RFI_47QFRA23K0012 Attachment A - Deployment Services Draft Requirement.pdf

Attachment A – Deployment Services Draft Requirement

Deployment Services in support of:

Cybersecurity and Infrastructure Security Agency (CISA)

1.0 Background

The United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) leads the national effort to understand, manage, and reduce risk to the cyber and physical infrastructure that Americans rely on every hour of every day. In its role as the nation’s cyber defense agency and the national coordinator for critical infrastructure security, CISA works with critical infrastructure partners every day to address the evolving threat landscape. The risks it faces are complex and geographically dispersed, and they affect a diverse array of stakeholders, including Federal Civilian Executive Branch (FCEB) agencies; private sector companies; and state, local, tribal, and territorial (SLTT) governments, and critical infrastructure (CI) sectors. CISA spearheads a national effort to ensure the defense and resilience of cyberspace. It is building the national capacity to defend against and recover from cyberattacks. It works with federal partners to bolster their cybersecurity and incident response postures and safeguard the FCEB networks that support the nation’s essential operations. And it partners with the private sector and others to detect and mitigate cyber threats and vulnerabilities before they become incidents.

The federal enterprise depends on information technology (IT) systems and computer networks for essential operations. CISA, through its Cybersecurity Division (CSD), works with each FCEB agency to promote the adoption of common policies and best practices that are risk-based and able to effectively respond to the pace of ever-changing threats.

CSD leads efforts to protect the federal “.gov” domain of civilian government networks and to collaborate with the private sector to increase the security of critical networks. The CSD mission is to understand evolving threat activity as it affects critical functions at the national level and high-value assets, ensuring stakeholder access to essential data on the risk posture of key information systems.

1.1 Continuous Diagnostics and Mitigation Program

Established in 2012, the Continuous Diagnostics and Mitigation (CDM) Program is a dynamic approach to fortifying the cybersecurity of Government networks and systems. The CDM Program provides cybersecurity tools, integration services, and dashboards to participating agencies (Chief Financial Officers [CFO] Act agencies and non-CFO Act agencies (see Section 11.0, Attachment F) to support them in improving their respective security postures by delivering better visibility and awareness of their networks and defending against cyber adversaries. In supporting CISA’s mission, CDM works closely with agencies to deploy capabilities that help agencies protect their hardware and software assets, networks, and the data they contain.

Currently, the Government maintains dozens of separate, tailored CDM solutions across the FCEB agencies. The CDM solution architecture, shown below in Figure 1: CDM Logical Architecture, illustrates the solution implementation supported at CDM-participating agencies:

1. Layer A is composed of tools and sensors that, together, provide the coverage of the CDM capabilities. The current Layer A tools vary by agency,

2. Layer B is the integration layer, which aggregates data from agency Layer A tools, performs data normalization, and then transforms and conforms records. Layer B is often tailored to individual agency environments and is an agency and CDM shared responsibility. A standardization data integration solution will be implemented via the CDM Data Services contract.

3. Layer C is the Agency Dashboard, which ingests data from Layer B and presents it to agency users in operationally relevant ways to promote the reduction of cybersecurity risk. The Agency Dashboard is standardized for participating agencies.

4. Layer D, also known as the Federal Dashboard, presents a unified view of the cybersecurity posture of the entire FCEB enterprise. The Federal Dashboard is standardized for use by CISA analysts.

Figure 1: CDM Logical Architecture (Current State)

2.0 Purpose

The purpose of this contract is to enhance the cybersecurity posture of FCEB agencies through the configuration and deployment of solutions that meet CISA capability requirements. Solutions are typically commercial off-the-shelf (COTS) products, which have been previously assessed to meet capability requirements. This contract shall provide the services to ensure that solutions are planned, configured, and implemented for agencies requiring support (i.e., Layer A in Figure 1).

The cadence of solution deployment to agencies will be iterative and continual throughout the period of performance.

The high-level performance objectives of this contract are to:

1. Provide a methodical approach to assess agency readiness and develop and maintain an implementation plan for capability deployment.

2. Procure, deploy, configure, and test deployed solutions at agencies, while leveraging original equipment manufacturer (OEM) professional services when available.

3. Successfully verify the agency’s deployed solutions and support validation of the system’s related operational requirements, as needed.

4. Operate a subset of deployments as a service for supported agencies.

To meet the above objectives, this contractor shall use a repeatable framework and approach to ensure that solutions are implemented in a consistent, timely, and successful fashion for FCEB agencies. Solution deployments will require configuration that ensures successful interoperability within the CDM Dashboard and integration layer (i.e., Layers B, C, and D), which is administered through another contract.

3.0 Scope

The scope of this contract is to implement solutions to CDM capabilities at all CDM-participating agencies (including CFO Act and non-CFO Act agencies). The contractor shall provide an in-depth approach to requirements management that allows for the intake of agency requests, assessments of agency readiness, and then provides implementation planning to prepare for execution.

The contractor shall plan, procure, deploy, and configure solutions to meet capability requirements at a receiving agency. The contractor shall thoroughly test the capability before transitioning the operation of the capability to an agency’s designated operations team. The contract is expected to utilize professional service teams from OEMs, to the maximum extent possible, to enhance deployment effectiveness.

The contractor shall provide ancillary support to ensure the effective execution of the contract and supported agencies, including project management support, procurement administration, and reach back support for any agency deployments.

The contractor shall operate and maintain CDM capabilities that are targeted for use by multiple agencies as a service for a subset of agencies.

At the time of award, the immediate focus of support will be to the CDM program to provide coverage for FCEB entities. As the period of performance progresses, additional CISA program offices may elect to utilize this contract for deployment services. In addition, as the CSD mission evolves, expansion to support SLTT and CI sectors may be necessary through this contract.

4.0 Request for Service (RFS)

The Government requires a flexible approach to support the evolving technical capabilities in a rapidly changing cybersecurity environment during the entire life of the contract. To address the evolving needs of the supported agencies, the Government will execute a Request for Service (RFS) process that will further define agency-specific requirements for initial delivery and/or additional support of a capability or service.

The RFS will state the purpose, supported agency(s), primary place of performance, anticipated tasks/subtasks from this contract required, technical details of the requirement (including references to programmatic documentation where appropriate), and other supporting details related to the Government’s requirements (e.g., security requirements, expected execution timelines, Government-Furnished Information (GFI), and tailored Systems Engineering Life Cycle requirements). Each RFS will apply performance-based outcomes and standards as appropriate to the requirements. The primary criteria for work performed under an RFS is to ensure high quality products and services are delivered in a timely and cost- effective manner.

The contractor shall generate an RFS Response, and following Government approval of the Response, the contractor shall execute necessary activities to implement a capability at an agency. All cost and schedule measures associated with the execution of a specific RFS shall be clearly identified in contract cost and schedule reporting, as well as invoices.

5.0 Tasks

Task 1: Project Management Task 2: Requirements Management Task 3: Capability Implementation Task 4: Procurement Administration Task 5: Provide Reach-back Support Task 6: Operate CDM Deployments as a Service (Optional)

5.1 Task 1 – Project Management

The contractor shall deliver project management services under this contract to support the successful execution of all work. These services shall include the management and oversight of all activities performed by contractor personnel, including subcontractors.

Performance objectives for the project management support shall include, but are not limited to:

1. Perform all management functions according to a Project Management Plan (PMP) (see Section 7.0, Deliverable XX).

2. Conduct a project kickoff meeting.

a. Multiple meetings will likely be required with CISA stakeholders who have direct management oversight of the contract, as well as with customer agencies who are anticipated to receive services via the contract.

3. Provide financial tracking and reporting, via a Financial Status Report (FSR) (see Section 7.0, Deliverable XX and Section 10, Attachment X), for all aspects of the project, including:

a. Expended, anticipated, incurred, and remaining funds.

b. Planned versus expended actuals by month and cumulative.

c. Monthly and cumulative invoiced amounts.

d. Costs broken out by capability and by agency.

4. Submit request to initiate purchase (RIP) documentation (Attachment X) and provide a Procurement Report (see Section XX, Deliverable XX) for tools and other direct costs

(ODCs) that are required to support the solution during the contract’s period of performance (POP).

5. Develop and maintain an Integrated Master Schedule (IMS) (see Section 7.0, Deliverable XX). The IMS shall include all work necessary across the project—including major tasks, milestones, and deliverables and the planned and actual start and completion dates for each task, subtask, and work package. The IMS shall comply with the CDM Scheduling Template (see Section 10.0, Attachment XX).

6. Develop and submit a Monthly Status Report (MSR) (see Section XX, Deliverable XX).

The monthly report shall capture:

a. Activities that occurred during a reporting period.

b. Milestone planning and tracking.

c. Financial management aspects, including funding and all incurred costs.

d. Significant project concerns, risks, and issues.

e. Completion and submission of the MSR Addendum Template (see Section 10.0, Attachment E) as part of the MSR deliverable.

7. Support CISA Contractor Workforce Management System (CWMS) initiatives.

8. Coordinate and complete each SELC gate review, detailed in the CDM SELC Process

Requirements (See Section 10.0, Attachment A).

9. Execute risk management activities while utilizing the existing CDM Risk Management system and defined processes to input and track all risks associated with this contract.

10. Provide knowledge management support, utilizing the Government identified repository for project documentation.

11. Support ad hoc meeting requests with government CDM stakeholders as needed.

12. Provide a Transition-In Plan (see Section XX, Deliverable XX) that captures necessary actions to perform a seamless transition-in. The Transition-In Plan shall be informed through direct coordination with relevant incumbent CDM contractors, to include clear relatability to the incumbent’s own transition-out activities, where appropriate.

13. Develop and deliver a Transition-Out Plan (see Section XX, Deliverable XX) that documents the steps necessary to ensure a seamless transition from the contractor awarded this contract to relevant incoming contractor/Government personnel at the expiration of the contract.

5.2 Task 2 – Requirements Management

The Government has a significant number of agencies that are anticipated to utilize the services of this contract. That contractor shall manage the execution of the capability implementation via a comprehensive requirements management process that provides accurate insight into agency requests, assessments of those requests, and that supports implementation planning.

The requirements management process shall seek to engage agency customers on deployment, support, and operational needs. It will include a solicitation process that ensures agency readiness before execution of design and deployments of CDM capabilities. This requirements process shall also ensure that federal or CISA mandatory requirements (e.g., OMB M-memorandums, CISA BODs, etc.) are collected and integrated into the deployment readiness process. The requirements process should ensure all the requisite planning occurs before an RFS or deployment activity initiates to ensure a “right size” approach to deployment and subsequent support.

5.2.1 Subtask 2.1 – Intake Agency Requests

The contractor shall assist in the capture, vetting, and validation of agency requirements requests from agency stakeholders, and subsequently track requirements achievement through potential execution via an RFS. The Government requires that the requirements management process shall be managed via a Government provided solution, The requirements management process shall be continually refined throughout project execution.

The contractor shall ensure that the requirements management process is effectively monitored with activity logging and traceability between agency requests, approval of requests, deployment, and acceptance of a deployment. The contractor shall ensure that the requirements request process provides an automated request intake mechanism to facilitate stakeholder outreach. Relevant intake requests shall include, but are not limited to:

1. Date of the request.

2. Agency priority.

3. Requesting agency information (e.g., POC, contact information, agency executive sponsor).

4. CDM capability implementation requested.

5. Agency needs statement, to include estimates/descriptions of any anticipated labor and procurement.

a. Labor support shall also include the type of support being requested (e.g., professional services/consulting, “hands-on” deployment support, etc.).

6. Agency-self assessment of its readiness for capability implementation, including timetables to deploy to production.

7. Any agency-specific capability requirements, including, but not limited to:

a. Product family or vendor preferences.

b. Additional modules/add-ons to the technologies that support the underlying product family.

c. Quantity and/or coverage needed by agency and/or components.

8. Any current agency investments in the capability including an assessment of that implementation

9. Requested timeline for capability implementation start and completion

10. Field for “other” details to be noted.

The contractor shall continually refine the submitted requirements requests with CISA and agency stakeholders, including, at a minimum, by undertaking the following:

1. Refining and clarifying the requests’ intent to provide traceability to relevant government programmatic documents.

2. Maintaining accurate status, including:

a. Capturing CISA decisions on whether to approve, deny, seek further information, or place on hold agency requests.

b. Implementation status.

3. Providing access to relevant programmatic documentation pertaining to a specific agency request, including but limited to intake requests, agency readiness assessments, implementation planning, and SELC documentation.

4. Mapping requests to RFS direction.

5.2.2 Subtask 2.2 – Assess Agency Readiness

The contractor shall assess target agencies’ readiness for a requested capability, as documented and maintained in the requirements management process. Throughout project execution, the contractor shall ensure that agency readiness assessments are evident in the requirements management process. The intent of the agency readiness assessment is to ensure the prudent use of Government resources by ensuring implementation of a capability at target agency is likely to be successful.

The contractor shall standardize its approach to conducting an agency readiness assessment, allowing for effective and succinct assessments that maximize accurate outcomes of potential implementations. When directed by CISA to assess the suitability of an agency (or agencies) to receive a particular capability implementation, the contractor shall conduct the assessment and then deliver an Agency Readiness Assessment Report (Section X, Deliverable XX).

The Assessment Report shall include, at a minimum, the following:

1. Agency specifics (e.g., stakeholders engaged, intended organization(s) for implementation).

2. CDM capability readiness assessed.

3. Summary of findings and a determination as to if the agency is suitable for the capability to be implemented.

4. Identification of risks originating from the agency to a successful implementation.

5. Discrete activities completed during assessment and outcomes.

6. Detailed accounting of assessment findings.

7. Consideration for agency-specific SELC requirements.

8. Justification for readiness determination (if applicable).

9. Recommended next steps.

10. Other notes as needed.

Assessment activities are intended to be ongoing throughout the complete POP. The contractor shall facilitate and lead regular touchpoints with CISA stakeholders to review new, in-progress, stalled, and recently completed agency readiness assessments. The contractor shall consistently provide recommendations and accompanying justifications for CISA to consider related to assessments.

5.2.3 Subtask 2.3 – Plan for Agency Implementations

The contractor shall provide an Implementation Plan (Section 7.0, Deliverable XX) that shall detail standardized methodology, timelines, and resources necessary to deploy a specific CDM capability into an agency’s environment. The Implementation Plan is a living document that shall be updated and refined as additional agencies are approved to receive CDM capabilities throughout this contract. Once initially created, plans pertaining to specific CDM capabilities are intended to be subsequently reused and tailored to additional agencies requesting that same capability. The Implementation Plans shall be linked with the outcomes of agency readiness and shall be visible via the requirements management solution. The Implementation Plan is intended to provide a comprehensive consumable vision of CDM capability deployments for agencies.

The Implementation Plan shall include, but is not limited to:

1. Alignment to CDM SELC Process Requirements (Section XX, Attachment X), with a plan to successfully enter and exit these SELC gates for a specific agency:

a. Solution Design Review (SDR) (Section 7, Deliverable XX).

b. Post Implementation Review (PIR) (Section 7, Deliverable XX).

2. Agency-specific integration considerations, including agency specific System Development Life Cycle (SDLC) requirements and data interchange with legacy applications.

3. Anticipated interaction with and needs from other CDM contracts, including Advanced Engineering Services and Data Services.

4. Procurement planning to support the new capability.

5. Identification of risks related to successfully implementing the Implementation Plan.

6. Agency authorization to operate (ATO), assessment and authorization (A&A), and other security considerations for agency- specific environments.

7. Any Government and/or third-party coordination requirements.

8. Transition to operations activities following agency confirmation of deployment approval.

Implementation Plans are anticipated to have considerations that are both general to any implementation of a CDM capability as well as capability implementations specific to an agency.

5.3 Task 3 – Capability Implementation

CISA will identify capabilities that require immediate action for implementation of a specific capability or set of capabilities via an RFS. The intent of the RFS is to act as technical direction authorizing the contractor to begin executing activities associated with capability implementation.

Following approval of an RFS Response, the contractor shall design, procure, deploy, and configure the capability for the receiving agency. The contractor shall thoroughly test the capability before transitioning the operation of the capability to an agency’s designated operations team. The contractor shall offer relevant training to ensure that the agency is capable of full utilization of the implemented capability prior to transition.

5.3.1 Subtask 3.1 – Develop Request for Service (RFS) Responses The contractor shall develop and deliver an RFS Response (Section 7, Deliverable X) for any Government-provided RFS. The RFS process is described in Section C.4 – Request for Service (RFS). The contractor developed RFS Response shall build upon the Implementation Plan and include a brief overview of the requested services, including any technical relevant details pertinent to the proper execution of the support. In addition, the RFS Response shall include a rough order of magnitude (ROM) cost estimate that depicts labor categories and hours by task/subtask, anticipated schedule, a draft RIP for any tools and/or ancillary hardware/software anticipated to be required, and anticipated travel to meet the requirements.

5.3.2 Subtask 3.2 – Technical Planning for Capability Implementation The contractor shall provide technical planning for capability implementation, with the intent of providing key Government stakeholders with a common understanding of the foundational solution design and architecture to accomplish RFS requirements. The conclusion of technical planning occurs at the successful completion of an SDR(Section XX, Deliverable XX) SELC Gate, with delivery of all corresponding artifacts and deliverables as defined in the CDM SELC Process Requirements (Section XX, Attachment X). Technical planning activities, including SDR, are required each time an agency receives a deployment of a new capability.

Specific technical planning activities beyond those explicitly required to achieve SDR shall include, but are not limited to:

1. A kickoff meeting (Section X, Deliverable XX) with relevant agency and CISA stakeholders to cover the following, but limited to, information: introduction of key Government and contractor personnel; overview of project scope and schedule; roles and responsibilities; and significant project dependencies and risks. Kickoff meetings shall be held no more than 10 business days following RFS award by CISA. A draft IMS (Section X, Deliverable XX) shall be provided just prior to an RFS kickoff meeting.

2. Identify and obtain agency-specific Government-furnished equipment (GFE) – such as laptops and personal identity verification (PIV) cards – and relevant system and/or tool access, as applicable, necessary for the contractor to successfully implement a capability within an agency’s environment.

3. Perform agency discovery and identify scope of deployment activities. At the end of this activity, a Discovery Validation Assessment Report (Section 7.0, Deliverable XX) shall be delivered. This report shall include all discrepancies discovered between the information provided by the Government and the existing agency environments.

4. Develop in-depth agency policy architecture to include logical diagram(s), identifying any external platform integration requirements and agency policy-based configuration deviations.

5. Coordination with other CDM contracts, including Advanced Engineering Services and/or Data Services, as applicable. Coordination is anticipated as relevant to CDM solution component integrations and the alignment of respective contract schedules where cooperation is required.

6. Assist in completing Security Impact Assessments at agencies by providing information pertinent to the introduction of a CDM capability into an agency’s environment.

7. Provide support to internal agency processes to obtain ATO for new tools introduced to the agency environment in support of deployment of a CDM capability. Including:

a. Provide documentation and schedule to transfer ATO maintenance responsibility to agency resources, including responsibility for tracking system plan of action and milestones (POA&Ms).

b. In the event that a POA&M is related to a tool configuration necessary for a CDM functional, operational, and/or data requirements, continued support may be required.

c. Support of internal agency processes is limited for deployment activities that are directly related to tools required to implement the CDM capability. Support targeted for actual deployment only.

The conclusion of technical planning activities for any specific capability deployment shall be the result of the successful completion of SDR exit criteria as defined in CDM SELC Process Requirements (Section XX, Attachment X). The approval of the SDR milestone signifies that a specific capability is approved for deployment at the agency.

5.3.3 Subtask 3.3 – Deploy, Configure, and Test capability within Agency Environment Following a successful SDR for an agency, the contractor shall install, configure, and test the CDM solution for the specific capability implemented within the agency’s environment. A deployment is considered finished after a successful completion of a PIR (Section 7, Deliverable XX) SELC Gate with the delivery of all corresponding artifacts, as defined in the CDM SELC Process Requirements (Section XX, Attachment X). Deployment, configuration, and test activities, including PIR, are required each time an agency receives a deployment.

The contractor shall undertake deployment and configuration activities at an agency to include, but not limited to:

1. Configure deployment in accordance with the to-be solution architecture approved at SDR, as well as Program requirements including the RFS, Data Services ICD, CDM Logical Data Model and accompanying Data Model Document, and CDM Technical Capabilities, Volume 2.

2. Ensure that the new capability has minimal network performance impacts in the agency environments and does not impact the operation of other capabilities within the overall CDM Solution.

3. Coordinate and communicate capability change requests based on agency-specific Change Control processes, as applicable.

4. Conduct performance and functional analysis to identify anticipated impact on agency resources from capability implementation and make recommendations accordingly.

5. Leverage OEM professional services as much as possible.

6. Verify data integration with CDM Data Services solution.

7. Ensure the new capability meets all applicable human systems integration standards, including accessibility as required by Section 508, has been tested and certified.

8. Ensure the new capability is compliant with applicable agency privacy requirements.

9. Ensure the new capability is compliant with applicable NIST 800-53 controls.

10. Ensure the new capability is compliant with applicable Federal and agency security technical implementation guidance. Provide a SCRM Impact statement to the agency that includes all new tools that make up the CDM capability, based on the guidance provided in NIST Supply Chain Security Guidance Under Executive Order 14028 Section 4e.

11. Assess the capability following deployment that provides a validation that the capability is complete for an agency, and if not, identify any gap associated with the capability.

For each capability deployment at an agency, the contractor shall conduct testing to ensure proper operation of the solution by fulfilling the following:

1. Test cases (Section 7, Deliverable XX) shall be developed. Finalized test cases shall be made available within the requirements management solution no less than 5 business days prior to any test event. The test cases shall include and identify, at a minimum, the following:

a. Testing methodologies, to include, but not limited to, the following:

i. Functional testing of capabilities.

ii. Performance testing.

iii. Security testing (e.g., static and dynamic source code reviews), including vulnerability scans.

iv. User acceptance testing (UAT).

b. Traceability to derived requirements.

c. Critical test parameters.

d. Evaluation criteria.

2. Schedule test events with clear identification of test cases to be evaluated during an event.

3. As needed, support validation of the system’s related operational requirements, including dedicated testing prescribed by the CDM Independent Test Agent and CDM PMO. The prescribed testing will leverage approved use cases from section 5.3.4.

4. Document the test results (Section XX, Attachment X) following a test event in the requirements management tool.

The conclusion of deployment, configuration, and test activities shall be the result of the successful completion of PIR exit criteria as defined in CDM SELC Process Requirements (Section XX, Attachment X). Approval of PIR signifies that a specific capability is operational at an agency. Drawing upon the activities identified within the capability Implementation Plan, the contractor shall transition the operation of the solution to the agency’s operations team.

5.3.4 Subtask 3.4 – Support Agency Stakeholder Training

In advance of a PIR exit, the contractor shall ensure agency stakeholders have access to OEM tools training. The government desires that agency have easy access to utilize OEM developed training. The Government does not desire the contractor recreate training for each deployed capability.

The contractor shall support agency training by:

1. Providing access to OEM tool training for agencies.

a. Access may be centralized in some instance, and in those instances the contractor shall track and monitor its utilization.

2. Assist agencies in understanding deployed capabilities align with tools/technologies and how they relate to federal mandates when applicable. The contractor shall ensure the agencies understand how the deployed capabilities support CISA/OMB requirements.

5.4 Task 4 – Procurement Administration

The contractor shall plan, procure, and track necessary tools and ODCs required during execution of this contract. The Government desires that the contractor strategically plan procurements to leverage multi-Agency bulk buy proposals when applicable, thereby leveraging buying power to recognize greater discounts. The contractor shall coordinate with the COR to initiate the procurements following the procedures in Section XX.

The contractor shall develop a Procurement Report (Section X, Deliverable XX) in accordance with the Procurement Report Template (Section X, Attachment XX). The Procurement Report shall initially capture planned procurements, and later be updated to capture the lifecycle of Delivery and Acceptance. The Procurement Report shall be a living document and shall be updated and delivered monthly.

The report shall include at the minimum the following:

1. Identification and description of receiving agency, to include sub-agency component (if applicable).

2. Associated RIP number for a procurement.

3. Proposed cost from RIPs or CTPs, actual cost of products purchased, and price comparison from a relevant source (GSA schedules or open market when not available).

4. Cost savings to the Government (i.e., discounts).

5. Product dates of order, delivery, receipt of goods by the stakeholder.

6. The date of expiration for tools that require renewal.

7. The next responsible entity (i.e., CISA, agency) for a tool’s renewal.

8. Assessment of licenses utilization, which captures the percentage of licenses procured by

CISA that are in use (operations) at an agency.

a. Assessment of utilization shall include aging metrics for licenses not in use.

To facilitate agency awareness and planning for CDM Solution maintenance, the contractor shall be provide agencies an excerpt from this report monthly, tailored to their specific details.

5.4 Task 5 – Provide Reach-Back Support

The contractor shall provide reach-back support for agencies that have executed deployments through this contract. Actual operation and maintenance of CDM capability tools is the responsibility of the receiving agency. The contractor’s support shall include:

1. Coordination and resolution of issues with deployed solution tool OEMs.

2. Tracking resolution from tool vendors.

3. Identification of issues at agencies and use centralized repository to identify systemic issues that may impact other deployments.

4. Provide specialized knowledge of a deployed solutions configuration to assist with data quality issue triage, troubleshooting, and remediation.

5. Act as a liaison between the CDM Dashboard solution and Data Services contractor to resolve any tool configuration issues related to data integration from a Layer A tool to the Data Services solution.

6. Coordination and resolution of issues with deployed solution tool OEMs.

The contractor shall be available to resolve escalated issues outside normal working hours as determined by the CISA COR. The contractor is not required to establish a help desk, but is required to utilize the CISA identified help desk.

5.6 Task 6 – Operate CDM Deployments as a Service (Optional)

The contractor shall operate and maintain CDM capabilities that are targeted for use by multiple agencies, as agreed to by the agencies and the CDM PMO in advance of offering of a capability.

In some instances, capabilities deployed in Task 3 will be offered to agencies as a service, and thus there will be no transfer to agency operations after deployments. The contractor shall assume responsibility for the successful operation of those tools.

The contractor shall develop a Plan for as a Service Operations (Section X, Deliverable XX).

The Plan for as a Service shall describe how the contractor intends to operate deployed as a service tools. The contractor shall perform O&M in accordance with the Plan for as a Service Operations once approved by the Government. The Plan for as a Service Operations shall include, but not be limited to:

1. Description of detailed O&M activities that are required for successful ongoing operations, including, at a minimum, the following:

a. Identification of problems and approach to fixing.

b. Implementation of patches/hotfixes/updates.

c. Conduct scheduled and unscheduled maintenance.

d. Identify and maintain configuration/releases (e.g., security/patch administration).

e. Maintain information security (e.g., security vulnerability scanning and auditing logs for suspicious behavior).

f. Maintain event management (e.g., authorized service interruptions).

g. Account maintenance including provisioning, disabling, and removing accounts.

h. Methodology for measuring availability metrics (up/down).

i. Verifying and validating recovery processes (e.g., backups, snapshots, and integrity thereof).

2. Approach to operating the deployed tools, including ensuring the active configuration and associated operations are compliant with CISA and Federal-wide mandated requirements (e.g., Binding Operational Directives, OMB Memorandums, etc.)

3. Description of the configuration management and change management methodology for deployed tools

4. Recommended operational service levels.

5. Operation of information exchange and data feeds from agencies and notification procedures when data channels are interrupted.

6. Provide help desk support and Tier I – III support for tools being operated.