MDM-RFI-NOAA (2024.12.03).pdf

Mobile Device Management (MDM) Hosted Service SaaS Request for Information (RFI)

1. Introduction and Purpose The National Oceanic and Atmospheric Administration (NOAA) is seeking information from qualified vendors regarding the procurement of licenses for a Commercial-off-the-Shelf (COTS) Software as a Service (SaaS) Mobile Device Management (MDM) cloud hosted service. The goal is to manage multiple Operating System (OS) platforms and devices across the NOAA enterprise. Interested parties are invited to respond to this Request for Information (RFI) and will be referred to as “Respondents.”

2. Background The NOAA Office of the Chief Information Officer (OCIO) oversees NOAA’s IT resources and services, which support a wide range of critical environmental and economic functions. NOAA is committed to improving IT services while reducing costs through the Federal Shared Services Model.

3. Current Environment NOAA currently utilizes IBM’s MaaS360 to manage approximately 4,500 devices on various OS platforms. This service is integrated with Google Workspace Enterprise services.

4. Scope of Work The MDM solution must provide an end-to-end SaaS service for all NOAA users. The vendor must include any necessary software or services for migration and operation.

5. Performance Objectives The vendor’s solution must meet the following functional requirements:

● Current FISMA Authority To Operate (ATO) and/or FedRAMP certification.

● Management of iOS, Android, and Microsoft devices as a SaaS solution.

● Security compliance measures, including device access controls and malware alerts.

● Support for specific Android and iOS controls based on Security Technical

Implementation Guides (STIG).

● Integration with existing NOAA systems like Google Workspace, ForgeRock OpenAm and OpenIDM.

6. Questions for Respondents Respondents are asked to provide answers to the following questions:

1. What additional operating systems do you support, outside of iOS and Android, as part of your SaaS offering (e.g., ChromeOS, Windows)?

2. Do you offer mobile threat management solutions within your SaaS framework?

3. Are there preconfigured approved and denied lists for iOS and Android applications? If so, how are these lists categorized within your SaaS platform?

4. How do you handle updates to these lists in your SaaS solution?

5. Can you provide details on your app categorization process for both iOS and Android platforms as part of your service?

6. Does your solution provide/support the following:

a. Apple Declarative Device Management (DDM) & Apple Business Manager (ABM)

b. YubiKey/Security Key for phishing resistant MFA

c. Android Enterprise - Allow 2nd and 3rd managed email accounts.

d. Zero day support for after OS updates?

e. Built-in remote mobile device support?

f. Identity and Access Management/ SSO to SaaS web interface and ForgeRock

OpenAM

g. Cloud based device backup/restore options that are FedRamp certified?

h. AI controls/policies as it relates to iOS and Android

i. Technical Account Manager (Consultant On Demand)

7. Transition

a. What is the estimated timeline for complete transition?

b. Strategies for minimizing disruption during the transition?

8. What is the general % update for the service(s) (i.e. 99.9%)?

9. Can your proposed solution(s) provide a 508-compliant end user self-service portal capable of authenticating to NOAA’s SSO?

10. Compliance enforcement actions - any limitations on how many enforcement actions can be enforced per compliance rule?

11. What is the percentage of Request for Enhancement submissions implemented and in what timeframe?

12. What FedRamp options are available for backing up devices?

13. What FedRamp options are available for backing up SMS?

7. Submission Instructions Respondents are requested to submit the following:

● Company information

○ Company Name

○ SAM Unique Entity Identifier (UEI)

○ CAGE Code

○ Company Address

○ Point of Contact/Company Representative

○ Phone Number/Email Address

● Capabilities statement to the proposed MDM SaaS solution(s) which includes the responses to the questions in Section 6 above.

● 1-2 examples of relevant experience in providing SaaS solutions that meet NOAA’s requirements, if any.

● Preliminary pricing models or estimates.

8. Response Format Responses should be submitted in PDF format (size 11 font) to the contacts listed below and should not exceed five (5) pages (excluding a cover page and table of contents). The Government may contact respondents to obtain additional information, clarification and/or market research to fully understand a company's response.

9. Timeline Responses are due by 11:00 AM EST, December 27, 2024.

10. Confidentiality All information submitted in response to this RFI will be treated as confidential and will not be disclosed to any third parties without prior consent.

11. Contact Information For questions or clarifications regarding this RFI, please contact:

Daniel Ok Contract Specialist daniel.ok@noaa.gov

Paul Batrony Contracting Officer paul.batrony@noaa.gov mailto:daniel.ok@noaa.gov mailto:paul.batrony@noaa.gov