IT Support RFP 2.7.2022-Final.pdf

Request for Proposals

Information Technology Managed Services

February 7, 2022

Office of Inspector General Legal Services Corporation

3333 K St, NW Washington, D.C. 20007

Inquiries should be directed to:

Alison Ottenbreit Operations Specialist aottenbreit@oig.lsc.gov mailto:aottenbreit@oig.lsc.gov

TABLE OF CONTENTS

Page

1. Introduction

2. Purpose

3. Inquiries

4. Services Procurement Strategy

5. Performance

6. Delivery

7. Proposals

8. Instructions to Prospective Offerors

9. Proposal Evaluation

10. Review Process

11. Option Years

12. Confidentiality

13. LSC OIG’s Rights

14. Freedom of Information Act

15. Contract Negotiation

16. Certifications

Appendix A

Appendix B

Appendix C

1. Introduction

The Legal Services Corporation (LSC) is the single largest funder of civil legal aid for low-income Americans in the nation. Established in 1974 and funded by the United States Congress, LSC operates as an independent 501(c)(3) nonprofit organization that promotes equal access to justice and provides grants for high-quality civil legal assistance to low-income Americans. LSC distributes about 95 percent of its total funding to 132 independent nonprofit legal aid programs with more than 850 offices that provide legal assistance to individuals and families throughout the nation.

The LSC Office of Inspector General operates under the Inspector General Act. The OIG has two principal missions: to assist management in identifying ways to promote efficiency and effectiveness in the activities and operations of LSC and its grantees; and to prevent and detect fraud, waste, and abuse. Within their different statutory roles, the OIG and LSC Management share a common commitment to improving the federal legal services program and increasing the availability of legal services to the poor.

2. Purpose

The OIG requests the services of an Information Technology (IT) firm (preferably a Microsoft® Certified Solution Provider (MCSP)) to support the operability of the OIG computing network over a one-year contract with three options years. As a quasi-federal non-profit entity, LSC qualifies for GSA, non-profit and charitable rates. This Request for Proposal (RFP) is not subject to the Federal Acquisition Regulation (FAR).

Appendix A is a description of the current OIG IT Technical Environment. Appendix B includes a list of OIG Service Areas. Appendix C provides the IT Roles and Responsibilities Matrix of the IT support services contractor and OIG IT staff.

3. Inquiries

Inquiries concerning this RFP should be directed to Alison Ottenbreit, at aottenbreit@oig.lsc.gov. As it deems appropriate, the OIG will answer questions related to the RFP by email and will copy all prospective Offerors. Questions should be submitted by February 23, 2022, at 5 PM Eastern Time.

4. Services Procurement Strategy

The OIG will contract with one firm under a capped time and materials contract encompassing the service areas listed under Appendix B, as well as similar projects that may arise during the course of the contract. The OIG estimates ordering an average of http://www.lsc.gov/laws/act.php http://www.lsc.gov/map/index.php

1000 hours per year, not to exceed a maximum of 4,000 hours for the duration of the possible contract period. Under the contract, the Offeror will submit a Statement of Work (SOW) for each set of services requested by the OIG, setting forth specific objectives and scope, deliverables, level of effort, total number of hours allocated towards the completion of the project, key personnel, milestones, and project management plan. The successful Offeror will have the capacity to work in all the service areas listed under Appendix B.

Work in any one of these areas may or may not be required and will be ordered on an as needed basis.

5. Performance

The selected Offeror is required to give “best efforts” toward the completion of the tasks for the service areas under this contract. Most work will be done off-site, with occasional on-site work as needed and with notification to the OIG. The OIG will provide the required on-site software and hardware. The OIG will provide access for designated contract employees to its work environment between the hours of 7:00 AM and 7:00 PM, Monday through Friday as needed. Additional access times can be pre-arranged with designated OIG staff.

6. Delivery

The selected Offeror will work with OIG staff to complete individual tasks in the most efficient and effective manner. The Offeror will keep OIG staff informed of the tasks completed under each project statement via monthly status reports. The Offeror’s team, including the project manager, will meet monthly with the OIG to review the status of projects. An invoice, along with a status report detailing all activities undertaken during the month, will be submitted to the OIG monthly for each SOW.

If the Offeror fails to timely complete scheduled tasks under a project statement or delivers products which do not conform to all provisions of the contract and the relevant SOW, the OIG may, by notifying the Offeror in writing, terminate the whole or any part of this contract. Additionally, if the OIG determines there is sufficient justification for doing so, it will enter into discussions with the Offeror to amend a SOW.

7. Proposals

Each Offeror will submit an electronic copy of their proposal to Alison Ottenbreit at aottenbreit@oig.lsc.gov. To be considered, the proposal, including certifications, must be received no later than 5:00 PM Eastern Time on March 2, 2022. The OIG reserves the right to consider late proposals or exclude timely proposals from consideration for any reason. The OIG may, at its discretion, extend the response date if it deems necessary.

All costs incurred in the creation of a proposal are the responsibility of the Offeror. Upon selection, all Offerors will be notified electronically of the outcome of their proposal in response to this RFP.

8. Instructions to Prospective Offerors

Each Offeror in its proposal shall, at a minimum, include the following:

A. Organization, Size and Structure:

The Offeror shall describe its organization history, size, structure, solution partnerships, and general IT support areas.

B. Information Technology Project Management and Support

Experience:

The Offeror shall describe its prior experience in applicable systems and services including IT project management and annual planning, network engineering and services, network and cloud support and systems monitoring, network and data security integrity and policies, IT staff capabilities, helpdesk support, emergency services, disaster recovery, and general network planning, configuration, and migration. Further, the Offeror will describe its expertise in information management support in the areas of: Microsoft 365 (including intranet) support. Appendix B details the areas of expertise in which the LSC-OIG is primarily interested.

References: The Offeror will list and describe current and/or previous clients served, focusing on clients and projects similar in size and complexity to the OIG (30 FTEs). The Offeror will also describe any experience with other OIGs. The Offeror will provide the name, point of contact, address, email, and telephone number of at least three (3) specific references the Offeror currently serves or has served in the past three years, preferably those where one or more of the proposed project team members are providing or have provided services similar to those requested herein.

C. Staff Qualifications:

The Offeror shall describe the qualifications, certifications, and relevant experience of staff to be assigned to support the OIG. More particularly the Offeror shall provide resumes of key staff to be assigned to cover each service areas listed in Appendix B, including descriptions of education, position in the firm, years, and types of experience, continuing professional education and professional certifications. Representative resumes of potential additional staff should also be included. As a minimum staffing requirement, the OIG requires a senior level engineer to perform or oversee the delivery of technical services and a dedicated program manager, but expects a minimum of five resumes to service all functional areas listed in Appendix B. The Offeror will only provide qualified personnel to complete all work.

D. Work Plan and Approach:

The Offeror's work plan must describe, for each service area listed in Appendix B, its understanding of the work to be performed, including methodologies for conducting the work, all necessary project management to be exercised, and its approach to customer satisfaction, milestones, and staffing (skills sets) for this contract.

The Offeror may use the services of a subcontractor to perform some of the specialized services listed under Appendix B. The Offeror will disclose its intent to subcontract and provide a description of the subcontracting firm(s) as well as its staff expertise for each of the project area. The OIG reserves the right to approve all subcontracting arrangements in advance of the work.

E. Project Management The Offeror should discuss its approach to project management and quality control to ensure all tasks and activities are completed on time, on budget, and are of the highest quality. The Offeror should provide a detailed Project Management Approach (PMA) section describing how it will coordinate multiple, simultaneous OIG projects among staff to ensure on time and on budget delivery. The PMA should include a description of any tools used in project management, such as workplans, project schedules, staffing structure and plan, risk mitigation plans, and any other tools used.

Additionally, the Offeror should maintain a key point of contact (Program Manager) to coordinate all OIG projects and to liaise with the OIG.

Offerors should provide a sample timeline for activities described in this RFP and in Appendix B as an appendix to their proposals. When developing this schedule, the Offeror should describe risks that may result in schedule slippages– including the availability of personnel, and/or other risks associated with timely contract performance.

Additionally, each Offeror’s PMA, at a minimum, should address each of the following:

1. Post-Award Conference: The selected Offeror will meet the OIG for a post-award meeting with within 10 business days of contract execution at the OIG offices (3333 K Street, NW, Washington, DC 20007) or virtually as determined by the OIG. At the meeting, the Offeror will introduce key staff and establish communication with the OIG. The purpose of this meeting will be to assure a common understanding of contract requirements, increase knowledge of OIG goals, systems, and policies and practices, and to begin project activities. At this meeting the OIG will provide key points of contact for this contract and discuss roles and initiating contract activities, including the first task order(s) which will result in SOW(s).

2. Project Management Plan: The Project Management Plan (PMP) should be provided to the OIG within 20 business days of the post-award conference. It should include a schedule for ongoing IT activities that will be undertaken as a part of this project, including all activities resulting from task orders discussed in the post award conference, and possibly to include the transitioning of services from the OIG’s prior service provider for a period of time as required.

3. Communications Plan: As a part of its project management approach, the Offeror should provide an initial communications approach to explain how it will keep the OIG abreast of all ongoing activities throughout the duration of the contract. At a minimum, communications should include monthly status reports (MSR) to the OIG on all activities, regular check-ins with the OIG as needed, and ongoing communications with the OIG to address any concerns, questions, risks, or issues. As a part of its PMP the Offeror will provide a final communications plan.

Each MSR should include ongoing activities, planned activities, issues and resolution strategies, and risks. The MSR should also indicate any action items for the OIG, including items awaiting OIG approval.

The Offeror should hold regular status check-in meetings (in person and/or virtually), at an interval to be agreed upon between the Offeror and OIG, to provide updates on projects, outstanding issues, action items, risks, financial status, and other pertinent information.

The Offeror should describe how it will address any serious issues or significant risks, including how it will alert the OIG in the ongoing communications of the contract. The Offeror should communicate with the OIG as frequently as warranted by circumstances to discuss major impediments that may hamper progress or create a problem. Any delays or problems that may cause revisions to the project scope or delivery schedule should be brought to the attention of the OIG as soon as they become known. Such communication may be in the form of electronic mail, conference/video call, or personal visits to the OIG office and should describe recommended solutions. Impediments that may entail the need for additional scope, labor hours or funding will require a contract or SOW modification.

4. Quality Control: As a part of its project management approach, the Offeror should provide a description of its quality control procedures, detailing how it will maintain the highest quality throughout each project.

The Offeror should explain how it plans for quality control at the outset of a project, and then how it carries these through in a project. The description should include any specific processes, checks, or checklists utilized for products and deliverables to ensure customer satisfaction. As a part of its PMP the Offeror will provide a final quality control plan.

F. Price:

The Offeror will provide estimated hours and rates per labor category for each service area listed in Appendix B in a separate document. The Offeror is expected to provide their best estimate based on the information provided at this time. The Offeror will also identify any conditions that might increase or reduce the cost of the proposed services. The OIG will purchase all licenses and equipment for installation within the OIG computing environment but not items required for contractor support.

G. Proposal Instruction:

The proposal (exclusive of appendices) should be no longer than fifteen pages in no less than 10-point font (including tables). Resumes and references may be included in an appendix. Cover pages, cover letters, and table of contents are not included in the page count.

H. Certifications:

The Offeror must sign and include as an appendix to its proposal the enclosed certifications.

All or some portion of the information supplied in the proposal of the winning Offeror will become part of the formal contract.

9. Proposal Evaluation Proposals may be judged non-responsive and removed from further consideration if any of the following occur:

1. The proposal is not received timely;

2. The proposal does not follow the specified format or exceeds the maximum page length;

3. The proposal does not include the Certifications; or

4. The proposal is not adequate for the reviewers to form a judgment that the proposed activities/price are sufficient to complete the work.

Evaluation of each proposal will be based on the criteria described below. The OIG will use the Best Value approach to assess and select the most advantageous offer based on price, quality, and performance.

A. Organization, Capacity, Size, and Structure:

The OIG will assess the Offeror’s organizational capacity, history, size, structure, solution partnerships and general IT support areas.

B. Information Technology Project Management and Support Experience and Past Performance:

The OIG will assess the Offerors’ prior experience and past performance, including:

i. Relevant experience in providing similar services in applicable systems administration and integration projects and past experience with other OIG offices and organizations similar in size and complexity.

ii. Past performance on LSC OIG service contracts, if any.

iii. Past performance on other contracts via references: After the

OIG has made a preliminary evaluation the OIG may contact and assess the references of the firm(s).

C. Staff Qualifications:

The OIG will evaluate the qualifications of the staff to be assigned to OIG support. This will be determined from resumes submitted. Subsequent substitution of personnel must be approved by the OIG. The evaluation criteria will include education; position in the firm; years and types of experience; continuing professional education and certifications; and relevance of prior projects.

D. Work Plan and Approach:

The OIG will assess each Offeror’s work plan, approach, and team make up to perform the services described in Appendix B.

E. Project Management:

The OIG will assess each Offeror’s PMA, including their communications and quality control activities.

F. Service Area Approach:

The OIG will assess each Offeror’s Approach to each area and activity listed in Appendix B.

G. Price:

The OIG will assess the hours and rates per labor category assigned to each project area. The OIG will also assess any additional cost that the Offerors may identify in the proposals.

H. Certifications:

Certifications must be signed and included as an attachment to the proposal.

I. Interview:

If it deems necessary, the OIG may conduct interviews with some Offerors.

If an interview is conducted, the OIG will assess the Offeror’s senior staff introductory presentation and interview.

10. Review Process The OIG will review all proposals and may decide to narrow the pool of Offerors to those who are the most competitive. The OIG may, at its discretion, request interviews with Offerors in that narrowed pool, to clarify or negotiate modifications to the Offerors’ proposals. However, the OIG reserves the right to make an award without further discussion of the proposals submitted. Therefore, proposals should be submitted initially on the most favorable terms, from both technical and price standpoints, the Offeror can propose.

11. Option Years The OIG intends to enter into a one-year contract for the work described in this RFP, with up to three option years, for performance of IT Managed Services. The decision to exercise yearly options will be solely within the OIG’s discretion.

12. Confidentiality As part of the ensuing contract with the OIG, a successful Offeror will be required to enter into a confidentiality clause, requiring information related to this OIG to be kept in strict confidence. Any such agreement will not limit lawful reporting of fraud, waste, or abuse.

13. LSC OIG’s Rights Notwithstanding any other statement in this RFP or otherwise, the LSC OIG reserves the right to:

A. Accept or reject any or all proposals, or any part thereof;

B. Conduct discussions with respondents and accept revisions of proposals after the closing date;

C. Make an award based upon various selection criteria;

D. Request clarification from any respondents on any or all aspects of its proposals;

E. Cancel or re-issue this RFP at any time;

F. Retain all proposals submitted in response to this RFP; and, G. Invite some, all, or none of the respondents for interviews, demonstrations, presentations, and further discussion.

14. Freedom of Information Act The Freedom of Information Act (FOIA) and associated LSC regulations may require the LSC OIG to disclose certain documents to the public, including portions of your proposal.

Generally, we will not release any documents that would cause Offerors competitive harm. You are encouraged, however, to label any confidential information contained in your proposal to facilitate our ability to withhold it from disclosure.

15. Contract Negotiation The selected Offeror will be invited to enter contract negotiations with the OIG.

16. Certifications

A. The individual signing certifies that he/she is authorized to contract on behalf of the Offeror and to make these Certifications.

B. The individual signing certifies on behalf of the Offeror that he/she has read and understands all of the information in this Request for Proposal and appendices and that his/her proposal reflects the truth based upon their understanding of these documents.

C. The individual signing certifies on behalf of the Offeror that the Offeror will not subcontract any portion of the work without advance approval of the OIG.

D. The individual signing certifies on behalf of the Offeror that the Offeror, including any individuals to be assigned to the project, does not have a record of substandard work and has not been debarred or suspended from doing work with any Federal, state, or local government.

E. The individual signing certifies on behalf of the Offeror that the Offeror is an Equal

Opportunity Employer and does not discriminate in hiring, employment or activities because of race, color, religion, sex, age, national origin, disability, or any other basis prohibited by law.

Dated: ________________________________

Offeror’s Firm Name: ____________________________________________

Signature of Offeror’s Representative: ___________________________________

Printed Name and Title of Individual Signing: __________________________________

Appendix A LSC-OIG Technical Environment

Current Technical Environment

1. 35 Remote and on premises Dell laptop computers

2. 6 On premise switches

3. 1 Firewall

4. 18 Combined non-virtual and virtual servers

5. 3 Dell Physical VMware host

6. 1 SAN

7. 50 User Email accounts

8. Local and remote cloud back up

9. Windows and Linux environment

10. Azure and AWS cloud environment

11. Microsoft 365

12. External Website

All numbers in the list above are approximate and there is no guarantee that they will not fluctuate.

Appendix B Service Areas

The OIG goal is to have network resources available 99.5% of the LSC OIG working calendar. The work is not to interfere with normal OIG business hours of 8:00 AM and 5:00 PM, Monday through Friday, so certain items may be done at night, on weekends, on premises or remotely.

Sections 1 to 5 below provide a description of the tasks and service areas in which the Offeror is required to have expertise.

1. Management Services

Provide on-going management services for the life of the contract to include:

A. Project Management – time shall be spent on identifying client needs and ensuring customer satisfaction. Further the Offeror will manage trained technical solution resources, budget, schedule, milestone deliverables, tracking and reporting on resource usage and proper invoicing.

B. IT Management Decision Support – time shall be spent on network assessment, planning and architecture, and technical solution approaches to support current and future OIG IT operations and sharing IT best practices.

C. Subcontractor Management – if required as bid.

2. Infrastructure, Virtualization / Cloud Computing, Security

Review, plan and managing virtual and cloud infrastructure and security. As part of this project area, provide an assessment in the first 90 days of the contract of OIG systems and provide recommendations on the best implementation of solutions. Provide on-going implementation support throughout the contract.

3. Disaster Recovery Planning and Implementation

Provide disaster recovery assessment including with Business Impact Analysis and Risk Analysis. As part of this project area, provide an assessment in the first 90 days of the contract of OIG systems and provide recommendations on the best implementation of solutions. Provide on-going implementation support and a disaster recovery plan.

4. Data and Security Integrity - Policy Review and Development

Provide review of OIG security policies and procedures and provide on-going support. Time shall be spent on reviewing, creating, and updating IT policies and procedures to include security, Continuity of Operations Plan (COOP), and business impact analysis among other standard IT policies. Familiarity and experience with government IT security best practices and NIST standards is required.

5. IT Support Services The Offeror will augment the OIG’s Senior Cybersecurity and Information Technology Specialist by providing on-going support services to the OIG (approximately 30 users)1 for the life of the contract, including:

A. Cloud, network and firewall architecture, security, and administration B. Network, and server hardware - installations, administration, maintenance, configuration management and data and operations recovery

C. Operating system such as Microsoft and VMware and application software installation, configuration, updates, and patching to include operating systems, databases, web applications and other software.

D. Support user remote access to network resources E. System troubleshooting, performance tuning and monitoring services/prevention F. Network services outage risk management G. Virus, spam, and malware protection H. Device support – Mobile laptops and cellular phones I. End user help desk and hosting a help desk management and ticketing system. This is a high priority service for the OIG.

Please include information on your proposed help desk operation approach including description; response times and goals for resolving problems; ticketing system used; support availability (days of week and time, afterhours calls); toll free number and/or email access; structure of charges for support; steps for resolving problem escalation; conflict resolution and system change authorities.

J. Training and documentation: The selected Offeror may be requested to train staff and produce documentation, system administration and user manuals.

K. OIG’s Intranet platform L. Digital graphic design support M. In house application support services on an as needed basis N. Other technical services as required.

1 A specific breakdown of information technology roles and responsibilities is attached as Appendix C.

Appendix C LSC OIG IT Roles and Responsibilities Matrix

The Legal Services Corporation Office of the Inspector General Information Technology Roles and Responsibilities Matrix is used to show the connection between IT-related work that needs to be done and the various roles or units within OIG. To accomplish this, a RACI matrix is utilized. RACI is an acronym for Responsible – Accountable (aka Approver) - Consulted - Informed.

Here is a detailed explanation of the participation types used in the RACI matrix:

• Responsible - The person or role who is assigned to achieve the task. There is only one resource given this category type. Others may be required to assist in the work, but they are either given another participation code, such as Assist, or are not included as the RM may only list the key people for the activities.

• Accountable – This person or role must sign off on work that Responsible provides.

They are ultimately accountable for the correct and thorough completion of the deliverable or task, and the one to whom Responsible is accountable. There must be only one Accountable specified for each task or deliverable. For our matrix this will also be the group that Approves the task when necessary.

• Consulted - Those whose opinions are sought and with whom there is two-way communication.

• Informed - Those who are kept up-to-date on progress, often only on completion of the task or deliverable, and with whom there is just one-way communication (informational only).

Within the matrix the following roles are identified:

• OIG Management – serves as the lead for IT-related work within LSC OIG. This role will have the majority of accountability for IT tasks.

• OIG IT Support Staff – is in charge of the day-to-day IT operations and desktop support. The staff is also consulted on the majority of IT decisions.

• OIG IT Contractor – serves as the IT technical lead for LSC OIG and is responsible for IT Server, network, and application support.

OIG Mgt

OIG IT

Support

Staff

IT

Contractor Server Management and Configuration A C R

Server Maintenance A C R Server Patch Management A C R

Server Daily Monitoring and Checks A R I Desktop Management and Configuration A C R

Desktop Maintenance and Checks A C R Desktop Patch Management A C R

Network Equipment Configuration A R C Network Equipment Checks A R C Backup Configuration A C R

Backup Monitoring and Support A C R Anti-virus Configuration A R C

Anti-virus Monitoring and Support A R C Active Directory Configuration A C R

Active Directory Monitoring and Support

A C R

DNS Management (External)* A R C DNS Management (Internal) A C R OIG Wi-Fi Policy and Configuration A R C MS 365 SharePoint Online Requirements and Design

A C R

MS 365 SharePoint Online Maintenance and Support

A C R

Other In-House Application Maintenance and Support

A R C

Current Website Maintenance and Support A R C IT Policy Development and Maintenance A C R Training, Testing and Awareness A R C IT Policy Enforcement A/R R C Inventory Management A R C IT Equipment Procurement Lifecycle Management

A R C

IT Project Management A R C End User Help Desk Support A R C IT Vendor Support A/R C C

IT Financial Planning A/R C C IT Strategic Planning A/R C C

• - External DNS is handled by the Legal Services Corporation Office of Information Technology as

OIG.LSC.GOV is a subdomain of LSC.GOV.