IT IDIQ SOW ROUGH DRAFT SOO 6_17.pdf

Indefinite delivery/indefinite quantity (IDIQ) Type: Statement of Work (SOW)/ Statement of Objectives (SOO)

United States International Development Finance Corporation (DFC)

Office of Information Technology (OIT) Support Services OIT CloudFirst Enterprise Systems Support Services (CFESSS)

GENERAL INFORMATION

1.0 Scope of Work:

The DFC/OIT has a requirement for professional Information Technology (IT) expertise to provide end to end IT operations and maintenance support in order to deliver enterprise-level information IT capabilities throughout the agency. The Contractor shall provide a full range of delivery services necessary to support program technical and management approaches, organizational resources, and management controls in alignment with program cost, performance requirements as they are set forth by individual Task Orders and scheduling demands.

DFC/OIT anticipates the award of a five year, Firm Fixed Price (FFP), Award Fee (AF), Time and Materials, or Hybrid Type Order Indefinite delivery/indefinite quantity (IDIQ), with a Maximum Shared Ceiling across all awards of ($250,000,000) dollar threshold, with the potential for five (5) one (1) year Option periods.

The IDIQ will be broken down into four distinct pools, with specific tasks and expertise required for each of the following pools and outlined throughout the document: Pool A – Operations; Pool B – Application Development (AppDev); Pool C – Cyber Security; and Pool D – PMO Support Services. Awards will be made to ensure a reasonable number of vendors per pool to support the work that may be required within the pool.

1.1 Background:

The U.S. International Development Finance Corporation (DFC) is America’s development bank. DFC was established in 2019 through the passage of the Better Utilization of Investments Leading to Development (BUILD), Act, which strengthened and modernized American development finance. The BUILD Act combined the capabilities of the Overseas Private Investment Corporation (OPIC) and the Development Credit Authority which had previously been housed in the U.S. Agency for International Development (USAID). DFC partners with the private sector to finance solutions to the most critical challenges facing the developing world today. DFC invests across sectors including energy, healthcare, critical infrastructure, and technology. DFC also provides financing for small businesses and women entrepreneurs in order to create jobs in emerging markets. DFC investments adhere to high standards and respect the environment, human rights, and worker rights. DFC makes America a stronger and more competitive leader on the global development stage with greater ability to partner with allies on transformative projects. Further, DFC provides the developing world with financially sound alternatives to unsustainable and irresponsible state-directed initiatives.

DFC supports development in emerging markets through: Debt Financing Direct loans and guaranties of up to $1 billion for tenors as long as 25 years, with specific programs targeting small and medium U.S. businesses: Equity Investments DFC direct equity investments can provide critical support to companies committed to creating developmental impact: Feasibility Studies Support for the analysis of a potential DFC project: Investment Funds Support for emerging market private equity funds to help address the shortfall of investment capital: Political Risk Insurance Coverage of up to $1 billion against losses due to currency inconvertibility, government interference, and political violence including terrorism. DFC also offers reinsurance to increase underwriting capacity: Technical Assistance Support to increase the developmental impact or commercial sustainability of existing DFC projects or develop potential DFC projects+

The DFC Office of Information Technology (OIT), herein after referred to as DFC/OIT or OIT. DFC/OIT’s Vision is to become an Agile IT enterprise, that adapts quickly to new technology and industry standards, enabling secure, innovative, cost-efficient support to our DFC customers. DFC/OIT’s Mission, and Goals, as follows:

• To advance DFC's ability to drive global development impacts through providing reliable, innovative IT solutions.

• Infrastructure Stabilization: Strengthen current infrastructure to support our customers growing IT needs. Ensure resiliency, security, mobility, and availability.

• Cloud First adoption. Moving the needle forward to cloud first approaches and usage for DFC. Doing our best to minimize on premises data infrastructure and support.

• Application Development Maturation: Mature toward an agile, automated development/test pipeline using DevOps, CI/CD methodologies.

• Desktop Stabilization: Standardize the desktop image and provide desktop security and mobility to our customers.

• IT Governance: Meet statutory and legal reporting/audit requirements while enforcing IT processes and policy that matures our investment, security, architecture compliance and posture. (This includes policy, security, and architecture efforts)

• Service Desk Maturation: Mature our service desk operations by standardizing our service delivery processes and maturing our ITIL supporting processes and metrics

• IT Workforce Development: Hire, train and retain competent IT professionals to support the DFC mission.

• OIT Branding/Service Delivery Improvement: Raise awareness of OIT provided services and work to be seen as a strategic, collaborative business partner within the organization.

• Information Security: Continue to support the OIT, Chief information security office in protection of IT equipment and software owned and used by the DFC and outside users.

• DFCs move towards “Zero Trust”. A shift of network defenses toward a more comprehensive IT security model that enables restricted access controls to networks, applications, and environment without sacrificing performance and user experience.

2.0 Applicable Documents:

2.1 .

Background information for Indefinite Delivery Indefinite Quantity (IDIQ) contract type.

This IDIQ is broken out into pools that reference the level of work to be performed herein. The tasking is based on the PWS as a whole, with a per task workstream solicited by need of the DFC.

3.0 Requirements: The following outlines general information and expectations needed to successfully complete any order off of the IDIQ.

3.0.1 The Contractor shall provide highly qualified personnel as required by individual

Task Orders, in the performance of this overall requirement.

3.0.2 Applicable to all potential orders, and for estimating purposes, the yearly estimated Other Direct Costs (ODC) are set forth at an estimated shared amount of $______ per year, where this will be the shared ceiling across all orders of potential ODCs allowable per year.

3.0.3

3.0.4 Software and Hardware Requirements:

3.0.4.1 Software Licenses Data Requirements: Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, the contractor shall submit monthly reports, for the Contracting Officer’s Representative (COR) review/approval, on all software licenses, to include the following criteria – quantity of licenses in use, quantity of licenses available, renewal date, alerts 90 days prior to renewal due date, cost of renewal, forecast of hiring and recommended adjustments in number of licenses to procure.

3.0.4.2 Software Licenses Delivery Requirements: Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, the contractor shall submit a monthly report to the COR for review/approval.

3.0.4.3 Software Licenses Report Requirements: Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, the contractor shall submit a monthly report to the COR for review/approval. Submit a continuous monthly aggregate inventory report at the time of Monthly Invoice submission.

This report shall demonstrate “real time” kinds of quantities of electronic equipment/software, alphabetized & categorized by item nomenclature, dollar value, disposition, location, issuance or/retrieval status, inventory with all relative associated dates, employee names and contract numbers.

3.0.4.4 Software Maintenance Services – The Contractor shall provide highly qualified personnel to perform Software maintenance services to create, design, implement, and/or integrate customized changes to software that solve one or more problems that is not included with the price of the software. Software maintenance services includes person-to-person communications regardless of the medium used to communicate telephone support, online technical support, customized support, and/or technical expertise which are charged commercially.

3.0.4.5 Software Maintenance Services Data Requirements: Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, the contractor shall submit monthly reports to the COR for review/approval.

3.0.4.6 Software Maintenance Services Delivery Requirements: Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, the contractor shall submit monthly reports to the COR for review/approval.

3.0.4.7 Software Maintenance Services Report Requirements: Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, the contractor shall submit monthly reports to the COR for review/approval. Submit a continuous monthly aggregate inventory report at the time of Monthly Invoice submission. This report shall demonstrate “real time” kinds of quantities of electronic equipment/software, alphabetized & categorized by item nomenclature, dollar value, disposition, location, issuance or/retrieval status, inventory with all relative associated dates, employee names and contract numbers.

3.1 Electronic Hardware:

The Contractor shall provide services for the purchasing of New Electronic Equipment.

Please reference associated Addendum for information/requirements on Electronic Hardware.

3.1.1 To include, desktop, laptop, tablet computers (including rugged per request), servers, storage equipment, hyperconverged integrated systems, supercomputers, routers, switches and other communications equipment, cloud, IT security equipment (hardware-based firewalls), audio and video (AV) equipment, public address systems, monitors/displays, sensors and other Internet of Things (IOT) devices, printers and Multi-Function Device (MFD) equipment, broadcast band radio, two-way radio (LMR), ed with invoice, RPA, AI.

3.1.2 Electronic Hardware Data Requirements: Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, the contractor shall submit monthly reports to the COR for review/approval. The Contractor shall develop and propose a Technical Refresh Plan for Hardware Replacement, based on DFC/OIT refresh criteria describing all activities, costs, and schedule associated with maintaining and updating a current asset inventory of all DFC/OIT hardware devices (see Addendum List of Hardware, or individual Task order addendums as required). Personal computers and peripheries are generally expected to be refreshed every three to four years while network, server, and storage systems may be refreshed based on support cycles and need. The plan shall reflect a cyclic representation of a technical refresh process that includes all related activities associated with equipment replacement. The fundamental areas that shall be addressed include:

• Asset inventory, identification and assessment.

• Standard hardware equipment specification (based on DFC requirements).

• Acquisition strategy.

• Implementation process.

• Equipment disposal strategy.

• Repeatable, cyclic schedule, and.

• Cost analysis based on annual refresh cycle (hardware, software, labor).

3.1.3 The Contractor shall be responsible to develop the DFC Technical Refresh Policy to govern the strategic goals and objectives of refreshing the Agency infrastructure on a recurring annual cycle. This plan will be implemented in partnership with the Government.

3.1.4 Electronic Hardware Delivery Requirements: Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, as required by individual Task Order (TO), the contractor shall submit monthly reports to the COR for review/approval.

3.1.5 Electronic Hardware Report/Inventory Requirements; Utilizing the Contractor’s format, with clear lines drawing back to the Contractor’s proposed QACP, the contractor shall submit monthly reports to the COR for review/approval. A continuous monthly aggregate inventory report at the time of Monthly Invoice submission. This report shall demonstrate “real time” kinds of quantities as necessary of electronic hardware, alphabetized & categorized by item nomenclature, dollar value, disposition, location, issuance or/retrieval status, inventory with all relative associated dates, employee names and contract numbers.

3.2 Leasing of new electronic equipment:

The Contractor shall provide highly qualified personnel to perform the task of leasing new electronic equipment requirements. This requirement will be definitized by individual Task Orders (TO). Additional information will be within the specific pool associated with leasing at the IDIQ and Task order level.

3.3 IT Services and Support Objectives:

The Objectives herein below are broken into 4 different categories or “pools” based on what functions of type of work and associated vendor skill sets that DFC OIT will need for future task orders. Each of these pools labeled A-D will focus on type of work objectives broken into A) Operations B) Application Development (App/Dev) C) Cyber Security D) PMO . The objectives cover workstreams that are broken out from the highest level objective into functions of what needs to occur within that workstream. The pools will use individual task orders that will use the objectives and functions to cover what will be needed within the Period of Performance of this IDIQ and may provide additional specific details not outlined here within. When orders are issued that cover multiple functions across pools, they will be solicited to the pool that will perform the preponderance of the work.

All IDIQ standards are subject to change based on the evolution of Executive guidance and policy as well as changes in technology over the period of performance of the IDIQ.

Future standards will be outlined at the task order level and will outline expectations of that task order to be in compliance with best in class performance from industry partners.

POOL A: Operations

Objective:

Pool A combines most functions of IT operations for DFC into the pool. Things included but not limited to:

Help/Service desk support

Operations and Maintenance

Data center operations

Hardware and software

Audio/Video

Information Technology Professional Services:

The Contractor(s) must submit a comprehensive operations and service desk staffing/transition plan with their proposal submission. This Plan must establish the operational framework that is necessary to ensure a seamless, low-risk migration. The plan should include initial phase in with onsite support and offsite support intent with a plan to go 100% remote support within the first six months of contract. The plan must outline the actions and timeline necessary for the transition to occur and the communications necessary to ensure a flawless implementation. The plan at a minimum must include the following:

• Transition-in approach and schedule

• Staffing/Hiring approach

• Retention approach

• Amount of onsite/remote support

• Knowledge transfer approach

• Training of staff on OIT environment and process

• Service continuity (ensuring no disruption of service during transition)

• Designated backups to key personnel (as outlined in section 3.3)

• Potential Risk identification and mitigation strategy A Kick-Off meeting must be scheduled within 5 business days after award of the contract. Awardee must update and present a final comprehensive service desk staffing/transition plan consistent with their solution to the COR (or assigned designees) for review and approval no later than two weeks after contract award.

Structure

The service desk is divided into three tiers categorizing the type of service provided:

Tier I is the front-line first level support team. They are the first level customer-facing support. Tier I should resolve most common incidents and requests. Tier I will triage all incidents and requests and assign or escalate all tickets, accordingly. Tier I analysts will perform Total Contact Ownership (TCO) of all incidents and requests either within or outside of the Service Desk queues. Tier I Service desk will maintain excellent collaboration and working relationships with all tier teams and end-users/customers.

They will create and institute a comprehensive onboarding and offboarding SOP to ensure new hires receive sufficient training and guidance on accessing DFC systems and the proper removal of access as needed.

Tier II Network Operations is the second level support team. Tier II will intercept and handle all escalations from Tier I and will be senior systems administrators. Tier II will maintain excellent collaboration and working relationships with all tier teams and end-users/customers. Tier II will have strong troubleshooting skills. Tier II is responsible for daily operations and maintenance of the DFC infrastructure. The Tier II team will also comprise of a security operation team that will focus primarily on security operations and compliance. The DFC (Chief Information Security Office) CISO team will perform network security scans and will identify system vulnerabilities and non-compliant systems. To maintain compliance and a secure network security posture, system patching and vulnerability mitigation must be performed on a weekly basis.

Tier III engineering is responsible for network modernization, technical refresh implementations, and enterprise architecture solutions. However, for purposes of incident/ticket escalation, system-wide outages and total contact ownership, good collaboration with Tier III technical and application support specialists is required. The tier III team will work in coordination with the federal IT team to develop a system lifecycle framework and overall technical architecture.

• These tiers also provide the structure for escalating tickets The operations infrastructure support team provides engineering support for our telecom circuits, Cisco, Palo Alto, Aruba Wireless and NAC, Nutanix, Citrix, Microsoft, HP MFD Printers Microsoft 365 and Azure environments.

The operations support teams are expected to work in tight coordination for the resolution of all client requests and issues and provide the overall support of the DFC network systems and application infrastructure.

The DFC expects our support tiers to ensure that current, complete and accurate documentation exists for all systems, processes and tasks. Ongoing, all support team members are expected to look for areas to create new and update existing processes to ensure things are consistently followed.

• Tier I support will strive to resolve all common incidents and requests using a combination of prior technical knowledge among team members via mentoring and cross-training. In addition, team members are expected to research and contribute to a shared knowledge base to help troubleshoot issues and share information to be used by others. Team members are expected to look for areas to create new and update existing processes to ensure things are consistently followed.

• Tier II will support escalation tickets that cannot be resolved at the Tier I level as well as requests that require advanced knowledge or access. They will also assist on Tier I level requests and issues as needed. Similar to Tier I, team members are expected to research and contribute to a shared knowledge base to help troubleshoot issues and share information to be used by others. Team members are expected to look for areas to create new and update existing processes to ensure things are consistently followed. Tier II will also perform daily operation and maintenance tasks.

• Tier III will support escalation tickets that cannot be resolved at the Tier II level as well as requests that require advanced knowledge or access.

• After Business Hours Availability: DFC's IT Service Desk and NetOps teams shall provide after-hours and weekend support by passively monitoring the ServiceNow incident queue and infrastructure system alerts, warnings and failures from Operations Manager and other monitored systems and will respond to critical incidents and enterprise-wide outages. After business hours support includes time-frames outside of standard business hours on a best effort basis, to include overnight and weekends. After-hours support consists of a passive monitoring of alerts configured to send to mobile phones for all technical contractor personnel. If a critical alert is received and acknowledged by contracting personnel, DFC would expect contractor personnel to report the critical alert to OIT management and escalate to the appropriate support personnel, including opening an incident with external vendors, i.e., ATT, Cisco, etc., as necessary. For standard, non-critical alerts, the service desk would be expected to respond the next business day when the incident SLA counter would begin. Contractor personnel would be expected to bill for hours worked when responding to critical alerts and enterprise-wide outages received after standard business hours. DFC will not apply SLA’s to after-hours passive alerting response times.

At a high-level DFC’s technical landscape requires the daily support of a variety of technologies including:

• Windows 10, Office 365 Apps and other COTS and in-house developed software

• Citrix virtual desktops and remote access

• Desktop peripherals (monitors, docking stations, mice, printers, and other devices)

• Cisco Call Manager VOIP and desk phone management

• Secure enterprise printing, scanning and faxing

• On-premise Active Directory service management (DNS, GPO, DHCP, file services, user and group management, PKI certificate management etc.)

• Azure Active Directory

• Azure cloud storage

• Hycu backup software for local and cloud storage

• HP Network Attached Storage

• Cisco – Routing (L3) and switching (L2)

• Palo Alto – Firewall, perimeter protection and VPN access

• Citrix NetScaler load balancing

• Cisco video conferencing equipment Key Personnel

The contractor shall provide the following key personnel referenced below, but subject to be expanded at the individual Task order level at point in time.

Program Manager: The Program Manager must have at least five (5) years of program management experience.

• The Program Manager is a full time position. The Program Manager must be the contractors representative responsible for management and coordination of all the contractor’s supplier. The Program Manager will be the Contractors liaison for the COR or designee(s).

• The contractors Program Manager will be responsible for the recruitment, screening, interviewing, and hiring of qualified personnel for various positions within the OIT. The Program Manager must analyze the work of subordinates and take appropriate steps for retention or other personnel actions.

− The Program Manager will conduct onsite weekly/monthly meetings with the COR to review weekly/monthly reports, issues, and continuous service improvement plans.

− The Program Manager position is critical to the success of the OIT and Contractor and the Program Manager must create an effective working relationship with the COR, COTRs and the CIO management team. The OIT retains the right to have the Program Manager replaced without cause.

Service Desk Manager: The Service Desk Manager must have at least five (5) years of service desk/help desk management experience. The Service Desk Manager must have an HDI Support Center Manager Certification.

• The Contractor must provide a Service Desk Manager. The Service Desk Manager is a full-time on- site position and must manage the OIT Service Desk and Service Desk personnel. The Service Desk Manager will be the Contractors on-site liaison for the COR or designee(s).

• The Contractors Service Desk Manager will be responsible for the management of the day-to-day operation and direct supervision of all Service Desk personnel. The Service Desk Manager must analyze the work of subordinates and take appropriate steps for retention or other personnel actions. The Service Desk Manager is responsible for ensuring all requirements of the contract are fulfilled and all deliverables submitted on time.

• The Service Desk Manager position is critical to the success of the mission and must create an effective working relationship with the COR, COTRs, and CIO management team. The OIT retains the right to have the Operation Manager replaced without cause.

Asset Manager: The Asset Manager must have at least five (5) years of Asset management experience

• The Contractor must provide an Asset Manager. The Asset Manager is a full-time on-site position and must document all asset management, processes, and procedures.

• The Asset Manager must have at least five (5) years of Asset management experience

• Manage, integrate, and improve the asset and software license modules within the ITSM tool

• Maintain the asset management database containing all the information necessary for the lifecycle of an IT asset

• Resolve discrepancies identified in asset management database and update the asset management database upon any custodial changes

• Reconciliation of discovered assets that are not tracked in the asset management database

• Maintain stock locations for storing assets waiting deployment or disposal

• Maintain documentation relating to the asset management process and procedures

• Work together with OIT, business, finance, procurement, legal departments, in providing reports that support the negotiating of vendor contracts

• Maintaining current knowledge of software or hardware changes and planning changes

• Managing and tracking software licenses, reviewing volume and expenditure purchase agreements to ensure license compliance.

• Validate receipt of tracked assets and reconcile discrepancies or quantities with vendors

• Manage the validation of the asset management database records by performing a scheduled task to QA the data for asset records

• The Asset Manager position is critical to the success of the OIT and Contractor and the Asset Manager must create an effective working relationship with the COR, COTRs, Engineers, and OIT management team. The OIT retains the right to have the Asset Manager replaced without cause.

Operations Infrastructure Team Lead (Tier II): The Operations Infrastructure team lead will be responsible for the support, maintenance and troubleshooting of DFC’s IT infrastructure. The areas below highlight some of the key systems and administrative duties this will be responsible for:

• Administer Windows Active Directory, Windows Group Policies, and Certificate Services.

• Administer Azure Active Directory services.

• Administer Intune Mobile Device Management

• Nutanix Hyperconverged Virtual environments.

• Citrix and remote access.

• Manage the private PKI infrastructure.

• Manage Multi-factor authentication, Single-Sign-On and Smart Card Sign-On services.

• Manage Distributed File System (DFS) and DFS Replication.

• Manage Network Attached Storage (NAS) and network shares.

• Provide lifecycle management for all supported systems.

• Create and maintain system documentation to ensure that it is complete and accurate

• Create automated packages to install, modify, enhance, test, and implement standard configurations for deployment of workstations, servers, and other network components and client software.

• Develop secure automated solutions for administrative and domain management tasks using scripting languages such as PowerShell.

• Develop automated alerts and reports.

• Monitor system and network performance (availability, utilization, throughput, and latency).

• Participate in Business Continuation/Disaster Recovery infrastructure planning, building, and testing, including network performance, security, anti-virus, design, and acquisition of infrastructure hardware.

• Troubleshoot systems/network issues, identify/analyze root cause, and implement corrective actions.

• Perform maintenance actions including system back-ups and validation, manage base image and restore points, file restoration processes, event log reviews, vulnerability mitigation and compliance.

• Create and document all actions, practices, procedures, and processes.

Continually review and update documentation as needed.

• Research and make recommendations in all areas of automation needs, objectives and capabilities, including anticipation of DFC business needs and future requirements.

• Interact with all IT departments as part of engineering and administration activities, such as customer support, technical and operational integration, and system maintenance.

• Coordinate and manage diverse technical support tasks.

• Maintain high satisfaction (both internal and external) through successful and timely resolution of technical problems.

• Manage and resolve escalated helpdesk related incidents and provide on-call support.

• Perform other duties and assist with special projects and installments as assigned.

Senior Network Administrator: The Senior Network Administrator will be responsible for the support, maintenance and troubleshooting of DFC’s networking infrastructure.

The areas below highlight some of the key systems and administrative duties this will be responsible for:

• Install, configure, manage and troubleshoot Cisco switching, traffic shaping and routing infrastructure.

• Install, configure, manage and troubleshoot Aruba wireless routing infrastructure.

• Install, configure, manage and troubleshoot Aruba Network Access Control (NAC) infrastructure.

• Install, configure, manage and troubleshoot Citrix NetScaler infrastructure.

• Proactively monitor telecom circuits, system and network performance (availability, utilization, throughput, and latency).

• Troubleshoot systems and network issues, identify and analyze root cause, and implement corrective actions.

• Provide lifecycle management for all supported systems.

• Maintain all cabling infrastructure at desktops, patch panels, network equipment and video conferencing systems.

• Create and maintain network documentation to ensure that it is complete and

Common Support Tasks:

The OIT is requesting proposals from offerors to provide a fully managed IT Service Desk and Infrastructure Support Teams. The requirements for this contract include but are not limited to:

• Provide and fully staff a managed IT Service Desk supporting all DFC OIT and DFC personnel

• Receive and manage incidents and service requests from approximately 550 staff (full time employees, contract staff, interns, etc.) to include approximately 60 VIP staff. The current Service Desk processes approximately 9400 tickets per year

• Serve as the SPOC for all IT-related service requests and incidents with total contact ownership. This includes the monitoring of incident and service request tickets escalated to other IT support staff to ensure timely processing and resolution of issues.

• Support customer requirements across all locations (From DFC OIT Headquarters at 1100 New York Ave NW, Washington DC 20527) Client Support services must be provided weekdays through telephone, remote, and deskside (please identify what personnel will reside onsite and who will be remote) support during the agency’s business hours of 7:00am-5:00pm EST plus on-call telephone and remote support outside of business hours including federal holidays and weekends as determined by the COR.

• Accurately document via the agency’s ticketing system (currently SysAid) and report all incidents and service requests received via telephone, e-mail, voicemail, IM / chat, deskside, and walk-ins

• Effectively process all incidents and service requests within the agency’s service level agreement (SLA) definitions (see Appendix on Task order level)

• Triage all incidents and requests

• Resolve incidents and requests within SLA

• Escalate to CIO/DCIO/TS Director and federal Service Desk Manager when Service Desk is unable to resolve incidents and requests (see Appendix on Task order)

• Operate within a hybrid environment consisting of on-premise, private-cloud, and cloud- hosted infrastructure and service components

• Provide support for all OIT-issued end-user IT equipment (laptops and docking stations, conference room equipment, network and personal printers, wireless devices, computer monitors, mobile devices and assorted peripheral devices) to support the current organizational IT structure and accommodate all future changes (to include but not limited to equipment refresh and migrations)

• Current PC refresh cycle is 1/3 of the agency per year.

• We currently have a Mobile Device Management (MDM) tool in-house, but the Service Desk will be responsible for Service Desk technical assistance on devices.

• Conference room support: Service Desk will conduct an early morning walk-through of all DFC HQ Conference rooms (currently 17) daily to confirm equipment availability and functionality. Deficiencies in availability and/or functionality will be addressed by Service Desk staff in collaboration with OIT Tier II staff (when needed) to remediate and resolve. The check will be completed and an update provided to the COR via email daily.

• Provide sufficient staff to answer calls and respond to e-mail, voicemail, IM / chat, desk side, and walk-in requests for service and resolution of incidents within in SLAs

• Issuing loaner/new IT Equipment such as:

− Laptops

− Dock stations and Monitors, − Keyboards, mice, Peripherals, etc.

− Mobile devices to include tablets and mobile phones (Apple iOS)

• Shipment/Mailing of hardware or parts required:

− Loaner equipment, supplies and equipment controlled by the Service Desk.

− Utilizing the in-house mailroom if shipment is prepared by 3:00 PM EST

• Create, maintain, and update documentation on Service Desk work instructions for the provisioning of services, resolution and recovery from incidents for those issues within the scope of Service Desk control and Tier III as well as tickets escalated outside the Service Desk (where applicable)

• Perform daily status checks of the Service Desk phones, email, and ticketing system at the start of each business day and send the status update to the COR and or provide status at morning Operations meeting at 7:30 A.M. EST

• Perform daily verification for enterprise printing, scanning and faxing

• Perform daily opened tickets status checks to ensure all opened tickets (to include tickets outside of Service Desk) are actively being worked and are addressed

• Provide written reports on a scheduled and ad-hoc basis

• Manage inventory of the Service Desk IT Stock equipment and advise the COR when there is a low inventory of IT stocked items; inventory includes (but not limited to) docking stations, cables, keyboards, mice, hard drives,

• Provide desk-side visits by Tier I staff to end users at DFC OIT HQ if remote assistance is not effectively possible – Upon the first follow-up, desk-side visits by Tier I must be conducted

• Provide support for all OIT-managed applications and services (see Appendix on Task order)

• Utilize Cisco Unified Contact Center Express for automatic call distributor (ACD) and metric reporting Provide, support, and manage the delivery (mail delivery for remote locations) and set-up of all OIT-approved end user equipment for DFC OIT headquarters

• Provide, support, and manage the delivery and set-up of all new personnel equipment prior to the start date (i.e. phone, laptop, peripherals)

• Coordinate the warranty/non-warranty repair of all OIT-approved end user hardware after authorization by the COR

• Manages all government assets; policy, procedures, tracking, auditing.

• Draft, update, maintain Standard Operation Procedures (SOP’s) and checklists and store in a master document repository

• Manage active directory user accounts per DFC account lifecycle management policy, to include disabling inactive user and admin accounts, account review, administrative account management

• Office 365 exchange account management and retention policies

• Azure admin and role management

• Azure storage management and resource utilization

• Azure governance management

• Onboarding and offboarding of DFC employees and contracting staff

• Assist CISCO in resolving Plan of Action and Milestones (POA&M) as needed

• Provide artifacts when requested from OIG and internal audits from patch management (routine and emergency)

• Provide WebEx and other AV/conference support

• Provide high quality, professional customer service that builds and maintains a positive customer experience

• Approaching close out of this contract, the vendor must support the transition to new service desk vendor including knowledge sharing

Reports

The Contractor must track all project activities and submit a Weekly Status Report and Monthly “Invoice Period” Status Report. These reports must be a “succinct” written status report. The Weekly and Monthly Status Report must include, at a minimum:

• Accomplishments

• Patching (per patching SOP)

• Ticket Trends

• License reports

• Assets inventory, including assigned and spare

• Staffing reports and work schedule

• Operational risks

• Count of all open incidents by creation date

• Recommendations for operational or process improvements

• Analysis of the top 10 Categories

• Analysis of the top 10 escalated tickets

• List of Change Requests (CR’s) and status of implementation

• Analysis of the top 10 customers

• Performance Achieved for each SLA item

• Contractor Quality Assurance results

• CPU, power, memory consumption statistics/trending

• Issues:

− Reasons why performance measures not met, if any;

− OIT-issued Hardware or Warranty Issues, − Systemic issues encountered, if any;

− Tasks behind schedule, − Corrective Actions taken on: (1) Individual employees (2) Overall Service Desk

• Other issues as identified by OIT and agreed to by both OIT and the Contractor.

Although information will also be reported daily and weekly, the SLAs will be measured on a monthly basis. The daily and weekly reports are for situational awareness and to help maintain performance through the month.

The report must be provided in Microsoft Word and/or, Microsoft Excel format and electronically submitted to the COR and designees. The weekly report must be submitted via email by COB the first business day of each week. Monthly report must be submitted via e-mail with the invoice in IPP prior to the 10th calendar day of each month.

The report must be divided into sections by specific area as identified above and contain sufficient information to identify all accomplishments, activities, and issues.

Upon contract award, the Contractor must submit a sample report to the COR for review and approval. Any corrections identified by the COR must be incorporated into the report format prior to submission. All performance reports must include the calculations and mechanisms used to arrive at report results and be approved by the COR prior to use.

Meetings

The Program Manager, Service Desk Manager and the Operations Infrastructure Lead will attend daily Standup/Change Control meetings. In these meetings, the Service Desk will brief the prior day’s status of calls/tickets, discuss VIPs who called, and any issues from previous day.

The Program Manager and Service Desk Manager will also be required to attend meetings within other OIT Divisions as well as other DFC groups outside of OIT as required.

The Service Desk Manager will be responsible for disseminating information throughout the Service Desk team in a timely manner.

The Program Manager, Operations Infrastructure Lead, Service Desk Manager will have a weekly and monthly onsite meeting to brief the COR on weekly and monthly reports as well as attending meetings at DFC Headquarters (currently once a month and ad hoc).

The Contractor shall provide highly qualified personnel to perform IT Professional Services and/or labor categories for database planning and design; systems analysis, integration, and design; programming, conversion and implementation support; network services, data/records management, and testing. The contractor shall provide the following objectives:

System Monitoring:

System Monitoring the Contractor shall provide accurate and timely information on the status of all applications, systems, reports, and interfaces. The Contractor shall monitor and evaluate at least 95% of all applications, reports, interfaces and batch jobs in real-time. Monitoring shall include system resources such as disk usage : CPU utilization.

• The Contractor shall Install required monitoring tools and configure these monitoring systems to generate warnings when predefined thresholds are exceeded.

• The Contractor shall Perform application-level monitoring of BIS systems to ensure functional availability of all application modules in support of the 99.99% uptime performance-based objective.

• The Contractor shall Monitor application and server logs to determine if application errors have occurred. The system shall generate warnings when predefined thresholds are exceeded. Warnings shall be configured to notify on duty administrators of the alert condition and to log the alert for later analysis.

• The Contractor shall Configure the monitoring system to raise an emergency alert when critical system components become unavailable for any reason. An emergency alert shall notify on-duty system administrators and designated DFC staff.

• The Contractor shall Confirm that all nightly batch and other data exchanges complete successfully.

• The Contractor shall Continuously monitor and notify support teams through electronic means when an application issue or outage occurs.

• The Contractor shall Provide weekly activity reports that summarize application failures, root cause, and resolution steps taken.

• Application Performance the Contractor shall provide effective systems administration to ensure that DFC applications are highly reliable, available and secure 24/7/365.

• The Contractor shall maintain an SLA of system and applications availability of 99.99% or better outside of scheduled maintenance windows.

• The Contractor shall measure application performance and specify performance baselines for all applications.

• The Contractor shall monitor and log application availability and performance on an ongoing basis.

• The Contractor shall review monitored application logs and test application performance for potential bottlenecks, identify possible solutions, and work with developers to implement those fixes.

• The Contractor shall optimize performance by tuning the system, making required changes to the way in which various system resources are consumed, coordinate with Infrastructure team to make required changes to the infrastructure, recommending changes to business processes, making changes to the applications, etc. In the event of a disaster or unscheduled interruption of application availability or usability, the Contractor shall:

• The Contractor shall perform Meet Mean Time to Restore (MTTR) thresholds as agreed upon with DFC/OIT.

• The Contractor shall Meet Recovery Time Objective (RTO) thresholds as agreed upon with DFC/OIT. (The time it takes from the time of disaster to the time-of-service restoration and access by customers. Dependent on mission criticality.)

• The Contractor shall Meet Recovery Point Objective (RPO) thresholds as agreed upon with DFC/OIT. (The amount of lost data that is acceptable after a disaster. Anywhere from zero to the point of the last backup of 24 hours.)

• The Contractor shall establish Quality Metrics the Contractor, implement, and maintain an effective quality assurance program to ensure consistent quality for all work products and services performed under this requirement.

• The Contractor shall perform all activities as designated in the Quality Assurance Control Plan (QACP), including quality surveillance and data collection necessary to accurately measure performance.

• The Contractor shall perform quality analysis and report insights into the overall health and performance of the delivery team, technical environment, and systems and applications.

• The Contractor shall report these results via the Monthly Status Reports (MSRs). Information in this report shall include, at minimum, performance metrics, quantitative performance against those metrics, and reason/justification for variance (+ or -). For measures that have not met quality standard, the contractor shall provide a corrective action plan.

• The Contractor shall work in collaboration with the DFC/OIT PMO in assessing program quality metrics and its outcomes to ensure that goals are consistently being measured against metrics in an effective and efficient manner.

• Resource Utilization – The contractor shall provide the following below:

• The Contractor shall provide experienced and qualified personnel to perform tasks related to accomplishing this requirement.

• The Contractor shall develop, and provide, a resource schedule detailing allocation of staff (and daily calendar demonstrating the status thereof) for coverage of all system and execution areas. Resource Schedule plans shall be reviewed regularly with the COR and shall ensure resource utilization adequately supports all major applications.

• The Contractor shall take responsibility for Contractor staff training to ensure that personnel are proficient in use of all technologies supported throughout this requirement.

• The Contractor shall facilitate staff cross-training to ensure adequate backup support for all applications required in the performance of this tasking.

The Contractor shall perform internal management of its personnel in carrying out operational functions, including:

• The Contractor shall track and report staff resource utilization status via the Monthly Status Report (MSR), to include but not limited to:

− Overall utilization of Contractor staff

− Work performed on-site vs off-site

− Staff coverage for major systems and applications.

− Matrixed resources across system support teams

− Duration of open positions

Incident and Problem Management Performance Requirement Performance Standard Data Collection Methodology Severity Level Description Response time to begin working issue Resolution/ Mitigation Status Updates Target Metric/ Measurement Critical Multiple Departments are impacted by the degradation or unavailability of Application(s). To include:

• Within 5 minutes from time reported 4 hours Every 2 hours 100% Reported monthly in availability reports. High A Department is impacted by the degradation or unavailability of Application(s).

• Within 15 minutes from time reported 1 day Every 2 hours 100% Tracked/measured in DFC approved Ticketing system. Medium One or more individuals are impacted by the degradation or unavailability of Application(s).

• High level Analysis to be completed within a week so that it can be properly prioritized during the weekly review meetings as per mutually agreed upon schedule Upon closure 90% Tracked/measured in DFC approved Ticketing system.

• Low Minor and rare system glitches that affect only a few users to be reviewed & prioritized during the weekly review meetings as time permits as per mutually agreed upon schedule N/A Tracked/measured in DFC approved Ticketing system.

• The contractor will update and maintain the ServiceNow executive dashboard. The dashboard will be updated on a daily basis so DFC OIT leadership can have access to real-time statistics and status updates.

− The executive SNOW dashboard is located here:

https://dfcprod.servicenowservices.com/nav_to.do?uri=%2 F$dashboards.do%3Fsysparm_dashboard%3D481c47a01b c9051016ac2f85624bcb19.

• The contractor will provide conference room audio/visual (A/V) web conference, Webex, Teams support, presentation support, ensuring all conference room equipment is functioning and operational on a daily basis.

• The contractor shall manage all DFC printing capabilities to ensure all DFC print devices are available and operational on a daily basis, including toner, paper, print, scan and fax capabilities.

• Change and Configuration Management Performance Requirement Performance Standard(s) Data Collection Methodology

• The Contractor shall deploy all changes to production only after getting approval from the Change Control Board (CCB) or AMP meetings. 100% of all changes deployed are reviewed by the CCB or AMP Report generated out of ticketing system showing deployed ticket approval statuses.

• All changes and bug fixes shall be 100% of all changes are logged in A Kanban like dashboard that tracked in DFC approved Ticketing system Ticketing System prior to work beginning tracks and visually represents the status of all CRs, bug fixes, and resource allocations. TO lead shall conduct daily standups to inquire into any non-recorded changes / fixes

• All request for changes to applications shall be responded to within 1 business day of request Acknowledgement of receipt and recording into DFC ticketing systems within 1 day for 100% of change requests Report generated out of ticketing system showing recording of CRs

• Reduce reliance on manual data corrections to reduce overall operational costs by at least 50% year over year (baseline would be the first year of the contract). Total number of actual hours spent on tickets categorized as data correction reduced 50% year over year Ticketing System report that breaks down actuals by ticket type Oracle EBS, Salesforce and SharePoint data can be tracked, manually corrected or corrected via data uploads.

• Ensure that the status of all incidents in the ticketing system is up to date Any active ticket has a…