RFI ITSM Tool 3.18.25.pdf

REQUEST FOR INFORMATION

Information Technology Service Management Tool

Table of Contents Introduction:

Requirement:

Responses: ............................................................................................................ Error! Bookmark not defined.

Secure Software Attestation:

Section 508 Requirements:

Capability Statement

Post RFI Phase

Introduction:

This is a Request for Information (RFI) only issued for conducting market research. Accordingly, this RFI constitutes neither a Request for Quote (RFQ)/Request for Proposal (RFP), nor a guarantee that one will be issued by the

Government in the future; furthermore, it does not commit the Government to contract for any services described herein. The Department of Veterans Affairs (VA) is not, at this time, seeking proposals or quotes, and therefore, will not accept, review, or evaluate unsolicited proposals or quotes received in response hereto. This notice is not to be construed as a commitment on the part of the Government to award a contract, nor does the Government intend to pay for any information submitted because of this request. The Government does not reimburse respondents for any costs associated with submission of the information being requested or reimburse expenses incurred for responses to this RFI.

The information provided may be used by VA in developing its acquisition strategy and Performance Work

Statement (PWS) or Product Description (PD). Any information submitted by respondents to this RFI is strictly voluntary; however, any information received shall become the property of the Government and will not be returned to the respondent. Interested parties are responsible for adequately marking proprietary, restricted, or competition sensitive information contained in their response. This is a request for information and does not obligate the Government in any way, nor does it commit the Government to any specific course of action. Product information, brochures, part numbers, and/or other description information may be included with the submission.

Requirement:

This requirement will be for brand name or equal commercial software subscriptions for license entitlements, with a focus on reducing overall costs. VA, Office of Information and Technology (OIT), Infrastructure Operations (IO) IT

Service Management (ITSM) currently leverages ServiceNow as the OIT Enterprise Resource Planning (ERP) tool.

The following information outlines the current state of the ITSM solution utilized by VA. In an effort to reduce costs, we are requesting that industry partners review our existing modules and the utilization of our current tool. We are open to the identification and evaluation of alternative tools that can meet our requirements and support the mission of the VA. VA requires enterprise licenses that will accommodate the VA userbase of up to 600,000.

Please see RFI submission instructions below. The Government is also seeking recommendations on the best user model, either ala carte and/or unlimited license, to meet the VA’s requirements.

Today, VA uses ServiceNow in the following mission-critical manners: ServiceNow is configured to support VA service desk operations across the entire enterprise and provide event and incident management for early warning and detection of system degradations and service interruptions to prevent outages to critical VA business systems.

As VA adds clinicians, support staff, and volunteers to meet the needs of increased patient care, the ITSM Tool is used to provision all new devices and provide immediate clinical application access for staff. Veterans Health

Information Systems and Technology Architecture (VISTA) is the VA’s Electronic Health Record Management

(EHRM) system. The ITSM Tool ensures system availability which monitors potential deficiencies in over 30 VISTA applications, including those that will be subsequently migrating to the new EHRM platform, called Cerner. The

ITSM Tool triages IT-related issues that surface in VA medical devices used by clinicians. To support burgeoning telehealth needs, VA uses the ITSM Tool for clinician credentialing and for immediate system password reset across the enterprise for all VA applications, including performing specific application capacity monitoring in support of telehealth. The ITSM Tool monitors the VA network health for the entire workforce. Its capability can report and triage issues that could disable telehealth workers or otherwise negatively impact all other IT services provided to

Veterans and their families.

The OIT ERP tool provides VA with a single service management console to support key stakeholders across the VA enterprise including OIT, Veterans Benefits Administration, Veterans Health Administration, and National Cemetery

Administration.

Currently, the majority of the existing contract operates under a bundled unlimited license agreement, a user model based on a top limit of 750,000 VA users controlling the contract not to exceed. . We are seeking a more structured approach to limit the number of licenses to a maximum of 600,000. VA wants to focus less on growing the footprint of the current ITSM tool at the VA and focus more on fully utilizing what we have deployed today.

The ITSM tool must meet the following requirements:

The ITSM Tool must have Federal Risk and Authorization Management Program (FedRAMP) High approval at time of proposal submission. The vendor must provide documentation verifying current FedRAMP authorization, including an Authorization to Operate (ATO). For cloud-hosted solutions, the ITSM Tool must be deployed on a FedRAMP-authorized cloud service provider. The vender must also demonstrate ongoing compliance with FedRAMP continuous monitoring requirements to ensure the security and integrity of federal data.

The current tool guarantees a minimum uptime of 99.8%, measured monthly, excluding scheduled maintenance. The vendor must provide a Service Level Agreement (SLA) outlining uptime commitments equal to or greater (99.8%), incident response times and penalties for non-compliance.

The ITSM Tool must allow the VA to track license utilization in real time vis dashboard or other means.

Hosting solutions should be provided to include Cloud and On-Premises.

The cloud hosting solution must offer secure, scalable cloud=based deployment on a FedRAMP-authorized cloud service provider.

The current solution is hosted by the license provider, however if an on-premises solution is available resulting in cost savings to the VA but as part of the RFI response vendors must provide requirements for deployment on CA managed infrastructure.

See Attachment A for all currently in production modules in green (owned) that would be required to meet capabilities. As mentioned above focus more on fully utilizing what we have deployed today.

Current license utilization is as follows:

The VA currently utilizes the license types listed in the Part Table, with the following license utilization requirements. The ITSM tool for this request must match both the license utilization and capabilities. The VA uses a total of 25 ServiceNow environments, with seven designated for specific purposes: 2 for Production and 5 for Sub

Production. The remaining environments are dynamic and used as needed.

Below is currently what is being provided to VA for informational purposes only.

Part Table

Item Part # Description License Type

Not to Exceed

(NTE)

Quantity

(QTY)

1 PROD00832 ServiceNow® Instance - Government Data Center - Production

Instance 4

2 PROD00832 ServiceNow® Instance - Government Data Center - Non- Production

Instance 21

3 PROD17269 IT Service Management Enterprise – Unrestricted User with Unlimited Virtual Agent Conversation Transactions

Unlimited License

4 PROD16953 Strategic Portfolio Management Professional - SPM User

Unlimited License

5 PROD16963 IT Operations Management (ITOM) AIOPs Enterprise

Unlimited License

6 PROD11482 ServiceNow® IntegrationHub Enterprise with Unlimited via sys_user IntegrationHub Transactions annually

Unlimited License

7 PROD17145 ServiceNow® Customer Service Management Professional - CSM User v6

CSM User 800

8 PROD16744 Security Operations Professional

- SIR - Unrestricted User

Unlimited License

9 PROD16745 Security Operations Enterprise - VR - Devices

Unlimited License

10 PROD15033 ServiceNow® Software Asset Management Professional - Computer v3

Unlimited License

11 PROD12015 ServiceNow® Application Portfolio Management - APM User

Unlimited License

12 PROD13074 ServiceNow® Now Platform® App Engine

Unlimited License

13 PROD16295 Impact Total - Package Unlimited License

OPTIONAL CLIN ITEMS

Item Part # Description License Type

Not to Exceed

(NTE)

Quantity

(QTY)

14 PROD00832 ServiceNow® Instance - Government Data Center - Production

Instance 1

15 PROD00832 ServiceNow® Instance - Government Data Center - Non- Production

Instance 6

16 PROD17145 ServiceNow® Customer Service Management Professional - CSM User v6

CSM User 400

17 PROD17145 ServiceNow® Customer Service Management Professional - CSM User v6

Unlimited License

18 PROD17238 ServiceNow® HR Service Delivery Enterprise – HR User v2 with Performance Analytics

HR User 300,000

19 PROD17238 ServiceNow® HR Service Delivery Enterprise – HR User v2 with Performance Analytics sys_user

Unlimited License

20 PROD12490 ServiceNow® Integrated Risk Management Professional - IRM User

IRM Operator 2,000

21 PROD16047 Hardware Asset Management Professional

Subscription Units 611,435

22 PROD16047 Hardware Asset Management Professional

Unlimited License

23 PROD13097 ServiceNow® Integrated Risk Management Professional Enterprise - Unrestricted

Unlimited License

24 PROD18126 IRM Lite Operator IRM Lite Operator 4,000

25 PROD12023 ServiceNow® Vendor Risk Management - Vendors

Vendors 1,990

26 PROD16885 Workplace Serv Delivery – Unrestricted v2

Unlimited License

27 PROD16884 Workplace Service Delivery - Workplace User v4

User 20,000

28 PROD15369 Field Service Management Pro Fulfiller User 20,000

29 PROD15370 Field Service Management Contractor

Contract User 20,000

30 PROD08558 Customer Performance Testing Instance - Per Week

Weekly Instance 4

Secure Software Attestation:

The contractor shall comply with M-22-18 when using third-party software on VA information systems or otherwise affecting the VA information. M-22-18 requires software producers to self-attest that secure software development practices are utilized as outlined by EO 14028 and NIST Guidance. The contractor must provide a self-attestation of compliance with these requirements. A third-party assessment provided by either a certified FedRAMP Third Party Assessor Organization (3PAO) or one approved by the agency shall be acceptable in lieu of a software producer's self-attestation. This requirement is applicable to new purchases, software renewals, and major version changes.

Although no documentation is required in response to this RFI, contractors are encouraged to upload attestations in advance of the actual solicitation to the CISA RSAA portal available at: https://softwaresecurity.CISA.gov

Section 508 Requirements:

The Federal Accessibility Law affecting all Information and Communications Technology (ICT) Procurements

(Section 508) is part of the Rehabilitation Act of 1973, which was amended in 1998. It requires that all federal agencies ensure their electronic and information technology is accessible to people with disabilities. This means that employees and members of the public with disabilities must have access to ICT that is comparable to the access available to those without disabilities.

Please ensure that the provided software solution complies with “508 Chapter 2: Scoping Requirements”.

Information about these Section 508 standards can be found at Revised 508 Standards and 255 Guidelines (access-board.gov).

RFI Submission Instructions:

Please submit a capability statement describing your company’s ability to meet the overall requirement described and responses to the questions below. The capability statement shall be limited to 15 pages. Also, please note that the proposed requirement must adhere to EO14028 and NIST guidance for Secure Software Development.

Responses shall be submitted to Contract Specialist, John Adamitis, at john.adamitis1@va.gov and Contracting Officer, Troy Loveland, at troy.loveland@va.gov. Please include best pricing in your response.

Capability Statement Questions

1) Are there any specifications that you believe are unachievable by industry? If so, please state why.

2) What additional information would be needed to provide a firm fixed price quote for each item/task?

3) Does industry have suggestions or suggested strategy for replacement of ServiceNow with a different tool(s).

4) Include the following identification information:

a. Name of Company

b. Address

c. Point of Contact

d. Phone Number

e. Fax Number

f. Email address

g. CAGE/Data Universal Numbering System (DUNS) Number

h. Company Business Size and Status for NAICS 541519.

i. Any Schedules held on General Services Administration (GSA), Government-Wide Acquisition Contracts (GWAC) held on the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V, or any other schedule not mentioned above to assist in determining acquisition strategy if you are included in one or more. Please also include Contract Number, expiration date, etc.

j. Socioeconomic data: If a small business, what type of small business are you? Are you able to comply with FAR 52.219-6 and 52.219-14 in execution of this effort? Are you able to comply with VAAR 852.219-73, VA Notice of Total Service-Disabled Veteran-Owned Small Business Set-Aside and with subcontracting limitations in 13 CFR 125.6 in execution of this effort?

5) Is your company currently providing similar services to any government agency or other non-government customers? If so, please identify the agency or non-government customer. If you are unwilling to share your customers' identity, please address whether your company offers the same or similar services, commercially (outside the federal government).

Post RFI Phase

VA envisions that once RFI responses are reviewed, select responders may be invited to provide a face-to-face or telephonic briefing to VA personnel to answer additional questions with respect to the response given. VA retains sole discretion of whether any post RFI briefings are warranted, and which industry partners may be invited to provide additional market research information.

OFFERORS ARE ADVISED THAT THIS REQUIREMENT MAY BE DELAYED, CANCELED, OR REVISED AT ANY TIME.