Request for Quote.pdf

Request for Quote

International Standards Organization – IT Systems

Interested vendors shall provide pricing for the table of services below. Firm fixed pricing is contemplated for this contract. Please include all fees and prices to handle the totality of the work listed in the Statement of Work in the following pages.

Item Period of Performance Price

Assessment / Recertification Activities 10/01/2022 – 09/30/2023

Surveillance Audit 10/01/2023 – 09/30/2024

Surveillance Audit 10/01/2024 – 09/30/2025

Assessment / Recertification Activities 10/01/2025 – 09/30/2026

Surveillance Audit 10/01/2026 – 09/30/2027

Other Associated Fees / Costs [As determined by vendor]

TOTAL

Statement of Work

ISO 20000-1 and 27001 Certification - DOJ JMD OCIO 20000-1 and 27001 Certification

UNITED STATES DEPARTMENT OF JUSTICE, JMD

SERVICE DELIVERY STAFF

June 2022

A. Mission Statement and Background

The Department of Justice (DOJ), Justice Management Division (JMD), Office of the CIO (OCIO) is an information-intensive organization. Consequently, OCIO’s dependence on information technology (IT), information systems, electronic communications, and digital media continues to grow rapidly and is essential to the mission of DOJ, program accomplishment, and service delivery.

The International Standards Organization (ISO) promotes globally recognized standards for various entities, including IT services. ISO/IEC 20000-1:2018 is the current IT Service Management System (SMS) standard. It specifies requirements for the service provider to plan, establish, implement, operate, monitor, review, maintain and improve an SMS. Requirements include the design, transition, delivery and improvement of services to fulfill agreed service requirements. ISO/IEC 20000-1:2018 provides a framework that helps establish an integrated approach to identify interlinked processes. Having an integrated approach among service management processes offers greater control, efficiency and provides continual improvement.

As a result, service providers are able to deliver managed services to clients and meet business requirements. ISO/IEC 20000-1:2018 provides IT service management processes that optimize services delivered within agreed resources levels and which best meet customer needs. The goals include:

• Ensure the fulfillment of service requirements agreed upon with service consumers

• All service providers use a consistent approach

• Service provider organizations demonstrate their capability and consistency in the design, development, transition, and delivery of services

• Service provider organizations require continuous service improvement

• Monitor, evaluate and review service management processes and services delivered by service providers

ISO/ISEC 27001:2013 is the current Information Security Management System (ISMS) standard.

It adopts a process-based approach for establishing, implementing, operating, monitoring, maintaining, and improving an ISMS. An ISMS includes the policies, procedures and systems involved in an organization’s information risk management processes. ISO/IEC 27001:2013 certification demonstrates that you have identified the risks, assessed the implications and put in place systemic controls to limit any damage to the organization. The goals include:

• Increase reliability and security of systems and information

• Reduce business risk

• Improve customer and stakeholder confidence

• Increase organizational resilience

• Evaluate risks to information security and establish appropriate controls

• Continually improve the Information Security Management System (ISMS)

The OCIO is seeking ISO 20000-1:2018 and 27001:2013 certification to ensure the highest quality of service for the OCIO’s customers, who are DOJ employees, private industry, citizens, federal agencies, foreign governments, state, local and tribal organizations, and non-government organizations. They require and expect exceptional services, ranging from mechanisms that enable real-time reporting of important alerts, to data storage, enterprise collaboration tools, and case management services that support criminal justice around the globe. The OCIO needs to evolve and enable innovative ways for DOJ components to share information and services. Critical to our success is a strong foundation of governance practices that promote transparency and efficiency

B. Objectives

To acquire services for the assessment/audit, certification, and recertification of the OCIO’s Service Management System (SMS) and Information Security Management System (ISMS), and to achieve certification and be registered as an ISO 20000-1:2018 and 27001:2013 certified organization.

C. Scope of Work

The Contractor, also referred to as the certification body or the registrar in this Statement of Work (SOW), will provide an integrated assessment, certification, and recertification of the OCIO’s SMS and ISMS, which covers the OCIO’s service management and information security management processes and OCIO offered services. These services include application services, cyber security, data center, enterprise services, and infrastructure services. OCIO’s Integrated Management System, which includes service management and information security management processes are delivered and managed from one location (2Con, Washington, DC).

The OCIO’s outsource providers include telecommunications companies, cloud providers, and other Federal data centers. Supporting Federal data centers are located in Sterling, VA;

Clarksburg, WV and Pocatello, ID. The OCIO serves DOJ employees, private industry and citizens, other federal agencies, foreign governments, state, local and tribal organizations, and non-government organizations. The registration Information is ISO/IEC 20000-1:2018 (IT Service Management) and ISO/IEC 27001:2013 (Information Security Management) and there are no exclusions from the standard. The Federal Acquisition Regulation (FAR) dictates the legal and regulatory information, used for this project. The total number of people working in the OCIO is 1,065 (154 government employees and 911 contractors). Approximately 1,056 work on first shift, five (5) people work on second shift, and four (4) people work on third shift.

All employees and contractors are full time and support all OCIO services and processes. The employee/contractor breakdown by shift is as follows:

2CON, Washington, DC (Total 154 Government Employees and 911 Contractors):

1st Shift: 154 FTEs and 902 Contractors 2nd Shift: 0 FTEs and 5 Contractors (Staff rotates with 1st shift) 3rd Shift: 0 FTEs and 4 Contractors (Staff rotates with 1st shift)

Technical Requirements:

The Contractor must be accredited by a member of the International Accreditation Forum (IAF) with a scope of membership that includes service management system and information security management certification. The Contractor’s proposal must include all of the service elements that ISO deems necessary to grant registration and certification to ISO 20000-1:2018 and 27001:2013. There are no exclusions being taken to ISO 20000-1:2018 or 27001:2013.

Assessment and certification of OCIO’s Integrated Management System, which includes service management and information security management processes shall be performed within the specified performance period(s) for the location at 2CON (Washington, DC).

Assessments/audits include performing the following:

Start up:

In general, the task start-up period is a time for the contractor to acquire qualified auditors, obtain the needed clearances, and provide the necessary plans to lead to success.

Kick-Off Meeting:

Within five (5) business days following award of contract, the contractor shall hold a kick-off meeting, as mutually agreed with the Government Task Manager (GTM). The purpose of the meeting is to ensure a complete understanding and agreement of the requirements by both the Government and the Contractor. Items to be covered in the meeting shall include, as a minimum:

• Introduction of key Contractor and Government personnel performing work under the various tasks in this contract.

• The Contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this contract.

• The Government will validate Government Furnished Equipment (GFE) and Government Furnished Information (GFI) to be provided by the DOJ and/or outgoing contractor(s).

Security Requirements:

Because the work conducted under this solicitation is an audit of processes and procedures of sanitized information, and because the work performed on-site (or virtually) will typically last no more than five (5) business days, there is no need for a background investigation under DOJ Order 1700.1, however, the OCIO Security Programs Manager (SPM), at his/her discretion, may require the contractors to submit to a criminal pre-employment fingerprint check and credit check to ensure trustworthiness and low risk to the government if the individuals are required to have access to DOJ space. Should a contractor representative be linked to a criminal conviction or severe arrears of financial obligations or public judgments, the auditor, at the decision of the government, may be prohibited from participating in the audit process and an alternate representative will need to be arranged.

At no time will contractor representatives be provided with classified or sensitive information.

Likewise, at no time are auditor representatives permitted to utilize DOJ systems (laptops, phones, etc.) or take screenshots or video content of the sanitized DOJ-content shared on the public side of the MS Teams (or similar) video conferencing software via their own systems.

Registration Audit and Surveillance Audits:

The registration audit is the initial audit that makes a certification determination. Once approved, the certificate is valid for three years. The government reserves the right to cancel at any time, and only pay for what is used. After successful registration audit, the registrar returns every year for surveillance audits to validate maintenance of the SMS and ISMS in accordance with their respective standards. Costs are typically dependent on the number of audit days required for the registration audit, number of people, number of locations, and travel costs for the auditors, administration fees, and accreditation fees. Application fees shall be waived.

There are two stages for the initial registration audit for ISO/IEC 20000-1:2018 and 27001:2013.

Stage One Assessment - The Contractor shall audit the OCIO’s Service Management System (SMS), and Information Security Management System (ISMS) using assessors appointed for this purpose. The Stage One assessment will be aimed at establishing OCIO’s readiness for the Stage Two audit by completing a document review and evaluating the level of implementation of the OCIO’s SMS and ISMS. The Stage One assessment/audit will start within three months after contract award date or an agreed upon date with the government.

Stage Two Assessment – The Contractor shall assess the OCIO’s conformance with the ISO/IEC 20000-1:2018 and 27001:2013 requirements using assessors appointed for this purpose. The OCIO has the right to raise an objection to the composition of the audit team.

The OCIO will provide access to those parts of the organization, premises and supporting documents covered by the proposed scope of registration, with the exception of classified documents. The OCIO will provide office accommodations for the duration of all assessments/audits. The OCIO GTM (or designee) will be present, or available, throughout all assessments/audits and attend the opening and closing meetings. The OCIO will have completed SMS and ISMS internal audits and management reviews prior to the Stage One assessment.

Certificate of Registration: Following acceptance of recommendation for registration, the registrar will forward a Certificate of Registration detailing the OCIO’s scope of registration, the date of registration, validity period and the certificate number. The certificate shall incorporate the appropriate accreditation mark. During the currency of its registration, the DOJ OCIO shall be entitled to advertise that fact and to use the registration or certification mark(s) as appropriate.

Periodic Surveillance/Special Visits/Short Notice Audits: The first surveillance visit shall take place within 12 months after the last day of the Stage Two assessment/audit. The second surveillance visit shall take place within 12 months after the last day of the first surveillance assessment/audit. Subsequent surveillance visits can be undertaken on an annual basis. All annual assessments shall be performed on-site at the OCIO’s facilities.

OCIO Complaints against the Registrar: The registrar will maintain a documented process for receiving, evaluating, and making decisions on the OCIO’s complaints. The complaints process shall include methods for recording, tracking, validating, investigating, and deciding what actions should be taken in response to the issue. The registrar shall acknowledge receipt of complaints and provide feedback to the complainant on progress and the final outcome.

Appeals: The OCIO may make representation to the Independent Certification Board (ICB) against any decision of the registrar to refuse to grant or withdraw registration.

Registrar Selection Criteria: The Contractor (1) must be accredited by a member of the International Accreditation Forum (IAF) with a scope of membership that includes service management system and information security management system certification; (2) must follow ISO/IEC 17021-1:2015, which are the ISO conformity standards used while conducting the assessment and certification; (3) must have IT experience; (4) must have the potential to also certify DOJ in ISO 14001, and 22301; and (5) must use auditors having the appropriate Standard Industrial Classification (SIC) code for assessing ISO/IEC 20000-1:2018 and 27001:2013.

Other Requirements: Prior to the audit, the Contractor will (1) present or provide access to all interpretations of the standards; (2) provide the OCIO with their assessment checklists, to allow the OCIO to conduct a self-assessment; (3) describe how major and minor non-conformances are determined; (4) provide the OCIO information on the areas of the standards in which they find the majority of non-conformances across industry and government; (5) provide bios of the lead and other auditors, i.e. education, experience, companies audited, and references; (6) describe their methodology to change auditors, when needed; (7) provide written examples of observations and non-conformances; and (8) allow the OCIO to approve the auditors that will be assessing the OCIO’s SMS and ISMS.

D. DELIVERABLES

The contractor must prepare written deliverables using a reporting medium agreed to by the Government Task Manager (GTM). All reports must be delivered to the GTM in digital formats, unless requested otherwise.

The Contractor shall be responsible for the deliverables listed below. The Contractor shall provide these deliverables to the GTM. Upon receipt and review, the GTM will provide feedback on necessary modifications or acceptance.

The Government may add or remove deliverables from this list as requirements and reporting needs change. All deliverables shall be provided in Microsoft Word, Excel, PowerPoint, Microsoft Project, or Visio, unless otherwise specified by the GTM.

The Contractor shall provide assessment/audit and registration services for ISO/IEC 20000- 1:2018 and 27001:2013 certifications as follows:

The Base year will include:

• OCIO’s Integrated Management System, which include ISO 20000-1:2018 and ISO

27001:2013 System Re-Certification Audit – Includes an on-site or remote integrated assessment to review and evaluate system documents and processes to determine if the OCIO’s Integrated Management System, which includes OCIO’s SMS and ISMS is maintained, improved, and ready for recertification, to include all findings and action plans.

• Registration – Written assessment report and decision document for issuance of ISO/IEC 20000-1:2018 and ISO/IEC 27001:2013 re-certification.

The first option year will include:

• The first Surveillance Audit of OCIO’s Integrated Management System, which entails an on-site or remote integrated assessment of critical components of the OCIO’s integrated SMS and ISMS against the ISO/IEC 20000-1:2018 and ISO/IEC 27001:2013 standards and written documents of identified findings.

The second option year will include:

• The second Surveillance Audit of OCIO’s Integrated Management System, which entails an on-site or remote integrated assessment of critical components of the OCIO’s integrated SMS and ISMS against the ISO/IEC 20000-1:2018 and ISO/IEC 27001:2013 standards and written documents of identified findings.

The third option year will include:

• OCIO’s Integrated Management System, which include ISO 20000-1:2018 and ISO 27001:2013 System Re-Certification Audit – Includes an on-site or remote integrated assessment to review and evaluate system documents and processes to determine if the OCIO’s Integrated Management System, which includes OCIO’s SMS and ISMS is maintained, improved, and ready for recertification, to include all findings and action plans.

• Registration – Written assessment report and decision document for issuance of ISO/IEC 20000-1:2018 and ISO/IEC 27001:2013 re-certification.

The fourth option year will include:

• The first Surveillance Audit of OCIO’s Integrated Management System, which entails an on-site or remote integrated assessment of critical components of the OCIO’s integrated SMS and ISMS against the ISO/IEC 20000-1:2018 and ISO/IEC 27001:2013 standards and written documents of identified findings.

Reporting Schedule:

A draft report of the audit findings, including any information security weaknesses, shall be presented to the government within 24 hours after the audit. To prevent potential exposure of any found information security vulnerabilities, OCIO reserves the right to discuss with the auditor how findings will be stated in the final written report. The final report will contain information at a level that would preclude an advantage to potential criminals or adversaries.

The final report will be due to the government within 30 days after the audit.

The Contractor shall provide registration services to include system re-certification and registration for ISO/IEC 20000-1:2018 (IT Service Management) and 27001:2013 (Information Security Management) within three months of a re-certification audit.

The Contractor will provide the official certification document, if earned within 30 days of the certification registration.

E. KEY PERSONNEL

The Contractor must provide the name and resume of the Lead Auditor and all accompanying auditors. The Lead Auditor must be present at each of the subsequent audits.

To maintain consistency, the same Lead Auditor must provide services at each audit. No substitutions of the Lead Auditor will be permitted unless such substitutions are approved by the Government or necessitated by an individual’s sudden illness, death or termination of employment. All requests for substitutions must provide a detailed explanation of the circumstances necessitating the proposed substitution, a resume for the proposed Lead

Auditor, and any other information requested by the GTM to aid in the process of approving the proposed substitute. Proposed substitutions shall have the same (or better) qualifications and experience as the personnel being replaced.

F. PERIOD OF PERFORMANCE

The term of the order will include a base period and four option periods as shown in the table below. The start date for the base period will be adjusted to reflect the actual order effective date.

Order Term

Base Period October 1, 2022 through September 30, 2023

Option Period 1 October 1, 2023 through September 30, 2024

Option Period 2 October 1, 2024 through September 30, 2025

Option Period 3 October 1, 2025 through September 30, 2026

Option Period 4 October 1, 2026 through September 30, 2027

This order may be extended, at the unilateral option of the Government, upon the same terms and conditions stated herein for a period of one (1) year or fractions thereof. To exercise the option to extend the period of performance, the CO will issue a written modification by the first day of each fiscal year or within thirty (30) calendar days after funds for that fiscal year become available. The Government will endeavor to provide a preliminary written notice of its intent to exercise the option; however, the lack of such a written notice will not in any way lessen the Government's unilateral right to extend the order pursuant to this clause. If such a preliminary notice is provided, it must not be construed as an exercise of the option nor will it bind the Government to exercise the option.

G. ACCEPTANCE CRITERIA

The Government will continuously evaluate the deliverables and work performed under the order and the extent to which the contractor meets the objectives and instructions detailed in the SOW. If, at any point, the Government does not believe that the quality of service is in line with the requirements, the Contracting Officer (CO) will notify the Contractor in writing. If the Government determines there is no improvement after the notification, the CO will require the removal of the appropriate personnel and replacement personnel must be provided without a break in service.

Quality Assurance and Quality Control

The Contractor shall ensure that all documented guidelines and operating procedures for quality assurance/control are followed for all areas of performance. The Contractor shall develop and implement additional quality assurance/control procedures as necessary to ensure all work performed is in accordance with standards prescribed in this contract for the duration of the contract, and the Contractor shall stress to its staff the importance of quality control and quality assurance. The services provided herein are determined to be commercial items.

Pursuant to Federal Acquisition Regulations, the contractor shall conduct its own quality assurance.

Within the specifications of the contract, the guidance of the ISO standards, the accreditation requirements, the guidance of procedures manuals, and the direction of the GTM or GTM designee, Contractor personnel shall perform all activities on their own initiative.

H. REPORTING REQUIREMENTS

The Contractor must coordinate work plans with the GTM, as required by the GTM. The Contractor must bring to the immediate attention of the GTM any specific issues or problems that may affect the delivery of requested products or completion of assigned tasks.

In a timely fashion, the Contractor must provide all reports stipulated in the SOW along with any other reports the Government deems necessary. Issues affecting the performance of the contractor under this SOW must be brought to the immediate attention of the GTM.

I. TRAVEL

All travel by Contractor personnel shall be covered in this firm fixed price contract and not billed separately.

J. GOVERNMENT-FURNISHED ITEMS OR INFORMATION

The Government reserves the right to supply the Contractor with government-furnished equipment (GFE), office facilities/space, office supplies, and materials, determined by the Contracting Officer and the Government Task Manager to be necessary and in the best interest of the Government in the performance of this order. Title to all property furnished by the Government shall vest in the Government. The Government retains the right to add, withdraw, or replace facilities, equipment, and information.

K. PLACE OF PERFORMANCE

The primary place of performance will be at the locations listed below, with the exception for work that is to be done by the Contractor at their remote locations, as required.

ISO/IEC 20000-1:2018 (IT Service Management) and 27001:2013 (Information Security Management) Department of Justice 145 N Street NW (2CON) Washington, DC 20530

L. GOVERNMENT TASK MANAGER (GTM)

The GTM for this order is:

Todd Mackert U.S. Department of Justice

JMD, OCIO, SDS

M. Observance of Legal Holidays/Federal Non-work Days

The Contractor must establish a standard holiday schedule that exactly coincides with the Government’s schedule for employees working on Government site for those employees that are not considered “essential” to 24/7 operations. For those personnel not considered essential, Holidays observed are listed below. Holidays and other non-work days are not billable unless work is requested by the Government and performed on these days. The following is a list of Government holidays:

New Year’s Day Martin Luther King Day Washington’s Birthday Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day Inauguration Day (every fourth year in Washington DC metro only)

N. SPECIAL PROVISIONS

Data and Property Rights

JMD shall retain all rights and privileges, including those of patent and copyrights to all Government furnished data. The Contractor shall neither retain nor reproduce for private or commercial use any information or other materials furnished or produced under this order. All property rights, including publication rights, in the information and materials produced by the Contractor in connection with this order shall belong to JMD.

The contractor shall not embed its company name or logos or claim copyright for any deliverable submitted under this contract. The Contractor agrees not to assert any rights at common law or in equity or establish any claim to statutory copyright in such data. These rights are not exclusive and are in addition to any other rights and remedies to which JMD is otherwise entitled elsewhere in this order.

Training of Contractor Employees

The contractor shall provide employees with the required core skills to perform their job duties.

Reimbursement for training shall not be authorized for replacement contractor employees.

Evaluation Criteria

The selection and final award decision will be made based on a determination by the Contracting Officer as to which quotation represents the “Best Value” to the Government.

“Best Value” means the expected outcome of an acquisition that, in the Government’s estimation, provides the greatest overall benefit in response to the requirement.

The “Best Value” determination will include evaluation of the following non-price factors in addition to price:

Factor I: General Technical Approach (more important than cost)

• Ability to demonstrate value added audits, versus simply compliance audits

• Ability to provide clear, useful, and accurate draft and final audit reports in a timely manner

• Ability to provide recognition/reporting where customer demonstrates industry best practices

• Ability to provide access to the registrar’s interpretation of the standard

• Ability to demonstrate a reasonable conflict resolution approach to resolve issues between the auditor and the customer

• Ability to demonstrate the registrar’s internal process for qualifying and training auditors, on-going evaluation, local availability, and accessibility

• Ability to provide competent technical services at registrar’s home office, accessible via telephone and/or email.

• Ability to provide any registrar unique prerequisites not required by the standard

• Ability to provide differentiators from other registrars for their technical approach

Factor 2: Qualifications of Proposed Staff (more important than cost)

• Ability to demonstrate that proposed auditors have an IT, Service Management System and/or Information Security Management background (provide the resumes of the Lead Auditor and the Audit Team)

• Ability to provide insight into the typical non-conformances received from past audits

• Ability to demonstrate audits focused on operational effectiveness and organizational success

• Ability to demonstrate a reputation for providing a high standard of expertise, support, and flexibility and to provide auditors willing to consider creative approaches to meeting requirements

• Ability to provide a Lead Auditor with seasoned management experience and is familiar with the realities of running a business or government agency

• Ability to provide differentiators from other registrars for providing qualified auditors and providing post certification recommendations/improvements

Factor 3: Corporate Past Performance (more important than cost)

• Ability to demonstrate performing as a successful registrar for other federal government agencies

• Ability to participate in customer’s certification award ceremony

• Must be accredited by a member of the International Accreditation Forum (IAF) with a scope of membership that includes management system certification, to provide assessment and registration services for the OCIO’s ISO 20000-1:2018 and 27001:2013 certification; identified as a signatory to the International Accreditation Forum (IAF);

follows Certification Body requirements of ISO/IEC 17021-1:2015

• Ability to provide certification audits for future potential engagements to include ISO 14001 and 22301

• Ability to demonstrate a reputation for prompt customer service and technical competency

• Ability to award the certificate in a timely manner after the audit is successfully completed

• Ability to provide differentiators from other registrars for corporate performance

Factor 4 Cost:

• Contractor shall provide firm fixed prices with breakdowns to allow the assessment of ALL costs, which include the off-site documentation review, pre-assessment audit, registration audit, accreditation fee, all surveillance audits over the three-year cycle, travel expenses, and any other applicable costs (e.g. application fees, administration fees, document assessment fees, etc.)