1_LSC-OIG-IT_Support_RFP-2018.pdf

Request for Proposals

Information Technology and Information Management Services

November 20, 2017

Office of Inspector General Legal Services Corporation

3333 K St, NW Washington, D.C. 20007 https://oig.lsc.gov/

Inquiries should be directed to:

David Maddox Assistant Inspector General for Management and Evaluation dmaddox@oig.lsc.gov mailto:dmaddox@oig.lsc.gov

TABLE OF CONTENTS

Page

1. Introduction

2. Purpose

3. Inquiries

4. Services Procurement Strategy

5. Performance

6. Delivery

7. Proposals

8. Instructions to Prospective Offerors

9. Proposal Evaluation

10. Review Process

11. Certifications

Appendix A

Appendix B

Appendix C

1. Introduction The Legal Services Corporation (LSC) is the single largest funder of civil legal aid for low-income Americans in the nation. Established in 1974 by the Legal Services Corporation Act and funded by the United States Congress, LSC operates as an independent 501(c)(3) nonprofit corporation that promotes equal access to justice and provides grants for high-quality civil legal assistance to low-income Americans. LSC distributes approximately 94 percent of its total funding to 133 non-profit legal aid grant recipients with 820 offices that provide legal assistance to low-income individuals and families throughout the nation.

The LSC Office of Inspector General (OIG) operates independently under the Inspector General Act. The OIG has two principal missions: to prevent and detect fraud, waste and abuse and to assist management in identifying ways to promote efficiency and effectiveness in the activities and operations of LSC and its grantees. To support the OIG mission, the OIG operates its own computer network and website (https://oig.lsc.gov/).

2. Purpose The OIG requests the services of an Information Technology (IT) and Information Management (IM) services firm (preferably a Microsoft Certified Solution and an Amazon Web Services qualified provider) to support the operations of the OIG over a three-year, IT/IM services umbrella contract. As a quasi-federal non-profit entity funding legal services to low-income individuals throughout the United States, LSC qualifies for GSA, non-profit and charitable rates. This Request for Proposal (RFP) is not subject to the Federal Acquisition Regulation (FAR).

Appendix A is a general description of the current OIG IT architecture. Appendix B includes a list of OIG support areas. Appendix C provides a description of the roles and responsibilities of the IT\IM support services contractor and OIG IT staff.

3. Inquiries Inquiries concerning this effort should be directed to David Maddox, at dmaddox@oig.lsc.gov. All inquiries and responses will be e-mailed to all prospective Offerors by the OIG.

4. Services Procurement Strategy The OIG plans to contract with one firm under a capped time and materials contract encompassing the service areas listed under Appendix B and other similar future support projects via statements of work. The OIG estimates ordering an average of 1,200 total hours per year, not to exceed a maximum of 3,600 hours for the duration of the contract. A minimum number of hours will be established. During the execution of the contract, the Offeror will conduct a network assessment and submit a general support plan and a statement of work covering the service areas in Appendix B and setting forth specific http://www.lsc.gov/laws/act.php http://www.lsc.gov/map/index.php objectives and scope, deliverables, level of effort, total number of hours allocated towards the completion of the service areas, key personnel, milestones and an overall project management plan. Addition substantive projects will require additional statements of work (project statements) detailing the same project specific elements. The successful Offeror will have the capacity to work in all the service areas listed under Appendix B. Work in any one of these areas may not be required but will be ordered on an as needed basis.

5. Performance The selected Offeror is required to give “best efforts” toward the completion of the tasks for the service areas and/or project statements under this contract.

All work will be done on-site at the OIG’s office or off-site as needed and with OIG approval. The OIG will provide the required on-site software and hardware unless otherwise approved. The OIG will provide access for designated contract employees to its work environment between the hours of 7:30 AM and 7:00 PM, Monday through Friday.

Additional access times can be pre-arranged with designated OIG IT staff.

6. Delivery The Offeror will work with OIG staff to complete individual tasks in the most efficient and effective manner. The Offeror will keep OIG staff informed of the tasks completed under each service area and/or project statements. The Offeror’s team, including the project manager, will meet monthly with the OIG at the OIG’s office to review the status of projects.

A detailed invoice will be submitted to the OIG monthly.

If the Offeror fails to timely complete scheduled tasks under a service area and/or project statement or delivers products or services which do not conform to all of the provisions of the contract, OIG may, by notifying the Offeror in writing, terminate the whole or any part of this contract. If it determines there is sufficient justification for doing so, the OIG will enter into discussions with the Offeror to amend the general support plan and/or project statement.

7. Proposals Each Offeror will submit an electronic copy of their proposal to David Maddox at dmaddox@oig.lsc.gov. To be considered, the proposal including certifications, must be received no later than 5:00 PM Eastern Time on December 11th, 2017. The OIG reserves the right to reject any and all proposals received in response to this RFP. The OIG reserves the right to consider late proposals or exclude timely proposals from consideration for any reason. The OIG may, at its discretion, extend the response date and expand the list of eligible firms or publicly post this RFP. All costs incurred in the creation of a proposal are the responsibility of the Offeror. The selection of the successful firm is scheduled to be made by January 10th, 2017. Upon conclusion of final negotiations with the successful firm, all Offerors will be notified electronically of the OIG choice. The OIG reserves the right to cancel this procurement and not enter into a contract for services pursuant to this RFP.

8. Instructions to Prospective Offerors

Each Offeror in its proposal shall, at a minimum, include the following:

A. Organization, Size and Structure:

The Offeror shall describe its organization history, size, structure, general IT and IM support areas and affiliations.

B. Information Technology and Information Management Services

Experience:

The Offeror shall describe its prior experience in supporting a small to medium size office with IT and IM functions. These functions would include:

applicable systems and services including network engineering services, network administration and systems monitoring, IT staff augmentation, helpdesk support, emergency services, project management, data and network security and integrity assurance, disaster recovery, AWS cloud and O365 support, server virtualization, configuration and support. Further, the Offeror will describe its expertise in information management support in the areas of: O365 SharePoint, applications development in ASP.NET using Visual Studio 2017, database administration, web site support, and graphic design support. Appendix B details the areas of expertise in which the LSC- OIG is primarily interested.

The Offeror will list and describe current and/or previous clients served, focusing on clients similar in size and complexity as the OIG (30 FTEs). The Offeror will also describe any experience with OIGs. The Offeror will provide the current name, address, and telephone number of at least three (3) relevant references the Offeror has served either currently or in the past three (3) years; preferably those where one or more of the project team members provided the same or similar services as requested herein.

C. Staff Qualifications:

The Offeror shall describe the qualifications, certifications and relevant experience of staff to be assigned to support the OIG. More particularly the Offeror shall provide resumes of staff to be assigned to the service areas listed in Appendix B, including descriptions of education, position in the firm, years and types of experience, continuing professional education and professional certifications. As a minimum staffing requirement, the technical services shall be performed or overseen by a senior IT manager. Ideally, the Offeror will also plan for the staffing of a dedicated program manager. The Offeror will only provide qualified personnel to complete all work.

D. Work Plan and Approach:

The Offeror's work plan must describe, for each service area listed in Appendix B, its understanding of the work to be performed, previous experience, recommended methodologies, project management to be exercised, how it will approach milestones and the staff (skill-sets) assigned to this project.

The Offeror may use the services of a subcontractor to perform some of the specialized services listed under Appendix B. The Offeror will disclose its intent to subcontract and provide a description of the subcontracting firm(s) as well as the subcontracting firm’s staff expertise for each service area. The OIG reserves the right to approve all subcontracting arrangements in advance of the work.

E. Price:

The Offeror will provide estimated hours/rates per individual/staff level for the service areas listed in Appendix B. The Offeror is expected to provide its best estimate based on the information provided now with consideration of LSC’s mission. The Offeror will also identify any conditions that might increase or reduce the cost of the proposed services.

F. Page Limitations:

The proposal (exclusive of appendices) should be no longer than seven pages long. Resumes may be included in an appendix.

G. Certifications:

The Offeror must sign and include as an appendix to its proposal the enclosed certifications.

All or some portion of the information supplied in the proposal of the selected Offeror will become part of the formal contract.

9. Proposal Evaluation Evaluation of each proposal will be based on the following criteria. Furthermore, the OIG will use the Best Value approach to select the most advantageous offer.

A. Organization, Size and Structure:

The OIG will assess the Offeror’s organizational history, size, structure, general IT and IM support areas and affiliations.

B. Information Technology and Information Management Services Experience:

The OIG will assess each Offeror’s prior experience in applicable IT systems administration and IM projects based on the proposals received. The OIG will also assess experience with OIG offices and with organizations similar in size and complexity.

C. Staff Qualifications:

The OIG will evaluate the qualifications of the staff to be assigned to OIG support. This will be determined from resumes submitted. Subsequent substitution of personnel must be approved by the OIG. The evaluation criteria will include: education, position in the firm, years and types of experience, continuing professional education and certifications and applicability of prior projects. The OIG requires that the Offeror include a senior level engineer to perform or oversee the delivery of technical services.

D. Work Plan and Approach:

The OIG will assess each Offeror's workplan, methodology/approach, team make up and project management exercised to perform the services described in Appendix B.

E. Price:

The OIG will assess the rates per individual and staff level assigned to each service area, as well as the overall annual price projected over the 3-year term. The OIG will also assess any additional cost that the Offerors may identify in the proposals.

F. Certifications:

Certifications must be signed and included as an attachment to the proposal.

G. References:

After the OIG has made a preliminary determination regarding an Offeror with whom it may contract, it will contact and assess the references of that firm.

10. Review Process The OIG will review all proposals and may decide to narrow the pool of Offerors to those who are the most competitive. The OIG may, at its discretion, request presentations by or meetings with Offerors in that narrowed pool, to clarify or negotiate modifications to the Offerors' proposals. However, the OIG reserves the right to make an award without further discussion of the proposals submitted. Therefore, proposals should be submitted initially on the most favorable terms, from both technical and price standpoints, the Offeror can propose.

11. Certifications A. The individual signing certifies that he/she is authorized to contract on behalf of the

Offeror and to make these Certifications.

B. The individual signing certifies on behalf of the Offeror that he/she has read and understands all the information in this Request for Proposal and appendices and that his/her proposal reflects the truth based upon their understanding of these documents.

C. The individual signing certifies that the prices quoted in this proposal have been arrived at independently, without consultation, communication, or agreement for the purposes of restricting competition.

D. The individual signing certifies on behalf of the Offeror that the Offeror will not subcontract any portion of the work without advance approval of the OIG.

E. The individual signing certifies on behalf of the Offeror that the Offeror, including any individuals to be assigned to the project, does not have a record of substandard work and has not been debarred or suspended from doing work with any Federal, state or local government.

F. The individual signing certifies on behalf of the Offeror that the Offeror is an Equal

Opportunity Employer and does not discriminate in hiring, employment or activities because of race, color, religion, sex, age, national origin, disability, or any other basis prohibited by law.

Dated: ________________________________

Offeror's Firm Name: ____________________________________________

Signature of Offeror's Representative: ___________________________________

Printed Name and Title of Individual Signing: ____________________________________

Appendix A

OIG.LSC.GOV Domain Details

Servers/Cloud Environments

Names Function(s) OS Model

File server File, Print, Audit Information Management System (AIMS)

Windows 2008 R2 SP1 Dell PowerEdge R510

Database server SQL 2008

Windows 2008 R2 SP1 Dell PowerEdge 2950

Office 365 with Exchange Online

OIG File, Mail and SharePoint Services Cloud N/A

PDC

AD, DNS, DHCP Primary Domain Controller

Windows Server 2012 R2 Dell PowerEdge R730 *

SDC

AD, DNS, DHCP Secondary Domain Controller

Windows Server 2012 R2 Dell PowerEdge R730 *

NAS Network Attached Storage QTS (Linux) TS-431U

TM TeamMate Windows Server 2008 R2 SP1 Dell PowerEdge R730 *

IMIS

Investigations Case Management System (IMIS)

Windows Server 2012 R2 Dell PowerEdge R730 *

Web Server OIG Web Services (AIMS) Windows Server 2008 R2 Dell PowerEdge

Joomla-Web OIG Website Windows Server 2016 R2

AWS Cloud Computing Services

AIMS

Development AIMS Development

Windows Server 2012

R2 AWS

* Dell R730 is a Virtual Host using VMware VSphere 6.0 with ESXi Hypervisor

Workstations

13 Dell Latitude 6430U Windows 7 Professional, Office 365 5 Dell Latitude E7450, Windows 7 Professional, Office 365 2 Dell OptiPlex 9020, Windows 7 Professional, Office 365

10 Dell Latitude E7470, Windows 7 Professional, Office 365

Phones

Avaya IP Office Call Manager (Shared with parent organization)

Firewall

Sonic Wall NSA 2400

Appendix B

Service Areas

The OIG goal is to have network resources available 99.5% of the LSC OIG working calendar. The work is not to interfere with normal OIG business hours of 8:30 AM and 5:00 PM, Monday through Friday, so certain items may be done at night, on weekends, on premises or remotely.

Sections A to F below provide a description of the service areas in which the Offeror is required to have expertise.

A. Management Services

Provide on-going management services for the life of the contract to include:

1. Project Management - time shall be spent on identifying client needs and ensuring customer satisfaction. Further the Offeror will manage trained technical solution resources, budget, schedule, milestone deliverables, tracking and reporting on resource usage and proper invoicing.

2. IT Management Decision Support - time shall be spent on network assessment, planning and architecture, and technical solution approaches to support current and future OIG IT and IM operations and sharing IT best practices.

3. Policy Development – time shall be spent on reviewing, creating, and updating IT and IM policy and procedures.

B. Information Management and Software Engineering

The Offeror will augment the OIG’s Senior Applications Developer by providing information management and software engineering services for the life of the contract to include:

1. Gather and analyze business process requirements.

2. Website development, graphic design and support (Joomla).

3. SQL Server 2016 database administration and maintenance.

4. SharePoint Online, Office 365 configuration and hosting.

5. Summary Report Form (SRF) development support and maintenance using

Classic ASP.

6. Audit Information Management System (AIMS) development support in

Microsoft environment, using ASP.NET Core MVC.

7. Web development using Visual Studio 2017.

8. Test, deploy, support and modify Commercial Off The Shelf Software

(COTS) including TeamMate audit software, Cloudberry.

9. Additional System design, configuration, development implementation, documentation, training and support services on an as needed basis.

C. Data and Security Integrity The OIG will continue a review of its security policies and procedures and is requesting support in the implementation of next steps based on its Plan of Action and Milestones (PoAM). Familiarity and experience with government IT security best practices and NIST standards are preferred.

D. Server Virtualization/ Cloud Computing

The LSC-OIG requires the services of an expert who has demonstrated experience designing, implementing and maintaining virtual architectures with the use of VMware or Hyper V for small to mid-size organizations. In addition, the LSC-OIG requires the services of an expert who has demonstrated experience designing, implementing and maintaining cloud services such as AWS, Azure, Office 365.

E. Disaster Recovery Planning and Implementation

The LSC-OIG is seeking the services of a disaster recovery expert who could review OIG systems, provide recommendations as well as plan and implement a solution that best fits our office size and needs.

F. IT Support Services

The Offeror will augment the OIG’s Senior IT Specialist by providing on-going support services to the OIG (approximately 30 users)1 for the life of the contract including:

1. Network security and administration.

2. Cloud, network, server, and desktop hardware - installations, maintenance, configuration management and recovery.

3. Operating system and application software installation, configuration, updates and patching (to include TeamMate audit software, AIMS and Investigative Management Information System.

4. Configurations, migrations and updates of the Microsoft family of cloud-based software.

5. Support user remote access to network resources

6. System troubleshooting, performance tuning and monitoring services/prevention.

7. Network services outage risk management.

8. Virus, spam and malware protection.

9. Device management – notebooks and iPhones.

10. End user help desk and hosting a help desk management system.

11. Training and documentation: The selected Offeror may be requested to train staff and produce documentation, system administration and user manuals.

12. Additional IT and other IT support services as needed.

1 A specific breakdown of information technology roles and responsibilities is attached as Appendix C.

Appendix C

LSC OIG IT Roles and Responsibilities Matrix

The LSC OIG Information Technology Roles and Responsibilities Matrix displays a RACI model. RACI is an acronym for Responsible – Accountable (aka Approver) - Consulted - Informed.

The participation types in the RACI matrix are:

• Responsible - The person or role who is assigned to achieve the task. There is only one resource given this category type. Others may be required to assist in the work but they are either given another participation code, such as Assist, or are not included as the list includes only the key people in the activity.

• Accountable – This person or role must sign off on work that Responsible role provides. They are ultimately accountable for the correct and thorough completion of the deliverable or task, and the one to whom Responsible is accountable. There is only one Accountable specified for each task or deliverable. For our matrix, this can also be the OIG group that Approves the task when necessary.

• Consulted - Those whose opinions are sought and with whom there is two-way communication.

• Informed - Those who are kept up-to-date on general progress, often only on completion of the task or deliverable, and with whom there is just informational communication.

The following roles have been included:

• Inspector General (IG) – has limited responsibilities in the matrix but will at times be consulted and his/her approval will be required for various tasks.

• OIG Management & Evaluation (M&E) Management – (Assistant Inspector General for Management and Evaluation) serves as the head for IT-related work within LSC OIG. This role will have the majority of accountability for IT tasks.

• OIG IT Staff – (consists of the Senior IT Specialist and Senior Applications Developer) oversees the day-to-day IT operations, desktop support and AIMS development. The staff is also consulted on most significant IT decisions and recommends solutions to the AIGME.

• IT Contractor – serves as the IT technical lead for LSC OIG and is responsible for IT Server, network and application support.

• LSC CIO and IT Staff – serve as the responsible party for LSC corporate IT support and set some IT-related policy for the OIG.

• OIG Users – are by and large the Informed party for the matrix. There are times when their input is sought to gain a better understanding of the IT/IM direction of the office, their units’ goals, work processes and how users will be affected.

IG

OIG M&E

Management

OIG IT

Staff

IT

Contractor

LSC CIO

and IT Staff

OIG

Users

IT Operations and Management Server Management and Configuration

A C R I

Server Maintenance A C R I Server Patch Management A R C I Server Daily Monitoring and Checks A R I Cloud Services Management and Configuration (AWS, Azure, O365)

A C R I

Desktop Management and Configuration

A R C I

Desktop Maintenance and Checks A R I I Desktop Patch Management A R C I Network Equipment Configuration A R I I Network Equipment Checks A R C I Backup Configuration A C R I Backup Monitoring and Support A R I I Anti-virus Configuration A R C I Anti-virus Monitoring and Support A R C I Active Directory Configuration A R C I Active Directory Monitoring and Support

A R C I

DNS Management (External) A R C R I DNS Management (Internal) A R C I OIG Wi-Fi Policy and Configuration A R C I LSC Wi-Fi Policy and Configuration C C C R I CONNECT – SharePoint Requirements and Design

A/R C C R

Audit Information Management System (AIMS) Design, Development and Support

A R C I

IG

OIG M&E

Management

OIG IT

Staff

IT

Contractor

LSC CIO

and IT Staff

OIG

Users

Investigative Management Information System (IMIS) Application Maintenance and Support

A R C I

Other Application Maintenance and Support

A R C I

OIG Website Maintenance/Support A R C I IT Security Policy Development A C R I Training and Awareness A R C I Testing A C R I Policy- Compliance A/R R C I IT Planning and Procurement Inventory Management I A R C IT Equipment Procurement Lifecycle I A R C I IT Contract Management I A/R R C IT Vendor Support A/R C C I IT Financial Planning C A/R C I I IT Strategic Planning C A/R C C I