RFI-24-Service Managemnet Platform Draft SOO.pdf

United States Service Management Platform (SMP) License and Services Contract Patent and Trademark Office Statement of Objectives

Form # USPTO-OP-021 (08/2020) Page 1 of 64

Requirement Title:

ServiceNow Service Management Platform (SMP) Management Support Contract

1. Background

The United State Patent Trade Office (USPTO) is a federal agency comprised of approximately 13,000 federal employees and 3500 contractor employees. The mission of the USPTO is to administer the laws and regulations related to patents and trademarks in order to promote industrial and technical progress in the United States and strengthen the national economy. The USPTO carries out its mission by examining patent and trademark applications; issuing patents and registering trademarks; disseminating patent and trademark information to the public and by encouraging a domestic and international climate in which intellectual property can flourish.

USPTO is the federal agency for granting U.S. patents and registering trademarks. In doing this, the USPTO fulfills the mandate of Article I, Section 8, Clause 8, of the Constitution that the legislative branch "promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries." The USPTO registers trademarks based on the commerce clause of the Constitution (Article I, Section 8, Clause 3). Under this system of protection, American industry has flourished. New products have been invented, new uses for old ones discovered, and employment opportunities created for millions of Americans. The strength and vitality of the U.S. economy depends directly on effective mechanisms that protect new ideas and investments in innovation and creativity. The continued demand for patents and trademarks underscores the ingenuity of American inventors and entrepreneurs. The USPTO is at the cutting edge of the nation's technological progress and achievement.

The USPTO is committed to the following approaches to facilitate the delivery of the IT Product Delivery goals:

• Agile. To support development activities and meet target goals, USPTO uses agile methodologies, and new Agile ways of working. USPTO is embedding all key roles to either be physically or virtually co-located agile product teams to improve communication and interactions to deliver working software more frequently. This co-location embeds all needed skills on the team, and often in the form of cross-skilled individuals that have expertise in multiple areas and the ability to collaborate across disciplines and with experts in other areas. This co-location construct, in addition to vertically groomed backlogs and smaller user stories, clear understanding of product goals, and support by a dedicated product owner, improves the team’s ability to increase flow of high-quality, high-value software to the production environment.

• DevSecOps. (Development Security Operations) USPTO understands that to accelerate delivery of business value and foster innovation, a move to DevSecOps is needed. DevSecOps is an organizational software engineering culture and practice that aims at unifying software development (Dev), security (Sec) and support/operations (Ops). The main differentiation of DevSecOps as opposed to DevOps is that the former introduces security at all phases of the software lifecycle: scope, estimate, plan, design, develop, test, integrate, release, deliver/deploy, maintain, operate, and monitor. DevSecOps principles highlight the need to detail business process and security requirements upfront and at every release in the form of epics and user

Form # USPTO-OP-021 (08/2020) Page 2 of 64 stories, to successfully achieve continuous integration and continuous delivery and progress to continuous integration and continuous deployment (CI/CD pipeline) in the future, as well as provide continuous monitoring and instrumentation/measurement of working software to the customer. A successful DevSecOps strategy encompasses working with all stakeholders involved in planning, designing, developing, testing, securing, integrating, deploying, continually monitoring, and improving the product. In a DevSecOps environment, Agile teams must adhere to all required escalation and release promotion processes. This move allows for continuous integration with proper governance and approvals, sufficient testing to meet USPTO’s quality standards, and a strict process for promotion of new features and defect fixes into production. In addition, USPTO is driving a comprehensive architectural move to micro-services that shrinks the size of deployments, de-conflict code, and makes the process more manageable for the team.

Security is embedded in all development work and IT security is everyone’s responsibility.

• New Ways of Working (NWOW): The USPTO has recommitted to agile principles and practices for IT delivery. The USPTO’s focus is on empowered resources who can research, assess, and make decisions on how to advance from concept to delivery. USPTO executives engage to set a high-level strategy and communicate priorities; however, a majority of the decision-making occurs at the working level. Teams, led by federal product owners based in the business area where value is ultimately delivered, are encouraged to fail small, learn, and quickly pivot. The new ways of working aim to drive collective purpose, efficiency, and faster time-to-delivery.

Within the USPTO, the Office of the Chief Information Officer (OCIO) delivers information and technology to enable innovation, and their services are critical to USPTO’s ability to achieve its mission, goals, and objectives. OCIO develops and maintains the information systems that provide the public services related to intellectual property, promote investment in innovation, and foster the entrepreneurial spirit.

The USPTO End User Services Office (EUSO) resides within OCIO and is the touchstone of customer service in delivering quality information products and services across the USPTO. Our work spans across the IT spectrum; from end user support of everyday tools strengthening collaboration to the video conferencing and webcasting services that have become increasingly vital during our remote work environment.

Additionally, in our ongoing effort toward transparency, we work diligently to ensure timely dissemination of USPTO records to the public and other key stakeholders. EUSO supports and contributes toward the ongoing OCIO goal of IT Stabilization and modernization efforts to maximize technology and deliver quality products. Finally, we develop ongoing communications to keep our stakeholders informed.

The vision for the USPTO’s Service Management Platform is to provide and integrate capabilities which enable the USPTO enterprise operate more efficiently by:

Empowering product teams and other offices to create and manage new services Improving management and collaboration within work environment to resolve issues more quickly Providing users direct access to self-service and other available resources, solve IT issues, obtain relevant and current information, and improve customer experience Automating of workflows and tasks to support quicker fulfilment and resolution of incident and requests Promoting and improving content of shared data, information and knowledge to support processes and support decision making

Form # USPTO-OP-021 (08/2020) Page 3 of 64

Increasing visibility of IT environment and consolidating disparate sources to streamline control and accounting of systems, applications and services both on premise and within cloud environments

Minimizing risk and costs to changes within USPTO environment

The vision for the USPTO’s Cybersecurity Program is to provide and integrate state-of-the-art cybersecurity services to enable USPTO secure business operations, to include:

Empowering product development teams by providing easily available, actionable data needed to identify and remediate vulnerability and compliance deficiencies

Ensuring the continued safeguarding of personally identifiable information (PII), business identifiable information (BII), and Privacy Act information in accordance with the Privacy Act of 1974, the E-Government Act of 2002, Federal Information Security Modernization Act (FISMA) of 2014, and policy and guidance issued by the President and Office of Management and Budget

(OMB)

Automating security and privacy control assessments to improve time to obtain an authority to operate (ATO)

Automating continuous monitoring of system and programs Improving vulnerability and compliance scanning frequency, analysis, and reporting Improving cybersecurity monitoring through threat intelligence capabilities Zero trust architecture approach to on-premise and cloud environments Orchestration of multi-cloud cybersecurity monitoring, compliance, and incident response capabilities

2. Purpose

The Service Desk Operations Division (SDOD) is managed under the EUSO, and is responsible for management of the OCIO Service Desk, oversees Incident Management Processes, Advanced Problem Resolution, Account Services, Transition Support, and portions of Problem Management as it seeks to address major incidents. SDOD develops and maintains knowledge related contents such as technical and support documentation, and maintains the ServiceNow Service Management Platform (SMP), currently used to support IT Service Management (ITSM) Pro, IT Operations Management (ITOM) Pro, the Now Platform, and associated capabilities therein.

ServiceNow SMP is supported using three instances: Development, Test and Production. Current capability currently hosts over 400 Service Catalog requests, nearly 30 Change Management Templates, and platform adoption has resulted in increased demand for service catalog items, integrations with other sources to automate workflows and deprecation of disparate sources and methods to create incidents and fulfill requests. With continued maturity of ITOM Discovery and associated modules, demand of other capabilities shall also increase to further enhance existing ITSM processes within USPTO.

The Enterprise Architecture (EA) Division is managed under the Information Technology Transformation Office (ITTO), which resides in the Office of the Chief Information Officer (OCIO). EAD manages the USPTO Enterprise Architecture (EA) Program and is responsible for defining and maintaining the EA, for providing governance and oversight of IT investments and IT projects, and for ensuring compliance with the Federal Enterprise Architecture (FEA) program. The Division creates and maintains EA architectures

Form # USPTO-OP-021 (08/2020) Page 4 of 64 and artifacts; maintains EA data and models; and ensures that the EA data is available to support decision making.

The Office of The Chief Information Security Officer (OCISO) is responsible for all aspects of Information Technology (IT) security and serves a pivotal role in protecting USPTO information systems from unauthorized access, use, disclosure, disruption, modification, and destruction.

The Security Operations Center (SOC) serves as a single point of management and reporting for information security incidents for USPTO, and is responsible for overall security of USPTO Enterprise-wide information systems, and collects, investigates and reports any suspected and confirmed security violations.

The Cybersecurity Authorizations and Compliance Branch (CACB) serves and supports the USPTO, and is responsible for the implementation and oversight of NIST Risk Management Framework (RMF) at the USPTO and is responsible for the implementation and oversight of NIST Risk Management Framework (RMF) at the USPTO, following National Institute of Standards and Technology (NIST) Special Publication

(SP) 800-37.

The OCIO, CD, Privacy and Continuous Monitoring Branch (PCMB) is responsible for supporting and maintaining the USPTO Privacy Program, to include performing privacy threshold analyses, privacy impact assessments, privacy policy development, privacy compliance reviews, reviews of System of Records Notices (SORNs), and maintains a comprehensive privacy program for USPTO. The PCMB ensures compliance with the Privacy Act of 1974, the E-Government Act of 2002, Federal Information Security Modernization Act (FISMA) of 2014, and policy and guidance issued by the President and Office of Management and Budget (OMB). The PCMB also performs continuous monitoring for system changes, vulnerability and compliance scanning, security impact analysis reviews, to include related assessment activities, and penetration testing. The branch also provides acquisition document reviews, FISMA compliance oversight and reporting, cybersecurity policy development, cybersecurity related audit coordination, Contractor system cybersecurity oversight and compliance monitoring, and cybersecurity awareness training.

The Office of Human Resources (OHR) provides the leadership, policies, programs, services and systems necessary to meet the human resources needs of the United States Patent and Trademark Office workforce. This includes designing innovative and effective strategies and policies that for a broad range of initiatives relating to strategic human capital planning, recruitment and employment; administration of pay, leave, benefits, and hours of work; administration of payroll support and time-and-attendance controls; employee recognition and performance management; employee relations and assistance services; labor management relations; and workers’ compensation.

The Office of Administrative Services (OAS) is responsible for administrating a broad range of administrative and employee support service programs responsive to the needs of the USPTO workforce.

These programs include:

Space and lease management Facilities engineering/management services Space planning and design services, including building renovations

Security services Safeguarding of classified/sensitive documents and information USPTO’s Occupant Emergency and

Continuity of Operations Plans

Form # USPTO-OP-021 (08/2020) Page 5 of 64

Safety and occupational health services Reproduction, publishing, and photocopier management Forms and office supplies management Cafeteria and food services Office moves and labor services Mail services

Vehicle parking for employees Motor pool, chauffeur, shuttle, and messenger services Energy management Personal property management Repository management of all patent and trademark files

The purpose of this Statement of Objectives (SOO) is to:

Procure the sustainment subscription licenses required for ServiceNow IT Service Management Professional, IT Operations Management Professional, modules and other connectors to include:

Product License Months Base Year Qty

Option Year 1 Qty

Option Year 2 Qty

Option Year 3 Qty

Option Year 4 Qty

ServiceNow Production Instance 12 1 1 1 1 1 ServiceNow Production Test Instance 12 1 1 1 1 1 ServiceNow Production Development Instance 12 1 1 1 1 1 ServiceNow Sandbox Instance 12 1 1 1 1 1 ServiceNow ITSM Professional Licenses-Fulfiller 12 1200 1200 1200 1200 1200 ServiceNow ITSM Professional Licenses-Business Stakeholder

12 450 450 450 450 450

ServiceNow ITOM Professional Licenses 12 12000 12000 12000 12000 12000 ServiceNow Impact Advanced 12 1 1 1 1 1

(OPTIONAL) ServiceNow ITSM Enterprise Licenses- Fulfiller

12 1200 1200 1200 1200 1200

(OPTIONAL) ServiceNow ITOM Enterprise Licenses- Business Stakeholder

12 450 450 450 450 450

(OPTIONAL) ServiceNow ITOM AI Ops Enterprise Licenses 12 12000 12000 12000 12000 12000 (OPTIONAL) ServiceNow Power BI Connector 12 TBD (OPTIONAL) ServiceNow ITOM Event Management 12 TBD (OPTIONAL) ServiceNow ITOM Predictive AI Ops 12 TBD

(OPTIONAL) ServiceNow ITOM Intelligent CMDB Search 12 TBD (OPTIONAL) ServiceNow ITAM Software Asset Management (SAM) Professional Licenses

12 15000 15000 15000 15000 15000

(OPTIONAL) ServiceNow ITAM Hardware Asset Management (HAM) Professional Licenses

12 7000 7000 7000 7000 7000

(OPTIONAL) ServiceNow HR Service Delivery (HRSD) 12 TBD (OPTIONAL) ServiceNow Enterprise Asset Management 12 TBD (OPTIONAL) ServiceNow Security Incident (SIR) Response Professional

12 16,000 – 19,000

16,000 – 19,000

16,000 – 19,000

16,000 – 19,000

16,000 – 19,000

(OPTIONAL) ServiceNow Vulnerability Response (VR) Enterprise

12 55,000 – 70,000

55,000 – 70,000

55,000 – 70,000

55,000 – 70,000

55,000 – 70,000

(OPTIONAL) ServiceNow Integrated Risk Management (IRM) Operator

12 400 - 450 400 - 450 400 - 450 400 - 450 400 - 450

(OPTIONAL) ServiceNow Privacy Operator 12 400 - 450 400 - 450 400 - 450 400 - 450 400 - 450 (OPTIONAL) ServiceNow Training Credits 110,000 88,000 88,000 88,000 88,000 88,000

Commented [YG1]: Possibly a new contract

Form # USPTO-OP-021 (08/2020) Page 6 of 64

Procure professional services and support to operate, configure, integrate, test, implement and maintain SMP ServiceNow Platform. Provide both architectural and senior level support to other development teams, supporting growth in the platform by providing expertise to assist USPTO in seeking opportunities to expand platform use at the agency.

Procure professional services and support to operate, configure, integrate, test, implement and maintain SMP ServiceNow IT Service Management Professional (ITSM Pro), associated modules and capabilities. Support the maintenance and continued enhancement of the ITSM module within ServiceNow, working across multiple business areas for enhancements and new development of the modules withing ITSM.

Procure professional services and support to operate, configure, integrate, test, implement and maintain SMP IT Operations Management Professional (ITOM Pro), associated modules and capabilities. Support continued enhancement of the ITOM functionality including maintenance and enhancement of the CMDB.

Procure professional services to create, update and deliver training materials and knowledge related resources for access and use by USPTO personnel for enhancements, upgrades, and new features contained within SMP ITSM Pro, ITOM Pro, and associated modules and/or capabilities.

Procure professional services and support for technical governance, ensuring proper stability and management of SMP, associated modules, capabilities and integrations. This includes establishing standards and policies regarding the environment, data, platform and development management.

Procure professional services for technical writing to create, revise and publish technical documentation to associated with SMP system architecture, operational support plans, testing, and other technical areas.

(OPTIONAL) Procure professional services to support the upgrade, delivery, integration maintenance and continued enhancement of ITSM Enterprise modules and associated capabilities.

(OPTIONAL) Procure professional services to support the upgrade, delivery, integration maintenance and continued enhancement of ITOM AI Ops Enterprise modules and associated capabilities.

(OPTIONAL) Procure professional services to support the delivery, integration, maintenance of ServiceNow Power BI Connector to support retrieval and reporting based on data and information within ServiceNow SMP tables.

(OPTIONAL) Procure professional services to support the delivery, integration, maintenance and continued enhancement of the Hardware Asset Management (HAM) functionality including integration with ITOM and CMDB.

(OPTIONAL) Procure professional services to support the delivery, integration, maintenance and continued enhancement of the Software Asset Management (SAM), SaaS License Management and Content Library functionality including integration with ITOM and CMDB.

(OPTIONAL) Procure professional services and support to operate, configure, integrate, test, implement and maintain ITOM Event Management, and associated modules/capabilities.

(OPTIONAL) Procure professional services and support to operate, configure, integrate, test, implement and maintain ITOM Predictive AI Ops, and associated modules/capabilities.

(OPTIONAL) Procure professional services and support to operate, configure, integrate, test, implement and maintain ITOM Intelligent CMDB Search and associated modules/capabilities.

(OPTIONAL) Procure professional services and support to provide ServiceNow Impact Advanced feedback and assistance to ServiceNow engineers to administer, improve and help troubleshoot technical issues with SMP.

Form # USPTO-OP-021 (08/2020) Page 7 of 64

(OPTIONAL) Procure professional services and support to operate, configure, integrate, test, implement and maintain ServiceNow Workplace Service Delivery, and associated modules/capabilities.

(OPTIONAL) Procure professional services and support to operate, configure, integrate, test, implement and maintain ServiceNow Human Resources Service Delivery, and associated modules/capabilities.

(OPTIONAL) Procure professional services and support to operate, configure, integrate, test, implement and maintain ServiceNow Enterprise Asset Management, and associated modules/capabilities.

(OPTIONAL) Procure professional services and support to operate, configure, integrate, test, implement and maintain ServiceNow IRM and SecOps applications, and associated modules/capabilities.

(OPTIONAL) Procure the professional services and support to, based upon ServiceNow Platform best practices, enable the USPTO to implement effective privacy management processes across the enterprise, ensure the USPTO comes into compliance with evolving privacy requirements, support privacy best practices, unify and scale privacy data governance, assist in staying on top of risk and compliance and enable the USPTO to effectively build trust in the agency through data protection across the enterprise.

(OPTIONAL) Procure the professional services and support to, based upon ServiceNow Platform best practices, enable USPTO to align compliance processes requirements, reduce risk, provide support to demonstrate effectiveness in USTPO enterprise-wide compliance, and automate a best practice lifecycle for policy and compliance management.

(OPTIONAL) Procure the professional services and support to migrate the system security and privacy plans (SSPPs) for all of the USPTO’s existing and new systems to the ServiceNow CAM application, to include all system information and system identification information and agency defined data items, system authorization information, system privacy information, continuity and incident response information, system categorization and information-types information, system location information, system relationships information, points of contact information, control tailoring and inheritance configuration, control implementation statements, control artifacts, control implementation status (stated and derived), appendices, and plans of action and milestones with all dates, details, artifacts, and control associations.

(OPTIONAL) Procure the professional services and support to dynamically maintain and update maintain system security and privacy plans (SSPPs) for existing and new USPTO Systems (to include Subsystem SSPPs where applicable) and Programs in the Cyber Security Assessment and Management (CSAM) tool based upon the SSPPs and information in the ServiceNow IRM CAM Application.

All solutions and work must bring value to the USPTO stakeholders through lean, innovative, efficient, effective, automated, and agile techniques, and conform to applicable federal government regulations and policies, as well as other agency supplemental regulations and policies.

3. Scope

The scope of this SOO is to:

Procure necessary subscription licenses for SMP ServiceNow ITSM, ITOM, SecOps, IRM, Workplace Service Delivery, connectors and associated applications within the scope of this SOO.

Form # USPTO-OP-021 (08/2020) Page 8 of 64

Procure necessary training credits to support training and certification to provide training to

USPTO personnel as required.

Procure the professional services and support to, based upon ServiceNow platform best practices, perform requirements gathering, discovery, architecture, design, configuration, testing, deployment, implementation upon Government approval, update, operate and maintain SMP Now Platform, existing and additional implemented ServiceNow modules, applications and capabilities within scope of this SOO.

Automate the implementation of all phases (Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor), and associated activities, of the NIST RMF at the USPTO through the implementation of ServiceNow SecOps and IRM modules and applications within the scope of this SOO, to include the ServiceNow CAM application. USPTO will only be implementing and using the NIST SP 800-53 Rev 5 security and privacy controls for SSPPs in ServiceNow IRM CAM.

Scope of the professional support and services in this SOO is to provide, full operations and maintenance (O&M) support as well as development, modernization, and enhancements (DME), to include the integration of additional modules and capabilities within the USPTO’s existing ServiceNow (SMP) platform, which includes Information Technology Service Management (ITSM Pro, ITOM Pro), USPTO’s existing and new enterprise tools, collaboration tools, vulnerability and compliance scanners, endpoint protection and management tools, security information and event management (SIEM) tools, identity and access management tools, configuration management databases and tools, cloud-native tools in USPTO’s Google, Azure, and Amazon instances, as well as USPTO instances of software-as-a-service (SaaS) cloud services.

Scope of this SOO includes the day-to-day Agile design, development, testing, production implementation, operations and maintenance support, business process documentation, requirements analysis, development of user stories, functional and technical elaboration, configuration, testing, production/release support, defect/bug fixes, and timely administrative support. Work will be prioritized by respective Product Owners (PO’s) and USPTO Division Leads for their respective areas of responsibility during Release/Sprint Planning based on business priorities. The scope includes maintaining the current ATO for the SMP and also annual renewal of the ATO.

USPTO envisions multiple teams led by the Contractor, working in parallel to perform requirements gathering, discovery, design, develop, deliver, and sustain multiple capabilities concurrently. Teams must collaborate closely with the USPTO SDOD, EA Division Leads, other USPTO stakeholders, to include teams supporting and implementing the USPTO ServiceNow Integrated Risk Management (IRM) and Security Operations (SecOps) modules, application teams responsible for enterprise tools and cloud services, customers (end users), and the ServiceNow Impact Squad for input and feedback. The number of teams operating at a given time and resource allocation for teams depends upon the approved implementation phases of business capabilities and enhancements.

Integrations with enterprise tools needed to effectively implement upon Government approval include the ServiceNow Platform, ITSM, ITOM, SecOps, IRM, HR Service Delivery (HRSD), connectors, and associated applications/capabilities within the scope of this SOO, to support automation of tasks, leverage used of pre-built flows and actions to automate integrations, Form # USPTO-OP-021 (08/2020) Page 9 of 64 configure and implement connectors to support accurate import data from third party data sources, and to integrate and connect to other authoritative sources to support day-to-day operations and reporting. Sources include, but are not limited to:

o Amazon Web Services o Belarc BelManage o BigFix o Bugcrowd o Crowdstrike o Genesys Telephony o Getlab o Google Cloud Platform o ItemAware RFID o MicroFocus ScanCentral Static

Code Analysis Testing (SAST)/Dynamic Application Security Testing (DAST) o MS Azure Active Directory o MS Endpoint Configuration

Manager (MECM) o MS Intune o MS OneDrive o MS Power Business Intelligence

(BI)

o MS SharePoint o MS Teams o Momentum o NetApp Cloud Insight o Salesforce o Vulnerability and Compliance

Scanner (Currently Tenable) o USPTO Enterprise Data

Warehouse (EDW) o USPTO Collection of Multiple

Enterprise Tools (COMET) o USPTO Service Delivery

Automation Platform (SDAP) o Okta o SIEM (Currently QRadar) o Rally

Additional integrations to the ServiceNow Platform, ITSM and ITOM Modules, and other modules, applications and capabilities addressed within this SOO will be based upon the Government’s needs and concurrence, the Contractor’s analysis of USPTO’s environment and enterprise tools, and Contractor’s recommendations of which additional integrations are needed for effective implementation.

Additional integrations which the Contractor shall configure will be based upon the Government’s needs, and the Contractor’s analysis of USPTO’s environment and enterprise tools, and the Contractor’s recommendations as to which additional integrations are needed to effectively implement, upon Government approval, the modules and associated applications within the scope of the SOO, and to support automated security and privacy control artifact generation and control association, and security and privacy control assessments.

The scope of work above is for Base Year and four subsequent option years. Scope of work

ServiceNow IRM Continuous Authorization and Monitoring (CAM) and Privacy Management (PM) increases up to 130 systems in option year 2 and beyond.

Performance-Based PWS produced as a result of this SOO must include the implementation and support for Agile practices, incorporate ServiceNow best practices for design, configuration, testing, implementation, operation and maintenance, and support of the ServiceNow Platform, ITSM, ITOM, SecOps, IRM, Workplace Service Delivery, EAM, connectors, and associated applications/capabilities, in a manner which supports USPTO adoption and requirements without disrupting USPTO business. PWS produced as a result of this SOO must also include, how those modules and applications and architecture are configured for availability, resiliency, and

Form # USPTO-OP-021 (08/2020) Page 10 of 64 recoverability. Technology decisions provided in the performance-based PWS must be structured to provide frequent, Agile deliverables, not multi-month milestones, and to create accountability.

4. Objectives

The objective of this procurement is to award a contract for support services for the efficient and cost-effective operation, configuration, integration, testing, implementation and maintenance of SMP ServiceNow Platform, modules and capabilities. Goal is to provide sufficient personnel and resources as appropriate to assist with fluctuating workload demands.

4.1 Objective 1 – ServiceNow SMP Platform

4.1.1 Operations and Maintenance

4.1.1.1 Provide ongoing administration, maintenance and availability of ServiceNow platform and associated capabilities in accordance with USPTO policies and procedures and ServiceNow best practices.

4.1.1.2 Perform patches, upgrades and updates (with Government approval) for platform and associated capabilities within scope of this SOO as needed.

Ensuring regression testing is conducted for all affected capabilities during upgrades and any mitigation actions are proactively addressed.

4.1.1.3 Collaborate with Product Owner’s (PO’s) to review requirements, configure and enhance capabilities based on ServiceNow best practices. Ensure platform aligns to business strategy and governance decisions. Analyze impacts of new requirements and provide control to ensure appropriate solutions are developed.

4.1.1.4 Identify opportunities to improve solutions, support implementation of new requirements affecting the ServiceNow platform. Remain current on ServiceNow products and integrated technologies.

4.1.1.5 Identify opportunities and proposed a plan to allow different development teams on the platform to develop with minimal risk to the platform. With approval from the product owner, execute and manage the plan leveraging the governance board.

4.1.1.6 Investigate any security incident, resolve and report to the COR and ISSO.

4.1.1.7 Perform operational support for system defects as they arise.

4.1.2 Configuration and Implementation of additional ServiceNow SMP Modules into the NOW Platform

4.1.2.1 Contractor shall conduct the discovery to identify and assess current business processes, the USPTO technical environment, operational environment, Form # USPTO-OP-021 (08/2020) Page 11 of 64 security requirements or other analysis required to deliver the scope of this contract, and provides a documented implementation strategy to the contracting officer and stakeholders within twelve (12) weeks from award of module contract option.

4.1.2.2 Contractor shall devote up to (12) weeks working with USPTO to create a documented blueprint for implementing required modules and applications within the scope of this SOO, that meets internal and external customer service needs of stakeholders.

4.1.2.3 Contractor shall include the following activities during the blueprinting effort:

Visioning/Alignment – Meet with USPTO product team leaders for visioning and alignment engagement, including interviews with the USPTO Team Leads, and other UPTO stakeholders required, facilitation of a virtual future vision workshop, and creation of a strategic digital transformation roadmap.

The resultant roadmap and implementation plan This plan must include an assessment of the USPTO’s security and privacy requirements and existing infrastructure to ensure the solution is tailored to meet the unique needs of the USPTO.

Process & Data Assessment – Review current processes, existing solutions, and data sets to identify key pain points/bottlenecks / open risks, opportunities, define future-state data sets/strategy, identify gaps, and prioritize solutions against those issues.

Target / Solution Architecture – Define what needs to be done technically to achieve future-state processes and determine data elements needed from other agencies or Business Units, as well as details of how the data are collected/managed.

Requirements Gathering – Elicit initial requirements to refine scope and set User Stories for solution design.

Solution / Scope Decision Points – Engage and review findings with the program sponsor, project manager, selected key stakeholders, and incorporate related revisions/requests (within scope).

Sprint Planning – Define and document User Stories in USPTO’s Agile tool (currently Rally) and a plan of what is to be executed each Sprint to manage expectations within USPTO as well as across Business Units when they can expect certain functionality to be available for review.

4.1.2.4 Blueprinting process outputs includes:

System process flow(s).

High-level architecture and technical design for the ServiceNow modules and applications within the scope of this SOO, to include integration points with USPTO’s ServiceNow platform, which includes existing ITSM and ITOM modules, USPTO enterprise tools and cloud environments, to include

Form # USPTO-OP-021 (08/2020) Page 12 of 64

USPTO’s instances of Amazon Web Services, Microsoft Azure, Microsoft Office 365, and Google Cloud Platform.

Document and define user roles required, and which the Contractor creates, tests, implements, manages, maintains, and updates (Government approved), ServiceNow modules and each application acquired through this SOO to meet the USPTO’s needs.

Document a future-state vision for the implementation of ServiceNow modules and applications, to include to meet the USPTO’s needs.

Create a documented solution roadmap for implementation for ServiceNow modules and applications, to include process flow diagrams for each module and application, identification of personas and roles for each module and application, enterprise tool integrations required to meet the USPTO’s requirements.

Document and define test plans to include functional testing, performance testing, regression testing, deployment and post-deployment support

Document test cases and test scripts with test results

4.2 Objective 2 – IT Service Management (ITSM)

Provide ongoing administration, maintenance and enhancements to USPTO ITSM Pro solution for the following capabilities listed below. Any changes, enhancements to existing and future capabilities are implemented with Government approval.

Incident Management Problem Management Change Management Request Management Virtual Agent Asset Management Service Operations Workspace Configuration Management

Database (CMDB)

CMDB Workspace Service Portal/Employee Center Knowledge Management Performance Analytics Predictive Intelligence Continual Improvement DevOps Change and Config Office 365 Teams Integration

4.2.1 Create workflows and templates to support the automation of tasks and approvals and streamline process areas.

4.2.2 Create and update service catalog items to support ordering of IT services, hardware and other support options. Contents available to users are clearly structured and user friendly.

4.2.3 Ensure documentation is created to gather requirements, identify required workflows, conduct testing, and gathering feedback from users for proposed improvements.

4.2.4 Review and process development requests approved by PO’s to support gathering of requirements, assessing feasibility, completeness and level of effort to support development and implementation.

Form # USPTO-OP-021 (08/2020) Page 13 of 64

4.2.5 Support migration of data and information as required within with retirement and deprecation of USPTO capabilities.

4.2.6 Ensure Service Catalog and Knowledge Base articles contain context and information necessary to support self-service and solve common requests.

4.2.7 Configure and create analytic dashboards and reports to gather metrics, track and assess trends over time.

4.2.8 Configure and implement predictive intelligence to collect and identify patterns to more quickly resolve incidents and cases.

4.2.9 Support integrations to connect to sources to obtain data required to support workflows and processes.

4.2.10 Support integrations to connect to sources which consume data from SMP to support reporting and workflows.

4.2.11 Document, configure and implement of Now Assist AI capability to automatically generate content such as responses, work notes, and knowledgebase articles.

4.2.12 Support the planning and migration of reports and dashboards into Platform Analytics.

4.2.13 Support Computer Telephony Integration with Customer Interaction Center and associated capabilities to streamline access to ticketing system records, interactions and assist OCIO Service Desk agents.

4.2.14 Support the migration service catalog and related capabilities of Service Delivery Automation Platform (SDAP) into SMP.

4.3 Objective 3 – IT Operations Management (ITOM)

Provide ongoing administration, maintenance and enhancements to USPTO ITOM Pro solution for the following capabilities listed below. Any changes, enhancements to existing and future capabilities are implemented with Government approval.

Discovery Service Mapping Event Management Advanced

Cloud Management Advanced Operational Intelligence Orchestration

4.3.1 Participate in Data Governance and Technical Governance boards to ensure data integrity, system stability and availability.

4.3.2 Support creation of CMDB queries to retrieve CI data and association relationships and service maps.

Form # USPTO-OP-021 (08/2020) Page 14 of 64

4.3.3 Configure discovery scans and schedules as defined by PO.

4.3.4 Perform troubleshooting of discovery, reviewing logs, issues, scan status and results.

4.3.5 Support CMDB integrations with other authoritative sources and applying precedence rules as required.

4.3.6 Configure, deploy and maintain ITOM module and associated capabilities to include scripts, workflows, reports and dashboards as needed.

4.3.7 Provide documentation for any additional enhancements and improvements within ITOM module and associated capabilities.

4.3.8 Perform quality checks against data sources to validate discovery data.

4.4 Objective 4 – ServiceNow SMP Training for the NOW Platform and ITSM Module

Develop, document, maintain and update (Government approved) a training program and course content for acquired and maintained ServiceNow NOW Platform, ITSM module and applications, capabilities and functionalities.

4.4.1 Create documentation and training for current and upcoming ServiceNow NOW Platform and ITSM module enhancements and application features directly tied to end-user functionality and supports improving business outcome. Documentation includes:

4.4.1.1 NOW Platform and ITSM module training manuals for end users, and troubleshooting playbooks for the Service Desk. The Contractor provides version control of these materials and updates (Government approved) them in the same sprint when introducing relevant changes to the production baseline. Training materials shall also include any enhancements, upgrades and new features and capabilities where applicable.

4.4.1.2 NOW Platform and ITSM module, application, and role-based Process Guides, Standard Operating Procedures, Job Aids, and other documentation required by the government.

4.4.2 NOW Platform and ITSM module training services must be provided as live online, instructor-led training, as well as interactive, on-demand, computer-based training. As system changes and enhancements are deployed, the Contractor must update training materials and submit them to the Contracting Officer’s Representative (COR) for review and approval.

4.4.3 Length of individual on-demand training modules for NOW Platform and ITSM module must not exceed an hour in total course time and must meet Section 508 compliance standards of the Rehabilitation Act of 1973.

4.4.4 Provide live-online, instructor-led training for enabled for NOW Platform and ITSM module and applications upon request from the government. The government envisions

Form # USPTO-OP-021 (08/2020) Page 15 of 64 the Contractor providing live-online, instructor-led training to product teams and users as part of the initial deployment and implementation modules and applications when new products/systems/programs are on-boarded to the Now Platform as requested by government. After initial implementation or on-boarding, training is supplemented by the on-demand, computer-based training.

4.4.5 Develop, document, present, maintain, and update (Government approved) user role-based training for USPTO-specific implementations configured by the Contractor for NOW Platform and ITSM module and associated applications.

4.4.6 On-demand training must be updated annually at a minimum, or more frequently as requested by the government, to address changes in the NOW Platform and ITSM module and applications, and other USPTO-specific requirements.

4.4.7 NOW Platform and ITSM module training must be compatible and integrated with the government learning management system, provide functionality to register for training, tracking attendance, tracking course completion, sending completion certificates, and analytics and reporting and have the ability to be distributed to USPTO employee’s or Contractors without access to the government learning management system.

4.4.8 Coordinate and collaborate with the USPTO Enterprise Training Division and other USPTO to integrate training courses with and upload training courses to the government learning management system.

4.4.9 Create and publish NOW Platform and ITSM module training content for distribution to users within SMP knowledge bases.

4.4.10 Create and publish user acceptance tests to support proper testing and evaluation of development requirements for NOW Platform and ITSM module provided by the customer.

4.4.11 Based on surveys and other feedback, assess knowledge and skill gaps with NOW Platform and ITSM module to identify where improvements are necessary and proposed training approach.

Objective 4.5 – Technical Governance

Provide professional services and support for technical governance, ensuring proper stability and management of NOW Platform and implemented modules, capabilities and integrations. This includes establishing standards and policies regarding the environment, data, platform and development management.

4.5.1 Support the development of Governance charter to define vision and strategy to improve and enhance ServiceNow SMP.

4.5.2 Collaborate with stakeholders to assess existing environment and deliver solutions to prioritize and deliver improvements.

Form # USPTO-OP-021 (08/2020) Page 16 of 64

4.5.3 Provide feedback on modules and other capabilities to be introduced and impact to users and the ServiceNow SMP platform.

4.5.4 Ensure proper mechanisms are in place for data security.

4.5.5 Support development of standards and policy to ensure platform performance and integrity.

4.5.6 Collaborate with ServiceNow/SMP architect, development leads, security and other stakeholders to provide advice and recommendations to upkeep the platform quality and upgradability.

4.5.7 Conduct design reviews for ServiceNow/SMP platform customizations and integrations.

4.5.8 Provide policy workflows and rules to prioritize integrations against other sources.

4.5.9 Participate in peer code reviews.

Objective 4.6 – Technical Writing Provide professional services for technical writing to create, revise and publish technical documentation to associated with ServiceNow SMP system architecture, operational support plans, testing, and other technical areas.

4.6.1 Work closely with Architect, Development Leads and Administrators to develop and update documentation for ServiceNow/SMP architecture in accordance with USPTO policies.

4.6.2 Review and update Dynamic Operational Support Plan (DOSP) documentation to capture changes in architecture, procedures, upgrades and other information as required.

4.6.3 Create and publish technical documentation for major enhancements, configuration changes and features extending beyond existing ServiceNow product documentation.

4.6.4 Create and publish supporting documents for ServiceNow/SMP such as instructional documents, diagrams, and procedures and are consistent with USPTO policies.

4.6.5 Create and publish supporting documents and artifacts for ServiceNow/SMP which are necessary to support and maintain system accreditation (Authority to Operate-ATO).

4.6.6 Update documentation as needed to address operational instructions, security controls, and risk assessments as needed for deployments.

Objective 4.7 (OPTIONAL)-Citizen Development Program Support. Provide professional services to assist in establishing and maintaining a ServiceNow Citizen Development Program within USPTO. Contractor shall:

Form # USPTO-OP-021 (08/2020) Page 17 of 64

4.7.1 Coordinate with ServiceNow SMP Product Owners to align citizen development with USPTO goals.

4.7.2 Coordinate with ServiceNow SMP Product Owners to establish a program framework for citizen development program.

4.7.3 Coordinate with ServiceNow SMP Product Owners to establish learning programs and support.

4.7.4 Coordinate with ServiceNow SMP Product Owners to make recommendations to properly scope modules and applications which are candidates for citizen-developed applications, to minimize risk for the Now platform and modules and applications in use.

4.7.5 Coordinate with ServiceNow SMP Product Owners to establish criteria for candidates to participate in citizen development.

4.7.6 Coordinate with ServiceNow SMP Product Owners to make recommendations of roles-based access controls and level of technical development to be granted to citizen developers to minimize risk to the Now platform and associated modules and applications.

4.7.7 Coordinate with ServiceNow SMP Product Owners to establish a portfolio review process for citizen-developed applications within the USPTO Technical Governance Board.

4.7.8 Provide platform, technical support as required to oversee citizen developer’s work.

4.7.9 Define required deliverables for citizen developer’s work to address Technical Governance Board and ServiceNow SMP Release Management requirements.

4.7.10 Maintain centralized visibility and reporting of all user stories within Agile (Rally) application performed by citizen developers to ensure requirements are understood, and do not conflict with existing or future efforts being worked on by ServiceNow SMP team architects and developers.

4.7.11 Provide reports and other metrics to assess training progress of citizen developers for their required training path.

4.7.12 Inform Product Owners and citizen developers of completion of required delta exams to maintain their training and development skills.

4.7.13 Conduct semi-annual assessments of citizen developers through labs and exercises to ensure compliance with ServiceNow and best practices.

4.7.14 Create and maintain a documented register of all USPTO citizen developers to include modules and applications they configure/administer. Register shall be provided monthly and included with Monthly Program Management Report (PMR) and Review.

Form # USPTO-OP-021 (08/2020) Page 18 of 64

4.7.15 Promptly escalate any potential issues resulting from citizen developers to ServiceNow SMP Product Owners which may result in security or operational risk to Now Platform and associated modules and applications.

Objective 4.8 (OPTIONAL) – ServiceNow Enterprise IT Asset Management-Software Asset Management (SAM) and Hardware Asset Management (HAM). Provide professional services to support the delivery, integration, maintenance and continued enhancement of the Software Asset Management (SAM), SaaS License Management and Content Library functionality including integration with ITOM and CMDB. Additionally, provide professional services to support the delivery, integration, maintenance and continued enhancement of the Hardware Asset Management (HAM) functionality including integration with ITOM and CMDB.

4.8.1 Collaborate with data owners and process owners for the development of software asset jobs.

4.8.2 Document integrations for external data sources supporting SAM.

4.8.3 Assist in the cleanup of CI and…