HC1028-15-R-0017-01.docx

HC1028-15-R-0017

Section A - Solicitation/Contract Form

RFP INFORMATION

A.1.1. The Defense Information Technology Contracting Organization (DITCO) is issuing a request for proposal (RFP) for a “Software as a Service” (SaaS) Access and Security Configuration Control (ASCC) that is implemented using BMC Bladelogic Software in support of the Defense Information Systems Agency (DISA).

A.1.2. Proposals in response to the RFP (HC1028-15-R-0017) are due no later than August 03, 2015 at 12:00 pm CST. See section L for further delivery instructions. Questions pertaining to this RFP shall be submitted electronically to amber.e.musenbrock.civ@mail.mil and kimberly.m.hampel.civ@mail.mil no later than July 27th at 10:00 am CST. The Government reserves the right not to respond to any questions received after this date/time.

A.1.3. DITCO/PL8321 is requesting proposals from qualified contractors who can provide a SaaS solution and are authorized resellers of BMC Bladelogic. Award will be made to the offeror who is technically acceptable and offers the lowest price to the Government using a lowest price technically acceptable (LPTA) evaluation process. The Government reserves the right to make award to one contractor, or to make no award in response to this solicitation. The North American Industry Classification System code for this acquisition is 541519, Other Computer Related Services, with sales size standard of $27,500,000.

A.1.4. In response to this RFP, the contractor shall not include terms, conditions, or assumptions, the Government will not entertain them.

Section B - Supplies or Services and Prices

Software Utility Services

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 0 - 12,100.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

FOB: Destination

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS, Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 12,101 - 13,300.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 13,301 - 14,500.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 14,501 - 15,700.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 15,701 - 16,900.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as requird. The Unit price is a fixed price.

NET AMT

Travel

FFP

Travel for on-site training requirements. Travel in accordance with JTR Regulations.

ESTIMATED COST

FFP

This OPTIONAL CLIN supports possible additional emerging requirements IAW PWS Section 14.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 0 - 12,100.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 12,101 - 13,300.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 13,301 - 14,500.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 14,501 - 15,700.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 15,701 - 16,900.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

ESTIMATED COST

FFP

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 0 - 12,100.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 12,101 - 13,300.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 13,301 - 14,500.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 14,501 - 15,700.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 15,701 - 16,900.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

ESTIMATED COST

FFP

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 0 - 12,100.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 12,101 - 13,300.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 13,301 - 14,500.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 14,501 - 15,700.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 15,701 - 16,900.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

ESTIMATED COST

FFP

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 0 - 12,100.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 12,101 - 13,300.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 13,301 - 14,500.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 14,501 - 15,700.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

Patch and Security Management Software Utility Service; Solution BMC Bladelogic (Agents). The contractor shall provide the BMC solution in accordance with the PWS (Section C), Addendum 1, and the DD254.

Pricing notes:

1. Unit price based on units of measure from 15,701 - 16,900.

2. Under this model, all required SaaS solution will be provided by the contractor in a single variable price structure invoiced monthly based on units of measure.

3. Government usage levels will be monitored and adjusted monthly as required. The Unit price is a fixed price.

NET AMT

FFP

ESTIMATED COST

FFP

NET AMT

PRICING INFORMATION

SECTION B

B.1.1. Offerors shall provide a detailed breakout to support their proposed price in an attached excel document. Under this model, all required software licensing and application administration will be provided by the contractor in a single variable price structure invoiced monthly in arrears. Government usage levels will be monitored and adjusted monthly to provide only the staffing, services, and licensing necessary to meet the Government’s requirements.

B.1.2. This project will be implemented and sustained under the “Software as a Service” model. Under this model the contractor shall provide all required BMC Bladelogic software and licenses, and perform the technical services necessary to install, configure, implement, administer, sustain, and provide training for the ASCC Bladelogic Enterprise solution using Government furnished computing resources.

Section C - Descriptions and Specifications

PWS

PERFORMANCE WORK STATEMENT (PWS)

as of 20 July 15

1. Contracting Officer Representative (COR).

a. Primary COR.

Logistics Division

(DISA)

Department of Defense Activity Address Code (DODAAC):

H98272

Chambersburg, PA 17201

b. Primary Technical POC.

Corporate Systems Section

(DISA)

Greenwood Village, CO 80111

2. Contract Title. DISA Enterprise ASCC Solution

3. Background. DISA is a provider of information technology solutions for the Department of Defense (DoD). DISA has the responsibility to plan, evolve, deliver, sustain, and ensure the quality of applications sustainment and application hosting for DoD customers. DISA’s DoD customers require granular-level access control for operating environments (OEs)-including but not limited to: Operating System, Application layer, and database layer and positive control of systems security configurations for a variety of processing environments. In order to support their customers, DISA procured the BMC BladeLogic tool. This tool allows DISA to implement and verify granular-level access control and security configurations of all DISA managed servers in an integrated and automated fashion.

4. Objectives. The objective of this PWS is to negotiate a multiple year contract for a single, integrated, software as a service (SaaS) solution that will provide use of the BMC BladeLogic tool to DISA. This initiative will provide integrated, state-of-the-art, auditable and automated control of operating environment access, security configurations, automated software deployments, automated server configurations in order to meet new and emerging customer requirements, and reporting.

5. Scope. The scope of this project includes the solution software and/or devices and technical services required to provide uninterrupted service of the existing ASCC solution, which utilizes BMC BladeLogic software. The configuration and security management service provided will address all operating environments at current and future DISA owned or managed data centers in the continental United States and data centers in Bahrain and Germany, as well as other DISA or DISA managed servers worldwide, for which DISA may acquire an operational responsibility. This initiative will apply to both the classified and the unclassified environments.

The Contractor shall provide the BMC BladeLogic software, which will allow for the granular-level access control of operating environments – including, but not limited to: operation system, application layer, and database layer, and positive control of systems security configurations for DISA computing environments and their technological replacements. The Contractor shall provide the software and support without root level access and across domain and enclave boundaries.

The Contractor shall provide support and a software asset inventory for the following operating environments: Windows Server (32 and 64 bit), RED HAT Linux, SUSE Linux (x86, x86_64, s390x and s390), HP-UX, Sun Solaris, Solaris on INTEL X86, IBM AIX, VMware and data bases including, but not limited to SQL Server and Oracle.

The specific task areas addressed in the PWS are:

· Task Area 1 – Software as a Service

· Task Area 2 – Technical Support

· Task Area 3 – Management/Support of Existing ASCC

· Task Area 4 – Operations Support

· Task Area 5 – Option Year Software Support

6. Performance Requirements.

6.1 Task 1 – Software as a Service

The contractor shall provide a software as a service model that includes the following capabilities while utilizing the BladeLogic software:

Function

6.1.1 SubTask 1 – Program Management. The Contractor shall provide the technical and functional support required for the Program Management of this PWS including Quality Assurance, progress/status reporting, schedule development, integration, and status reporting, risk identification/handling/mitigation strategy, and Program Reviews. The Contractor shall provide the centralized administrative, clerical, documentation, and related functions needed to develop work products and demonstrate completion of activities required under this task. The Contractor shall assign organize, plan, schedule, implement, control, analyze, and report on all elements of the contract. The contractor’s Program Manager (PM) shall have resources and authority to ensure efficient and timely program execution and shall be the focal point within the contractor's activity for all required program tasks. The PM shall be the primary contact through which communications, work assignments, and technical directions flow between the Government and the Contractor. The Contractor shall assign a designated representative to act in the absence of the PM.

6.2 Task 2 – Technical Support

6.2.1 Subtask 1 – Internet and Toll-Free Based Support

The contractor’s product support staff shall be accessible via a toll-free support line and available to assist in resolving software errors, answering questions regarding installation procedures, compatibility with other software and general questions of the licensed software products during and after installation. All calls to the toll-free support line are at no cost. There are no instances that a call would include a cost. The contractor shall also provide Internet-based support to facilitate status reporting (acceptance and socialization) of software problems, and provide downloads of software patches, fixes, and documentation.

6.2.2 Subtask 2 – Software Errors Support

Upon notification of software errors, the contractor shall respond to all emergency and urgent requests for software support. Response times for requests are based upon the software error severity level. Upon failure of the contractor to resolve software errors, the contractor shall escalate the issue(s) to the next level of issue resolution category until reaching the emergency level, at which time the contractor will focus all resources available to resolve the issue(s).

The contractor’s escalation process shall include clear procedures that outline the escalation process, the identification of management points of contact within the escalation process, and the ability to communicate directly with upper management when errors are not resolved.

6.2.2.1 – Software Errors Support - Severity and Support Response Times

Required availability and response time varies based on the severity levels. The severity level of a software error may be increased at DISA’s discretion up to a Severity 1, as the severity of the issue to DISA’s business increases, to verify proper focus and attention of the issue.

6.2.2.1.1 – Severity Level 1

Severity Level 1 consists of a system going down or a software product’s inoperative condition impacting a production environment.

· A production environment where the product is unable to run

· A product is preventing another production application from executing

6.2.2.1.2 – Severity Level 2

Severity Level 2 creates a high impact business condition, which endangers a production environment. The software may operate, but it is severely restricted.

· A major portion of the software product is unusable in a production environment

· A software product is causing another production application to not perform correctly or inhibits the production application’s ability to meet its commitments

6.2.2.1.3 – Severity Level 3

Severity Level 3 creates a low-impact business condition in which the majority of software functions are still usable; however, some circumvention may be required to provide service.

· The product is not performing as documented

· The product is causing another application to not perform correctly

6.2.2.1.4 – Severity Level 4

Severity Level 4 consists of minor problems or questions that do not affect the software functions.

· The customer has questions about the product

· The product is having minor problems

· The product is causing another product to have minor problems

MANAGED SOFTWARE ERRORS -

SUPPORT REQUIREMENTS:

1. 24 Hours x 7 Days x 365 Days a Year Contractor Support

1. 1 business hour Voice Response (Contractor returns call to the Government within 1 hour)

1. Support Direct to DISA Managed / Maintained Facility

1. Resolution within 12 hours

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 2 business hours Voice Response Support Direct to DISA Managed / Maintained Facility

1. Resolution within 24 hours

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 4 business hours Voice Response Support Direct to DISA Managed / Maintained Facility Support Direct to Requestor

1. Resolution within 2 Business Days

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 1 business day Response Support Direct to DISA Managed / Maintained Facility Support Direct to Requestor

1. Resolution within 5 Business Days

X

6.3 Task 3 – Management/Support of Existing ASCC

The Contractor will ensure there are no disruptions to the current service during transition/assuming responsibilities of the existing environment.

6.3.1 Subtask 1 - Planning

Planning will consist of information gathering meetings to assess the level of effort for the project and develop project management documentation and timelines. A review of the current ASCC system environment will allow the contractor to plan transition of the management of the system as it operates today and to include enhancements that are planned but not yet implemented. Design activities will be limited to anything necessary and required related to the transition of the management of the system. Deployment will be limited to anything necessary and required related to the transition of the software and licenses of the existing system. Planning, design and deployment services will be managed under the “SaaS” model and in accordance with the Managed SW Services terms and conditions are found SOFTWARE SERVICES LICENSING REQUIREMENTS - ADDENDUM 1. Under this model, all required software licensing and application administration will be provided by the contractor in a single variable price structure invoiced monthly.

6.3.2 Subtask 2 - Conduct detailed review of the functional requirements and capabilities of the current ASCC system to quantify existing workload required for immediate transition. Identify requirements which are planned for future enhancements and/or changes.

6.3.3 Subtask 3 - Provide technical and functional activities at the required level for developing and maintaining project schedules and deliverables. Include productivity and management methods such as quality assurance, progress/status reporting and program reviews. Identify and manage project risks, develop processes and identify and resolve issues; develop and maintain lessons learned on an on-going basis through all phases.

6.3.4 Subtask 4 - Develop project management documentation and timelines of necessary tasks.

6.3.5 Subtask 5- Develop 24x7x365 problem escalation/resolution procedures for software errors and system non-availability issues.

6.3.6 Subtask 6 - Identify appropriately cleared personnel as team members for performing required services, to include Technical, Management, Training staff, etc.

6.3.7 Subtask 7 – All project documentation and scheduled activities are required to be uploaded and maintained on the approved DISA management system.

6.4 Task 4 – Operations Support

During this task, the contractor will assume responsibility for the existing system.

6.4.1 Subtask 1 - Configuration Control

Contractor will provide BMC BladeLogic solution software and/or devices and technical services required to provide granular-level access control of OSs and positive control of systems security configurations for DISA computing environments and their technological replacements. This needs to be accomplished without root level access and across domain and enclave boundaries. Must scan and report all configuration changes to both physical and virtual environments in the current DISA computing environments, which include the following:

Operating systems (OS):

Windows Server (32 and 64 bit) RED HAT Linux SUSE Linux (x86, x86_64, s390x and s390)

HP-UX

Sun Solaris Solaris on INTEL X86

IBM AIX

VMware

Data Bases (DB) (including, but not limited to):

SQL Server Oracle

6.4.2 Subtask 2 - Compliance and Remediation

6.4.2.1 Security Compliance Scanning

Must scan security and all other platform configuration parameters (the absolute minimum subset being the DISA Security Technical Implementation Guides (STIG) and Information Assurance Vulnerability Management (IAVM) and provide centralized reporting for the enterprise. Must maintain a history of STIG and IAVM compliance by platform. Information must be optionally available in XML and XCCDF format. Must produce web based executive and detail reports of vulnerabilities across managed devices.

6.4.3. Subtask 3 - Security Vulnerability Remediation

Remediation must be accomplished without root level general access and across domain and enclave boundaries. Remediation should be provided by editable, role-based authority to make changes to include:

· Automated changes to OS, DB and Web parameters to comply with STIG requirements.

· Selectively applied changes.

· Creation of remediation policies by platform.

· History of exceptions and reasons.

· Fail back to the original configuration after any STIG or IAVM automated change.

· Baseline, pre-packaged compliance with NIST and NSA STIG standards.

· Automate with editable process for managing deviations.

· Ability to schedule remediation jobs.

· Provide for automated reboots, log file rotations, and etc. as needed to support actual “implementation” of configuration changes.

· Support automated baseline of servers prior to changes, as needed.

· Consistently enforce operational and security compliance across all platforms.

· Reduce time required to assess new vulnerabilities.

· Create measurable productivity gains due to fewer user disruptions and reduced recovery efforts as a result of the increased speed of vulnerability remediation.

· Provide automated monitoring capability for any adverse effects of patch implementation, reporting on patch deployment and status (e.g., for compliance purposes) and then validating that patches remain properly installed.

· Provide an automated interface into DISA’s Vulnerability Management System (VMS).

· Provide automated regression in cases of failed patch or security management rollout with associated audit trails, logs, and actions specified.

· Enable integration with DISA’s Configuration Management Data Base (CMDB) processes.

6.4.4 Subtask 4 - Patch Analysis and Deployment

Patch analysis and deployment of operating environment and software application patches must: 1) achieve greater efficiency of operations, 2) eliminate the need to manually maintain the currency of lists of target systems for patch deployments, 3) provide a streamlined approach for fail-over and contingencies guaranteeing assured computing services in support of the automated patch process, 4) enable an automated approach to researching new vulnerabilities and patches applicable to the platforms and systems identified in paragraph 6.1.2, and 5) lower unit cost per server managed.

6.5 Task 5 – Option Year Software Support

The contractor shall provide software support for all software under the contract for the option years. Software support consists of updates, revisions, error detection and correction, and rights to new releases and/or versions.

6.6 Task 6 - Certification Requirements

All technical support personnel will be at a minimum BMC BladeLogic Certified Operator(s) preferred BMC BladeLogic Expert Certified. All technical support personnel must have a minimum of 5 years’ experience working with DISA Cyber Command and DISA Field Security Operations. All technical support personnel must have a minimum of 5 years’ experience in the DISA organizational structure included but not limited to possessing expert knowledge of the DISA network architecture, communications infrastructure, trouble ticketing system, Security Technical Implementation Guide (STIG), and secure server configuration management.

6.6.1 The offeror will be responsible for funding any training and certification testing as well as any certification maintenance requirements.In addition, the offeror will ensure the appropriate Operating System, Operating Environment, or Virtual Environment and Security certifications are met and maintained, in accordance with Government guidance (IAW DoD 8570.01-M Information Assurance Workforce Improvement Program). Certification must be gained within six months of offeror personnel commencing service.

6.6.2 The contractor shall ensure that personnel accessing information systems have the proper and current information assurance certifications to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. Information Assurance Workforce Improvement Job Family Description: Responsible for providing technical support and/or leadership in the creation and delivery of technology solutions designed to meet the Government's business needs."

7. Performance Standards.

7.1 Performance Measure 1 - ASCC BladeLogic Solution System Availability

The solution will maintain a minimum of 95 percent system availability per unit of issue, to include adherence to security compliance, remediation, and associated tasks.

1. Explanation: The percentage of time each system is available for productive use.

1. Availability Objective: 24x7x365 minus measurement exception (see definition below).

1. Standard: Satisfactory is 95 percent

1. Contractor Escalation Solution: Contractor shall provide 24x7x365 problem escalation/resolution.

1. Contractor Responsibility: Maintain BladeLogic software solution, to include adherence to security compliance, remediation and associated tasks at a level to meet or exceed 95%.

1. Measurement: (Total available hours for 30 days – Measurement Exceptions – Time server is unavailable) / (Total available hours for 30 days – Measurement Exceptions )*100=“Service Level Attained”. Total available hours = 24x7x365 for each orderable system for each 30 day period.

Measurement Exception: Measurement Exception: DISA or customer initiated downtime, Contractor Preventative maintenance (not break fix or hardware/software repair) that is appropriately coordinated through the Authorized Service Activity (ASA)/Authorized Service Interruption (ASI) process with DISA and the customer, and environmental failures not attributed to the contractor.

7.2 Performance Measure 2 - ASCC BladeLogic Patch Analysis and Patch Deployment.

The contractor shall update all system operating systems with patches within seven calendar days of release from software contractor.

1. Explanation: The amount of time it takes to update all system operating systems with patches after it is released by the OEM contractor to address security vulnerability issues.

1. Availability Objective: Implement ASCC patches within the given time frame after a patch is received from the OEM software contractor.

1. Standard: Satisfactory = 7 calendar days after release by the OEM software contractor.

1. Contractor Escalation Solution: Contractor shall provide 24x7x365 problem escalation/resolution.

1. Contractor Responsibility: Conduct Patch analysis and Patch Deployment tasks at a level to meet or exceed the 7 calendar day implementation threshold.

1. Measurement: Implementation time met

Deliverable: Patch deployment scripts

7.3 Performance Measure 3 - ASCC BladeLogic Compliance Content and Information Assurance Vulnerability Management (IAVM).

The contractor will create a component template for all operating environments IAVM’s within the specified time from the time it is released from the DISA Field Security Office (FSO).

1. Explanation: The amount of time it takes to implement a component template for a operating environment IAVM after it is released from DISA FSO.

1. Availability Objective:

· Category I IAVM:

· Windows Environments: Create a component template for WINDOWS IAVM’s within the given time frame after the IAVM is release from DISA FSO.

· UNIX Environments: Create a component template for UNIX IAVM’s within the given time frame after the IAVM is release from DISA FSO.

· Category II and Category III IAVM:

· Windows Environments: Create a component template for WINDOWS IAVM’s within the given time frame after the IAVM is release from DISA FSO.

· UNIX Environments: Create a component template for UNIX IAVM’s within the given time frame after the IAVM is release from DISA FSO.

1. Standard: Satisfactory

· Category I IAVM:

· Windows Environments: 48 hours after release of OE IAVM from DISA FSO

· UNIX Environments: 72 hours after release of OE IAVM from DISA FSO.

· Category II and Category III IAVM:

· Windows Environments: 14 business days after release of OE IAVM from DISA FSO.

· UNIX Environments: 14 business days after release of OE IAVM from DISA FSO.

1. Contractor Escalation Solution: Contractor shall provide 24x7x365 problem escalation/resolution.

1. Contractor Responsibility: Conduct compliance content tasks for at a level to meet or exceed the specified time frame for Category I, II and III IAVMs.

1. Measurement: Create time met

Deliverable: IAVM compliance templates scripts

7.4 Performance Measure 4 - ASCC BladeLogic Compliance Content: Field Security Office (FSO), Quarterly Compliance Content updates.

The contractor will create the component template(s) for compliance content updates within 14 business days of release from DISA FSO based upon the quarterly release schedule.

1. Explanation: The amount of time it takes to implement a component template for compliance content updates after it released from DISA FSO.

1. Availability Objective: Implement component template within the specified time frame after a quarterly compliance content update is released by DISA FSO.

1. Standard: Satisfactory = 14 business days after release of compliance contend update by DISA FSO

1. Contractor Escalation Solution: Contractor shall provide 24x7x365 problem escalation/resolution.

1. Contractor Responsibility: Conduct compliance content tasks for FSO, quarterly compliance content updates at a level to meet or exceed the 14 business day implementation threshold.

1. Measurement: Implementation time met

Deliverable: Compliance content component template scripts

7.5 Performance Measure 5 - ASCC BladeLogic Remediation.

The contractor will create the Remediation Job(s) to support the component template updates within 7 business days of release from DISA FSO compliance content updates and IAVMs.

1. Explanation: The amount of time it takes to create a remediation job to support component template after a compliance content update is released from DISA FSO.

1. Availability Objective: Implement remediation job to support component template within the specified time frame after a compliance content update is released by DISA FSO.

1. Standard: Satisfactory = 7 business days after release of compliance contend update by DISA FSO

1. Contractor Escalation Solution: Contractor shall provide 24x7x365 problem escalation/resolution.

1. Contractor Responsibility: Create remediation jobs at a level to meet or exceed the 7 business day implementation threshold.

1. Measurement: Implementation time met

Deliverable: Remediation job component template scripts

7.6 Performance Measure 6 - Documentation and Reports

The contractor shall develop documentation and reports as required and within the timeframes defined in the Performance Work Statement in section 6.0.

1. Explanation: The contractor will provide accurate and timely documentation and reports as required by PWS, section 6.0.

1. Availability Objective: Develop accurate and complete documentation and reports within the specified time frame outlined in section 6.0 of the PWS.

1. Standard: Satisfactory = no errors or discrepancy and submitted in # business days as specified in the PWS, Section 11, Delivery Schedules

1. Contractor Escalation Solution: Contractor shall provide 24x7x365 problem escalation/resolution.

1. Contractor Responsibility: Prepare accurate and timely documentation and reports at a level to meet or exceed the no errors/discrepancy and submitted within the # business day as specified in the PWS, Section 11, Delivery Schedules.

1. Measurement: No errors/discrepancy and submittal requirement time met

Deliverable: Documentation and Reports

7.7 Performance Measure 7 - Training.

Contractor shall develop and update training curriculum and present training sessions within 75-days after contract award.

1. Explanation: The contractor will develop, update and present high quality training sessions on modules

1. Availability Objective: Develop, update and present high quality training sessions within 75-days after contract award

1. Standard: Satisfactory = develop and present accurate and complete training material/sessions within 75-days of contract award

1. Contractor Escalation Solution: Contractor shall provide 24x7x365 problem escalation/resolution.

1. Contractor Responsibility: Develop and present accurate and complete training material and sessions at a level to meet or exceed the high quality standard and 75-days after award threshold.

1. Measurement: Accurate and complete, and preparation time met

Deliverable: Training documentation and delivery

8. Incentives. None prescribed.

9. Place of Performance and Work Hours

The Government requires primary and alternate on- support for the ASCC in DISA facilities to be determined based upon access requirements to the NIPR and SIPR networks.. The Government requires on-site on-going sustainment for NIPR and SIPR environment support for the ASCC system and services included in this task order between the core hours of 6am to 6pm (M-F), excluding Government Holidays listed below.

In addition, the contractor may be required to perform system changes during non-peak processing hours which may fall on weekends, holidays, and after hours, and for 24x7x365 on-call support. Contractor will define how they will support core hours and how they will support non-peak processing hours (weekends, holidays, and after hours). When contractor staff is not physically present in the building, the contractor shall provide an on-call system administrator available by pager to address all emergency system events as defined in the Government approved sustainment support plan. Support may be required on the federal holidays as identified below:

Contractor will establish after-hour escalation procedures for software error and system non-availability issues.

10. Period of Performance. The period of performance will consists of a 1-year base period starting on the date of award, and four, 1-year option periods.

11. Delivery Schedule

6.1.1

Cat II/III: Windows and…