GSP Scope Document _ July 2021.pdf

DAD IO/J-6

Geographic Service Providers

(GSP)

Scope Document

DAD IO/J-6 Geographic Service Providers (GSP) Scope Document

Table of Contents

1 Purpose

1.1 Background

1.2 Problem Statement

1.3 Scale of Requirements

1.4 Future State

1.5 Goals

1.6 Assumptions and Constraints

2 GSP Scope

2.1 Services Out of Scope

2.1.1 Cyber Security Service Provider (CSSP)

2.1.2 Med-COI Wide Area Network (WAN) Engineering and Cyber Operations Support

2.1.3 Facility Management

2.1.4 DISA-provided Services

2.2 Geographic Service Providers (GSPs) Scope Overview

2.3 Current Contractor Labor Categories In Scope

2.4 Specific Tasks by Labor Categories In Scope

1 Purpose

The Geographic Service Provider (GSP) purpose is to realize the Deputy Assistant Director Information Operations Directorate (DAD IO)/J-6 mission to standardize and provide a robust and highly available IT support services at Medical Treatment Facilities (MTFs) and Other Lines of Business (OLB).

1.1 Background

The DHA is the “centerpiece of MHS governance reform” (Deputy Secretary of Defense March 11, 2013, memorandum, Implementation of Military Health System Governance Reform) with the intention of tighter integration of healthcare delivery systems to achieve medical readiness, improve health of people, enhance experience of care, and lower healthcare costs. As a result, the Department of Defense (DoD) began a multi-year transition of MTFs from the military departments to the DHA for the purposes of implementing an integrated system of readiness and health required by sections 702 and 703 of the FY 2017 National Defense Authorization Act (NDAA) and updated in sections 711 and 712 of the FY 2019 NDAA.

Consistent with NDAA mandates, DHA established the MHS Enterprise Information Technology Services Program Management Office (EITS PMO) to provide a framework for transforming MHS IT from the current decentralized model to centralized management and coordination with distributed delivery. The MHS EITS strategy includes three major components: EITS Integrator (EITSI), Capability Service Providers (CSPs), and GSPs.

1. The EITSI contractor specializes in coordination, integration, and management activities and replaces certain existing Enterprise contracts, including the DHA Global Service Center (GSC). The EITSI acquisition is currently under evaluation with award planned for 4th Quarter FY21.

2. Capability Service Providers (CSPs) are specialist contractors that provide a particular IT capability and provide it to the entire MHS Enterprise.

3. Geographic Service Providers (GSPs) are contractors that perform a wide variety of IT tasks and services for MTFs/OLBs spanning a defined geographic area.

1.2 Problem Statement

IT support services at the MTFs and OLBs are one of the largest IT cost drivers for DHA. IT support services are not currently standardized across the MHS. The DHA seeks to harmonize delivery of IT support services to MTFs/OLBs, therefore, maximizing efficiency and providing responsive IT support capability to optimize processes, staffing, and tools.

Currently the contracted IT support capabilities across MTFs and OLBs are decentralized and predominately managed at the local level. The capabilities vary by MTF/OLB size and generally include the following IT services scope areas:

1. Local IT Service Desk Support Services

2. Application and Web Development Support Services

3. Identity Management and Windows Desktop Support Services

4. Data Center Operations Support Services

5. Information Assurance Support Services

6. Network Operations Support Services

7. Telecommunications (Analog and Digital) Support Services

8. Clinical Informatics Support Services

9. Information Business Operations

There are approximately 103 contracts with a total annual value of $146M across 65 MTFs and 10 OLBs worldwide; 85 of the 103 (~83%) fall into the small business category.

1.3 Scale of Requirements

The DHA IT Enterprise supports multiple Continental United States (CONUS)/Outside the Continental United States (OCONUS) MTFs/OLBs, of which half are inpatient facilities and half are smaller or ancillary facilities including clinics and administration or educational research installations.

Key attributes of this requirement are:

1. Number of physical buildings: ~1,200

2. Number of network connected devices: ~850,000

3. User base, half of which are healthcare providers: ~250,000

4. Service Desk (GSC) calls per month: ~90,000 (~2,600 are for Tricare On-Line support)

1.4 Future State

The MHS EITS framework will transform the way DHA provides IT support services across the enterprise. The EITSI, which is based on the Multisourcing Services Integrator (MSI) model, provides the governance structure to promote the transformation efforts while the Service Providers, including the GSP(s), provide IT services to the MTFs/OLBs based on best business practices while maintaining acceptable service levels and performance metrics.

1.5 Goals

The overall goals of this effort are to enable the DAD IO/J-6 to reduce variability through standardization of IT service delivery and support processes, provide high quality services, and realize cost efficiencies.

1.6 Assumptions and Constraints

1) DHA will minimize risks to overall service performance, availability, and component and service capacity/demand management.

2) DHA will continue to deliver shared services equal to or better than existing capabilities and service expectations, such that Customers do not experience reduced service performance that could impact their operations.

3) Contracted Service Provider activities will be coordinated through an Enterprise IT Services Integrator (EITSI) for use of common processes, common tools, common operational governance, and common service performance and reporting. Service Providers will have Operating Level Agreements (OLA) with the EITSI that govern their mutual performance and accountability for delivery to DHA.

4) The Enterprise will be on a standardized transport via Multiprotocol Label Switching cloud network known as the Medical Community of Interest (Med-COI) and operating on the Medical Joint Active Directory (mJAD). Med-COI is the common network transport for MHS services. mJAD provides single common authentication and centralized identity management framework for the MHS.

5) Adhere to existing DHA DAD IO/J-6 governance processes.

6) Operations will leverage standardized enterprise management (EM) tools, as selected by the DAD IO/J-6 Enterprise tools rationalization process.

7) Tools such as Microsoft Systems Center Configuration Management (SCCM), System Center Operations Manager and Tanium will continue to be used to routinely inventory, centrally manage and deliver digital content (patches, software or updates) through distribution points and ensure all device end-points are visible by the Global Network Operations Center (GNOC). These Enterprise tools may change in the future.

8) Adhere to existing key performance indicators defined within approved service level agreements, memorandums of agreement, or other approved service levels.

2 GSP Scope

Figure 1 depicts in-scope and out-of-scope services for the GSP, including which services are provided locally and/or at the Enterprise level.

Figure 1: GSP Scope

2.1 Services Out of Scope

2.1.1 Cyber Security Service Provider (CSSP)

CCSP includes external vulnerability scans, web vulnerability scans, Malware notification protection, network security monitoring, warning intelligence, attack sensing and warning, incident reporting to Joint Force Headquarters DoD information network incident response support, penetration testing and Red Team Operation Plus.

2.1.2 Med-COI Wide Area Network (WAN) Engineering and Cyber Operations Support

Med-COI WAN includes engineering and Cyber Operations Support of Med-COI Gateway infrastructure located at nine region offices and 150 (or more) network protection suites located at organizations below the Med-COI Gateways. Also out of scope is the engineering of network devices operating above the organization local area network (LAN). Those devices include:

routers, virtual private networks, remote access appliances, firewalls, web caches, content filtering devices and load balancers. Generally, any network device above the organizational core switch falls under the auspices of Med-COI and is therefore, considered out of scope for engineering and Cyber Operations Support. This should not be confused with Med-COI standard Network Operations (NetOps) and Sustainment responsibilities, which are in scope.

2.1.3 Facility Management

Facility Management is the responsibility of the Assistant Director Management/Component Acquisition Executive, Deputy Assistant Director Administration and Management, J-1. This responsibility is carried out by the Infrastructure Support Division which operates and maintains the DHA and Defense Health Headquarters (DHHQ) facilities, telecommunications and day-to-day operational assistance for community services and asset management.

2.1.4 DISA-provided Services

DISA-provided services are out of scope for the GSP.

2.2 Geographic Service Providers (GSPs) Scope Overview

Geographic Service Providers (GSPs) are contractors that perform a wide variety of IT tasks and services for MTFs/OLBs spanning the globe and organized by optimum geographical areas (e.g., East, West, Europe, and Indo-Pacific). The GSPs will provide IT support capabilities required to execute enterprise functions. GSP services are meant to complement enterprise services but not replace them.

2.3 Current Contractor Labor Categories In Scope

The following represent examples of workforce categories at MHS sites; note not all sites will require all or the majority of labor categories listed below:

1) Local IT Service Desk Support Services; IT Help Desk Support Services encompasses, but is not limited to:

a. Help Desk Supervisor

b. Help Desk Technician-Tier 1

c. Help Desk Technician-Tier 2

d. Help Desk Technician-Tier 3

e. Queue Manager

f. Knowledge Base Manager

g. Change Management Manager

h. Process Manager

i. Continuous Improvement Manager

j. Problem Management Manager

2) Application and Web Development Support Services; Application and Web Development Support Services encompasses, but is not limited to:

a. Internet Information Services (IIS) Administrator (Junior, Mid, Senior)

b. Apache Administrator (Junior, Mid, Senior)

c. Application Developer (Junior, Mid, Senior)

d. Database Administrator (Junior, Mid, Senior)

e. SharePoint Developer (Junior, Mid, Senior)

f. Web Developer (Junior, Mid, Senior)

3) Identity Management and Windows Desktop Services; Identity Management and Windows Desktop Services encompasses, but is not limited to:

a. Windows Server Administrator (Junior, Mid, Senior)

b. Windows Desktop Administrator (Junior, Mid, Senior)

c. Windows Data at Rest (DAR) Administrator

d. Windows Directory Services Administrator

e. End Point Manager System Center Configuration Manager (SCCM) (Junior, Mid, Senior)

f. End Point Manager Tanium (Junior, Mid, Senior)

4) Data Center Operations Support Services; Data Center Operations Support Services encompasses, but is not limited to:

a. Windows Server Administrator [includes file, print server, dhcp mgmt.] (Junior, Mid, Senior)

b. Linux Server Administrator (Junior, Mid, Senior)

c. VMWare Virtualization Administrator (Junior, Mid, Senior)

d. Citrix Application Virtualization and Desktop Administrator (Junior, Mid, Senior)

e. Datacenter Facilities Manager (Junior, Mid, Senior)

f. Datacenter Storage & Backup Administrator (Junior, Mid, Senior)

g. Data Center Infrastructure Engineer (Junior, Mid, Senior)

5) Information Assurance Support Services; Information Assurance Support Services encompasses, but is not limited to:

a. Information Systems Security Manager (Mid, Senior)

b. Information Systems Security Officer (Mid, Senior)

c. Information Assurance Analyst (Junior, Mid, Senior)

d. Information Assurance Database Administrator (Junior, Mid, Senior)

e. Information Assurance Engineer (Junior, Mid, Senior)

f. Technical Writer (Junior, Mid, Senior)

6) Network Operations Support Services; Network Operations Support Services encompasses, but is not limited to:

a. Cable Installers (Junior, Mid)

b. Local Area Network (LAN) Administrator (Junior, Mid, Senior)

c. Wireless Local Area Network (WLAN) Administrator (Junior, Mid, Senior)

d. LAN Engineer (Junior, Mid, Senior)

e. WLAN Engineer (Junior, Mid, Senior)

7) Telecommunications (Analog and Digital) Support Services; Telecommunications Support Services encompasses, but is not limited to

a. Cable Installers (Junior, Mid)

b. VOIP Server Administrator (Junior, Mid, Senior)

c. VOIP Engineer (Junior, Mid, Senior)

d. Telecommunications Technician (Junior, Mid, Senior)

e. VTC Help Desk Manager

f. VTC Support Specialist

g. VTC Support Specialist (Senior)

h. Mobility Administrator (Junior, Mid, Senior)

8) Clinical Informatics Support Services; Clinical Informatics Support Services functionally encompasses, but is not limited to:

a. Clinical Application Trainers

b. Clinical Database Administrator

c. Clinical Workflow Analyst

d. Informatics Specialists

e. System Architects (Junior, Mid, Senior)

f. System/Server Engineer (Junior, Mid, Senior)

g. Information Business Operations

9) Information Business Operations

a. Financial Analyst (Junior, Senior)

b. IT Business Management Analyst (Junior, Senior)

c. Project Coordinator (Junior)

d. Program and Project Manager (Junior, Senior)

2.4 Specific Tasks by Labor Categories In Scope

1) Local IT Service Desk Support Services:

a. The Contractor shall provide all levels of IT support services for users across the organization, via Call Center Support, One-Stop-Shop Support, or Desktop Field Support.

The Contractor will provide assistance to users through multiple channels (telephone, online tickets, in-person, and appointments) to resolve any technical issues that may arise.

The Contractor will also log, track, resolve and report support tickets in help desk solutions systems identified by the MHS. The Contractor will integrate Help Desk support services with existing DHA enterprise help desk capabilities.

b. The Contractor shall provide mobile device management for all wireless handheld devices authorized to be on the customer network, including, but not limited to, cell phones, smart phones, tablets, pagers and mobile wireless fidelity hotspots (MiFi). Support related to mobile devices shall also encompass user account management, request and troubleshooting support, and asset management. The contractor shall assist in the acquisition, installation, operation, management, and maintenance of all organizational desktops, laptops, tablets and printer devices. The contractor shall provide support in asset management, inventory control, DRMO, warehouse management, laptop/desktop imaging, laptop issuance/setup and maintenance, and print server management and maintenance. The contractor shall maintain and refresh inventory reports of all end-user devices and associated components. The contractor shall evaluate new and existing device technologies and ensure alignment with enterprise initiatives. The contractor will lead and complete any hardware/software refresh deployments across the organization.

2) Application and Web Development Support Services

a. The Contractor shall provide applications, database administration, and web development services to meet the needs of multiple levels within the organization. The Contractor shall create, administer and support custom web and scripting applications using platforms including, but not limited to, SharePoint, .ASP, .NET, and/or JAVA. The Contractor will also provide SME support in the planning, analysis, development, testing and implementation of various commercial off the shelf (COTS) and custom web applications, as well as provide recommendations and insight regarding the acquisition and integration of any identified third-party packages. Support in this area shall include the breadth of the Software Development Lifecycle (SDLC), including: process definition, requirements management, project planning, quality assurance, metrics, testing, certification, validation and verification, architecture and reengineering, security and configuration management.

3) Identity Management and Windows Desktop Services

a. The Contractor shall provide architect, design, document and assist the engineering of a directory service infrastructure, founded on Microsoft Active Directory Services and associated products, including structural layout and services descriptions and required supporting elements to enable a capability that provides global identity management services across DHA Enterprise, including but not necessarily limited to medical treatment facilities, medical applications across the DoD medical department of Veterans Affairs (VA) facilities.

b. Design, architect document and assist the engineering of a methodology, system and database infrastructure to support data maps to authoritative identity data and system attributes consumed from DoD Identity and Access Management (IdAM) portfolio into the mJAD environment using Microsoft Active Directory Lightweight Directory Service

(ADLDS).

c. Design, architect, document and assist the engineering and integration into the MedCOI and JIE-SSA network and security architecture.

4) Data Center Operations Support Services

a. The Contractor shall provide server storage service support, including after-hours on-call support, to the storage system solution in place. The Contractor shall assist in the monitoring of physical and virtualized environments focused on health, capacity, utilization, performance, and security. The Contractor shall log and monitor disruptive incidents, changes and problems, service-level compliance, operational improvement processes, approaching events, ongoing progress, service reports, improvement processes, annual plans, annual evaluations, and other relevant studies. The contractor shall deploy enterprise-level technical updates, changes, patches, and enhancements across the organization. The contractor shall analyze organization/user requirements to automate or improve existing systems and enterprise infrastructure and capabilities. The contractor shall provide data science capabilities to analyze large, complex data sets and leverage industry technologies to interpret and understand data structure and metrics.

b. The Contractor will provide oversight and responsibility of Data Center projects to ensure they align correctly with organizational requirements, specifically those related to server backup, storage, and infrastructure. This position will be required to manage interdependencies between various teams and projects in the planning, design, implementation, operation, and management of IT solutions.

c. The Contractor will provide continuous operations and maintenance support of the Data Center infrastructure, including responsibility for lifecycle management, storage administration, backup, recovery and archival services, monitoring, and business continuity support as defined by DoD standards.

d. The Contractor will provide continuous operations and maintenance support for System Center Configuration Manager (SCCM) environment. They will be responsible for guiding and maintaining all aspects of the Microsoft SCMM environments operating within the organization, including security architecture, role based access, server infrastructure, administrative console, boundaries, client settings, software/hardware inventory, software distribution, patching, imaging, reporting, health monitoring and alerting.

5) Information Assurance Support Services

a. The Contractor shall provide support in all areas of Information Assurance and Cybersecurity tailored to a DoD healthcare environment. The Contractor shall ensure the organization is compliant with the DoD Risk Management Framework (RMF) guidelines and other mandates including HIPAA. The contractor shall develop RMF accreditation packages and maintain Authorization to Operate (ATO) certifications for networked systems and applications used by the organization. The contractor shall contribute to the verification and validation of system security posturing, risk assessments, security testing and evaluations, and contingency planning. The contractor shall support cybersecurity threat monitoring, including system scanning and risk identification and mitigation. The contractor shall develop, coordinate, and deliver enterprise-level security engineering solutions. The contractor shall develop and lead cybersecurity and information assurance trainings and seminars for organizational system administrators and other users.

6) Network Operations Support Services

a. The Contractor shall provide comprehensive network operations, installation, monitoring and maintenance support to networks residing on customer premises. The contractor will provide ongoing management and maintenance of network infrastructure. Networks to be supported will include Integrated Delivery Network (IDN), LAN, WLAN, SIPRNet, NIPRNet and others. Support shall include monitoring actions, such as administration, installation, configuration, testing, and troubleshooting; as well as strategic actions, such as the planning, design, and implementation of new networks, network modifications, infrastructure, and solutions. The contractor shall provide information assurance and cybersecurity monitoring and hardening across the network.

7) Telecommunications (Analog and Digital) Support Services

a. The contractor shall accomplish work processes through the use of telecommunications devices, methods, services, and facilities. The contractor will ensure telecommunications services are in compliance with applicable regulations. The contractor will support cable/wire/patch management (vertical and horizontal), configuration standards within communication/data closets, and inside plant (ISP) outside plant (OSP). The contractor shall support the operations of telecommunications infrastructure already in place. The contractor shall coordinate with clients to assess technology needs, providing technical information or assistance, resolve related problems. The contractor shall support IT site surveys as sources of technical data to evaluate new devices, proposals, and approaches for satisfying communications requirements. The contractor shall provide support on all IT systems residing both on premise, and beyond the carrier demarcation point.

b. The Contractor shall assist in the acquisition, installation, operation, management, and maintenance of all video teleconference and telepresence systems site-wide, across various network protocols, to include telehealth and telemedicine services and Audio/Visual (A/V) end-user support. The contractor shall provide staff training when necessary. The contractor shall provide input on video telecom service strategies, requirements, design approvals, and engineered infrastructure.

8) Clinical Informatics Support Services

a. The Contractor shall provide support in the application of informatics and IT within the healthcare delivery process, utilizing clinical systems, applications, and associated patient healthcare data. This support shall encompass Clinical Application Training, Clinical Workflow Analysis, Clinical Curriculum Development, and associated IT Support as related to Clinical Applications. The contractor shall provide clinical systems training focused on processes and workflow tailored to clinician-specific roles in the care-delivery process, with a focus of improving clinic operational efficiency, and enhancing the provider-patient experience. The contractor will also provide expertise, recommendations, and training in informatics and COTS tools utilized in the current clinical environment.

b. The Contractor shall provide assistance in formulating and defining systems scopes and objectives based on both user requirements and applicable clinical and business systems and industry requirements. The contractor shall assist in devising and modifying procedures to solve complex problems, analyzing business and user needs, documenting requirements, and translating into proper system requirement specifications. The contractor shall provide technical guidance concerning the business implications of the application of various systems. The contractor shall provide assistance in the creation, maintenance and design of complex computerized databases. The contractor shall assist the Government in analyzing and evaluating financial data on a quantitative/qualitative basis to assess, plan and forecast process and program effectiveness.

9) Information Business Operations

a. The Contractor shall provide support in managing current IT requirements, and forecasting, designing, and planning for future requirements in line with emerging technologies and organizational needs. This support shall encompass Strategic Planning and Assessment, Budget & Contract Support, Business Process Engineering (BPR), and IT Business Management Support. The Contractor shall support the evolution of the MHS in superior IT solutions delivery, support, and sustainment to meet current and future operational needs by evaluating current architecture, structures, and resource allocations to provide improvement recommendations. The Contractor will be responsible for researching and preparing IT engineering, technical, functional, business, clinical and staffing requirements packages in line with departmental requirements. The contractor will provide technical assessments and reviews based on systems engineering analysis; research various computer software, hardware, and technical services; evaluate government performance work statements and independent government estimates; identify technology issues and provide recommendations; and prepare technical briefings for use by Government representatives. The Contractor will also oversee, track, and manage all IT contracts, budgets, funding and procurement activities. The Contractor will further maintain IT business management tools and applications to provide appropriate departmental cost transparency and traceability.

b. The contractor shall provide cradle-to-grave project management services, including project coordination, kickoff, stand-up, monitoring, documentation, reporting, vendor communication, closeout, and review. The contractor will manage, from initiation to completion, all departmental projects with subject matter including IT Facilities and Construction, Telecommunications, End User Devices, Hardware/Software/Systems Implementation, Installation and Deployment, Cybersecurity, Networking, and IT Infrastructure. The contractor will further provide administrative support in the areas of status reporting, data gathering, data entry, report preparation, support for briefings, funding profiles, task lists, installation or customer meeting logistics, and other duties as required. The contractor will research, review, document, and implement organizational processes and procedures.