H - 34300024Q0023 Combined Synopsis Solicitation.pdf

34300024Q0023

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued.

(ii) Solicitation #: 34300024Q0023

The purpose of this Request for Quotation (RFQ) is to obtain services for Integration and configuration of an OCIO acquired ServiceNow ITOM eDiscovery solution which establishes and automatically populates a centralized IT asset database for all USITC OCIO managed hardware and software assets. The OCIO currently utilizes the ServiceNow Configuration Management Database (CMDB) for manual input of Configuration Items (CI) with limited integration with Microsoft System Center Configuration Manager (SCCM) via service graph connections. The solution will at a minimum capture automatically, with minimal human intervention, 95% of all hardware and software assets on the OCIO enterprise network when compared to the OCIO Security Scanning Toolsets and will allow manual inputs for those assets that are not on the OCIO enterprise network.

The Government anticipates award of a Firm Fixed Price contract.

(iii) This solicitation contains provisions and clauses in effect through Federal Acquisition Circular 04/22/2024, 2024-05.

(iv) This procurement is being solicited unrestricted, NAICS Code is 541511.

(v) Pricing –

This requirement is Firm Fixed Price, for the purchase of integration and configuration services.

Offerors shall propose a single fixed price, with anticipated labor categories, rates, and hours included to further bolster their cost realism.

(vi) Description of requirements for the items to be acquired:

Statement of Work

1.0 Solution Description and High-Level Requirements

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/12.htm#P311_50761

1.1 Introduction: The United States International Trade Commission (USITC or Commission) has a need for an authoritative source with centralized database for all Information Technology (IT) hardware and software assets that are tracked, managed, and maintained by the USITC’s Office of the Chief Information Officer (OCIO). The solution will be interoperable with the OCIO’s existing management and inventory applications and solutions that are defined in further detail within this statement of work.

1.2 Background: The project will also allow USITC to comply with the objectives of Executive Order 14028, Improving the Nation’s Cybersecurity, specifically Modernize and Implement Stronger Cybersecurity Standards in the Federal Government and Improve Software Supply Chain Security.

Currently the authority for the deployment and maintenance of host systems within the Commission’s logical IT inventory is delegated within the Office of the Chief Information Officer (OCIO) to the verticals assigned with managing a specific asset type (Service Desk for workstations and Network Services for Windows and Linux Servers, Network Communications, and Network Appliances). OCIO will implement a centralized asset management database that leverages and combines these disparate data sources to provide a unified view of USITC assets in a single location. This centralized management database will leverage automation to identify and reconcile a majority of the identified and discovered assets with minimal intervention from support staff. This centralized management database will be leveraged by various downstream solutions to enable higher-level data centric management and security (network access control, audit log validation, vulnerability scan validation, external reporting, etc.). Specifically, OCIO will use this centralized asset management database to reconcile the output of its vulnerability scanning solution to the hosts within the asset management database. In addition, the Commission will transition its current network access control solution to leverage this centralized asset management database to remove unauthorized devices from the network.

1.3 Objectives: Integration and configuration of an OCIO acquired ServiceNow ITOM eDiscovery solution which establishes and automatically populates a centralized IT asset database for all USITC OCIO managed hardware and software assets. The OCIO currently utilizes the ServiceNow Configuration Management Database (CMDB) for manual input of Configuration Items (CI) with limited integration with

Microsoft System Center Configuration Manager (SCCM) via service graph connections. The solution will at a minimum capture automatically, with minimal human intervention, 95% of all hardware and software assets on the OCIO enterprise network when compared to the OCIO Security Scanning Toolsets and will allow manual inputs for those assets that are not on the OCIO enterprise network.

1.4 Scope:

• Development and phased deployment of ServiceNow ITOM eDiscovery that follows the ServiceNow delivery approaches for CMDB

• Implementation and integration of automated solution within OCIO environment that utilizes a least privileged model of access and credentials which will require customization of the ServiceNow Discovery deployment approach

• Configuration of the automated discovery and reconciliation of assets on the enterprise network which are then stored in the ServiceNow asset tracking system

• Interoperability with OCIO hardware and software management solutions identified within this statement of work

• Ability to manually input and track assets that are non-network capable

• Interoperability with existing security solutions

• All applicable and pertinent policy, standard operating procedures, and regulations will be provided on an as needed basis.

• Government Furnished Hardware, when needed, will be approved by the Chief Information Security Officer (CISO) and issued on an as needed basis by OCIO support staff.

• Access to any OCIO owned and managed software noted throughout this SOW will require identification and approval by the CISO on an as needed basis.

2.0 Specific Requirements

2.1 Task Description:

2.1.1 IMPLEMENTATION PLANNING

During implementation planning, the implementation team will work with USITC OCIO project personnel to identify the USITC stakeholders that will provide input for the implementation, draft stakeholder workshops schedules and agendas, and prepare and hold an implementation kickoff with all affected stakeholders.

2.1.2 DISCOVERY PREPARATION

During the Discovery preparation phase, the implementation team will host stakeholder workshops to provide an overview of solution discovery as it exists out of the box (OOB) and the customized least privileged credentialing approach that will be implemented, gather any technical requirements, and prepare stakeholders for the data requests needed to fully implement the solution. After confirming IP ranges, the implementation team will work with USITC to obtain the required information and resources (i.e., data, credentials, MID servers, etc.).

2.1.3 CONFIGURATION

During configuration, the implementation team will configure the solution discovery modules per the requirements gathered in the preparation phase and enable the required service graph connections (SGC)(s), application programming interface (API)(s), and any other communications and interoperability configurations as needed. The team will test the configured functionality and perform the necessary data validation directly in the development environment. After a successful test, the implementation team will prepare data for UAT and draft a deployment plan for USITC approval.

2.1.4 User Acceptance Testing (UAT)

Because the main output of an Asset Management discovery implementation is a clean and compliant configuration management database (CMDB), UAT in this case will mainly consist of data validation. During UAT the implementation team will meet with asset owners, including representatives from the network, infrastructure, and end user device teams to validate the accuracy and completeness of data ingested by the solutions discovery and the OCIO toolset(s) integration.

Should any discrepancies be found, the developer on the implementation team will remediate immediately for the stakeholder to retest. After a successful test from each stakeholder team, USITC OCIO project leadership will provide the Go/No-Go decision.

2.1.5 DEPLOYMENT AND TRANSITION

During the Deployment and Transition phase the implementation team will promote the necessary update sets and data and ensure proper functionality of the required solution. Should any adjustments be needed after go-live, the implementation team will work with USITC personnel to remediate issues. The implementation will also finalize any configurations for the hardware and software management portions of the solution. During this phase the implementation team will also finalize any needed documentation and knowledge articles, then meet with the USITC OCIO project team to answer any open questions to ensure a smooth transfer of responsibilities.

2.2 Deliverables: The successful vendor solution will include the following:

1. Project Kickoff Meeting to occur within fifteen (15) business days of award of the contract.

2. Government approved Project Plan in Microsoft Project within thirty (30) days of project kickoff meeting.

3. Solution that meets the objectives and requirements as established within this document and associated requirements documentation provided and successfully passes the User Acceptance Testing (UAT) within the mutually agreed upon thresholds.

4. Government approved User Acceptance Testing (UAT) plan No Later Than (NLT) thirty (30) days prior to UAT testing start dates in approved Project Plan.

5. Configuration and System Design Documents delivered within thirty (30) days of completion of successful User Acceptance Testing. Documents will meet 508 guidelines and be in a format of MS Word, Vizio, or other Government approved format.

6. Training and Orientation for a minimum of five (5) Government personnel that provides overview of the solution and covers all aspects of management, administration, and configuration.

Training should occur within 10 business days prior to User Acceptance Testing commencing.

7. Quality Assurance Plan for monitoring and managing the overall project and associated deliverables within fifteen (15) business days of project kickoff.

8. Warranty Support for a minimum period of thirty (30) days after government acceptance of contractor provided solution. Warranty Support will include assistance and remediation for any defects in the operation of the contractor provided solution that arise from fault(s) with the installation and configuration of the contractor provided solution.

2.3 Inspection and Acceptance: Vendor will provide the following items to the government to ensure that the vendor is complying with and actively monitoring solution delivery:

• Weekly Status Reports (1st business day of each week) for Overall Project that include reporting of progress for:

o Approved schedule and scope o Risk and Issue Management

• Quality Assurance Reports based on the approved QAP monthly (1st business day of each month)

2.5 Detailed Requirements:

2.5.1

1.1 communicate with the multiple disparate systems within OCIO to provide a consolidated System Inventory of unique CIs

1.2 automatically reconcile any duplicative CIs

1.3 maintain an asset inventory history defined by OCIO guidelines

1.4 have a non-proprietary database and data schema that must include MAC(s) and IP address(es) in the data reference fields

1.5 communicate with OCIO management and security systems and applications in the OCIO environment managed by OCIO *list of applications and systems will be provided as part of solicitation*

1.6 integrate with USITC Log Management Solution

1.7 the solution must be 508 compliant

1.8 the solution, if cloud enabled, must be FedRAMP approved

1.9 vendor support that is US based and meet the security requirements of the United States International Trade Commission

1.10 vendor must comply with OMB BOD 2301 M22-18 if applicable

1.11 Single Sign On via SAML , openID or Azure SSO

2.5.2 Shall Meet: No.

REQUIREMENTS

2.1 conform data and ingest data within OCIO established metadata schema standards

2.2 accept manual inputs for CIs that are not able to be identified on the network

2.3 accept and process SNMPv3 , REST APIs, and file formats that are utilized by the OCIO management solutions

2.4 ability to differentiate between non-network assets and network accessible assets

2.5 provide the ability to communicate (import/export) with OCIO management systems

2.6 communicate with the OCIO Nessus toolsets

2.5.3 Could Meet: No.

REQUIREMENTS

3.1 identify what each CI status is. i.e. . Operational and online vs Inop. And/or Offline

3.2 Identify the backup status for each identified CI within the inventory

3.3 identify and alert for any CIs that are not at the current baseline configuration for their system family(ies) (either inherently or via OCIO management and application system provided metadata)

3.4 identify the deltas between what the hardware and software management tools are providing for inventory and configuration information vs what the cyber tools are providing for CI information (authorized and unauthorized CIs)

3.5 correlate the software inventory to the hardware inventory to identify the hosts(s) on which specific software is installed

3.6 communicate with the OCIO systems by utilizing discrete communication with systems to gain access that is unique to each proxy system

3.7 CI database views to be exportable and consumable by reporting tools (I.e. powerbi, etc)

2.6 USITC OCIO Management and Inventory Systems

Counteract

Cisco Prime

SCCM

vSphere

Nutanix

InfoBlox

Yum repo

Cisco ISE

Ansible

InTune

ServiceNow

ABM FM Web Audit

Jenkins

Apache Maven

Angular Apps

Software Whitelist

Composer

TCG

Tenable

Nexus

Satellite

JIRA

Dell Server Hardware

CKMS

Hitachi Hardware

Nutanix Hardware

2.7 USITC Asset Counts by Type

• End User Computing Devices (Total): 697 o Computers/Workstations: 528 o Mobile Phones: 169

• Servers (Total): 342 (includes virtual and physical devices) o Linux: 259 o Windows: 83

• Network Gear (Non-Server) Devices (Total): 236

• Network-Connected Printers (Total): 66 o USITC Print-Server Printers: 56 o Desktop Printers: 10

(vii)

The contract period of performance is anticipated to be (please include in Factor 1: Technical your proposed timeline):

June 15, 2024 – September 30, 2024

(viii) 52.212-1, Instructions to Offerors – Commercial Products and Commercial Services (SEP 2023), applies to this acquisition.

(ix) Evaluation Procedures

Quotation Submission Instructions

The Government requires the offeror to submit its quotation in two separate volumes:

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/52_000.htm#P1619_225648

(1) Technical

(2) Price

Technical – Volume 1

Offer shall include a full written description of their proposed solution to meet our requirements.

Offerors shall be an “Elite” level ServiceNow Partner, and include with their proposal certification of such. Volume 1 is limited in length to 15 pages. Any pages in excess of 15 pages will not be evaluated. Past Performance questionnaires and / or references will not count against the 15 pages, but are limited to a total of 3 (minimum of 2) references, 3 pages each. Offeror’s can either send the questionaries directly to the reference, and have them submit the form directly back to Ian.Quillman@usitc.gov by the due date and time that bids are due, or the offeror may include the name and POC for the reference for the USITC to contact.

Price – Volume 2

Pricing may be submitted in email, pdf, or Microsoft word, and needs to be clear, legible, and only 1 page. Offerors shall propose a single fixed price, with anticipated labor categories, rates, and hours.

Evaluation Factors for Award

Award shall be made to the responsible offeror whose offer, in conforming to this Request for Quotation, provides an overall best value to the Government, technical evaluation factors and price considered.

The Government's objective is to obtain the highest technical quality considered necessary to meet the Government’s requirement, with a realistic and reasonable price. Technical is more important than Price.

The Government reserves the right not to make an award as a result of this solicitation if, in the opinion of the Government, none of the offers would provide satisfactory performance at a price that is considered fair and reasonable and/or economically feasible.

In order to be considered for award, the offeror must be registered, and current (with certain exceptions), in the System for Award Management database (www.sam.gov) prior to award being made (Reference FAR 4.11), unless an exception at FAR 4.1102 applies.

Factor 1: Technical Offer shall include a full written description of their proposed solution and how it can meet our requirements.

mailto:Ian.Quillman@usitc.gov

The following areas will be used to determine the Technical Factor rating:

• The Offeror’s understanding of and explanation of how to complete the scope of the requirement; The Offeror’s knowledge of ServiceNow ITOM eDiscovery implementations

• Offeror’s Past Performance, specifically ServiceNow deployments

Factor 2: Price Offer shall propose a single fixed price for completing the requirement. Offerors shall include anticipated labor categories, rates, and hours. The Government will evaluate the offeror’s quoted prices for reasonableness. Price reasonableness will be determined based on competition as well as established commercial prices for same or similar services.

Each price quote will be assessed to identify any potential risk. Price risk refers to any aspect of an offeror’s quote which could have significant negative price consequences for the Government.

Where risk is assessed, it may be described in qualitative terms or used as a best-value discriminator.

(x) Each Offeror shall submit a completed copy of the provision at 52.212-3, Offeror Representations & Certifications - Commercial Items, with its quotation.

(xi) FAR 52.212-4, Contract Terms & Conditions – Commercial Items, (Nov 2023), applies to this solicitation.

(xii) FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (Feb 2024).

The successful offeror must comply with the following applicable commercial item terms and conditions, which are incorporated herein by reference. The provision at FAR 52.212-1, Instructions to Offerors -Commercial Items; the provision at FAR 52.212-2, Evaluation; FAR 52.212-3 Offeror Representations and Certification-Commercial Items. FAR Clause 52.212-4 Contract Terms and Conditions, Commercial Items. FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Order-Commercial Items. Paragraph (a) and the following cluses in Paragraph (b): 52.203-6, 52.204-10; 52.209-6; 52.222-3; 52.222-19; 52.222-21;

52.222-26; 52.222-35; 52.222-50; 52.223-18; 52.225-13; 52.232-33

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

http://farsite.hill.af.mil/ http://farsite.hill.af.mil/

FAR CLAUSES & PROVISIONS INCORPORATED BY REFERENCE

52.202-1 DEFINITIONS JUN 2020

52.203-3 GRATUITIES APR 1984

52.204-4 PRINTED OR COPIED DOUBLE-SIDED MAY 2011

ON RECYCLED PAPER

52.204-7 CENTRAL CONTRACTOR REGISTRATION OCT 2018

52.229-3 FEDERAL, STATE, AND LOCAL TAXES FEB 2013

52.232-8 DISCOUNTS FOR PROMPT PAYMENT FEB 2002

52.232-17 INTEREST MAY 2014

52.232-23 ASSIGNMENT OF CLAIMS MAY 2014

52.233-4 APPLICABLE LAW FOR BREACH OF

CONTRACT CLAIM OCT 2004

52.246-25 LIMITATION OF LIABILITY - SERVICES FEB 1997

52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES NOV 2020

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 calendar days before the contract expiration date.

(End of clause)

(xiii) Additional Contract Requirements

AUTHORITIES

Contracting Officer: The Contracting Officer (CO), in accordance with Subpart 1.6 of the Federal Acquisition Regulation, is the only person authorized to make or approve any changes in any of the requirements of this contract and, notwithstanding any clauses contained elsewhere in this contract, the said authority remains solely with the CO.

In the event the contractor effects any changes at the direction of any person other than the Contracting Officer, the changes will be considered to have been made without authority and no adjustment will be made to the contract’s price to cover any increase in costs incurred as a result thereof. The CO shall be the only individual authorized to accept nonconforming work, waive any requirement of the contract, or to modify any term or condition of the contract. The CO is the only individual who can legally obligate Government funds.

Ian Quillman Contracting Officer

U. S. International Trade Commission 500 E Street, S.W., Room 315

Washington, D.C. 20436

Contracting Officer’s Representative: The Contracting Officer will appoint the Contracting Officer's Representative (COR) at time of award. The COR will be responsible for technical monitoring of the Contractor's performance and deliveries. The COR will be appointed in writing, and a copy of the appointment will be furnished to the Contractor. Changes to this delegation will be made by written changes to the existing appointment or by issuance of a new appointment. The COR for this contract will be:

Filled in upon award

The COR is not authorized to perform, formally or informally, any of the following actions:

• Promise, award, agree to award, or execute any contract, contract modification, or notice of intent that changes or may change the terms and conditions of this contract;

• Waive or agree to modification of the delivery schedule;

• Make any final decision on any contract matter subject to the Disputes Clause;

• Terminate, for any reason, the Contractor's right to proceed;

• Obligate, in any way, the payment of money by the Government.

The Contractor shall comply with the written or oral direction of the Contracting Officer or authorized representative(s) acting within the scope and authority of the appointment memorandum.

The Contractor need not proceed with direction that it considers to have been issued without proper authority. The Contractor shall notify the Contracting Officer in writing, with as much detail as possible, when the COR has taken an action or has issued direction (written or oral) that the Contractor considers to exceed the COR's appointment, within 3 days of the occurrence. Any action(s) taken by the Contractor, in response to any direction given by any person acting on behalf of the Government or any Government official other than the Contracting Officer or the COR acting within his or her appointment, shall be at the Contractor's risk.

Invoices

Submission of Invoices:

Invoice(s) shall be submitted through the U. S. Department of Treasury’s Invoice Processing Platform (IPP), which provides for secure electronic submission and receipt of invoices.

https://www.ipp.gov/vendors/index

IPP Customer Support may be reached at 866-973-3131 or IPPCustomerSupport@fiscal.treasury.gov, is available to assist users of the system.

PLEASE NOTE: When entering the invoice(s) in IPP, ensure the period of performance being invoiced is included in the Description field. Please use the format “MM/DD/YYYY to

MM/DD/YYYY.”

https://www.ipp.gov/vendors/

To ensure a proper invoice is submitted, the following information must be on each invoice submitted:

1 Name and address of contractor 2 Invoice date and invoice number 3 Purchase Order No. (34300024P00XX) 4 Description, price, and quantity, CLIN, of services and/or supplies delivered;

5 Delivery Date/Performance Period covered by the invoice;

6 Payment terms 7 Name and address of the contractor’s official to whom payment is to be sent. The “Remit

To” address must correspond to the remittance address in this contract;

8 Name, title, phone number, and mailing address of contact person to be notified in the event of a defective invoice.

PROHIBITION AGAINST PERSONAL SERVICES

The Contractor shall not perform personal services under this contract (FAR 37.104). Contractor personnel are employees of the Contractor, or its subcontractors, and are under the administrative control and supervision of the Contractor. The Government will not supervise or direct Contractor employees in the performance of assignments under this contract. If, at any time, the Contractor believes that any Government action or communication has been given that would create a personal service relationship between the Government and the Contractor employee(s), the Contractor shall immediately notify the Contracting Officer of such communication or action.

PROHIBITION AGAINST INHERENTLY GOVERNMENTAL FUNCTIONS

The Contractor shall not perform any inherently Governmental functions, as defined in FAR 2.101, under this contract. No Contractor employee shall represent or give the appearance that s/he is a Government employee, agent, or representative. No Contractor employee shall state either orally or in writing, at any time, that s/he is acting on behalf of the Government.

(xiv) Not Applicable https://www.ipp.gov/vendors/index mailto:IPPCustomerSupport@fiscal.treasury.gov https://www.ipp.gov/vendors/

(xv) Due date of Offers:

RFQ Questions/Vendor Communications

All questions concerning the RFQ are due by 11:00 a.m., E.T. Wednesday, May 22, 2024, and must be sent via email, to Ian Quillman at Ian.Quillman@usitc.gov. Please include the solicitation number 34300024Q0023 in the subject line of your email.

If questions are received after the date stated above, the Government reserves the right not to provide an answer. If, however, in the Government’s opinion, the question represents an issue of significant importance, the Government may provide responses to all offerors. Please note, questions and comments will not be protected by the Government as proprietary.

Quotation Due Date

Quotations submitted in response to this RFQ shall be received by the due date and time established herein. Quotations must be received by the USITC no later than 11:00 a.m. E.T. Thursday, May 30, 2024, to be considered for award. Quotations must be emailed to Ian.Quillman@usitc.gov. No hard copy quotations will be accepted.

(xvi) Point of Contact for this solicitation is Ian Quillman, Ian.Quillman@usitc.gov 202-631- 1234.

< End of Solicitation >