J-7 PWS Task Order 0001.pdf

02 AUG 2010

HQ0034-10-R-0046

PERFORMANCE WORK STATEMENT

1. GENERAL INFORMATION:

1.1 The overall outcome that the Government is seeking by award of this contract is to acquire seamless, reliable, and responsive enterprise solutions for information technology (IT) services for Office of the Secretary of Defense (OSD) Chief Information Officer (CIO) supported organizations, which improve existing services resulting in a stable and secure enterprise IT network, and which meets the functionality, speed, and capacity expectations of Office of the Secretary of Defense (OSD) end users while complying with Department of Defense (DoD) and Federal rules and regulations.

1.2 The specific objectives of this acquisition are to: (1) satisfy OSD customer needs for secure, accessible and stable IT support; (2) exceed established operational service level agreements;

(3) maintain the OSD CIO networks by capitalizing on industry best practices and innovation;

and (4) implement IT management best practices described in the Information Technology Infrastructure Library version 3 (ITIL v3), the Project Management Body of Knowledge (PMBOK), and the Capability Maturity Model Integration (CMMI).

1.3 The contractor will be required to provide management, labor, tools, supplies, and materials required to provide IT services and support for customers and organizations supported by the OSD CIO at classifications levels up to Top Secret/ Sensitive Compartmented Information (TS/SCI). The contractor(s) will provide IT support for current and evolving IT requirements in classified and unclassified environments, providing and maintaining connectivity, computing, operations and maintenance, core IT support and performance monitoring services across the OSD IT enterprise in an environment that is dynamic and continually evolving.

1.4 User Population List: See Attachment in Section J.

1.5 The Government intends to allow 30 days for phase-in. The phase-in period shall be in accordance with Section I, FAR 52.237-3, Continuity of Services. This period allows for the establishment of operations and infrastructure in preparation for full performance.

2. SCOPE:

The general nature of the work is for the contractor to provide a full range of Enterprise IT services in support of the OSD. The general areas of contract performance are divided into eight (8) functional areas:

• Program and Project Management

• Manage and Implement Change

• Operations and Maintenance Support (Service Operations)

• Configuration Management Support (Service Asset and Configuration Management)

• Integrated Logistics and Asset Management Support

• Security Operations Support

• Standardize Base Work Station Images (Optional CLIN)

• OSD Continuity of Operations (COOP) and Continuity of Business (COB)

3. GENERAL CONTRACTOR RESPONSIBILITIES:

3.1 The contractor shall, as an independent Contractor, and not as an agent of the Government, furnish all management, labor, tools, supplies, and materials (except as provided by the Government) necessary to perform the requirements contained herein. The Government reserves the right to approve hardware and software based on security requirements and mitigations.

Hardware, COTS software, custom-developed software, and data provided during the execution of this contract shall become property of the Government at the end of the task order.

3.2 The contractor shall utilize commercial best business practices to include:

• The Information Technology Infrastructure Library (ITIL) version 3 (ITIL v3).

• Project Management Body of Knowledge (PMBOK) guide.

• Capability Maturity Model Integration (CMMI).

3.3 The contractor shall use Government furnished tools to accurately document and maintain data and information. Tools include but are not limited to the following: (1) BMC Software Remedy for ticket tracking and routing, configuration management database (CMDB), and asset management; and (2) OSD Portal, using Microsoft SharePoint, as a knowledge management repository including incident reporting and standard operating procedure (SOP) library.

3.4 The contractor shall participate in formal activity and program management reviews and provide to OSD CIO status reports at least monthly.

3.5 The contractor shall participate in various governing bodies that perform functions including, but not limited to, standards setting and configuration control.

3.6 The contractor shall form a partnership with the Government to meet all objectives using progressive, technologically advanced information solutions.

3.7 The contractor shall provide overall management of sub-contractors. The contractor shall participate with OSD, Government staff, and other contractors as an integrated team

3.8 The contractor shall comply with all current DoD security policies and procedures for handling IT equipment and data on multiple classification levels.

3.9 The contractor shall follow current Government approved standard operating procedures (SOPs) until revised SOPs are coordinated and approved.

3.10 The contractor shall meet the minimum performance standards specified in the performance-based matrix in paragraph 5.0.

3.11 The contractor shall adhere to OSD CIO personnel “in and out” processing procedures.

3.12 The contractor shall require all contractor staff to sign nondisclosure agreements (NDAs); the contractor shall also require designated staff to sign legal and financial NDAs as required.

3.13 The contractor shall provide the full range of support services during normal working hours

(NWH). NWH are defined as Monday through Friday from 6:00 am to 6:00 pm except for Government holidays. Authorized Service Outage Windows may occur 10:00 pm to 6:00 am, but requires Government approval and notification five (5) business days in advance according to the establish Planned Outage Notifications task standard. The contractor shall also provide support services during extended working hours (EWH). EWH includes Monday through Friday 6:00 pm to 6:00 am and all day on weekends and all day on Federal Holidays. Additionally, the contractor shall provide on-site desk side support (based on the average volume of tickets) on Saturdays from 8:00 am to 3:00 pm.

3.14 The Contractor may be required to provide on-call on-site (Tier Two) desk side support services outside normal working hours. This support may be required for an extended period of time in support of preplanned or unplanned activity. During this period, contractor support will be the same as normal working hour support. The Government will provide the contractor at least 1 hour advance notice of required support via an e-token. The contractor shall track e-token usage by OSD component and report usage to the Task Order Monitor (TOM) on a monthly basis.

3.15 The Government will provide the following roles: contracting officer, contracting officer’s representative and task monitors; see G.11 Roles and Responsibilities of the Solicitation.

4 REQUIREMENTS / TASKS:

4.1 Program and Project Management: Involves assisting OSD program managers in conducting oversight and management of Enterprise IT programs. Program management is comprised of program support, life cycle support, and planning support. Program support includes but is not limited to facilitation support, meeting support (plan, schedule and report on meetings), project schedule and control, project management (scope management). Life cycle support includes but is not limited to: IT asset management and life cycle management. Planning support includes but is not limited to: strategic planning support and program management planning (including risk management). Plan, coordinate, and implement move/add/change support for users and offices.

Moves/Adds/Changes require project management to insure close coordination of equipment, account, and file changes by Logistics and Asset Management, Service Operations, and Account Based Access Management teams. This is particularly important in the following situations:

office and user moves/relocations, reorganizations, in and out processing – GAL, equipment/hard drive refresh. The contractor shall:

4.1.1 Develop a concept of operations with supporting SOPs. The contractor shall provide SOP updates throughout the contract performance period.

4.1.2 Develop operational plans; formal communications documents, white papers and feasibility studies in line with OSD strategic plans and objectives. Provide newsletter content per established deadlines. (There are 6 bi-monthly newsletters per year; the estimated average number for other documents in this paragraph is 25 per month, and up to 365 per year)

4.1.3 Provide monthly reporting on contract performance, major accomplishment and future activities and develop and implement a monthly Program Management Review (PMR). Include performance measures in the PMR.

4.1.4 Administer and maintain content in Remedy Knowledge Management and the configuration management database (CMDB).

4.1.5 Deliver and maintain a document describing and depicting the contractor’s IT support organization including the management structure and all support teams; maintain a support organization structure to carry out objectives and tasks detailed in this task order and assigned by the Government.

4.1.6 Participate in on-site meetings; prepare and present written and oral briefings on progress of work, draft responses to IT -related data calls from WHS, and various other sources, as directed by the Government. (The estimated average number of meetings, briefing, and presentations in this paragraph is 144 per month, and up to 1,920 per year. The estimated average number of data calls is 20 per month, and up to 365 per year.). Develop, administer and document the results of Customer Satisfaction Surveys and communicate results to OSD.

4.1.7 Provide Service Improvement Plans (SIP) as required by Government staff. (The estimated average number of SIPs is 20 per month, and up to 365 per year.)

4.1.8 Develop annual lifecycle management plans for all IT assets following lifecycle guidance in OSD

CIO Policy Bulletin 18, Lifecycle Standards for OSD IT Equipment. The plan should include the replacement of IT assets as they near the end of their lifecycle.

4.1.9 Develop continuity of support plans and risk management for Wedge5 Pentagon Renovation Moves and Base Realignment and Closure (BRAC) moves to the Mark Center. Mark Center moves include not only assisting OSD customers who move to Mark Center, but also relocation of the Enterprise Service Center from Crystal City to the Mark Center. While the BRAC moves to the Mark Center already include logistics for moving IT equipment, the contractor must prepare and execute plans for de-install, re-install, and configuring IT equipment at the new location. The contractor must plan and execute a Continuity of Business (COB) plan to ensure performance continues to meets the performance standards outlined in the Performance-based Matrix during the move of the Enterprise Service Center.

4.1.10 Customer Liaison and Customer Communications: In coordination with OSD CIO Government staff and IT Managers, the contractor shall provide Customer Liaison support within OSD.

Customer Liaison support involves matching available IT products and services to customer requirements and business objectives; establishing communication channels between customers and ITM; measuring customer satisfaction; and managing change with customers and IT support personnel. The overall Customer Liaison goal is to achieve high levels of customer satisfaction.

The contractor shall develop and execute a communication plan to include newsletters, broadcast messages, and network outages.

4.1.10.1 In coordination with OSD CIO Government staff and IT managers, develop, establish and maintain the Information Technology Point of Contact (IT POC) Program.

4.1.10.2 Ensure that each office has designated an IT POC and an Alternate IT POC, which will serve as an interface between OSD CIO and the customer components.

4.1.10.3 Maintain IT POC distribution lists.

4.1.10.4 Organize quarterly IT POC meetings.

4.1.10.5 Develop and maintain the IT POC and ITM customer service web pages on the OSD CIO portal.

4.1.10.6 Prepare a monthly IT newsletter for all OSD CIO customers.

4.1.10.7 Send broadcast messages regarding IT-related events.

4.1.10.8 Coordinate network/server outages and ITA-related work with customers.

4.1.10.9 Monitor customer liaison mailbox and phone lines.

4.1.10.10 Meet at least annually with each office IT POC and/or Alternate IT POC to gather customer requirements and business objectives in order to match requirements to current IT products and services and to plan for future IT services.

4.2 Manage and Implement Change: The contractor shall perform routine maintenance for servers and desktops. Routine maintenance includes deploying patches, managing standard server and workstation images, and upgrading software to the next approved version. The contractor shall also participate in the transition of new services into production environment. The overall objective is to plan, manage and deploy infrastructure changes into the production environment successfully while minimizing interruptions to customers and current IT services. The contractor shall:

4.2.1 Develop, implement, and maintain the Implement Infrastructure Change Concept of Operations (CONOPS) that provides common operating processes and procedures for systematic approaches to performing routine maintenance. The general process includes:

A. The Government approves changes to IT Services and infrastructure.

B. The contractor implements only approved changes according to a plan and in an orderly fashion.

C. The contractor develops and tests changes before implementing changes to the production network.

D. The contractor demonstrates that changes meet the Government's requirements and specifications, and the contractor delivers the changes.

E. The Government receives, accepts and approves changes.

F. The contractor updates the Configuration Management Database (CMDB) and the Service

Knowledge Management System (SKMS) when deploying changes.

4.2.2 Build, test and apply required information systems security requirements (scripts, patches, updates, and configuration changes) as approved by the Government and within the directed time frame.

4.2.2.1 Prior to implementation, perform analysis to determine impacted systems, technical implementation recommendations, and implementation impacts. Coordinated and communicate this information with systems owners.

4.2.2.2 Use Government provided tools to automate the deployment and removal, if necessary, of information systems security requirements (patches, updates, and configuration changes).

4.2.2.3 Verify the implementation of information system security requirements by conducting post implementation scans to ensure successful implementation of the security requirement for all systems.

4.2.2.4 Log updates into the Vulnerability Management System (VMS) website. Provide Plan of Actions and Milestones (POAMs) for any remaining vulnerability requiring mitigation and remediation.

4.2.2.5 Communicate information systems security requirement compliance to IAO using VMS and other Government provided tools.

4.2.3 Manage standard server, desktop, and laptop workstation images. Create, update, and optimize standard server, desktop, and laptop images and the processes used to deploy the images to ensure more predictable application behavior, performance, simplify configuration management, increase security, and decrease system deployment times.

4.2.3.1 Ensure workstations and server images are compliant with Federal Desktop Core Configuration

(FDCC), DoD, Defense Information Systems Agency (DISA) and other applicable security requirements.

4.2.3.2 Ensure image updates and software changes are approved by the Government change management processes. Update standard images to reflect approved configuration changes.

4.2.3.3 Coordinate with components on rollout schedule and testing of new software releases.

4.2.3.4 All implementation to include build, test, install, uninstall and deploy is to be documented in accordance to OSD CIO established SOPs and templates.

4.2.3.5 Work with security teams to certify all images and maintain them as part of the software library.

4.2.3.6 Use Government provided imaging and software deployment tools to ensure standard workstations and server images are rapidly deployed.

4.2.4 Develop plan to improve, operate and maintain the Enterprise test environment for servers, desktops and laptops.

4.2.4.1 Develop and maintain virtual workstations and servers utilizing standardized images in the Enterprise test environment for testing of security patches and other system updates or changes.

4.2.4.2 Use the Enterprise test environment to test infrastructure changes before deploying to the production network. Ensure changes are interoperable, do not impact system performance or availability, and are secure in accordance with all DoD, and all other applicable security policies.

4.2.5 Develop group policies and other policy deployment methods to ensure servers and workstations receive standardized group policies.

4.2.6 Provide plans, schedules and recommended priorities for upgrading software to the next approved version. Ensure software updates are approved by the Government change management processes. Deploy software upgrades based on Government approved plans.

4.2.7 Participate in the transition of new services into production environment. Provide system transition support to enable the successful transition of all engineered systems into production, operations and maintenance phase of the system lifecycle.

4.2.8 Participate in the Enterprise Configuration Control Board (ECCB), Request for Change (RFC), and Change Advisory Board (CAB) process. Attend meetings for reviewing RFCs and provide constructive input during the meetings.

4.2.8.1 Prepare and submit recommendations to the Government on best approach to implement change requests along with benefits and risks.

4.2.8.2 Propose cost effective process for adding new services.

4.2.8.3 Obtain required approvals and provide relevant artifacts throughout the change management lifecycle.

4.2.9 Develop, implement and maintain procedures for communicating the Schedule of Changes (SOC), the Projected Service Outage List (PSO), and System Change Notifications (SCN).

4.3 Operations and Maintenance Support (Service Operations): The contractor shall provide operations and maintenance (O&M) support for all the systems including servers, desktops, laptops, and personal electronic devices. Effective Service Operations will allow OSD CIO to deliver the agreed levels of IT service to users and to manage the applications, technology, and infrastructure that support delivery of the IT services. The result of this service should be preventative measures to ensure continuous service availability and timely restoration of services to customers with the following focuses:

• System Administration

• Service Operations Technical Management

• Service Desk

• Continuity of Operations and Continuity of Business

4.3.1 System Administration: The contractor shall:

4.3.1.1 Test and provide initial diagnosis of network problems; submit informative problem reports to

ITA and other network support agencies.

4.3.1.2 Assist the Government in conducting site surveys and preparing initial network change requests for new and modified customer office requirements.

4.3.1.3 Maintain and operate desktops and laptops including all tasks typically associated with managing workstation clients.

4.3.1.4 Maintain and operate approved Government Owned mobile electronic devices including but not limited to Blackberry and SME PED devices. (There are approximately 3,655 Blackberries and 65 SME-PEDs.)

4.3.1.5 Maintain and operate VTC devices for desktop and conference room. (There are currently 122 total VTC end points connected to the enterprise VTC network which includes both NIPRNet VTC units and SIPRNet VTC units.)

4.3.1.6 Apply required patches in accordance with established SOP; log updates into the Vulnerability Management System (VMS) website.

4.3.1.7 Assist with Security Assistance Visits (SAV) and perform remediation of vulnerability findings.

4.3.1.8 Event Management: The goal of Event Management is to detect events, make sense of them, and determine the appropriate control action before receiving an outage report from the customer community. Monitoring network operation includes, but is not limited to monitoring enterprise message services (for example SMTP, eVault, Blackberry enterprise service, and Microsoft Exchange servers), file services and Storage Area Network (SAN) connectivity, web services, database services, Mobile Armor servers, Common Access Card (CAC) Smart Card Logon (SLC) and other authentication services, network backup services, network speed and status, and Remote Access Services (RAS).

4.3.1.8.1 Monitor and report network operation events 24 hours a day, 7 days a week (24X7) including weekends, holidays and surge situations. Monitor notifications created by configuration items and monitoring tools. Ensure event notifications are logged in the event records database.

4.3.1.8.2 Provide the Government immediate notification of a critical network condition. Escalate and coordinate network problems and incidents to service providers such as Information Technology Agency, US Army (ITA), Defense Continuity Integrated Network (DCIN) and other service providers.

4.3.1.8.3 Escalate, track, and report events that require human intervention, for example, to properly resolve the event requires an incident, request, or configuration Request for Change (RFC).

4.3.1.8.4 Proactively monitor systems performance attributes to include but not limited to server uptime, resource consumption, and data connectivity through responsively communicating and reporting issues.

4.3.1.9 Problem Management: Log, investigate, and diagnose problems with IT services and infrastructure.

4.3.1.9.1 Analyze events, incidents, and requests to detect potential problems. Collect, review, and acknowledge notification of potential problems from users. Log potential problems into the Problem Records Database.

4.3.1.9.2 Investigate and diagnose problem root-cause.

4.3.1.9.3 Create and maintain data in the Known Error Database; document workarounds and generate known error sub-processes to facilitate quicker diagnosis and resolution for future incidents.

4.3.1.9.4 Document reviews and analysis of major problems and unplanned service outages.

4.3.2 Service Operations Technical Management Capabilities: The contractor shall provide staff proficient at operating and administering the OSD CIO workstation, server, and network infrastructure. The contractor shall:

4.3.2.1 Effectively administer the OSD Enterprise IT services, servers, and infrastructure at both source and Continuity of Operations (COOP) locations, including but not limited to: Domain Name Service (DNS), enterprise messaging and wireless email, network file and storage, print services, network backup, network access control, relational database management and web-based systems.

4.3.2.2 Hold daily conference calls via phone or DCO (Defense Connect On-Line) with operations SMEs to discuss past, current, and future shared operational issues.

4.3.2.3 Manage and maintain the operability of both physical network servers and virtual network servers including but not limited to Windows Server 2000/2003/2008, VMWare, ESX, Unix and Linux

4.3.2.4 Provide technical input for briefings, documents, reviews, and discussions on current and proposed workstations, server, and network infrastructures using best practices for IT Enterprise Service Operations and the ITIL practices.

4.3.2.5 Coordinate support issues with internal and external support agencies, such as Defense Information Systems Agency (DISA), Information Technology Agency (ITA), Defense Continuity Integrated Network (DCIN), and Pentagon Renovation (PENREN).

4.3.2.6 Perform quarterly failover test of all mission essential enterprise applications and provide support for mission application failover.

4.3.2.7 File Storage Administration. The overall objective is to maintain and operate Network Area Storage (NAS) technology for Network Device Management Protocol (NDMP) backup services.

4.3.2.7.1 Manage and administer the NAS including all tasks typically associated with large file storage administration and backup functions.

4.3.2.7.2 Monitor and report the network file system disk space, quota, and size limits monthly;

Perform disk management and disk utilization forecasting.

4.3.2.7.3 Assist with the correction of data spills and perform sanitation in accordance with established

SOP.

4.3.2.8 Backup and Restore: Develop, implement, and maintain a system backup plan and ensure all system backups are properly performed daily.

4.3.2.8.1 Provide tapes and perform file and system backups in compliance with established backup schedules.

4.3.2.8.2 Review daily backup logs to ensure any failed backups are completed immediately.

4.3.2.8.3 Manage the backup media library and tape inventory. Restore systems and data as requested by the Government.

4.3.2.8.4 Provide secure offsite indefinite archive storage of all OSD Enterprise backups for Unclassified, Secret, and onsite indefinite archive storage for Top Secret/SCI. Mark tapes for archive, catalog, and manage all tapes; to include transport all tapes to and from offsite storage.

4.3.2.8.5 Retrieve and make all required tapes available on-site within 1 business day of notification.

4.3.2.8.6 The transportation process and storage facilities must comply with all relevant Government and DoD laws, regulations, polices and guidelines.

4.3.2.8.7 Perform monthly tests of data recovery solution to ensure availability and accuracy of backup data.

4.3.2.8.8 Review and update systems backup plan on a quarterly basis at a minimum to ensure system backups are being properly performed.

4.3.2.9 Investigative Search Requests (ISR): Perform data search requests and file retention on current and backed up e-mails and files as requested by the Government and in accordance with established SOP. (The estimated average number of ISRs is 8 per month and up to 144 per year.

Typically there are between 2 to 3 open ISRs which must be worked concurrently, and there have been up to 6 open ISRs at one time.)

4.3.2.10 BMC Software Remedy Administration: Administer, support, maintain, and enhance the OSD Enterprise Remedy ticket system. Identify, submit, and support efforts to integrate ticket systems as required by the Government.

4.3.2.11 SharePoint Administration: Administer, support, and maintain Microsoft SharePoint.

4.3.3 The Enterprise Service Center and Distributed Service Desks: The contractor shall support distributed service desks in customer locations to provide a virtual service center to the customer community. Performance metrics for distributed service desks work in conjunction with performance metrics for enterprise service center, and do not provide additional cycle time for completion. The contractor shall:

4.3.3.1 Provide incident and service request support using the Information Technology Infrastructure Library (ITIL) Information Technology Service Management (ITSM) model. Restore service as quickly as possible minimizing the impact to business operations. Provide a centralized service desk that will provide IT support services, call triage and routing for non-IT support services with the following focuses for incident management and service request delivery:

• First Call Resolution

• Impact and Priority Based Incident Categorization

• Quality Assurance

• Warm handoff incident escalation

• Compliance with all stated SD SLAs (section 5.0 Performance-based)

• Request fulfillment

4.3.3.2 Provide enterprise service center support (incident management) 24X7 including weekends, holidays and surge situations for NIPR, SIPR, JWICS and other TS and SAP networks.

4.3.3.3 Provide desk-side support for all OSD users located at applicable NCR building locations and off-site deployments, including COOP locations, to resolve incidents or implement service requests for NIPR, SIPR, JWICs, and other TS and SAP networks.

4.3.3.4 Provide initial rapid turn-around, within 24 hours notice, for urgent requests to stand-up new offices for up to 25 users and workstations per day; for example setting up new Boards, Commissions and Task Force (BCTF) activities. (The estimated maximum number of urgent requests for rapid office stand-ups is no more than 12 per year.)

4.3.3.5 Provide onsite support to Pentagon global situation awareness facility (GSAF) location during events and exercises to include after hours support, weekends and holidays. (The estimated monthly average for GSAF events and exercises is 1 to 2 per month and estimated no more than 24 per year).

4.3.3.6 Provide support for all COOP exercises supporting IT functionality from COOP locations.

Minimally there are quarterly COOP events, at least 4 per year. May require travel to off-site locations within 100 miles of the National Capital Region.

4.3.3.7 Provide desk-side support for off-site conferences and events as required, at least 3 per year.

4.3.3.8 Provide surge support for budget cycle between June to December including desk side support during extended hours (6:00 pm to 8:30 pm).

4.3.3.9 Provide VIP level support to designated users, not to exceed ten percent of the entire user population. VIP support means responding and resolving incidents and responses within the VIP priority tickets performance metrics.

4.3.3.10 Provide Executive level support to designated users, not to exceed the senate-approved senior officials in each PSE and their immediate assistants. Executive level support means responding and resolving incidents and responses within the VIP priority tickets performance metrics and includes Executive home visits as approved by a Government manager. (The estimated maximum number of home visit is no more than 20 per month and no more than 240 per year.)

Perform daily visits on business days to Government-specified executive offices to ensure executive and staff IT needs are met.

4.3.3.11 Incident Management: The goal of Incident Management is to track progress of all incidents and restore degraded or disrupted services to users as quickly as possible. Using ITIL practices and model review, revise and maintain service desk policies for incident management to process, track, categorize, prioritize, and assign customer incident reports and service requests.

Provide a service desk support structure that allows for escalation of incidents based on expertise required for resolution and urgency.

4.3.3.11.1 Answer customer telephone calls to the service desk promptly, 24X7 including weekends, holidays and surge situations. Proactively monitor Automatic Call Distribution (ACD) calls, incidents and service request work flows, processes and queues to immediately identify and address performance issues that will impact the delivery of services to users.

4.3.3.11.2 Response time for incidents reported after hours shall be minimally considered as “urgent” by default.

4.3.3.11.3 Monitor voicemails and emails left for the service desk 24X7 including weekends, holidays and surge situations; and send a prompt acknowledgement to customer.

4.3.3.11.4 Log incidents and service request into the Incident Record Database (Remedy). Ensure that all incidents are promptly and accurately documented in the incident tracking system so that up-to-date information is available at all times.

4.3.3.11.5 Provide the Government immediate notification of an Enterprise incident.

4.3.3.11.6 Perform initial diagnosis and immediate resolution and recovery if possible. Use client workstation remote control tools to assist and resolve customer incidents as initial resolution.

Escalate incidents that cannot be immediately resolved;

4.3.3.11.7 Assist with data-spill cleanup and sanitization in accordance with DoD and local policies and procedures.

4.3.3.11.8 Ensure non-IT requests are properly routed to appropriate support organizations. This includes routing OSD component-specific mission IT incident calls to the appropriate system administration team.

4.3.3.11.9 Provide accurate reporting and statistics on all related incidents and service requests.

4.3.3.11.10 Participate with problem management team to maintain control over, and resolution of, incidents occurring within the enterprise environment which may affect multiple clients or resources.

4.3.3.11.11 Develop and implement a detailed knowledge base which will contain resolution information, standard operating procedures, and vendor-specific data pertinent to technical use and instructional information specific to products. Examples include MS Office, Adobe, or other COTS and GOTS products.

4.3.3.11.12 Utilize the knowledgebase to guide users through resolution of the reported issues. Verify that the knowledgebase solutions are kept up to date and applicable to all applications and facilities.

4.3.3.11.13 Communicate system outages in accordance with established SOP to appropriate Government points of contacts and customers using Government provided tools and communication methods and continue constant communications until the incident has been resolved and all services have been restored.

4.3.3.11.14 Proactively manage, track and work incidents that were not resolved by the target incident resolution time.

4.3.3.11.15 Follow-up on completed incidents to check quality and to report customer satisfaction

4.3.3.12 Request Fulfillment Process: The goal of Request Fulfillment is to provide a way for users to request and receive pre-approved IT components and to correctly route requests for components which are not pre-approved. Requests are received from a variety of sources including web interface, user or technician telephone call and voicemail, user or technician e-mail, and user or technician walk-up. The contractor shall log and track requests for IT components and services, and the contractor shall deliver approved IT components and services.

4.3.3.12.1 Log service request into the service request database (Remedy). Ensure that all service requests are promptly and accurately documented so that up-to-date information is available at all times.

4.3.3.12.2 Verify IT equipment or software version is pre-approved; fulfill approved service requests and deliver approved, in-stock hardware and software.

4.3.3.12.3 Confirm software licenses availability before installing software. Install properly licensed software. The Government will specify available software licenses.

4.3.3.12.4 Generate purchase requests as needed.

4.3.3.12.5 Submit updates to related CMDB records.

4.3.3.12.6 Track request status and escalate requests when the target delivery times are exceeded.

4.3.3.12.7 Maintain an equipment checkout system for short-term assignments of laptops and other portable IT equipment.

4.3.3.12.7.1 Ensure all portable IT equipment is current and ready for immediate deployment at all times. Urgent requests for IT equipment must be resolved within 11 business hours;

critical requests for IT equipment must be resolved within 6 business hours.

4.3.3.12.7.2 Ensure that equipment for VIP travel is separated from the standard use inventory so that equipment for VIP travel is available for VIPs only.

4.3.3.12.7.3 Track the status and whereabouts for all checked-out equipment and ensure checked-out equipment is returned on time.

4.3.3.13 Account Based Access Management: The contractor shall log requests for network access, and the contractor shall execute processes to create, modify, disable, delete, and manage unclassified and classified network and application accounts. The goal of Access Management is to grant appropriate access to authorized users, workstations, and other network devices.

4.3.3.13.1 Log account requests into the access request database (Remedy). Ensure that all account requests are promptly and accurately documented so that up-to-date information is available

4.3.3.13.2 Review and route access requests for appropriate authorization according to approved SOPs.

4.3.3.13.3 Provide the Government immediate notification of an unusual account request.

4.3.3.13.4 Grant and modify access to authorized users, workstations, and other network devices.

4.3.3.13.5 Administer security groups and application accounts.

4.3.3.13.6 Maintain GAL distribution lists.

4.3.3.13.7 Develop, seek approval, and implement a plan for cleanup and maintenance of Account, Mail Distro, and File Groups.

4.3.3.13.8 Disable access to departing users or removed workstations and network devices.

4.3.3.13.9 Monitor access records to identify and disable stale accounts and workstations.

4.3.3.13.10 Report account membership in user groups, roles, and service groups.

4.3.3.13.11 Maintain account exceptions and exemptions list.

4.4 Configuration Management Support (Service Asset and Configuration Management): The overall objective of Configuration Management (CM) is to ensure that standardized methods and procedures are used for efficient and prompt handling of all configuration items and changes;

provide OSD CIO a current and accurate logical representation of the physical IT infrastructure including servers, desktops, laptops, Government issued mobile electronic devices and software.

Using the ITIL and ITSM models and in accordance with OSD CIO Configuration Management Plan the contractor shall provide Configuration Management (CM) support. The contractor shall:

4.4.1 Develop and execute a project plan for implementing and improving configuration management within OSD. Include configuration management processes that incorporate change management processes to ensure all configuration management items are updated in a timely fashion. Software license management is of particular interest and importance.

4.4.2 Provide CM services to include configuration identification, change control management, and maintenance of the existing document and software libraries.

4.4.3 Develop and maintain the BMC Remedy configuration management database (CMDB) for tracking configuration information for all configuration items.

4.4.3.1 Define, document, update and control the configuration items (CI) of IT services and infrastructure including hardware and software.

4.4.3.2 Document and update the relationships and context of the IT infrastructure.

4.4.3.3 Maintain accurate configuration information on the historical, planned, and current state of IT services and infrastructure.

4.4.3.4 Track and update location and user assignment of CIs in the CMDB. Accuracy of the CMDB shall include location and user assignment.

4.4.3.5 Ensure the completeness and accuracy of the records stored in the CMDB.

4.4.4 Maintain and account for installation media and electronic programs for software in the Definitive Media Library as well as across the network; maintain copies of the software installation programs on the shared network folder.

4.4.5 Implement, maintain, document and report installed software license counts and Definitive Media Library changes; provide support for inquiries on software license availability. Update appropriate CIs in the CMDB when installing software.

4.4.6 Leverage monitoring tools to monitor the configuration of every computer to ensure that it is correct and remains correct.

4.4.7 Analyze and report configuration data at various levels of aggregation in ways that are meaningful to all levels of management and stakeholders. Working with the Government, the contractor will develop mutually agreed formats for reports.

4.4.8 Be responsible and account for all hardware and software which is not assigned to a specific user or custodian.

4.4.9 Inspect hardware CI annually; update the CMDB with latest physical verification date and notify the Government immediately when hardware is lost or stolen. Notify the Government quarterly of items which have not been physically verified in the previous 12 months.

4.4.10 Prepare purchase requests for software maintenance renewals according to policies in place (at least 120 days prior to maintenance expiration date).

4.4.11 Provide end-to-end visibility of status of users’ requirement from request to fulfillment.

4.5 Integrated Logistics and Asset Management Support: The contractor shall provide end-to-end

Integrated Logistics Support (ILS) for information technology hardware and software throughout the asset life cycle. The three integrated functions are as follows:

• Operate ILS Facility

• Material Handling

• Computer Equipment Repair and Maintenance.

4.5.1 Operate ILS Facility. The Government will provide warehouse space for the ILS facility. The contractor shall:

4.5.1.1 Provide warehouse operations support to ensure the Government warehouse is the primary storage location for all inventory. All other locations must be approved by the Government before it is used to store IT assets; do not store IT assets in customer areas.

4.5.1.2 Provide logistics for both reportable IT assets (for example: printers, monitors, workstations, and laptops), non-reportable assets (for example: speakers, switch boxes, CAC readers keyboards, mice, and laptop bags).

4.5.1.3 Receive vendor deliveries of computer hardware and software, recording receipt, affixing security, bar codes and other labels/markings to selected items. Enter new assets in the BMC Software Remedy CMDB. Notify acquisition team and component POC of equipment receipt.

4.5.1.4 Manage the disposal process, including preparing documentation for disposal, preparing equipment for shipment, pickup and delivery, coordination and turn in to the redistribution system. Update the CMDB when assets are disposed.

4.5.1.5 Monitor IT asset warehouse inventory and immediately report IT assets that are approaching Government identified reorder threshold for warehouse inventory levels.

4.5.1.6 Be responsible and account for all hardware which is located at the ILS facility.

4.5.1.7 Immediately report lost or stolen items to IT Asset Management Government points of contact.

Prepare Lost and Stolen Reports for any lost or stolen items.

4.5.1.8 Ensure all IT asset transactions have the appropriate documentation signed and are part of the transaction. Perform weekly audits for IT asset documentation in correlation with completed IT Asset Service Requests.

4.5.1.9 Ensure all damaged or unused IT assets are returned to the warehouse for service or excess.

4.5.1.10 Conduct quarterly review of Asset Management SOPs and make recommendations for continuous improvement.

4.5.2 Material Handling: The contractor shall:

4.5.2.1 Move and deliver computer equipment between the ILS facility and among various user sites in and around the Pentagon, National Capital Region, or other support locations as requested.

4.5.2.2 Adhere to DoD and local procedures for moving classified equipment.

4.5.2.3 Provide transportation and delivery of IT assets throughout the NCR. Note: The Government will not provide a vehicle(s) for the transportation and delivery of IT assets.

4.5.2.4 Develop and implement processes that coordinate delivery of IT assets directly to customers and office equipment custodians. Insure new user in/out processing is factored into the process.

Note that they may be unique in each OSD Component.

4.5.2.5 Submit updates to related BMC Software Remedy CMBD records when moving computer equipment.

4.5.2.6 Provide support and execution for incidents and service request that require IT assets from the ILS

Facility.

4.5.2.7 Computer Equipment Repair and Maintenance: To support this effort the contractor shall assist the

Government with managing computer equipment repair, warranties, and maintenance support contracts for computer equipment.

4.5.3 Maintain a list of computer equipment warranties and maintenance contracts in effect, terms of the warranties and contracts, expiration dates, and cost.

4.5.4 Provide annual maintenance contract cost estimates to the Government for budgetary purposes.

Prepare purchase requests for hardware maintenance renewals according to policies in place (at least 120 days prior to maintenance expiration date).

4.5.5 Process and manage requests to repair computer equipment with warranty and maintenance support contracts in effect. Coordinate warranty and maintenance support requests with external vendors.

4.5.6 Perform limited hardware repairs on equipment that is not covered by warranty or maintenance support contracts.

4.5.6.1 Recommend bench stock levels of GFE spare parts and GFE spare end items required to facilitate the repair process.

4.5.6.2 Prepare technical requirements and purchase requests for the additional spare parts and spare end items.

4.6 Security Operations Support: The contactor shall provide services to maintain systems security.

Information systems security maintenance requirement include but are not limited to IAVAs, IVMs, vendor security patches, Security Technical Information Guides (STIGs), DISA Gold Disks, and Communication Tasking Orders (CTOs). In addition, the contractor shall :

4.6.1 Utilize VMS to update, manage and track implementation of information security requirements for the IT assets and resources and ensure they are properly protected against current and evolving attacks and/or compromise vectors.

4.6.2 Perform security maintenance functions and provide detailed outcome reports to ensure the security posture of the information systems to include but not limited to: disabling inactive network accounts; domain and local admin group verification; global service and admin password changes and security requirement implementation (STIGS, IAVAs, CTOs, and PENCERTs).

4.6.3 Use Government provided tools to automate the deployment and removal, if necessary, of information systems security requirements (patches, updates, and configuration changes) for all information systems.

4.6.4 Perform security requirements (patches, updates, and configuration changes) analysis to determine impacted systems, technical implementation recommendations, implementation impacts.

4.6.5 Provide security support at a technical level, in remediating vulnerability findings during system vulnerability assessments of systems, network, and assist with the development of POAMs for remediation. As required, provide technical input for DoD and IA related data calls for compliance or status verifications.

4.6.6 Utilize Government provided security systems to monitor, manage, and maintain the security of the information systems.

4.6.7 Provide technical expertise to CERTS in containing and sanitizing data spillages in accordance with DoD and local policies and procedures.

4.6.8 Provide system support for integrating existing IA products with new hardware and software introduced into the network.

4.6.9 Provide support for current and new initiatives related to implementing IA related products and services. Some initiatives are directed from within the IA management while others are directed from the DoD level. Initiatives could be related to security mechanisms to improve the security posture of desktops, servers, or other peripherals.

4.6.10 Maintain the Financial Protected Zone and the Legal Protected Zone which provide limited access to specific network file shares. Maintain file, network boundary, and folder access auditing including permissions and logs for file shares and network boundary.

4.7 (Optional CLIN- Firm-fixed-price) Standardize Base Workstation Images: The contractor shall propose a plan including tools, metrics and risk mitigation to re-image all desktops and laptops with FDCC load within one year. On Government approval, the contractor shall execute the plan to re-image all desktops and laptops within one year.

4.8 OSD Continuity of Operations (COOP) and Continuity of Business (COB)

4.8.1 The contractor shall provide technical support to establish and maintain desktop, laptop, network, server, system, and application operations capabilities, to include remote access services, at remote/alternate work sites as designated by the Government. Equipment and software configurations, processes, and procedures will be consistent with existing architecture and operating environment. Equipment will be configured to operate in a real-time scenario, capable of taking over primary functionality in the event operations are reduced or eliminated at the Pentagon. The contractor will provide ongoing support to ensure COOP systems are operational

4.8.2 The contractor may be required to work at remote/alternate sites while equipment is being installed, for on-site testing and maintenance, or to provide support for exercises or contingency operations. The contractor shall provide contingency plans and designate mission essential personnel. In accordance with DODI 3020.37, Continuation of Essential DoD Contractor Services During Crises, mission essential contractors are required to provide a contingency plan and designate mission essential personnel. The contractor is required to maintain updates to this plan as necessary and ensure that coverage is provided during real-world and exercise scenarios.

4.8.3 Contingency of Operations: Should a crisis be declared, the Contracting Officer will verbally advise the contractor of the revised requirements, followed by a written notification. Written notification will be sent as soon as practicable. The contractor shall ensure contingency support is available for the continuation of essential DoD contractor services during a crisis situation. This support will be detailed in a contingency plan. In the event of mission essential system failure, which requires immediate attention, the contractor shall remedy the situation(s) in accordance with the performance standards outlined in the Performance-based Matrix. In the event of non-mission essential system failure not requiring immediate attention but requiring short turn-around time due to another exercise, the contractor shall repair the affected system in a timely manner.

Any price changes resulting from this crisis will be negotiated…