ITSM RFI.pdf

REQUEST FOR

INFORMATION

U.S. Special Operations Command

Purpose

The United States (US) Special Operations Command (USSOCOM) is conducting market research to assist in understanding the capabilities available in the marketplace relevant to consolidated solutions based around Information Technology (IT) Service Management (ITSM). This Request for Information (RFI) seeks to identify ITSM solutions that offer workflow management enabling organizations to plan, manage, report on, and deliver IT services and related digital experiences. The scope of this effort includes core services currently hosted in our on-premises and commercial cloud environments.

Background

USSOCOM hosts Special Operations Forces (SOF) applications and services both on-premises and in the cloud across our Non-classified Internet Protocol (IP) Router Network (NIPRNet), Secret Internet Protocol Router Network (SIPRNet) and Top Secret (TS) security enclaves. Our current ITSM platform is hosted on our SIPRNet environment and is used to manage change, incident, problem, configuration management, and assets for all Enterprise services. For this RFI the following tools are currently used to support ITSM across USSOCOM and may be relevant to your response:

• IT Service Management – Remedy ITSM

• Account Management – Remedy Action Request System (ARS)

• NetMRI – Network Operations Configuration Management Database (CMDB)

• BMC Configuration Management Database (CMDB) – Enterprise Services Baseline

• BMC Configuration Management Database (CMDB) – Enterprise Hardware/Software Inventory

• Application Performance Monitoring – Riverbed Application Performance Management (APM)

• Asset Discovery – Microsoft Endpoint Configuration Manager (MECM)

• Asset Discovery – BMC Discovery

• Directory/Authentication Services – Microsoft Active Directory

• Mail Services o NIPRNet – M365 o SIPRNet – Microsoft Exchange

• Instant Messaging Services o NIPRNet – Microsoft Teams o SIPRNet – Cisco Jabber

Required Capabilities

Change Management:

• Change impact, including services, service offerings, and business applications, should be automatically derived based on one or more Configuration Items (CIs).

• Dynamically triggering change approval policies and detecting change conflicts, including blackout schedules, maintenance schedules, CI changes, and overlapping resource assignments.

• Automated scheduling assistant for identifying conflict-free time spans for implementing changes.

• Detecting unauthorized changes and flagging them for review/remediation.

• Provide actionable insights into change operations and easily identify process bottlenecks.

Incident Management:

• Logging incidents via email, web portal, chat, mobile app, and virtual agent.

• The system should include the ability to display relevant knowledge articles during incident creation.

• Automatic categorization and assignment of incidents.

• Track past and current incident records that are similar to the current incident.

• A mobile app for agents to update records, coordinate with coworkers, track locations, and work offline.

• Dependency views to identify affected services during incidents and aid in investigation.

• On-call schedules and escalation policies setup.

• Communication features or 3rd party integration for notifications via SMS, voice mails, chat messages, and conference calls.

Walk-up Experience:

• The solution should provide functionality to support an IT walk-up or scheduled service on-site or virtually.

• Users should be able to view, check-in, and get details about walk-up queue locations on their mobile devices.

• Online Walk-Up Experience appointments should be added to users' calendars.

• Admins should configure different appointment booking options based on the user's reason for service.

• Dashboard and reporting functionality for admins providing basic high-level reporting on incident and request types, record volume, average wait time, assignments by technician, location.

Problem Management:

• Relating problem records with incidents, changes, and other record types is essential.

• Dependency views to aid root cause investigation should be provided.

• Searching affected service offerings by a problem.

• Creating known error articles from problems for incident deflection.

• Efficient communication of workarounds and fixes to affected users.

• Updating new problem records or task records without manual state changes.

Knowledge Management:

• Solution should support the creation of multiple knowledge bases for different groups based on user criteria like department and location.

• Access to knowledge articles from a mobile app.

• Assignment of knowledge bases to individual managers with separate workflows for publishing, retiring articles, and access controls.

• Users should be able to subscribe to knowledge bases and articles for updates, provide feedback and comments to articles.

• Provide Incident managers feedback on articles, identify missing topics, and fill gaps to deflect future incidents.

Configuration Management:

• The solution should provide a Configuration Management Database (CMDB) that allows tracking of assets and configuration items (CIs) separately with relationships and automatic synchronization between them when needed.

• Dependency views that graphically display an infrastructure view for a CI and the application or business services it supports.

• Simulate the impact of changes to CIs o The BMC Atrium Impact Simulator application helps you to determine how a change to the availability of an item represented by a CI affects other items. For example, you can run a simulation in BMC Atrium Impact Simulator to learn what devices and applications in the network would be affected if you took a server offline. You can also use BMC Atrium Impact Simulator to plan for disaster recovery. You can run simulations to determine where the network is weakest, and plan accordingly.

(https://docs.bmc.com/docs/asset2105/bmc-atrium-impact-simulator- 1002237965.html)

• Work with configurations o Configuration administrators define configurations as sets of CIs that are required by different groups of people in the company. For example, the configuration for support agents might include a computer, monitor, keyboard, mouse, and printer. If a CI belongs to a configuration, to view details about the configuration, click the Configuration link from the navigation pane. This link opens the Configuration Information dialog box. You can also add a new configuration to replace the current one.

(https://docs.bmc.com/docs/asset2105/working-with-configurations-1002237956.html)

• Approve and manage products, versions, and patches in the Product Catalog o As part of managing your products, you must approve products in the Product Catalog.

Products with the Approved status are available in the DML or DHL, depending on whether they are software or hardware.

(https://docs.bmc.com/docs/ac2002/approving-and-managing-products-versions-and-patches-in-the-product-catalog-908214363.html)

• Natural language query capability for non-experts and a query builder for power users to run complex infrastructure and service queries.

Asset Management:

• The solution should support tracking of assets and configuration items separately with relationships and automatic synchronization between them when needed.

• Integration with endpoint asset information sources like Microsoft MECM.

• Tracking asset information such as state, procurement information, contracts, depreciation, and disposal information.

• Asset information lookup using natural language query capability for non-experts and a query builder for power users to run complex infrastructure and service queries.

• The solution should enable agents and users to view their assigned assets and report incidents against an asset.

• Scanning and receiving multiple assets in an inventory, uploading them to a central platform in a single batch (bulk).

Service Level Management:

• The solution should allow multiple Service Level Agreements (SLA), operational level agreements (OLA), or underpinning contracts (UC) to be assigned to a task for monitoring and managing service quality.

• Definition of start, pause, stop, and reset conditions for an SLA.

• A breakdown view providing detailed task ownership and SLA duration-related data for any task

SLA record associated with a task.

• A visual timeline providing detailed insight into specific task updates, triggering stage changes during the life cycle of an SLA.

• Ingesting service level indicators from Application Performance Monitoring (APM) tools from vendors like Riverbed to create Service Level Objectives (SLO), Error Budgets, and triggering Policy Actions.

Service Catalog:

• The solution should allow the creation of one or more service catalogs for users to request items through web portals, virtual agents, and mobile apps.

• Should support cataloging of user selected cloud services/infrastructure.

• The solution should allow the creation of simple data-driven workflows aimed at fulfillment processes for common scenarios.

• Access controls managing item visibility by user criteria like department and location.

• Search capability to quickly find relevant catalog items across web portals, mobile, and virtual agents.

Management Analytics:

• The solution should have native reporting, dashboarding, and analytics capabilities.

• Support for a variety of report types including bar, pie, donut, time series, multi-dimensional, scores, statistical, calendars, maps, and lists.

• Use of standard deviation to aggregate field values in reports should be possible.

• Creating and distributing reports showing the current state of instance data, such as the number of open incidents of each priority.

• Should offer the ability to securely collect daily KPI data from customer instances and aggregate anonymized data into monthly global benchmark reports providing comparative insights relative to industry averages and peers in geography or organization size.

• Data visualizations should show score, trend, proportional, and comparison data.

Requested Information

• Assuming the requirement to support all security enclaves please discuss the following:

o Highlight, in-depth, your past performance delivering a turnkey ITSM solution consisting of a fully integrated suite of software tools and/or as a managed service.

o Describe whether and how you would deliver a fully integrated turnkey ITSM solution hosted in the cloud (IaaS or SaaS).

o Describe whether and how you would deliver a fully integrated turnkey ITSM solution hosted on-premises.

o Describe your licensing model for a fully integrated turnkey ITSM solution:

Hosted in the cloud (IaaS or SaaS).

Hosted on-premises.

o Describe how your solution prevents transmission of malicious data or files.

o Describe whether and how you would deliver a fully integrated ITSM as a Managed

Service.

o Discuss in-depth how you would handle discovery and maintenance of IT assets (On-prem and cloud) across multiple security enclaves (NIPR, SIPR, TS) and maintain in a central asset database.

o Discuss in-depth how you would handle incidents across multiple security enclaves (NIPR, SIPR, TS) and maintain a central incident database.

o Discuss your solution for and past performance in handling remote offices/users globally.

o Describe how your turnkey ITSM solution supports the following Zero Trust tenets:

Data sources Computing Services Communications Authentication and Authorization

Response Guidelines

Interested parties are requested to respond to this RFI with a white paper. Submissions cannot exceed 15 pages, single spaced, 12-point type with at least one-inch margins on 8 1/2” X 11” page size. The response should not exceed a 5 MB e-mail limit for all items associated with the RFI response.

Responses must specifically address the vendor’s capability to meet the requirements outlined in this

RFI.

Companies, large or small, who wish to respond to this RFI must send responses via email no later than April 4, 2024.

Industry Discussions

USSOCOM representatives may choose to meet with potential offerors and hold one-on-one discussions. Such discussions would only be intended to obtain further clarification of potential capability to meet the requirements, including any development and certification risks.

Questions

Questions regarding this announcement must be posted to this RFI. Verbal questions will NOT be accepted. Answers to questions will be posted to FedBizOpps (FBO). The Government will not reimburse companies for any costs associated with the submission of their responses.