync between AD and LDAP servers.

f. Configure Audit reporting.

g. Configure email notifications for assignments, approvals and delegations.

3) Proof of Concept

a. Demonstrate the Proof of concept environment to EXIM management and Business.

b. Build production environment upon EXIM’s IMT Security Management Approval.

4) Build Disaster Recovery environment

a. Build and configure Disaster Recovery (DR) environment exactly like Production

(PROD).

b. Configure LDAP/AD Replication

c. Configure IGI/SDS sync between PROD and DR.

d. Setup Server Configuration replication between PROD and DR.

5) Documentation

a. Write SOP documentation to support and maintain the environments post implementation.

b. Write procedural documentation to build & deploy similar environments in other areas at EXIM.

c. Write a technical road map document to integrate Identity Governance tool with EXIM’s Financial Management System (FMS) which runs on Oracle E- Business Suite version# 12.2.6 and managed by Oracle Managed Cloud Services. Purpose is to establish a single administration console to grant EXIM’s internal users access to FMS system.

6) Audit Reports

a. User Access Provisioning, de-provisioning, inactivity, lockouts, password changes, password policy, etc.

b. Access Approval/Delegation/Denial/pending Info

c. User Access ACL Info to the resources (c3 resources in this case)

d. Admin Accounts provisioning info like Sec_Master, Root, Admin, Wasadmin, Directory Manager, etc.

e. Privileged Access provisioning and de-provisioning info like user getting escalated access rights above admin accounts.

f. Trusted Service account information like AD, LDAP, WAS, ISAM, Documentum, DB, TAI++ trust user, AAC trust user, VMWare accounts

g. External user Information like inactivity, password changes, password policy, locks out.

h. Roles Assignment and removal Information for C3 Internal and external users.

i. Internal Users Multi Role, Switch Role Information and frequency.

4. Quality Assurance The Contractor shall apply the appropriate engineering, analytical, statistical, and managerial disciplines to ensure that the processes and products applied to all tasks in this statement of work result in the delivery of quality product.

4.1 Testing

a) The Contractor shall perform & assist in successful component and integration testing with the C3 application in test environment to ensure secured, role-based and approved user provisioning within Identity Governance Tool is occurring with appropriate level of access & roles/responsibilities defined as per C3 application.

b) Contractor shall confirm during testing that adequate auditable artifacts are being generated in the Identity Governance tool and can easily be produced in the form of reports or other format for EXIM’s independent audit inquiry.

4.2 Section 508 Compliance

The Contractor shall comply with Section 508 of the Rehabilitations Act (29 U.S.C. 749d), as amended by Public Law 106-246.

5. Key Personnel:

(a) In order to ensure a smooth and orderly start-up of work, it is essential that the key personnel identified be available on the effective date of this task order. If these personnel are not made available at that time, the Contractor shall notify the Government CO and show cause. Failure of the Contractor to not show cause may be taken as admission that no valid cause or explanation exists, and the Contractor may be subject to default action.

(b) The key personnel are considered essential to the work being performed. Unless otherwise agreed to in writing by the CO, the Contractor shall be responsible for providing such personnel for performance for the term required. The Contractor shall not on their own volition remove or replace any personnel designated as "key" personnel, for this task order, without the written concurrence of the cognizant CO.

(c) Contract Key Personnel

The Government has identified the following Contractor’s personnel as key personnel for overall administration and responsibility for this task order:

• One (1) Cyber Security Professional

(d) Key Personnel Qualifications

• Understand architecture, administration, and management of operating systems, networking, and virtualization software

• General programming/software development concepts and software analytical skills

• Proficiency in programming in Java, C/C++, disassemblers, and assembly language and programming knowledge of two or more scripting languages (PHP, Python, Perl, or shell)

• Deep understanding of different type of firewalls, network routers and switches

• Web Application Technology

• Linux Operating System

• Open Source Application

• Understand the architecture of systems and network including identifying the security controls in place and how they are used

• Ability to clearly articulate complex concepts both written and verbally

• Excellent presentation and communications skills to effectively communicate with management and customers

6. Period of Performance The period of performance is anticipated to extend from September 20, 2017 to November 30, 2017.

7. Deliverables

Deliverable When Due

Standard Operating Procedure (SOP) documentation Due at the end of the project

Technical Road Map document to integrate Identity Governance tool with EXIM’s Financial Management System (FMS) which runs on Oracle E-Business Suite version# 12.2.6 on Oracle Managed Cloud.

Due at the end of the Project

Transition Manual for EXIM IT staff Due at the end of the Project