ITEMS RFI Enterprise Management Services 9_01_11.pdf

UNCLASSIFIED

1 September 2011

Subject: Request for Information (RFI) No: 4

Information Technology Enterprise Managed Services (ITEMS) – NGA Enterprise

Management Services (EMS)

A. Introduction

NGA is seeking to change how the Agency procures and provisions Information Technology

(IT) in order to meet expanding mission requirements given budgetary constraints. Labor vs.

performance-based contracts and IT governance issues are driving up Operations & Sustainment

(O&S) costs. Currently there are multiple IT acquisition vehicles across the agency. NGA wishes to implement a managed services model that decreases complexity, increases agility, enhances reliability, while improving efficiency and effectiveness of IT delivery in support of the

Agency’s mission. The goal is to have one consolidated Infrastructure Service Provider (ISP) strategy across NGA using the appropriate (best fit) Information Technology Infrastructure

Library (ITIL) best practices.

This RFI is being issued solely for information and planning purposes and does not constitute an

Invitation for Bids (IFB), a Request for Proposals (RFP), a Request for Quotations (RFQ) or an indication that the Government will contract for any of the items and/or services contained in this notice (FAR 15.201(e)). In accordance with FAR 52.215-3 – Requests for Information or

Solicitation for Planning Purposes (Oct 1997), the Government will not pay for any information/items submitted in response to this RFI. Data will not be returned. This RFI does not commit the Government to award a contract. No determination as to the viability of this requirement has been made at this point and there is currently no solicitation for this effort. Any solicitation resulting from this RFI will be announced separately. Based on your response to this

RFI, the Government may contact you for follow-up questions and/or a one-on-one session.

This RFI is focused on your company’s experiences and capabilities for providing Enterprise

Management Services (EMS) through a managed services contract in a multi-vendor, multi-security level environment. The scope includes the following functions:

Service Desk in the above described environment which serves as the single point of entry within an Agency where IT support is provided

Network Operations Management which serves as the central point for Local Area

Network (LAN)/Wide Area Network (WAN) infrastructure situational awareness on all classified domains

Security Operations Center which serves as the central point for security incident detection, analysis, investigation and reporting

NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY

7500 Geoint Drive

Springfield, VA 22150

UNCLASSIFIED 2

Development and collection of business intelligence information to support process and product improvement

NGA is seeking information and approaches on leveraging industry best practices, and as appropriate, enabling products, technologies, and services to accomplish three primary IT goals;

(1) improved delivery of IT services, to include remote access of applications; (2) maintenance and improvement of information and network security; and (3) reduction of the total cost of ownership of its IT Enterprise.

Solutions must be compliant with applicable U.S. Government Information Assurance (IA) requirements and policies to include, but not limited to those listed in Appendix A. All applicable operational and administrative directives, manuals, instructions, standards, memoranda, messages, implementation guides, pamphlets, and best practices published by the

DOD e.g., Defense Information Systems Agency (DISA), United States Strategic Command

(USSTRATCOM), and United States Cyber Command (USCYBERCOM) shall also be considered.

B. Enterprise Management Service Requirements:

This RFI requests information on your company’s experiences and capabilities in providing EMS through a managed services contract in a multivendor, multi-security level environment

(unclassified through Sensitive Compartmented Information (SCI)). The services provided by the EMS provider should include the following:

I. Centralized monitoring of infrastructure availability, capacity, performance, security, usage, data collection, anomaly detection, and reporting both domestically and at sites overseas. This includes the monitoring for all services, end-to-end :

1. Network Services

Network services support the exchange of any information between partners within and outside the Agency, the DOD, and Intelligence Community(IC). This service consists of the local and wide area networks. The network services provider will be responsible for the associated equipment, security devices and cable infrastructure to enable secure, reliable and timely transmission of data from one point to any other.

2. Compute Services

Compute Services support partners by monitoring the deployment, management, and operations of mission, corporate and enterprise (e.g., email) applications. The

EMS services provider will be responsible for monitoring all of the components such as the servers and associated operating systems, directory services, domain name services, license, print, and email servers supporting the delivery of mission and corporate applications throughout the enterprise.

UNCLASSIFIED 3

3. Storage Services

This includes monitoring of Storage Services which provides for multiple tiers of users. Administrative users typically require user home drives, shared file folder drives, email storage and USB hard drive storage. Business users require additional storage services configured and sized for business use (i.e., driven by financial management and personnel data requirements). Production users require high performance storage supporting very large data sets (e.g., imagery and product libraries, temporary geospatial imagery storage buffers, and other smaller mission application support).

4. Common Services

This includes the full scope monitoring e.g., license usage, application performance, security vulnerabilities, etc. Other services may be included over time. Examples are listed below:

Software-as-a-Service (SaaS)

Remote (mobile) Computing Capability for the client, e.g., Personal IT Devices

(PITDs)

Desktop and Laptop user environments to include the operating system and standard image

Peripherals (Scanners, Printers, and Faxes)

Voice and Video Services

II. Asset Management

Capability to manage end-to-end hardware, software and infrastructure assets to include: automated asset discovery, tracking, auditing, and inventory maintenance and reporting to ensure integrity of the Configuration Management Database

(CMDB).

III. Change Control Process for New, Upgraded, and Retired Services

1. Interface with the providers of the services and provide a mechanism for transparent service delivery of new or updated services.

2. Assist in the design, implementation, and delivery of new and updated enterprise level services such as Incident Management, Problem Management services, Service Request Management (SRM), and Catalog Management. The goal is to enforce an ITIL governance framework across all of the IT contracts with EMS delivering the framework management solution that all other IT contracts would leverage.

3. Disposition of services as they are retired.

IV. Configuration Management

1. Define process for updating the CMDB with modification(s) resulting from the

Change Management process.

2. Develop the capability to provide physical audits.

3. Develop capabilities to control drift from established baselines (drift management).

UNCLASSIFIED 4

V. Demand Management

Establish the capability and processes for addressing service requests resulting from

Demand Management analysis by other service providers.

VI. Service Level Management

1. Capability to determine the degree to which Service Level Objectives (SLOs) are being met.

2. Capability to ensure that SLOs are met (e.g., “Time to Escalate a Service Desk

Incident”).

3. Capability to ensure that the service levels for priority services are being met.

VII. Cyber Security Management

1. Capability to monitor, detect, and report threats on networks (e.g., Host Based

Security System (HBSS), Intrusion Detection Software (IDS), firewall log review).

2. Capability to manage firewall changes without incidents or outages.

3. Capability to monitor and manage and implement security patch updates with a process to manage exceptions.

4. Capability to conduct focused operations for enterprise security. This includes interpretation of network incidents, vulnerabilities and threat information to identify deep, and exploitation of enterprise information technology.

5. Capability to conduct continuous security standards compliance monitoring for enterprise information technology.

VIII. Change Management Requirements

1. Process to maintain oversight including Verification and Validation (V&V) of changes by following correct procedures for testing written engineering orders, providing documentation of a transition activity plan, and staffing resources for implementation

2. Appropriate Service Level Agreements (SLAs) to ensure agile process for implementation of changes

IX. Service Desk

1. Ensure operational continuity of the Service Desk.

2. Capability to provide standard processes for Incident reporting across all tiers from a ticket management standpoint by creating and maintaining procedures to manage, record, and track incidents.

3. Capability to provide special non-standard support for Research and Development

(R&D) operations.

4. Capability to provide a Knowledge Management database of the past events and their corresponding solutions for Incident resolution.

a. Provide users with self service access to the knowledge base

b. Develop and update knowledge database

5. Respond appropriately to levels of service priority.

UNCLASSIFIED 5

6. Capability to provide data to support Problem Management of the multiple-vendor environment.

7. Provide Automated Call Distribution (ACD) based on skill sets of Service Desk staff via user interface.

8. Provide and manage multiple security level access to an Incident Management

Service e.g., Unclassified, Joint Worldwide Intelligence Communications System

(JWICS), Secret Internet Protocol Router Network (SIPRNet).

9. User communication

a. Capability to handle all unclassified and secure calls

b. Capability to use available and appropriate technologies (chat, email, Web e.g., automated password reset for certain accounts)

c. Allow government oversight of quality of service (e.g., listen in on support calls)

10. Develop and maintain self-help capabilities.

11. Provide trend analysis and metric report (incident and problem).

C. Due Date-Time and Submittal Instructions

Responses to this RFI MUST BE Submitted/Received by the Due Date-Time, and Method for

Submittal specified below without exception.

Due Date-Time. All responses to this RFI MUST BE received by no later than 29 September

2011 5:00 PM Hours Eastern Daylight Savings time.

Method for Submittal. Submissions should not contain attachments greater then 5MB in size.

Such submissions may be excluded. RFI responses shall be submitted to Scott Stallsmith at scott.l.stallsmith@nga.mil.

RFI responses will not be accepted via fax, the Submit Unsolicited link on the IC-ARC homepage, or other means. The Government is not obligated to review responses to the RFI received after the deadline specified above.

The Government will entertain questions on a case by case basis. Written requests for clarification may be sent to the Contracting Officer via e-mail at the title of the e-mail must include “RFI# 4 – EMS QUESTION”. The content of a question may be included in a notification or answer to all Offerors, but if so included will not divulge the source of the question. All questions and answers will be posted on the FedBizOpps website prior to the closing date of the RFP. All questions need to be submitted to scott.l.stallsmith@nga.mil no later than 19 September 2011 5:00 PM Eastern Daylight Savings Time.

To aid in Government review, the total pages for the entire submission are limited to not more than 25 pages, submitted electronically in Portable Document Format (PDF). File size shall not exceed 5MB. The first page of the submission must state the RFI title and provide the name, e-mail address and telephone number for an individual that can be contacted for clarification or questions regarding this submission. The first page should also provide a short description of the company to include capabilities, company size and category (e.g., large, small, small mailto:scott.l.stallsmith@nga.mil mailto:scott.l.stallsmith@nga.mil

UNCLASSIFIED 6

disadvantaged). Each 25-page submission shall include responses areas of interest outlined in

Section D. The response format is 8.5" x 11", 12 pt. Times New Roman font.

Responses shall not include proprietary information. Any responses that are marked proprietary will not be considered.

Respondents are hereby notified that more than one Government Agency may be provided the responses for review, and the Government may utilize Federally Funded Research and

Development Centers (FFRDC) and/or Support Contractors to provide technical advice on the responses. Otherwise, information submitted under this RFI will be limited only to the ITEMS

Program Office and to the support contractors who have executed the requisite ITEMS non-disclosure agreements and conflict of interest statements. The Government will create a bidders list and will post this list onto www.fedbizopps.gov. Please state whether or not you have any concerns about posting your company’s name and point of contact information onto this site.

The Government may use the information provided to develop a comprehensive procurement strategy and solicitation. Any information used will be on a non-attribution basis.

D. Information Requested

RFI responses shall provide, at a minimum, clearly annotated answers to the following questions:

Question 1) Provide examples/experiences in addressing the requirements listed in paragraph B, in a managed service environment, particularly for government customers.

Address some or all of the services listed in paragraph B that your organization has had experience in managing. Address your company’s ability to supply staff at all security levels including SCI.

Question 2) Provide your recommended approach for the transition of enterprise managed services from vendor to vendor and/or from government to vendor.

Question 3) Provide your recommended approach for the transition from government owned equipment to government leased or contractor owned equipment.

Question 4) Given that the Services being managed could be provided under different contracts to discrete operating units at varying security levels worldwide, how would you create an architecture to support an enterprise view of the NGA operations?

Question 5) Based on your experience in providing EMS as a managed service, including

Service Desk services, what challenges have you experienced in providing 24/7 support in an environment as described above? Detail how you overcame any difficulties you may have encountered in providing those services.

Question 6) Provide examples/experiences associated with assisting a customer in transitioning from an in-house capability to a managed service model.

UNCLASSIFIED 7

Question 7) Provide your technology roadmap for enhancing EMS services in future releases of these services. Ensure that your response concentrates on the capabilities of these EMS services and not on the tools used to provide those services.

Question 8) Provide examples and benefits of virtualized solutions you have deployed as it relates to EMS.

Question 9) Provide a description of the concepts/methodologies you will employ to provide Incident, Change and Problem Management.

Question 10) Describe your company’s experience with taking over an existing government furnished Remedy version 7.5 suite of tools and transitioning that capability to managed services based EMS offering.

Question 11) How do you define a “service” at the enterprise level? (a combination of hardware, software, process, product, etc) Do you have established criteria for identifying and registering services?

Question 12) If a bidders’ conference for this type of work was held, would your company be interested in attending?

Question 13) Would you be best positioned to compete and perform as a prime or subcontractor in an effort as described above? Would you bid on this effort if an RFP was issued?

Question 14) Do you know of another company that could provide the RFI effort, but cannot due to required clearance levels? If yes, please provide company name and a point of contact.

Question 15) Do you have a GSA Schedule contract that encompasses the work (labor and associated hardware/software) described in this RFI? If so, provide the name of the contractor and the GSA Schedule Number.

Question 16) Would you recommend any portion of the work to be set aside for small businesses?

Question 17) The anticipated NAICS Code for this effort is 541513 Computer Facilities

Management Services. Is there another suggested NAICS Code? If yes, please provide.

Question 18) The Government will create a bidders list and will post this list onto the www.fedbizopps.gov website. Please state if you would like your company’s name and point of contact (POC) information posted onto this site: www.fedbizopps.gov.

http://www.fedbizopps.gov/

UNCLASSIFIED 8

Appendix A: Applicable Documents

A.1 Compliance Documents

(CURRENT VERSIONS SHALL BE UTILIZED)

OMB Circular A-130, Management of Federal Information Resources;

(http://www.whitehouse.gov/omb/circulars_a130_a130trans4)

DoD Directive 5015.2, DoD Records Management Program

Records Management Code, 36 Code of Federal Regulations Chapter XII, Subchapter B , (http://www.archives.gov/about/regulations/subchapter/b.html), with emphasis on Part 236, Electronic

Records

DoD Directive 8500.01E, "Information Assurance” dated 24 October 2002

DoD Instruction 8500.2, "Information Assurance Implementation” dated 6 February 2003

DoD Instruction 8510.01, "DoD Information Assurance Certification and Accreditation Process

(DIACAP)" dated 28 November 2007

NI 9010.3 R7, “NGA Instruction for Certification and Accreditation of Information Systems” approved

22 August 2007

DoD Directive 8570.01, "Information Assurance Training, Certification, and Workforce Management" dated 19 December 2005

Intelligence Community Directive ICD-503 “Intelligence Community Information Technology

Systems Security Risk Management, Certification and Accreditation” dated 15 September 2008

NIST Special Publication 800-53 Revision 3, "Recommended Security Controls for Federal

Information Systems and Organizations" dated August 2009

Committee on National Security Systems (CNSS) Instructions No. 1253 “Security Control Catalog for

National Security Systems” dated December 2007

Committee on National Security Systems (CNSS) Policy No. 25 “National Policy for Public Key

Infrastructure on National Security Systems” dated March 2009

Committee on National Security Systems (CNSS) Instruction No. 1001 “National Instruction on

Classified Information Spillage” dated February 2008

DoD Instruction 8552.01 "Use of Mobile Code Technologies on DoD Information Systems” dated 23

October 2006

DoD Instruction 8551.1 "Ports, Protocols and Services Management (PPSM)” dated 13 August 2004

DoD Policy Memorandum "DoD Guidance on Protecting Personally Identifiable Information (PII)” dated 18 August 2006

DoD Policy Memorandum "Encryption of Sensitive Unclassified Data at Rest on Mobile Computing

Devices and Removable Storage Media” dated 3 July 2007

Federal Information Management Security Act (FISMA) [Title III of E-Government Act of 2002]

Federal Cloud Computing Strategy

DISA Security Technical Implementation Guides (STIGs) – http://iase.disa.mil/stigs/index.html

DoD Manual 5220.22M "National Industrial Security Program Operating Manual (NISPOM) dated 28

February 2006

NSA Security Configuration Guides – http://www.nsa.gov/ia/guidance/security_ configuration_ guides

/index.shmtl

IC Directive 503, IC Policy Guidance 500.2, IC Directive 705

NIST Special Publication 800-37, NIST Special Publication 800-53

DDD 8100.02, DoDI 8420.01

CNSSP No 17

Section 508 of the Rehabilitation Act of 1973