RFI Cloud Based Faxing Solution Full and Open.docx

19AQMM22N0047

Request for Information Department of State – Information Resource Management Office of Consolidated Customer Support Contents

1. Purpose In accordance with Federal Acquisition Regulation (FAR) clause 52.215-3 Request For Information, the Department of State’s (DOS) Office of Consolidated Customer Support (CCS), is issuing this Request For Information (RFI) as part of market research, to forge a partnership with industry to provide a comprehensive approach to improve the end-to-end processes involved with managing people and resources in the organization. The Government does not intend to award a contract on the basis of this RFI or reimburse any costs associated with the preparation of responses. This RFI shall not be construed as a formal solicitation or an obligation on part of DOS to acquire any product or services. Submission of any information in response to this RFI is completely voluntary and any cost associated with submission shall not be reimbursed by the Government. The information requested will be used by DOS to facilitate decision making. All information received in response to this RFI marked “Proprietary” will be handled accordingly. Responses to the RFI will not be returned. As stated in FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract. Responses to this RFI will assist DOS in determining the potential level of interest, competition adequacy, and technical capabilities of commercial industry to provide the required products and services. The Government does not guarantee any action beyond this RFI.

Note that a similar recent RFI (19AQMM22N0043) was issued for small businesses only, and response to this RFI is open to all. If you responded to the previous RFI, you need not respond to this one too.

2. Background The Department of State’s CCS office is seeking information on a cloud-based faxing solution to migrate from slow and costly manual/semi-automated faxing processes to an enterprise-wide, scalable, secure, and cloud-based fax system that offers increased efficiency and security. The goal is to reduce time and costs associated with manual faxing. Maintaining fax devices, fax servers, toner/ink, paper, analog fax lines, along with support staff for operational sustainment, can be costly. Additionally, manually faxing documents burdens staff who must remain physically present while sending/receiving faxes, especially if there is sensitive or PII/PHI information transmitted. Unattended fax machines can introduce security risks. An enterprise cloud fax solution will allow DOS users to remotely fax from their endpoint devices and can be integrated with content management applications which provide document management. In addition, this is a critical opportunity to improve and simplify a vital communication requirement that allows users to send and receive faxes in the cloud through an email program or web portal without the on-premises hardware or software to manage while simultaneously reducing the physical footprint and capital expenditures cost to DOS.

CCS requires the vendor to provide the products and associated support services necessary to design, customize, install, integrate, and maintain a Cloud-Based Faxing Solution Service. Primary requirements include, but are not limited to the following:

2.1. The solution must be FedRAMP certified Moderate

2.2. Must meet HIPAA, CJIS and PII compliancy.

2.3. The solution must be cloud-hosted and cloud-managed.

2.4. The solution must be capable for disaster recovery/failover.

2.5. The solution must fully integrate with the DOS ServiceNow ITSM platform to seamlessly update ServiceNow tickets.

2.6. Ability to integrate with the Department’s Federated Identity Management System such as PKI and Multifactor Authentication solutions, such as Azure AD and Okta.

2.7. Provide serverless faxing capabilities to reduce administrative and maintenance issues.

2.8. Provide single sign-on integration capabilities.

2.9. Ability to assign multiple users a single DID (Direct Inward Dialing), such as a department main fax number.

2.10. Ability to use the current DOS fax numbers.

2.11. Ability for department staff to receive faxes from a single DID, such as a department main fax number.

2.12. Ability for user to forward their fax mailbox when on leave.

2.13. Users must be able to send faxes from their Microsoft O365 Email account.

2.14. Users must be able to send faxes through an email or a web portal by attaching electronic documents from any endpoint devices.

2.15. Users must be able to receive, view and forward faxes through email or a web portal from any endpoint devices.

3. Key Generic Tools and Minimum Capabilities

4.1. Cloud-Based Faxing Solution Administration Capability

4.1.7 Tracking and auditing capabilities to control costs and manage resources.

4.1.8 Generate reports and track fax jobs by user, department, job title or endpoint devices.

4.2 Mobile device Fax support

5. General System Requirements

5.1. The Contractor shall provide the managed infrastructure services on a 24 hour per day, 7 days per week, 365 days per year basis.

5.2. The managed Cloud Fax (EFax) service shall provide DOS the ability to send and receive secure fax documents electronically, exponentially improving the security and efficiency of faxing services within DOS. DOS embassies and consulates and CONUS sites requiring a managed EFax service shall be able to connect to the cloud-based system, streamlining the request process, and reducing the implementation time. Sites with existing faxing services will migrate to the managed EFax service with support from the EFax provider. Outside parties shall have the ability to send faxes in a secure manner which the managed EFax service will capture and route to the correct DOS office, process, or staff member. Similarly, DOS shall have the ability to send outbound faxes without the need to print, timestamp, and scan prior to sending a document. This shall include the capture and transmission of data from various DOS applications.

5.3. The Contractor shall provide all management, transportation, equipment, tools, materials, service-related equipment, supplies, installation, supervision, engineering, maintenance, testing, and services necessary to make the services, and features fully operational and perform all the tasks associated with providing an enterprise-wide managed cloud faxing service. The managed EFax service shall include ongoing responsibility for 24-hour monitoring, managing and/or problem resolution. The Contractor shall be bound by the SLAs that state the performance and quality metrics of their relationship. The managed EFax service shall be capable of supporting transition of the entire DOS enterprise.

5.4. The system must feature real-time logging of account and system functions for security and maintenance purposes.

5.5. Preferably, no agent will be installed on the endpoint devices. If the system requires an agent to be installed on the endpoint devices, it should be the smallest possible footprint.

5.6. System upgrades must be completed within contractually stipulated timeframe after release. Contract will include any upgrade fees.

6. System Redundancies:

6.1. High Availability – The system shall be critically reliable and fully redundant. No single-point-of-failure shall exist to meet this requirement. The system shall provide 99.99% up-time and provide for a seamless transition from a failed component/system to the redundant component/system. The system must be able to perform consistently with no diminished functionality under periods of intense usage (i.e., high Fax volume, excessive network traffic, operating on backup power, air conditioning failure, etc.)

7. Database and Records

7.1. Import/Export – The system must provide the ability to import and export records as an individual record, in total, or as customized selected sets of records for business purposes. Exported data must include a format that meets federally mandated and DOS record-keeping standards.

8. Additional Communication Features

8.1. SMS – The system must have the ability to send alerts via text messages both domestically and internationally to one or more users. Text will be sent both immediately and programed to send at a given time in the future.

8.2. Email – The system must have the integrated ability to email one or more users.

9. System Integration

9.1. DOS applications: Where applicable, the System must have the ability to integrate data from other Operations Centers and State Department applications including, but not limited to:

9.1.1. DOS Microsoft’s Active Directory/Azure

9.1.2. Exchange Global Address Database

9.1.3. ServiceNow

10. Metrics, Analytics, Reports

10.1. Reports – The system must create users and administration reports, both regularly scheduled and ad hoc, that can be exported into Department of State various formats (Word, PDF, and Excel). Reports will be customizable based on data filters and include numeric, text, and graphical outputs. System and user data should be limited and only exported by approved users who have access to reporting and logging functions.

10.1.1. The system must create various Department of State reports, including but not limited to user and fax reports (total # of users, average fax per user, average cost per user, total fax pages, job counts, total cost, etc.,)

10.1.2. Ability to build custom reports, with formula-based feature

10.1.3. Ability to export reports to Microsoft Excel, Word and PDF

10.1.4. Ability to schedule reports to groups of, or specific, configurable, recipients

10.1.5. Ability to drill down into reports

10.1.6. The system must maintain real-time system administration and technical logs that can be exported for maintenance and security purposes.

10.2. Metrics Dashboard – The system must feature a dashboard where users can view statistics, set up regular and ad hoc reports, and provide analytics, including trend analysis.

10.3. Provide a database interface for connection of business intelligence tools

11. Graphic User Interface (GUI) and Additional Customizations

11.1. Customized GUI – The contractor must be able to customize every aspect of the user experience. The GUI layout and appearance, directory fields, and database functionality shall be fully customizable to the specific needs of CCS.

11.2. Customized Alerts – The system must have system generated alerts/notifications regarding faxing. The system must allow users to program alerts to review database records, run reports, etc.

12. Security Requirements

12.1. Vendors must:

12.1.1. Hold or obtain Top Secret clearances granted by or recognized by the Defense Security Systems Operations Center Columbus (DSSOCC), formerly known as Defense Industrial Security Clearance Office (DISCO) for all contractor and subcontractor personnel working on the project.

12.1.2. Make every effort to maximize procurement of hardware manufactured in the United States using parts built in the United States and software developed in the United States. Hardware and software components shall comply with Section 508 and the Trade Agreements Act (FAR 52-225-5).

12.2. The system must:

12.2.1. Conform to FIPS PUB 200: the minimum-security requirements as defined through the use of the security controls in accordance with the National Institute of Standards and Technology Special Publication (NIST SP 800-53).

12.2.2. Meet IC Tech Specs ICS 705 Chapter 11 governance, including the stipulation that information systems equipment with telephonic or audio features shall be protected against remote activation and/or removal of audio (analog or digitized) information.

12.2.3. Support for single sign-on (SSO)

12.2.4. Supports restricted access to views and configuration based on definable user privileges

12.2.5. Ability to manage users/accounts remotely

12.2.6. Built-in registration, fraud, and intrusion detection features

12.2.7. Ability to integrate/interoperate with multiple firewalls

12.2.8. Support for secure connections to customers/business partners

12.2.9. Conforms to trusted service principles, including security, availability, processing integrity, confidentiality, and privacy.

12.2.10. Two-factor authentication is available.

12.2.11. Virus/malware-protected.

13. System Lifecycle Support

13.1. Support service.

13.1.1. All support service described below must be executed by personnel with a final top-secret security clearance.

13.1.2. Site survey – Contractor will perform surveys to gather site-specific information to detail the products, work, and schedules required to access applicable services.

13.1.3. Site preparation – The contractor will perform any site preparation, and other related work identified in the Site Survey Reports (SSR)s. The contractor shall complete all site preparation work without interruption to the current system’s operation.

13.1.4. Shipping of equipment – The contractor will ship equipment to the specified government location in accordance with best commercial practices.

13.1.5. System installation including engineering and configuration – The contractor will install and make operational all systems. The contractor shall complete system installation without interruption to the current system’s operation

13.1.6. Staff training – The contractor shall provide hands-on training for all system users in accordance with the training plan identified in the SSR.

13.1.7. On-site post-installation support – The contractor shall provide 24/7 on-site support for the first 30 days after the new system is operational.

13.1.8. IT CCB approval - The contractor shall work with local IT staff to submit all requirements through the Department’s IT Change Control Board and assist with Cybersecurity Assessment and Authorization.

13.1.9. Transition plan – The contractor shall provide documentation to describe how the transition from the current system to the new one will occur without interruption.

13.1.10 Software maintenance and software upgrades – The contractor shall describe how it will implement version upgrades while retaining customized DOS functionality.

13.1.11 Warranty and Life Cycle Support– The contractor shall describe warranty, licenses, and annual life cycle support, included with the proposed system.

13.2. Key personnel

13.2.1. The vendor will provide key personnel on a on-call basis once the system is operational: (Note – key personnel must hold final top-secret clearance)

13.2.2. Network Configuration/Admin Subject Matter Expert (SME) with a minimum of 5 years of experience in network design and admin/configuration, and 2 years of network/system implementation experience.

13.2.3. Network Engineer – Must have a minimum 3 years of experience in network design and at least 1 year of network/system implementation experience.

13.2.4. Systems Engineer – Must have a minimum 3 years of experience in network design and at least 1 year of system implementation experience.

14. RFI RESPONSE INSTRUCTIONS:

14.1. Provide the additional following information in your response:

1. Section 1 - Corporate Overview

2. Please complete the following prompts. Responses to this section (XIV) shall be no longer than one page in length and do not count against the page count maximums described for other sections.

3. Name of Company

4. Name of Business Unit Responding to the RFI (if applicable).

5. Type of Small Business and NAICS code:

6. Company business size with socioeconomic classification based on North American Industry Classification Code 541511 – Custom Computer Programming Services

7. DUNS number:

8. CAGE Code:

9. Corporate Address:

10. Website URL:

11. One Point of Contact (POC); please provide a name, phone number, and email address:

12. Does your company have a cost accounting system deemed adequate by a cognizant audit agency, such as DCAA or ONR (Yes or No and please provide the audit agency)?

13. Does your company have an approved purchasing system (Yes or No)?

14. Does your company have a GSA Schedule Contract, such as Government Wide Acquisition Contract (GWAC), NASA SEWP contract, OASIS, etc. If yes, please identify which acquisition vehicle your company holds a contract(s) with and the corresponding contract number.

14.1.2 Questions: Department of State seeks to understand the following in your response:

1. Describe your current solution Architecture and how it compares to the functional requirements noted in this RFI. List all technical and security standards your solution employs.

2. Provide a summary of your technical capabilities and expertise to execute Scaled Agile Framework management methodologies to meet the requirements. If appropriate, explain why this methodology should not be applied to contract execution.

3. If you currently have a commercial cloud hosted E-Fax capability, is it FedRAMP certified?

4. Has your commercial solution ever received an Authority to Operate (ATO) from any Government Agency and if so, which agency?

5. Does your product store and transmit sensitive information using security mechanisms that meet Federal Information Processing Standard (FIPS) 140-2 criteria? Describe the overall security features of your solution in relationship to this RFI. Discuss details on how data is protected in transit and at rest, and from any cyber vulnerabilities or attacks, such as Denial of Service (DoS) attacks, malware, spoofing, spams, and viruses.

6. Describe your ability to temporarily store faxed documents in the event of failure of transmission or receiving due to operational system issues.

7. Describe the disaster recovery/system failure capabilities of your solution.

8. Does your solution integrate with email applications such as Microsoft (MS) Outlook right out of the box? If so, which applications and versions.

9. Are there additional software requirements to implement the solution across Department of State, including augmentations that may be required for currently existing multifunctional devices (fax, printer, scanner)? Include a vendor list of devices not requiring changes as applicable.

a. Total Max capability of existing fax numbers that can be ported to eFax solution

b. Typical amount of time required to port numbers to eFax solution

c. Max numbers your service can port simultaneously

i. Initial operational capability year one base task of 100,000 faxes a month. Include the price to complete items to establish the service, test, evaluate, and achieve an initial operating capability (IOC) within 12 months from award.

ii. Fully Operationally managed

iii. Estimated fully operational Managed Services with a capacity of 100,000 faxes per month annualized pricing over five years, related to implementing and managing this service across Department of State. If all fees are inclusive of service, please state this.

1. Any Licenses or subscriptions fees.

2. Number porting fees/sustainment fees

3. Software maintenance (patches, upgrades etc.).

4. Implementation support planning and execution (including site surveys and training).

5. Non-recurring software development.

7. Cloud hosting fees.

8. Security accreditation support

23. Information to help determine if the requirement is commercially available, including pricing information, basis for the pricing information (e.g., market pricing, software-subscription based, catalog pricing), delivery schedules, customary terms and conditions, warranties, etc.

15. SUBMISSION INSTRUCTIONS:

Responses to this RFI must total no more than 12 pages; with Times New Roman font no smaller than 10 point; however, text included in graphics, tables, and figures can be no smaller than 9 point. Limit any foldout pages to two per section. The cover page, cover letter, and table of contents are not included in the total page count. The submissions must be in enough detail and clarity to provide DOS with the information it needs.

Submissions should describe the business model, i.e., SAAS or PAAS with managed services. They should also clarify changes can be made by the Department at the operational level, and which ones need to be made by vendor. Of changes made by vendor, what are included and what are extra consulting costs?

15.1. Please provide an electronic version of your written response in an editable Microsoft Word document and corresponding Excel tracking sheet to:

15.1.1. AQM CONTACT, William Thuman, thumanwg@state.gov, no later than TBD (approximately three weeks after RFI Issue)

15.1.2. The Government will accept questions until July 12, 2022 (approximately 5 business days after RFI issue) EDT.

15.1.3. Questions must be submitted to AQM, questions posed via another method will not be answered. Please use an email that is identifiable with your company. Failure to follow instructions will result in questions not being answered. Please reference the line number of this RFI to facilitate the Q&A process.

15.1.4. The Government will post responses on SAM.gov by TBD (approximately 5 business days after questions are due, depending on the number of questions).

15.1.5. Please be advised that all submissions become Government property and will not be returned.

UNCLASSIFIED//FOR OFFICIAL USE ONLY