HSPD-12_CSA_RFP_-_Solicitation_QTA0016LYA1005_-_Amendment_9.docx

SECTION M – EVALUATION FACTORS FOR AWARD

U.S. General Services Administration

COMBINED SYNOPSIS – SOLICITATION

REQUEST FOR PROPOSAL (RFP)

SOLICITATION No. QTA0016LYA1005

TO ESTABLISH A CONTRACT

ISSUED BY

GENERAL SERVICES ADMINISTRATION

FEDERAL ACQUISITION SERVICE

OFFICE OF INTEGRATED TECHNOLOGY SERVICES

IN SUPPORT OF

HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-12 (HSPD-12)

MANAGED SERVICE OFFICE (MSO) – USACCESS PROGRAM

FOR

HSPD-12 CORE SERVICES

RFP RELEASE DATE

APRIL 20, 2016

AMENDMENT 9

NOTICE TO PROSPECTIVE OFFERORS

This is a combined synopsis/solicitation for commercial items and services prepared in accordance with the format in Federal Acquisition Regulation (FAR) Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued. The solicitation (QTA0016LYA1005) is being issued as a Request for Proposal. This notice and the incorporated provisions and clauses are those in effect through the FAR and General Services Administration Acquisition Manual (GSAM).

The North American Industry Classification System (NAICS) code is 518210 Data Processing, Hosting, and Related Services. Offerors must be registered in the ORCA/SAM electronic systems for the submission of Representations and Certifications www.SAM.gov.

Clauses in Section I of this RFP apply to this procurement. For the exact text and wording of clauses and provisions please see https://www.acquisition.gov/?q=browsefar and https://www.acquisition.gov/?q=browsegsam. The Government contemplates an award of a Firm Fixed-Price and Time & Material hybrid Contract for a 10 year Period of Performance (to include a 1year base period and 9 one-year option periods) resulting from this solicitation.

This Request for Proposal (RFP) is for Homeland Security Presidential Directive 12 (HSPD-12) Core Services, and is a competitive full and open acquisition. The objective of this procurement is to acquire a solution that will provide the U.S. General Services Administration (GSA) HSPD-12 MSO USAccess Program uninterrupted, Government-wide contractor managed services for identity and credential management services including: 1) applicant sponsorship, enrollment , biometric submission (for background investigation purposes); 2) credential issuance, maintenance (certificate rekey) and management and 3) Biographic & Agency Specific Sponsorship Record maintenance. The contractor shall provide services that minimize disruption to USAccess Customer Agencies and shall maintain the full life and functionality of currently existing, issued active PIV cards and credentials.

This requirement contains major changes in several areas, to include the service delivery model. Previous task orders have required the core services contractor to provide equipment for the Fixed Credentialing Sites only and required the Customer Agencies to purchase Light Solutions kits from the incumbent’s Schedule 70 contract. This RFP requires all equipment to be provided and maintained by the contractor as part of the service. Customer Agencies will not purchase equipment off of a Schedule contract, but it will be provided to them as part of the service. This RFP requires a technology refresh of credentialing equipment at designated points during the period of performance, to include the transition period if applicable.

All additional questions or requests for clarification should be e-mailed to the Contracting Officer (CO), Ms. Lisa Yimbo at lisa.yimbo@gsa.gov by 2:00 p.m. Eastern Daylight Time (EDT), June 06, 2016. Proposals must be submitted as instructed in Section L of this RFP by 2:00 p.m., EDT, - June 22, 2016.

B.1 GENERAL

The offeror shall perform the effort required by this Request for Proposal (RFP) on a Firm Fixed-Price (FFP) and Time & Material (T&M) hybrid basis for HSPD-12 Core Services Support to the GSA HSPD-12 MSO USAccess Program. The work shall be performed in accordance with the terms and conditions of this RFP and the resulting contract.

B.2 SUPPLIES/SERVICES AND PRICES/COSTS

The FFP Contract Line Item Numbers (CLINs) will be used for products and the basic operation of the system to include the operation, maintenance, and routine tasks associated with the system and infrastructure.

The T&M CLIN (CLIN 0005) will allow for enhancements, customizations, and various system alterations that are not currently known, and cannot with any degree of certainty, be defined or estimated at the time of award. Since this is an operational system in a dynamic environment, the T&M CLIN provides a way to modify the system and allow it to grow. Offerors should list all proposed labor categories and applicable rates that might be utilized in the performance of this CLIN.

Note: Offerors shall complete the pricing scenario in accordance with Attachment U. The pricing scenario will be used for the purpose of standard evaluation, and is NOT a guarantee of any volume. It is based on the MSO’s estimate of future requirements, and is only a tool for evaluation to determine total evaluated price. For each year of proposed performance, offerors shall use Attachment U provide a breakdown of equipment costs, labor categories and description, and labor hours allocated by CLIN.

The contractor shall perform tasks under this contract in contractor facilities located within the Continental United States (CONUS), and among the USAccess distributed credentialing infrastructure within CONUS and US territories. The Contracting Officer’s Representative (COR) may approve the performance of work at remote locations. Primary staff and key personnel shall be located in the Washington, DC area for regular program reviews. Other contractor personnel shall be available for Washington, DC area meetings either in person or by conference call.

Test PIV cards, not to exceed 100 cards per year.

Per card

0011A

RESERVED

B.3 TRAVEL

Any travel required for the performance of this Contract shall be in accordance with the Federal Travel Regulations. The Government will not pay for local travel within the DC metropolitan area. The government expects that non-local travel incident to the installation and repair of provided systems and infrastructure will be reimbursed without prior government approval. Other long distance travel such as conference or periodic security assessments may be required on an as-needed basis and shall be reimbursed in accordance with the FAR 31.205-46 (Travel Cost). In those cases, the Contractor shall request the Contracting Officer’s (CO) approval 10 days prior to travel. Travel expenses shall be reimbursed as an Other Direct Cost (ODC) included in the offeror’s program cost. The Government will not pay overhead G&A or profit for travel.

Travel shall be scheduled during normal duty hours whenever possible. Airfare shall be reimbursed for actual common carrier fares, which are obtained by the most reasonable and economical means. When required, the most dependable means of ground transportation (i.e., taxi, bus, train, car rental) shall be used.

The NTE amounts in the table below shall be used to provide travel funding.

TRAVEL

SECTION B – SERVICES AND PRICE/COSTS

SOLICITATION # QTA0016LYA1005 PAGE B-1

C.1 OVERVIEW

The General Services Administration (GSA) provides an end-to-end Personal Identity Verification (PIV) Credential issuance and PIV Credential maintenance solution to the federal Government via its Homeland Security Presidential Directive 12 (HSPD-12) Managed Service Office (MSO), also known as the USAccess program. Since inception in 2007, the program has issued approximately 1.2 million PIV cards and there are approximately 600,000 active cards across 105 customer agencies. Services offered with the USAccess solution are FIPS 201-2 compliant and include mechanisms to allow customer agencies to sponsor, enroll, and adjudicate applicants and issue PIV cards to federal employees and contractors. The MSO provides centralized billing, program, and system infrastructure management as well as technical expertise, allowing customer agencies to be a part of the enterprise and benefit from the inherent economies of scale.

C.2 BACKGROUND

The MSO’s current contract, awarded to Hewlett Packard Enterprise Services (HPES) in 2012, contains options that allow for extension to March 31, 2017. The current contract covers the operation, maintenance and enhancements of the USAccess system (Identity Management System [IDMS], Credential Management System [CMS]), the related interfaces, enrollment, activation and issuance infrastructure, and customer support. The Core Services competitive acquisition will include all of these components as well as additional requirements, as described in detail in this Performance Work Statement (PWS).

The contractor shall provide all hardware, software and interfaces necessary to operate, maintain and enhance the system throughout the period of performance, as described in this PWS. The system is required to obtain and maintain a GSA Authority to Operate (ATO) at Federal Information Processing Standard (FIPS) 199 Security Categorization of HIGH or Federal Risk and Authorization Management Program (FedRAMP) HIGH (when available).

The MSO separated the current business functions into core and non-core services. The incumbent supports the core services, while vendors under separate contracts provide the non-core services. The expectation is that this will continue with the new award.

Current core services include:

1. IDMS

2. CMS

3. System Infrastructure Provider (SIP) Support/Mechanism

4. Help Desk

5. Credentialing Infrastructure

6. Registrar Training Current non-core services include:

1. Certificate Authority (CA) services provided by Entrust

2. Card Personalization (Electronic and Graphical) provided by XTec

3. Card Printing provided by XTec

4. Cardstock provided by XTec

5. Role holder refresher training provided by MSO Detailed descriptions of each component are included in this PWS and include, but are not limited to, solutions for PIV, PIV-Interoperable (PIV-I), Derived PIV and Temporary smart cards with physical and logical access capabilities.

The paramount consideration for this acquisition is the continuity of service to customer agencies’ cardholders and agency system operators. GSA’s success as a service provider to the Government depends heavily on an environment of continuous improvement. The new solution will need to interface with the card personalization and card printing solutions vendor, as well as multiple CA vendors for the supply of Public Key Infrastructure (PKI) certificates for PIV cards, PIV-I cards and Derived PIV credentials. Descriptions of these interfaces are in section C.5.2.5 of this PWS. This solution is in use across the federal workspace.

C.3 OBJECTIVE

The objective of this PWS is to acquire a solution that will provide the GSA HSPD-12 MSO USAccess Program uninterrupted, Government-wide contractor managed services for identity and credential management services including: 1) applicant sponsorship, enrollment, biometric submission (for background investigation purposes); 2) credential issuance, maintenance (certificate rekey) and management and 3) Biographic & Agency Specific Sponsorship Record maintenance. The contractor shall provide a solution that minimizes disruption to USAccess Customer Agencies and shall maintain the full life and functionality of the currently existing, 600,000 issued active PIV cards and credentials during and after the transition process. The As-Is documentation (Attachment B) details the baseline processes and functionality of the program.

C.4 SCOPE

The Government requires the successful offeror to provide an end-to-end identity and credential management solution for the requirements described in this PWS. The contractor shall provide support for, and development of, future innovations in the area of identity and credential management throughout the period of performance. Innovative changes to the system will follow the standard configuration management process where financial impact is determined and approved prior to the implementation of changes. All work that the contractor completes at the request and payment of the Government becomes property of the Government, and the contractor shall transfer it to the Government at the end of the period of performance. The contractor shall work in conjunction with the card personalization, card printing, and PKI CA vendors to ensure a fully operational solution that provides for continuity of service to credential holders and agencies, supporting the federal workspace.

C.5 SPECIFIC REQUIREMENTS

C.5.1 Contractor Management and Personnel Requirements C.5.1.1 Management Requirements The Contractor shall meet the following management and personnel requirements, at a minimum.

C.5.1.1.1 Participate in a contract kickoff meeting with the CO, COR, GSA MSO Director and staff within five business days after award or as directed by the CO. This meeting will serve as a forum for vendor questions and clarification regarding the award. The MSO and the contractor will schedule and discuss program-specific items at a separate program kick-off.

a. Deliverables:

i. Draft Project Management Institute (PMI) Project Management Body of Knowledge (PMBOK), or equivalent, compliant, Project Management Plan (PMP). The contractor shall maintain the PMP to indicate deadlines, status and key personnel throughout the life of the contract. The contractor shall deliver the PMP to the MSO for review when system changes occur, or at least on an annual basis. The contractor shall describe in detail their approach to risk management and how they plan to limit GSA’s loss in the event of a system breach. All offerors shall provide the Draft PMP as part of the Technical Proposal. The contractor shall base the final version of the PMP on GSA feedback to the draft.

ii.

iii. Kickoff Meeting Minutes delivered to the MSO within 2 business days after contract and program kickoff meetings and shall record the attendees, discussions, action items and significant events and decisions.

C.5.1.1.2 Provide the MSO regular status and program updates. The contractor shall conduct the Monthly Program Reviews in person with teleconference and webinar available for attendees not able to be onsite. The Monthly Program Review shall cover, but not be limited to, current and upcoming tasks and activities, updates from key personnel or their program area, issue tracking through to resolution, Service Level Agreement (SLA)/Performance Measure statistics, and major development efforts that require discussion.

b. Deliverables:

i. Weekly Status Report that describes the tasks and activities that occurred in each of the program areas, issue tracking through to resolution, planned tasks and activities for the following week and progress towards milestones. The contractor shall deliver this electronically in Microsoft Word or PowerPoint format.

ii. Monthly Program Review documents presented during the meetings. The MSO currently receives these as Microsoft PowerPoint slides.

C.5.1.1.3 Participate in ad-hoc meetings with GSA in person or via teleconference/webinar. These meetings include, but are not limited to the following topics: requirements discussions, project status, upcoming development efforts, program strategy and program staffing. Meetings also include monthly meetings with larger MSO Customer Agencies, monthly meetings with the technical USAccess User Group, semi-monthly meetings of the technical USAccess Working Groups (ex., Derived PIV).

c. Deliverables

i. The contractor shall send all documentation presented during meetings to the MSO electronically.

ii. Meeting notes that include, but are not limited to, meeting attendees, the items discussed, decisions made and any other relevant information. The Government will inform the contractor when meeting notes are required as meeting are scheduled.

C.5.1.1.4 Technical troubleshooting for core or non-core outages.

d. Deliverables:

i. Root Cause Analysis (RCA) for core services outages to include, but not be limited to, a description of the issue, what caused the issue, steps taken to correct the issue, description of resolution, length of outage, parties involved in resolution and preventative measures to be used going forward.

ii. Summary of troubleshooting and actions taken when the outage is caused by a service not part of this procurement.

C.5.1.1.5 Provide a release schedule at the start of the base period and each option period. The release schedule shall set the timeframe for change request identification, requirements gathering, development, testing, flaw remediation, system and program documentation updates, and deployment, at a minimum, and allow the MSO and its Customer Agencies to plan ahead of time for updates to the system. The contractor shall work with the MSO to prioritize and gain approval for the change requests included in each release. The contractor shall discuss and gain prior MSO approval for any changes to the release schedule.

C.5.1.2 Key Personnel and Program Staffing The contractor shall notify and obtain approval from the COR and the GSA MSO Director of any replacements of key personnel prior to replacement. Security clearance and citizenship requirements must be compliant with Federal policy. In the event of key personnel departures, the contractor shall ensure that any replacements meet or exceed the qualifications and experience as required in this contract. The contractor shall propose any other key personnel categories that they deem necessary to the successful operation of their solution. The contractor shall describe how they plan to utilize key personnel on a fully dedicated or as-needed basis. If leveraging key personnel on a less than fully dedicated basis, the contractor shall detail how the availability of these key personnel will affect the USAccess program. The following are examples of key personnel that may be used on this contract.

C.5.1.2.1 The Program Manager (PM), or comparable labor category, shall be responsible for managing the performance of the work as defined by the Government. The PM shall be the contractor’s authorized representative for performance of all services required within this PWS, and shall perform as a consultant in highly specialized, leading edge information technologies and methodologies. The PM shall be the first point of contact for contractual or administrative questions or difficulties that arise related to the execution of this PWS. The PM shall be the primary point through which communications, work assignments, and technical direction flow between GSA and the contractor. The PM is responsible for ensuring that the project delivers to Government expectations on time and to budget. In addition, the PM shall be a certified Project Management Professional through PMI, or equivalent, and shall have an extensive working knowledge of PIV, Derived PIV and PIV-I issuance systems, and IT project management.

C.5.1.2.2 The Technical Lead/Subject Matter Expert (SME), or comparable labor category, shall be responsible for the oversight of technical components of the work. The Technical Lead/SME shall provide highly specialized guidance concerning automated solutions and complex information processing problems. The Technical Lead/SME shall be the second point of contact, after the PM, for technical questions or issues that arise related to this PWS. The Technical Lead/SME shall have significant accomplishment as an expert in large integrated systems with varied Information Technology (IT) architectures and platforms in an integrated environment, and have expert working knowledge of PIV, Derived PIV and PIV-I issuance systems.

C.5.1.2.3 The Security Lead/SME, or comparable labor category, shall oversee…