NAMA-17-R-0003_Attachment_2_Sample_Task_Order_PWS.docx.docx

ATTACHMENT 2

PERFORMANCE WORK STATEMENT (PWS) SAMPLE TASK ORDER

LOGICAL ACCESS CONTROL SYSTEM INTEGRATION

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country so that people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.2 The National Archives and Records Administration (NARA) operates a Wide Area Network (WAN) that provides network services to all NARA facilities throughout the country. This network is known as NARANet. The services of NARA’s General Support System (GSS) are provided by Micro Focus (SUSE Linux) and the authoritative directory for identity is e-Directory, with subordinate Active Directory domains used by specific applications. NARA's Identity and Access management (IAM) system provides access governance to NARA on premises IT systems. In many cases this access is managed from the NARA Identity Management system (IDMS).

2.0 SCOPE OF WORK

2.1 The scope of work includes all personnel and resources necessary to establish, refine, develop, test, implement, and manage an optimal Homeland Security Presidential Directive (HSPD)-12 compliant IAM program within the NARA enterprise. The Contractor must provide the personnel and resources necessary to support NARA’s IAM program to include both the Logical Access Control (LAC) and Physical Access Control (PAC) requirements as described herein, except for those specifically identified as Government Furnished. The Contractor shall be required to meet with Government personnel and other NARA Contractors throughout the term of this task order on an ad hoc basis, as needed to effectively perform services required herein.

3.0 DESCRIPTION OF SERVICES

3.1 Objective. NARA’s objective is to obtain professional services for the design, testing, implementation, deployment, and continuous operational support for NARA’s HSPD-12, Personal Identity Verification (PIV) 2, Logical Access Control System (LACS), and overall Identity Management System (IDMS). The Contractor must support the implementation of technical mandatory authentication to the network for all NARA users. The Contractor must provide research, design, development, and integration of two-factor PIV authentication of NARA infrastructure devices and applications. Additionally, the Contractor must provide a Derived Credential LACS solution for all NARA supported mobile device and desktops, along with all other tasks outlined in this Performance Work Statement (PWS).

3.2 IDENTITY AND ACCESS MANAGEMENT SYSTEM

3.2.1 Architecture Analysis and Design. The Contractor shall perform architecture support for NARA IDMS and IAM systems which include Micro Focus’s eDirectory Services, Micro Focus Identity Management systems, Micro Focus Access Management systems, Microsoft Active Directory Services, Remedy Service Ticketing, SecureAuth Web Based SSO, Gmail Directory Services and System Authentication and Access Controls. The current IDMS configuration consists of eight (8) total Micro Focus Drivers. The Contractor shall:

3.2.1.1 Coordinate, manage and participate on NARA IAM projects;

3.2.1.2 Provide architecture analysis and recommendations on NARA IAM projects; and

3.2.1.3 Provide impact assessments of architecture changes to NARA IAM systems.

3.2.2 Development, Testing, and Release of New Architecture(s) or changes to the IDMS. The Contractor shall provide the development, testing, and release of new and existing Identity Management drivers into the IDMS.

3.2.2.1 The Contractor shall add new IDMS drivers to the infrastructure on an “as needed” basis, as NARA instantiates new systems. On average, the Contractor shall add five (5) drivers per year, but no more than ten.

3.2.2.2 During the period of performance on this task order, the Contractor shall:

3.2.2.2.1 Update of the existing HR driver to use the U.S. Department of the Interior's Interior Business Center (IBC) interface which allows two way synchronization of employee information

3.2.2.2.2 Develop a driver to synchronize Contractor personnel information from the IBC Contractor module to include full user provisioning of new accounts

3.2.2.2.3 Update of the existing integration of GSA MSO SIP US Access into NARA IDMS to enroll new users that have been provisioned from HR Systems and to update user information in GSA as needed form NARA IDMS.

3.2.2.2.4 Create an IDMS driver to synchronize users into a new NARA Active Directory (AD) domain to include user provisioning and the required fields for PIV Authentication from the NARA IDMS system. This environment will ultimately include all NARA desktops and Windows OS servers.

3.2.2.2.5 Development, testing and release of the enterprise Password Self Service (PSS) Portal, to include redundancy and addition of PIV authentication to the portal.

3.2.2.2.6 Integration and refinement of the IDMS driver integration with NARA Remedy Helpdesk system into the NARA IDMS

3.2.2.2.7 Configure the NARA Citrix remote access system to allow PIV authentication

3.2.2.2.8 Integrating the Digital Signature and Encryption certificates into the IDMS in support of the NARA Initiative to digitally sign all documents using PIV Card signing certs

3.2.2.2.8.1 Create implementation plan for Internal NARA Certificate Authority (CA) for all users to sign all documents using PIV Card signing certs

3.2.2.2.9 Development, testing and release of new and existing Access Management Systems for HSPD-12 compliant access and Single Sign-On, to include adding redundancy, monitoring and the configuration of additional applications for authentication. It is expected that on average five applications will be added for authentication per year. Base year focus on Single Sign On (SSO) support and configuration assistance for NARA Applications (FISMA reportable) high value applications.

3.2.2.2.10 Provide support for technical mandatory two factor authentication to the network for all NARA users

3.3 Continuing refinement, contingency planning, and monitoring

3.3.1 Continue refinement of procedures to handle and support forgotten PIN, forgotten or lost PIV card, and resolution of revoked certificates

3.3.2 Provide Monitoring of the NARA PIV Environment to include NARA IAM systems and authentication directories. To include adding redundancy to the existing Sentinel system, addition of event sources from NARA IDM and NARA Active Directory servers and creation of additional reports as needed, it is expected that an average of five (5) reports will be added per year.

3.3.2.1 Provide automated solution to update of NARA IDM with last login event using a PIV credential as known to Sentinel to facilitate consolidated authentication reports

3.3.3 Provide Contingency Plan for backing up and restoring configurations of IDMS

3.3.3.1 Contingency Plan shall include creating backup procedures of IDMS drivers and restore activities

3.3.3.2 Implement Contingency Plan for backing up and restoring configurations of IDMS

3.3.3.3 Restore of IDMS configurations shall be performed at least once per quarter

3.4 Implementation of improved reporting from US Access, IDMS and the network in order to provide transparency to stakeholders and managers regarding the PIV-2 card enrollment status and PIV enablement process, FISMA metrics.

3.4.1 Provide web interface available to system owners to run pre-configured reports

3.4.2 Allow reporting to include information from all IDMS connected systems

3.4.3 Creation of new reports based on reporting needs, it is expected that an average of 5 new reports per year will be required

3.5 Creation of Implementation plan for Privileged User Management of NARA personnel with elevated access to all applications or NARA enterprise systems.

3.6 Creation of Implementation plan for Standard User Management of NARA personnel access to NARANet.

3.6.1 Implementation plan for Standard User Management of NARA personnel access to NARANet shall include the technical mandatory conversion of all NARA personnel.

3.7 Creation of Implementation plan for HSPD-12 compliant SSO enabled access to all infrastructure devices and all NARA applications

3.8 Creation of plan for the convergence of NARA Logical Access Control (LAC) Systems and Physical Access Control (PAC) systems. The plan will list all existing PAC systems and implementation plan for each.

3.9 System Support Tasks

The Contractor shall perform problem fault/diagnostic assistance and restoration of services on systems based on the Micro Focus and Microsoft products. Specific tasks shall include, but are not limited to:

3.9.1 Support for PIV enabled authentication for NARA infrastructure devices

3.9.2 Support for PIV enabled authentication to NARA applications, it is expected that as systems are added to the HSPD-12 SSO solution they will be supported by the Contractor. During the base year this will include approximately 5 high value NARA applications

3.9.3 Support for forced PIV Login using directory policies

3.9.4 Coordinating and managing requests for third party technical support for authentication needs based on IDMS managed credentials

3.9.4.1 Coordinating Managing and resolving trouble tickets submitted through Remedy in regard to PIV enabled authentication and IDMS connected systems

3.9.4.1.1 Contractor shall develop and maintain operational level agreements (OLAs) and service level agreements (SLAs) to ensure the following:

3.9.4.1.2 The OLAs and SLAs adequately address the customer’s needs and provide the required services and support in the most efficient and cost-effect manner possible

3.9.4.1.3 OLAs and SLAs are measured and monitored to include at a minimum,

Maintaining the service or system availabilities

Standard Services

3.9.5 Supporting other NARA system support staff in identifying problems, root cause analysis and implementation of problem resolutions, relating to Micro Focus Identity Management and Access Management Systems. Support tasks include expert knowledge in the troubleshooting of the following Micro Focus IDMS Drivers:

eDirectory driver, Active Directory Remote Loader driver, Java Database Connectivity(JDBC) driver, Loopback driver, Delimited Text driver, Micro Focus Google Driver.

3.9.6 Provide Tier 3(**) level of support of the Enterprise eDirectory, Active Directory, LDAP, PKI, and Sentinel SIEM systems

**Tier 3 is the top level support tier provided by the specialists who are involved in the product development. The issue at hand could be quite complex and they will collect as much data as possible from the bottom two tiers.

3.9.7 Provide Tier 2 and 3 level of support for PIV authentication deployment NARA wide

3.10 System Configuration Tasks

The Contractor shall configure systems as requested by Contracting Officer’s Representative (COR). The Contractor shall suggest a proper system configuration; changes will be approved through the NARA Request for Change (RFC) process. Specific tasks shall include, but are not limited to:

3.10.1 Configuring directory and identity services database schemas for NARA systems.

3.10.2 Configuring security controls for systems configured for authentication through the IDMS

3.10.3 Configuring identity management system policies and rules.

3.10.4 Configuring and executing automated tests leveraging the NARA automated test framework for IDMS driver integrations with connected systems

3.10.5 Configuring system redundancy and high availability for the Enterprise Password Self Service solution.

3.10.6 Design and configuration for key system components as defined in section 3.3 to facilitate: Disaster Recovery, Fault Tolerance, Load Balancing and Performance testing.

3.10.7 Assist in the design and architecture of the NARA LDAP authentication services.

3.10.8 Support security requirements, to include hardening and documentation, for initial Authority to Operate (ATO) and Continuous Authorization activities on all new or updated systems associated with Contractor efforts specifically outlined in section 3.2.

3.11 Design a Derived Credential (PIV-D) LACS solution for all of the NARA mobile devices.

3.11.1 Develop an end-to-end solution for issuing, managing, and authenticating with a Derived Credential for NARA mobile devices (Apple iOS and Android)

3.11.2 PIV-D enablement to NARA electronic mail Application

3.11.3 Mobile Device Management (MDM) Integration (Multiple MDMs)

3.11.4 Internal Certificate Authority (CA) Integration for PIV-D

3.11.5 PIV-D Request Service

3.12 NARA Public Access Security System (NARA-PASS)

The Contractor shall provide continued support and design activities for NARA-PASS: an account and authentication system for external restricted access to NARA data available in the DMZ. Specific tasks may include, but are not limited to:

3.12.1 Configure reporting interface.

3.12.2 Cluster the NARA-PASS servers for full redundancy with servers at both data centers, Archives II and ABL -- NARA’s Continuity of Operations (COOP) site

3.12.3 Facilitate the use of Security Assertion Markup Language (SAML) authentication to the Identity Provider (IDP) servers

3.12.4 Document system configuration of the NARA PASS System and each connected system.

3.12.5 Additional NARA-PASS tasks shall include:

3.12.5.1 NARA-PASS on going support Tier 2 and 3 support

3.12.5.1.1 NARA-PASS enable applications as requested by other NARA Application Areas

3.12.5.1.2 Provide Helpdesk support documentation.

3.12.5.1.3 Deploy Future software releases.

3.12.5.1.4 Provide System monitoring.

3.12.5.1.5 Provide testing for NARA-PASS enabled authentication

3.12.5.1.6 Add online help documentation.

3.12.5.1.7 Configure a generic NARA-PASS interface to allow deployment for future applications that take advantage of NARA-PASS.

3.12.5.1.8 Develop methodology and standards for incorporating new user registrations for applications.

3.12.5.1.9 Provide end user training documentation

3.12.5.1.10 Develop and assist with drivers to facilitate workflow processes to perform automated service request resolution.

4.0 TASK ORDER PROJECT MANAGEMENT

4.1 The Contractor shall be responsible for managing all aspects of the services required within each task order Performance Work Statement (PWS). Project management shall include the ability and resources to define, plan, implement, integrate, and monitor every aspect of the services. The Contractor’s Project Manager shall provide management and technical oversight in coordination with NARA’s COR and Project Manager to ensure that the project successfully achieves its objectives on time, within budget, and in accordance with expected quality levels.

4.2 The Contractor shall develop and deliver a Project Management Plan (PMP). The PMP shall describe the Contractor’s overall strategy and approach to managing the services provided under each task order. The PMP shall address the following:

4.2.1 Project management methodology;

4.2.2 Subcontractor management (if applicable);

4.2.3 Communications management;

4.2.4 Logistics;

4.2.5 System Configuration management;

4.2.6 Risk Management Plan (risk identification, mitigation, and management);

4.2.7 Configuration management;

4.2.8 System Operations and Maintenance support; and

4.2.9 Milestones, deliverables, and dependencies for the completion of the project.

4.3 The Contractor shall submit updates and changes to the PMP after its finalization, as appropriate, to reflect the project status.

4.4 The Contractor shall be required to submit project plans on an ad hoc basis, as new system integrations, modules, upgrades, or tasks related to this PWS are ordered.

4.5 The Contractor shall provide monthly status reports (due the 1st business day of each month) which, shall include the following:

4.5.1 Tasks accomplished within the previous month, progress towards completion of the scheduled tasks, and deliverables submitted;

4.5.2 Updated project schedule (must include original baseline dates, planned dates, and actual dates);

4.5.3 Planned activities for the current month and dependencies on completing those tasks;

4.5.4 Any problems, issues, or explanations of schedule slippages, in the previous month, to include recommendations on remediation of those issues, plan for recovery from the schedule slippage, and potential impact to the timely delivery of services within acceptable quality standards; and

4.5.5 Any projected or actual risks to successful completion of the project to include the remediation or mitigation of those risks, as they arise.

4.6 The Contractor shall provide management briefings on an ad hoc basis, if requested by the COR regarding the overall status of project.

5.0 TASK ORDER PROJECT MANAGEMENT

5.1 The Contractor shall be responsible for managing all aspects of the services required within the task order Performance Work Statement (PWS). Project management shall include the ability and resources to define, plan, implement, integrate, and monitor every aspect of the services. The Contractor’s Project Manager shall provide management and technical oversight in coordination with NARA’s COR and Project Manager to ensure that the project successfully achieves its objectives on time, within budget, and in accordance with expected quality levels.

5.2 The Contractor shall develop and deliver a Project Management Plan (PMP). The PMP shall describe the Contractor’s overall strategy and approach to managing the services provided under each task order. The PMP shall address the following:

5.2.1 Project management methodology;

5.2.2 Subcontractor management (if applicable);

5.2.3 Communications management;

5.2.4 Logistics;

5.2.5 System Configuration management;

5.2.6 Risk Management Plan (risk identification, mitigation, and management);

5.2.7 Configuration management;

5.2.8 System Operations and Maintenance support; and

5.2.9 Milestones, deliverables, and dependencies for the completion of the project.

5.3 The Contractor shall submit updates and changes to the PMP after its finalization, as appropriate, to reflect the project status.

5.4 The Contractor shall be required to submit project plans on an ad hoc basis, as new system integrations, modules, upgrades, or tasks related to this PWS are ordered.

5.5 The Contractor shall provide monthly status reports (due the 1st business day of each month) which, shall include the following:

5.5.1 Tasks accomplished within the previous month, progress towards completion of the scheduled tasks, and deliverables submitted;

5.5.2 Updated project schedule (must include original baseline dates, planned dates, and actual dates);

5.5.3 Planned activities for the current month and dependencies on completing those tasks;

5.5.4 Any problems, issues, or explanations of schedule slippages, in the previous month, to include recommendations on remediation of those issues, plan for recovery from the schedule slippage, and potential impact to the timely delivery of services within acceptable quality standards; and

5.5.5 Any projected or actual risks to successful completion of the project to include the remediation or mitigation of those risks, as they arise.

5.6 The Contractor shall provide management briefings on an ad hoc basis, if requested by the COR regarding the overall status of project.

6.0 DELIVERABLES

PWS

PARAGRAPH

7.0 PERSONNEL.

The personnel performing work on this project shall be qualified and maintain professional competence in their areas of specialization. Contractor personnel shall have proven expertise in performing the requested services. All Contractor personnel are required to complete and return to the COR PWS Attachment 2, Non-Disclosure Agreement, prior to performing work under this requirement.

7.1 Key Personnel. The following positions are considered essential to achieving the desired outcomes for the services required herein. The Contractor shall provide personnel to fulfill these positions who meet the minimum qualifications for each designated position.

7.1.1 Program Manager. The Program Manager shall be responsible for project management, quality control, and overall task order performance this task order. The Project Manager shall ensure adherence to program management reporting, integrated schedules, task order reporting requirements, and will serve as the Contractor’s primary point of contact. The qualifications required are:

7.1.1.1 Must have a minimum of seven (7) years of experience managing complex IT projects, which involved many dynamic, interacting, parts and coordinating all activities required to undertake these types of projects.

7.1.1.2 Must have a solid understanding of IT Systems and Software Development Lifecycle including, experience with HSPD-12, PIV, FICAM, and Identity Management as demonstrated by training and/or experience.