Attachment A - NRC ITISS Statement of Work.pdf

33-11-325 Attachment A: Statement of Work

Information Technology Infrastructure and Support Services

Statement of Work

Table of Contents

C. DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

C.1 OVERVIEW

C.2 INTRODUCTION

C.3 STATEMENT OF INTENT

C.3.1 Program Objectives C.3.2 Specific Service Objectives C.3.3 Period of Performance C.3.4 Core Services and Additional Services C.3.5 Intent for Mutual Cooperation between Offeror and NRC Staff C.3.6 NRC Reserved Rights C.3.7 Additional Contextual Reading

C.4 NRC ENVIRONMENT

C.4.1 Staff Levels C.4.2 NRC Locations C.4.3 NRC Business Hours C.4.4 Existing Information Technology Infrastructure

C.4.4.1 Personal Computing Environment (Desktop/Laptop Computers) C.4.4.1.1 Hardware C.4.4.1.2 Software

C.4.4.2 General Server Environment C.4.4.2.1 Hardware C.4.4.2.2 Software

C.4.4.3 Application Hosting Server Environment (Additional Task) C.4.4.3.1 Hardware C.4.4.3.2 Software

C.4.4.4 Network Appliance, Printers, and Other Hardware C.4.4.5 Incumbent Contractor Staff Levels

C.5 CORE SERVICES

C.5.1 Basic Infrastructure Support Services

C.5.1.1 BlackBerry C.5.1.2 Electronic Mail (Email) and Messaging C.5.1.3 File and Print

C.5.1.3.1 File Management C.5.1.3.2 Print Management C.5.1.3.3 Network Attached Devices Management

C.5.1.4 Personal Computing and Related Software Licensing C.5.1.4.1 Personal Computing C.5.1.4.2 Office Productivity Software Deployment C.5.1.4.3 Software License Management C.5.1.4.4 Personal Computer Risk Management

Page i of v

C.5.1.5 Network Components C.5.1.5.1 Network Management C.5.1.5.2 Wireless Networking C.5.1.5.3 Network Asset Management C.5.1.5.4 Network Device System Administration C.5.1.5.5 Maintenance and Patching Management C.5.1.5.6 Network Monitoring

C.5.1.6 Remote Access C.5.1.7 Integration

C.5.1.7.1 Project Management C.5.1.7.2 Research C.5.1.7.3 Development C.5.1.7.4 Implementation C.5.1.7.5 Test

C.5.1.8 High Performance Computing C.5.2 Service Delivery and Management Responsibilities

C.5.2.1 Service Strategy C.5.2.1.1 Strategy Generation C.5.2.1.2 Financial Management C.5.2.1.3 Service Portfolio Management C.5.2.1.4 Demand Management

C.5.2.2 Service Design C.5.2.2.1 Service Catalog Management C.5.2.2.2 Service Level Management C.5.2.2.3 Capacity Management C.5.2.2.4 Availability Management C.5.2.2.5 IT Service Continuity (and Backup and Recovery) C.5.2.2.6 Information Security Management C.5.2.2.7 Supplier Management

C.5.2.3 Service Transition C.5.2.3.1 Transition Planning and Support C.5.2.3.2 Change Management C.5.2.3.3 Service Asset and Configuration Management C.5.2.3.4 Release and Deployment Management C.5.2.3.5 Knowledge Management

C.5.2.4 Service Operation C.5.2.4.1 The Service Desk Function C.5.2.4.2 Event Management C.5.2.4.3 Incident Management C.5.2.4.4 Problem Management C.5.2.4.5 Request Fulfillment C.5.2.4.6 Access Management (and the Directory) C.5.2.4.7 Other Service Operation Considerations

C.5.2.5 Continual Service Improvement (CSI) C.5.2.5.1 Centralized Reporting C.5.2.5.2 Proactive Reporting C.5.2.5.3 General Reporting

Page ii of v

C.6 ADDITIONAL SERVICES

C.6.1 Computer Facilities Management

C.6.1.1 Program Management C.6.1.2 Monitoring C.6.1.3 Quality Assurance C.6.1.4 Backup and Recovery C.6.1.5 Computer Operations C.6.1.6 Physical Facility C.6.1.7 Specialized Systems

C.6.1.7.1 Agency-wide Documents Access Management System (ADAMS) C.6.1.7.2 Human Resource Management System

C.6.2 Operations Center Network Management C.6.2.1 Operations C.6.2.2 Hardware Maintenance C.6.2.3 Software Maintenance C.6.2.4 Reporting

C.6.3 Data Center System Administration C.6.3.1 Project Management C.6.3.2 ADAMS and HLW Meta Systems

C.6.3.2.1 Document Storage Support C.6.3.2.2 Database Support C.6.3.2.3 Backup and Recovery C.6.3.2.4 Security Administration C.6.3.2.5 Disaster Recovery C.6.3.2.6 Performance and System Monitoring C.6.3.2.7 Systems Administration

C.6.3.3 Mainframe Administration C.6.3.3.1 Application Support C.6.3.3.2 Systems Administration C.6.3.3.3 Backup and Recovery C.6.3.3.4 Training

C.6.3.4 HRMS

C.6.3.4.1 PeopleSoft Application support C.6.3.4.2 Database Support C.6.3.4.3 Disaster Recovery C.6.3.4.4 Performance System Monitoring C.6.3.4.5 System Administration

C.6.3.5 Production Database Management C.6.3.5.1 Application patching C.6.3.5.2 Production Scripts C.6.3.5.3 Disk Space allocation C.6.3.5.4 Database Design C.6.3.5.5 Backup and Recovery C.6.3.5.6 Troubleshooting C.6.3.5.7 Documentation

C.6.3.6 NRC Web Servers and Three Tier Environments C.6.3.6.1 Web Server Support for iPlanet and Coldfusion

Page iii of v

C.6.3.6.2 Performance and System Monitoring C.6.3.6.3 Backup and Recovery C.6.3.6.4 System Administration

C.6.4 Wireless Communications Services C.6.4.1 Telecommunications Management and Oversight C.6.4.2 Project Status Reports

C.6.4.2.1 Monthly Status Reports C.6.4.2.2 Weekly Status Reports

C.6.4.3 Telecommunications Support Services C.6.4.3.1 Maintenance of Property Management Records C.6.4.3.2 Wireless Hardware and services C.6.4.3.3 Products and Services

C.6.4.4 Telecommunications Expense Management Services C.6.5 Software License Management

C.6.5.1 Software Inventory C.6.5.2 Planning and Design C.6.5.3 Software License Management Tool C.6.5.4 Enterprise License Vendor Management C.6.5.5 Software Catalog C.6.5.6 Usage Reporting and Auditing

C.6.6 Safeguards Local Area Network and Electronic Safe Services C.6.6.1 General C.6.6.2 System Administration

C.6.6.2.1 Performance Monitoring C.6.6.2.2 Backup C.6.6.2.3 Recovery C.6.6.2.4 Image Backup C.6.6.2.5 Database Administration

C.6.6.3 User Support C.6.6.3.1 Access C.6.6.3.2 Helpdesk Support

C.6.6.4 System maintenance C.6.6.4.1 Daily C.6.6.4.2 Weekly C.6.6.4.3 Monthly

C.6.6.5 Server Shutdown/Restart C.6.6.6 Disaster Recovery C.6.6.7 Configuration Management C.6.6.8 System Documentation Reference Update C.6.6.9 Status Meetings

C.6.7 Technology Assessment Center C.6.8 Emergency Response Data System (ERDS) Operations and Maintenance . 114

C.6.8.1 General C.6.8.2 Monitoring C.6.8.3 Maintenance C.6.8.4 Management C.6.8.5 ERDS Phase II Support

Page iv of v

Page v of v

C.6.8.6 Reporting C.6.8.7 Training

C.6.9 Secure LAN and Electronic Safe C.6.9.1 General C.6.9.2 User Support

C.6.9.2.1 Access C.6.9.2.2 Helpdesk Support

C.6.9.3 Records/Document Management C.6.10 Development Facility C.6.11 Microsoft SharePoint Support

C.6.11.1 Deliverables C.6.11.2 Ad-Hoc Meetings

C.6.12 Extraordinary Move Support

C.7 TRANSITION CONSIDERATIONS

C.7.1 Initial Transition C.7.2 Other Transition Considerations C.7.3 Transfer of End User Assets to a Successor Offeror or the Government

C.8 KEY PERSONNEL

C.8.1 Core Services C.8.2 Additional Services

C.9 WORKING ONSITE AT NRC FACILITIES

Appendix A: Quality Assurance Surveillance Plan (QASP)

A.1. Introduction

A.2. Surveillance

A.3. Unacceptable performance

A.4. Service Level Requirements

Appendix B: NRC WAN Connections

Appendix C: NRC WAN Utilization

Appendix D: Space Currently Used by Incumbent Contractors

Appendix E: Reporting Requirements

Appendix F: Acronyms

Appendix G: NRC IT Roadmap

C. DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

C.1 OVERVIEW

The U.S. Nuclear Regulatory Commission (NRC) is seeking an offeror that has proven experience in developing and maintaining a comprehensive Configuration Management (CM) strategy to provide ongoing agency-wide information technology infrastructure and support services. In addition, the NRC requires a consistent, integrated, service delivery approach with a foundation in the Information Technology Infrastructure Library Version 3 (ITIL v3) framework (see section C.5.2 Service Delivery and Management Responsibilities).

The contract awardee shall be expected to provide a wide range of IT infrastructure services that are set forth in section C.5.1 Basic Infrastructure Support Services, wireless telecommunications services described in section C.6.4 Wireless Communication Services, data center services set forth in C.6.1 Computer Facilities Management and section C.6.3 Data Center System Administration), programmatic IT infrastructure contracts set forth in sections C.6.2 Operations Center Network Management; C.6.6 Safeguards Local Area Network and Electronic Safe Services; C.6.8 Emergency Response Data System (ERDS) Operations and Maintenance; C.6.9 Secure LAN and Electronic Safe; and C.6.11 Microsoft SharePoint Support). The contract awardee shall also provide IT Integration Services (C.5.1.7 Integration; C.6.5 Software License Management; C.6.7 Technology Assessment Center; C.6.10 Development Facility and C.6.12 Extraordinary Move Support

C.2 INTRODUCTION

The NRC was created as an independent Agency by Congress in 1974 to enable the nation to safely use radioactive materials for beneficial civilian purposes while ensuring that people and the environment are protected. It regulates commercial nuclear power plants and other uses of nuclear materials, such as in nuclear medicine, through licensing, inspection and enforcement of its requirements. The NRC’s headquarters are in Rockville, Maryland, and it has a number of other offices around the United States. The NRC currently uses a U.S.

General Services Administration (GSA) Seat Management services contract task order to provide agency-wide Information Technology (IT) infrastructure and support services. The final option year for the order ends on September 27, 2010 (with the potential of being extended until December 27, 2010).

C.3 STATEMENT OF INTENT

It is the intention of the NRC to award this contract, in its entirety, to a single prime vendor.

This prime vendor will be responsible for the management of all deliverables under the contract.

C.3.1 Program Objectives The NRC intends to establish a performance based contract to provide the full scope of IT infrastructure support to its customers. The programmatic objectives for this acquisition include:

1. Consistent provision of IT infrastructure support services at the required levels of service for the most reasonable cost;

2. Maintaining a robust, secure computing environment that protects the information and users that the IT infrastructure supports;

3. Adaptability of the IT infrastructure to changes in requirements and priorities;

4. Creation and promotion of collaboration between the NRC staff and the awardee to support all services under this contract; and,

5. Innovation in the use of information technology to increase the productivity of agency users, improve the agency’s security posture, and reduce the cost of services provided while maintaining customer service expectations

C.3.2 Specific Service Objectives The service objectives of the NRC for this performance based contract are to:

1. Provide personal computing solutions that allow NRC staff to effectively work securely from anywhere at any time;

2. Provide a highly consistent user support environment that meets or exceeds agreed upon performance standards;

3. Establish and maintain an effective security posture for NRC information and information systems to reasonably prevent the compromise of NRC resources that are interconnected with the NRC network and complies with appropriate Federal and agency policy and regulations;

4. Establish and maintain a rigorous framework for the management of Information Technology Infrastructure (ITI) services (i.e. ITIL version 3 (ITIL v3), ISO 20000);

5. Provide centralized support for agency users that they can obtain at any time from anywhere through a variety of mechanisms;

6. Proactively review ITI incidents to recognize patterns, establish baselines, implement improvements, provide training and solve problems to improve users’ experiences;

7. Proactively monitor the infrastructure and implement mitigations for recognized problems and issues;

8. Plan for and ensure that disruptions to ITI resources have a minimal downtime and impact on NRC users;

9. Understand business requirements of Agency users and how they impact the services within the ITI to enhance its effectiveness in support of the NRC mission;

10. Evaluate the NRC IT infrastructure environment and make specific recommendations for how the agency can better utilize existing services in different ways that better serve the needs of its users.

11. Manage an accurate, reliable, and complete inventory of both offeror furnished and Government furnished IT assets;

12. Provide “best effort” support for Government owned personal printers and Government provided software as outlined in section C.3.5 Intent for Mutual Cooperation between Offeror and NRC Staff (Item 4);

13. Establish an effective quality assurance program that ensures continuous improvement in support of the business needs of the NRC users;

14. Leverage technology to increase availability of critical business services as well as remote access; and

15. Participate in the creation and maintenance of local operating and quality assurance procedures and establish and maintain a virtual library for all documentation available through the NRC Intranet.

C.3.3 Period of Performance The period of performance for the new ITISS contract is expected to be:

Base Period: Unknown Date, 2010 – November 30, 2013

Option Year 1: December 1, 2013 – November 30, 2014

Option Year 2: December 1, 2014 – November 30, 2015

Option Year 3: December 1, 2015 – November 30, 2016

C.3.4 Core Services and Additional Services This Statement of Work (SOW) includes descriptions of core services and additional services. The NRC’s infrastructure is currently managed under a series of contracts. The first of these, the ISSC, is primarily used for seat management, some server support for shared administrative applications, and IT infrastructure research, development, and testing.

Other contracts currently providing ITISS services which are also described in this Statement of Work can be found in Table 1, below.

Contract Description Start Base End Options

Data Center Facilities Operations; FY 2009 Q3

FY 2012

Q3

2 (1 Year Each)

Data Center System Administration; FY 2010 Q2

FY 2011

Q2

4 (1 Year Each)

Wireless Telephone Services Management;

FY 2009

Q3

FY 2010

Q3

4 (1 Year Each)

Nuclear Security and Incident Response (NSIR) Operations Center Network Management.

FY 2010

Q1

FY 2011

Q1

4 (1 Year Each)

Safeguards Wireless Local Area Network

FY 2009

Q1

FY 2018

Q4

10 (1 Year Each)

Emergency Response Data System FY 2011 Q1

FY 2012

Q1

4 (1 Year Each)

Table 1 - Current Contracts providing ITISS Services at the NRC

It is the intention of the NRC to consolidate all of these services into the Information Technology Infrastructure and Support Services (ITISS) contract. Some of the additional tasks describe activities that are not currently being performed at the NRC. It is the NRC’s expectation that some of the additional tasks will be awarded within months of initial contract award. Assuming the offeror demonstrates a high-level of performance in delivering the core tasks and initial additional tasks, the NRC intends to award the remaining additional tasks.

Offerors intending to propose solutions that will be hosted external to NRC-owned facilities for either core or additional services must clearly demonstrate that they have experience providing such solutions adhering to all of the security and performance requirements of the Federal Government and the NRC.

In order to provide an accurate account regarding the current state at the NRC, the SOW provides significant detail on current inventory and corresponding management practices.

While this level of detail may appear to dictate specific technologies or solutions in many places, the NRC is very open to the proposal of innovative technologies and/or solutions that would provide greater efficiencies (including “green improvements” which would decrease the environmental impact of NRC work practices) and/or better service. In proposing innovative improvements, the NRC is also interested in timeframes and roadmaps to migrate from “as is” to the proposed “to be.” The NRC is not flexible about IT security requirements or performance requirements; all innovative proposals must adhere to security and performance requirements of the Federal Government and the NRC.

The offeror shall provide hardware and software used by the offeror in the performance of work under this contract (e.g. personal computers for the offeror’s staff, network management software tools, etc.) and incorporated into the price for the proposed services.

The NRC also expects the offeror to comply with all requirements set forth in NRC Management Directives (MD) (see http://www.nrc.gov/reading-rm/doc-collections/management-directives). The offeror should review and understand the following specific MDs related to Information Technology at the NRC: MD 2.3 Telecommunications;

MD 2.6 Information Technology Infrastructure; MD 2.7 Personal Use of Information Technology; MD 2.8 Project Management Methodology; MD 12.1 NRC Facility Security Program; MD 12.2 NRC Classified Information Security Program; MD 12.3 NRC Personnel Security Program; MD 12.5 Automated Information Security Program; MD 12.6 NRC Sensitive Unclassified Information Security Program; and MD 12.7 NRC Safeguards Information Security Program.

MDs may be periodically updated during the course of this contract, and the offeror shall comply with updated versions. It is also expected that prospective vendors consider the agency’s goals and objectives, which include identifying and implementing green improvements, when planning for innovative solutions.

C.3.5 Intent for Mutual Cooperation between Offeror and NRC Staff The NRC wishes for the chosen offeror to mutually cooperate with NRC staff. Such cooperation would meet the needs and desires of both the offeror and the NRC in a cost-effective way. For example:

1. The NRC desires an offeror that will leverage technology in their proposal to provide excellent service at a reasonable cost to both the offeror and to the NRC;

2. Throughout the course of the contract, the NRC intends to actively solicit suggested changes in behaviors or the environment that will result in cost savings that can be reinvested in improved service or additional services;

3. The NRC is interested in continual improvement of service delivery using an Information Technology Infrastructure Library version 3 (ITIL v3)-based service delivery model. The offeror shall provide service delivery using appropriate ITIL v3 best practices and assist the NRC in maturing its overall service delivery;

4. Within this document, occasional reference is made to the offeror providing their “best effort” to accomplish a service that is difficult to predict (e.g. support of printers that are not owned by the offeror, but rather are owned by the NRC). For the purposes of this document, “best effort” will include such activities as:

• Installation of software/hardware/drivers

• Testing to verify software/hardware works

• Limited troubleshooting

When problems are identified, a “best effort” service support would include using the following resources to try and resolve the problem:

• Internal resources – technicians, developers

• Internet

• Manufacturer Support

• Attempt work around http://www.nrc.gov/reading-rm/doc-collections/management-directives http://www.nrc.gov/reading-rm/doc-collections/management-directives

If none of these attempts are successful, the problem shall be returned to the NRC for resolution. The offeror shall not apply Service Level Requirements (SLRs), as outlined in Appendix A – Quality Assurance Surveillance Plan, A.4 Service Level Requirements, to “best effort” service provisioning, other than to issue a ticket that will be logged into the service desk system for the Agency’s use in tracking whether or not the problem has been resolved. Open “best effort” tickets are not to be included in calculating any performance-based SLRs.

All offerors will be required to provide references on their past performance with previous clients.

C.3.6 NRC Reserved Rights NRC reserves the right to refuse the introduction of solutions proposed by the vendor if they are inconsistent with either Federal or NRC policy. This is of specific concern in the area of IT security where the NRC must comply with the Federal Information Security Act (FISMA) and the FISMA standards provided by the National Institute of Standards and Technology (NIST). The NRC also reserves the right to inspect any part of the ITI at any time. Specific NRC staff with IT security responsibilities shall be granted access to all components of the NRC ITI at all times to facilitate these inspections.

1. NRC will perform periodic reviews to ensure that the systems produce audit records that contain sufficient information to, at a minimum, establish what type of event occurred, when (date and time) the event occurred, where the event occurred, the source of the event, the outcome (success or failure) of the event and the identify of any user/subject associated with the event;

2. NRC will have unrestricted access to IT system audit tools and generated audit log information; and,

3. NRC will monitor and independently validate the implementation of NIST 800-53 security controls.

NRC will be able to monitor data flow and will be able to investigate through the use of NRC approved tools any instance or areas where suspicious or abnormal activity occurs.

C.3.7 Additional Contextual Reading The following links provide reading that may aid prospective offerors in better understanding the NRC’s goals and history:

1. NRC Strategic Plan: Part V. Management, Strategies and Means to Support Management Strategies, D. Expanded Electronic Government http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1614/v3/

2. NRC Information Technology/Information Management (IT/IM) Strategic Plan http://adamswebsearch.nrc.gov/idmws/ViewDocByAccession.asp?AccessionNumber

=ML081150680

http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1614/v3/ http://adamswebsearch.nrc.gov/idmws/ViewDocByAccession.asp?AccessionNumber=ML081150680 http://adamswebsearch.nrc.gov/idmws/ViewDocByAccession.asp?AccessionNumber=ML081150680

3. NRC – Office of Management and Budget Exhibit 300s: Infrastructure Services and Support http://www.nrc.gov/reading-rm/doc-collections/omb-exhibit-300s/

4. NRC History http://www.nrc.gov/about-nrc/history.html http://www.nrc.gov/reading-rm/doc-collections/omb-exhibit-300s/ http://www.nrc.gov/about-nrc/history.html

C.4 NRC ENVIRONMENT

This section provides detailed information on the current environment, the existing hardware/software infrastructure, and the expected ITI user levels at the NRC. The staff levels are approximate and may vary over time. The environment and software/hardware infrastructure are provided as guidelines to assist in creating an appropriate proposal. The NRC is seeking proposals that address the requirements of this SOW. The offeror’s proposed solution can be different than the current solution for those requirements.

C.4.1 Staff Levels The current NRC level of 5,500 personal computer users (including both NRC employees and NRC contractors) is expected to grow at a rate of 3% per annum. This growth is not guaranteed but should be incorporated for planning purposes.

C.4.2 NRC Locations Information on the NRC locations can be found on the website at http://www.nrc.gov/about-nrc/locations.html. The NRC has its Headquarters in Rockville, Maryland, and a number of other offices around the United States.

• The six-building headquarters complex (http://www.nrc.gov/about-nrc/locations/hq.html) in Bethesda and Rockville, Maryland, houses our headquarters staff and our Public Document Room (http://www.nrc.gov/reading-rm/pdr.html).

There are approximately 4000 ITI users at these locations.

During the ITISS period of performance, four of these buildings will be consolidated to a single new building that will be constructed (See paragraph below and section C.6.12 Extraordinary Move Support). The offeror shall provide the services described in this SOW both in the current headquarters buildings and the future headquarters building. It is expected that there will be some reduction in cost for some services once those buildings have been consolidated into a single building adjacent to the White Flint headquarters complex.

• The Region I Office (http://www.nrc.gov/about-nrc/locations/region1.html) in King of Prussia, Pennsylvania, oversees our regulatory activities in the northeastern United States. There are approximately 211 ITI users at this location.

• The Region II Office (http://www.nrc.gov/about-nrc/locations/region2.html) in Atlanta, Georgia, oversees our regulatory activities in the southeastern United States. There are approximately 175 ITI users at this location.

• The Region III Office (http://www.nrc.gov/about-nrc/locations/region3.html) in Lisle, Illinois, oversees our regulatory activities in the northern midwestern United States.

There are approximately 189 ITI users at this location.

• The Region IV Office (http://www.nrc.gov/about-nrc/locations/region4.html) in Arlington, Texas, oversees our regulatory activities in the western and southern mid-western United States. There are approximately 160 ITI users at this location.

• The On-Site Representative High-Level Waste Management Office (http://www.nrc.gov/about-nrc/locations/hlw-office.html) in Las Vegas, Nevada, maintains information associated with the proposed high-level waste repository (http://www.nrc.gov/waste/hlw-disposal/reg-initiatives/review-site-http://www.nrc.gov/about-nrc/locations.html http://www.nrc.gov/about-nrc/locations.html http://www.nrc.gov/about-nrc/locations/hq.html http://www.nrc.gov/about-nrc/locations/hq.html http://www.nrc.gov/reading-rm/pdr.html http://www.nrc.gov/about-nrc/locations/region1.html http://www.nrc.gov/about-nrc/locations/region2.html http://www.nrc.gov/about-nrc/locations/region3.html http://www.nrc.gov/about-nrc/locations/region4.html http://www.nrc.gov/about-nrc/locations/hlw-office.html http://www.nrc.gov/waste/hlw-disposal/reg-initiatives/review-site-recommend.html recommend.html).There are approximately 20 personal computers supported at this location.

• The NRC Technical Training Center (http://www.nrc.gov/about-nrc/locations/training.html) in Chattanooga, Tennessee, provides training for the staff in various technical disciplines associated with the regulation of nuclear materials and facilities. There are approximately 28 ITI users at this location.

• The NRC also has onsite inspectors permanently stationed at each reactor licensee that it regulates (http://www.nrc.gov/info-finder/reactor/). These Resident Inspectors require broadband access to the NRC network and use applications that are hosted at NRC Headquarters, the Regional Offices, and on the internet. There are currently over 100 locations that must be supported.

• The NRC ITI is extended to an application support facility. This facility is provided by an application development support contractor. The work performed under that contract is outside the scope of ITISS. The application support contractor supplies the Wide Area Network (WAN) connection from this facility to NRC Headquarters and provides the network router at the application facility end of that connection. The application support contractor manages that router. A domain controller and personal computers shall be supplied by the ITISS offeror. In addition, the ITISS offeror shall supply help desk support, desk-side support, and network monitoring for the equipment provided and the network at the application support facility. There are approximately 75 ITI users at this location.

From Fiscal Years (FY) 2013 – 2015, the NRC will centralize all headquarters staff not currently located in One White Flint North or Two White Flint North into a new building in Rockville, Maryland. The NRC anticipates 1500 staff moves in FY 2013, and 6000 extra staff moves in each of FY 2014 and FY 2015 to achieve consolidation (some people will be moved more than once). These moves are in addition to the current average annual moves of 1000. Appendix C provides square footage and descriptions of the space that will be available to the ITISS offeror’s staff.

While the primary computing and support facilities are located at the Headquarters campus, each regional office also maintains local computing and support capabilities, including some local email functions (Exchange satellite servers) which are provided by the incumbent ISSC contractor. The offeror shall provide dedicated system administration support at the Regional Offices to maintain network components and servers. The offeror’s staff will be primarily responsible for the management of the Regional Local Area Networks (LANs) and Wide Area Network (WAN) interfaces. In addition, they will provide Tier 2 Help Desk support as well as desk-side support as requested by a Regional Contracting Officer Technical Representative (COTR). Currently, user support is primarily provided by NRC Regional staff or non ITISS contractors.

During the ITISS period of performance, there will be additional remote sites that will be added to the ITI due to the construction of new nuclear power facilities. The offeror shall provide network devices (local router, etc.), personal computer equipment for the site, and network management for that segment of the network as if it were a Resident Inspector site.

It is unknown precisely when each new power plant will be constructed, but there is information available about the locations of the proposed sites (http://www.nrc.gov/reactors/new-reactors/col/new-reactor-map.html) and the current licensing schedule (http://www.nrc.gov/reactors/new-reactors/new-licensing-files/new-rx-http://www.nrc.gov/about-nrc/locations/training.html http://www.nrc.gov/about-nrc/locations/training.html http://www.nrc.gov/info-finder/reactor/ http://www.nrc.gov/reactors/new-reactors/col/new-reactor-map.html http://www.nrc.gov/reactors/new-reactors/new-licensing-files/new-rx-licensing-app-legend.pdf licensing-app-legend.pdf). However, only the licensee will determine if and when construction will begin.

C.4.3 NRC Business Hours Currently normal working hours are 6am-9pm Eastern Standard Time/Eastern Daylight Time (EST) Monday thru Friday excluding Federal Holidays. Maintenance and production changes typically shall not be made during normal working hours. However, it should be noted that new organizational changes allow users to report to work as early as 5am. As such, through results from trending and analysis, it may be necessary to adjust these hours either way throughout the life of the contract.

Some specific functions require 24 x 7 x 365 support – these are noted within the SOW.

C.4.4 Existing Information Technology Infrastructure The following diagram provides an overview of the existing technology infrastructure for the Core functionality and the two Data Center additional tasks. All information provided in this section of the document is intended for informational purposes only and should not be construed to dictate preference.

Figure 1 - NRC Information Technology Infrastructure – Core Services http://www.nrc.gov/reactors/new-reactors/new-licensing-files/new-rx-licensing-app-legend.pdf

C.4.4.1 Personal Computing Environment (Desktop/Laptop Computers) C.4.4.1.1 Hardware For the current base of approximately 5,500 personal computer users the NRC currently has:

• 5,450 desktop computers furnished by the incumbent ISSC contractor;

• 310 laptop computers that are managed under the current IT infrastructure and furnished by the incumbent ISSC contractor;

• Approximately 1000 Government-furnished laptop computers that are not managed by the current incumbent ISSC contractor. These Government Furnished Equipment (GFE) laptop computers are in the process of moving from non-managed to managed under the current ITI contract; and,

• 100 High-performance computing workstations furnished by the Government.

All computers provided under the current contract are supported on a 3-year refresh cycle.

These personal computers are distributed in approximate proportion to the number of NRC staff located in our Regional Offices and satellite offices as outlined in section C.4.2 NRC Locations.

C.4.4.1.2 Software The following (Table 2) are a sample of the typical software found on current NRC personal computers (PCs) (Desktops/Laptops). In some cases a mix of previous generation products and newer generation products exist (e.g. Microsoft Office). Under the new contract the NRC expects to license current generation products. Note, the Agency-wide Documents Access and Management System (ADAMS) is a Government-owned system. ADAMS is a document management system written in Visual Basic, based on IBM FileNet and includes a client-based software component.

Workstation Component Current Version Source

ADAMS Desktop (NRC Custom) 4.8 NRC Supplied ADAMS for MSOffice (NRC Custom) 1 NRC Supplied ADAMSOutlookIntegration (NRC Custom) 1.1 NRC Supplied Adobe Acrobat Reader 8 Incumbent Supplied Adobe Flash Player 10.0 Incumbent Supplied Adobe SVG Viewer 3 Incumbent Supplied Apple QuickTime 7.6 Incumbent Supplied Autodesk Design Review 2008 4.1 Incumbent Supplied Delphi NRC Telephone Directory 1.0 NRC Supplied Diskeeper Professional Edition 8.0 Incumbent Supplied FileNet Content Services Client Libraries 5.4 NRC Supplied FileNet IDMDT 3.2 NRC Supplied FileNET Panagon IDM Desktop 3.2 NRC Supplied FTI Microshield 5 NRC Supplied FTP Software OnNet32 3 NRC Supplied

Current Workstation Component Version Source

HRMS (NRC Custom) 1 NRC Supplied Inso Outside-In Viewer (ADAMS component) 8.0 NRC Supplied Metastorm Informs Filler 4.3 NRC Supplied Microsoft .NET Framework 1.1 Incumbent Supplied Microsoft .NET Framework 2.1 Incumbent Supplied Microsoft .NET Framework 3.5 Incumbent Supplied Microsoft Collaboration Data Objects 6.5 Incumbent Supplied Microsoft Data Access Objects (DAO) 3.5 Incumbent Supplied Microsoft Internet Explorer 6.0 Incumbent Supplied Microsoft MDAC 2.8 Incumbent Supplied Microsoft Office Professional Edition 2003 11.0 Incumbent Supplied Microsoft Office Visio Viewer 2003 11.0 Incumbent Supplied Microsoft Outlook 2007 12.0 Incumbent Supplied Microsoft Windows Genuine Advantage 1.3 Incumbent Supplied Microsoft Windows Installer 3.1 Incumbent Supplied Microsoft Windows Media Player 11.0 Incumbent Supplied Microsoft XML 4.0 Incumbent Supplied PkWare SecureZip 8.2 Incumbent Supplied PowerBuilder 8.0 NRC Supplied Real Player Enterprise Player 2.1 NRC Supplied SQL Drivers for NT 6.5 NRC Supplied Sun Java 6.1 Incumbent Supplied Sybase Adaptive Server Enterprise 12 NRC Supplied Symantec Antivirus 11.0 Incumbent Supplied Symantec LiveUpdate 3.1 Incumbent Supplied Wang Imaging 5.0 NRC Supplied Wang Watermark 3.1 NRC Supplied

Table 2 – Sample of typical personal computing software

Notes:

a) Software maintenance and development on ADAMS are not part of this SOW. Support of the ADAMS server infrastructure is included in the additional tasks for Computer Facilities Management and Data Center Administration. Installation and troubleshooting of the configuration of the client component is part of the core Personal Computing component of this SOW (see section C.5.1.4 Personal Computing and Related Software Licensing)

b) Any software listed as “NRC Supplied” shall be supported on a best effort basis by the offeror. Best effort is defined in section C.3.5 Intent for Mutual Cooperation between Offeror and NRC Staff (Item 4).

c) PowerBuilder 8 supports specific legacy applications. This application is not part of the standard image. Support requirements only include installation on an as needed basis and minor troubleshooting.

d) The current operating system (OS) is Windows XP. The NRC has currently elected not to upgrade to Windows Vista, but will upgrade to Windows 7. The NRC shall have the option to upgrade to a new OS within 6 months of release, but may elect not to upgrade if it is deemed unwise.

C.4.4.2 General Server Environment The NRC general server environment consists of network servers, file servers, and those servers used within the NRC which support the general network environment (shared storage, electronic mail, network management). These servers are primarily owned by the incumbent ISSC contractor.

C.4.4.2.1 Hardware The NRC general server environment currently consists of one-hundred seventy-five (175) servers. These servers consist of machines with one to four central processing units (CPUs) or in the case of dual-core or quad-core processors, one to four processing cores. None of the current servers utilize more than four CPUs or a total of four processor cores. The majority of servers in the general server environment run Windows; however, some run a Linux kernel. Specifically, the current general server breakdown is as follows:

• Wintel Servers with 1-4 CPUs: One-hundred sixty-five (165) servers; and,

• Unix/Linux Servers with 1-4 CPUs: Ten (10) servers.

The offeror will propose a server refresh cycle. The NRC is flexible, but in general believes no server should be allowed to forego support.

C.4.4.2.2 Software The following is a sample of the typical software found on current NRC Servers in the general server environment. The environment is evolving, and specific applications may vary at the time of contract award. The intent of this list is to define the general types of software currently in use.

• Active Directory;

• Asset Management System (WiseTrack);

• BlackBerry Enterprise Server;

• CiscoWorks;

• Citrix;

• Finjan;

• Helpdesk Ticketing System (BMC Service Desk);

• IronPort;

• LANDesk Management Suite;

• Microsoft Exchange Enterprise;

• Microsoft Exchange Standard;

• Patchlink;

• Structured Query Lanaguage (SQL) Server 2000/2005;

• Symantec Antivirus;

• Symantec BESR imaging tool;

• System Center Operations Manager;

• Tivoli Storage Manager (TSM) Backup Client;

• BrightStor ArcServ;

• Vulnerability Scanner (NCircle);

• What’s Up Professional (monitoring); and,

• ZENworks.

C.4.4.3 Application Hosting Server Environment (Additional Task) The Application Hosting server environment (also referred to as NRC Data Center Environment) consists of those servers that generally are used for hosting specialized applications. These servers are currently primarily owned by the NRC. The NRC would prefer that all components of the ITI eventually be offeror-supplied as the GFE reaches the end of its useful life.

C.4.4.3.1 Hardware The NRC Data Center environment currently consists of 323 servers. As with the general server environment hardware described in Section C.4.4.2.1 General Server Environment:

Hardware, all of the Data Center servers consist of machines with one to four CPUs or in the case of dual-core or quad-core processors, one to four processing cores.

The agency also takes advantage of processor time on an NIH mainframe server for some of its legacy applications. There are printers located within the NRC that are connected to these NIH systems which the incumbent Data Center Facilities Operations contractor maintains and manages both the printers and the printout sorting. In addition, the incumbent Data Center Facilities Operations contractor occasionally works with NIH personnel and contractors to troubleshoot connection problems as directed by the NRC PM.

C.4.4.3.2 Software Other than custom software or applications developed specifically for the purpose of meeting NRC requirements, the software expected in the Data Center environment is similar to that described for the general server environment in Section C.4.4.2.2 General Server Environment: Software, with the addition of VMWare.

C.4.4.4 Network Appliance, Printers, and Other Hardware Appendix B – NRC WAN Connections provides a diagram of the basic topology and link speeds of the NRC network. The offeror is not responsible for providing the WAN links, but is responsible for coordinating with the Provider to troubleshoot incidents and determine root cause. The offeror is not responsible for the links between buildings or the cabling plant itself.

In addition to the desktop/laptop, general server, and data center server environments, the NRC has other hardware components and devices that serve as part of the IT Infrastructure.

This additional hardware consists of:

• Network appliances including routers, switches, gateways;

• Network security appliances and firewalls;

• Tape back-up devices;

• Redundant Array of Independent Disk (RAID) devices and/or Storage Area Networks

(SAN);

• Network Printers (both color and black & white);

• Local printers; and,

• Scanners and plotters.

The following table (Table 3) provides a current list of hardware that falls in this category. It is expected that an ITISS vendor will initially manage this existing hardware and then as required, replace components with suitable current-day replacements. By “current-day” the NRC means current as of the date of replacement.

Hardware Description Quantity Cisco 1700 Router 1 Cisco 2800 Router 74 Cisco 3700 Router 33 Cisco 3800 Router 14 Cisco 7200 Router 1 Cisco 2960 Series Switch 15 Cisco 3750 Series Switch 34 Cisco 4500 Series Switch 46 Cisco 6500 Series Switch 8 Host Intrusion Protection System 1 HP 4650 Color Network Printer/+GFE 80/19 HP 4350/HP 4515x B/W Network Printer/+GFE 292/2 HP 9040 B/W Network Printer 38 XIOTech SAN 1 Fibre Switch (Silkworm 4100) 2 Tape Library (Spectra Logic T120Q) 2 Tape Drive (Spectra Logic T50) 7 Firewall (Base) 1 Firewall Proxy/ZONE 14 48 Port 10/100 Ethernet Module 179 48 Port 10/1000 Ethernet Module 25 Local Printers (Various Makes/Models), GFE 2,000 Plotters 10 Multifunction Printers 36 Scanners 211

Table 3 - Network Appliances, Printers, & Other Hardware

C.4.4.5 Incumbent Contractor Staff Levels Incumbent contractor staff levels are a combination of support for core functions charged as part of the seat management fee and additional contractor or NRC staff members who perform functions such as integration and test. These numbers are approximate and are supplied to inform potential offerors on the general level of effort currently expended; they are not meant to dictate future staffing levels. The estimates are as follows:

20 Integration;

3 Test Facility;

9 Headquarters (HQ) Remote Building Dedicated Sys Administrators;

10 Regional and Technical Training Center Support;

9 Extended Hours Dedicated Support - Help Desk;

8.5 Extended Hours Dedicated Support - Network Operations;

2 Laptop Patching/Maintenance Support/Loaner Laptop Program administration;

1 Technical Writer;

10 Operational IT Security Support;

10 Network Operations;

10 Help Desk - Telephone/Remote Support;

10 Help Desk – Desk-side support;

4 High Performance Computing Support;

5 Management and Administration;

1 Technology Assessment Center;

4 HQ Remote Building Dedicated System Administrators;

5 HQ Remote Building Dedicated Desk-side Support

5 Desktop Refresh

In addition, incumbent contractor staff levels that are currently dedicated to additional tasks are as follows:

6 Computer Facilities Management;

2 Nuclear Security and Incident Response (NSIR) Operations Center Network;

18 Data Center System Administration;

15 Telecommunications;

4 Wireless Communications Services; and, 1 Safeguards Information (SGI) Wireless System Administration Services.

C.5 CORE SERVICES

This section describes services to be provided under the Core ITISS contract. These services consist of basic infrastructure support services (e.g. messaging, file and print) in alphabetical order, followed by a further description of the NRC’s and offeror’s service delivery and management responsibilities. The responsibilities are structured in terms of the ITIL v3.

It should be noted that the offeror shall include a transition schedule and pricing in the proposal which is described in Section C.7 Transition Considerations.

Within this SOW, there is a description of the building space provided by the NRC to the incumbent ISSC contractor’s staff (See Appendix D: Space Currently Used by Contractors Performing ITISS Core and Additional Tasks). The offeror shall be responsible for providing staff to address all of the requirements described in this SOW, even if the number of staff required to do that exceeds the office space allocated by the NRC for those offeror staff.

The offeror shall include in their proposal how they intend to use NRC provided space as well as how they intend to use any additional office space (provided by the offeror) to fulfill the SOW requirements. The offeror’s proposal shall include any connectivity that a facility will require to the NRC ITI, and how it addresses Federal and NRC requirements for physical security, personnel security, and IT security. Any costs associated with an offeror-supplied facility shall be incorporated into the offeror’s cost proposal.

C.5.1 Basic Infrastructure Support Services Each of the following subsections describes a core service to be provided under the base contract. As a general rule, the services in this section are primarily describing “what will be managed.” Taken together with the ITIL-based services described in Section C.5.2 Service Delivery and Management Responsibilities, they should be considered the main body of work to be included in the core tasks. Also, the Service Level Requirements found in Appendix A – Quality Assurance Surveillance Plan, A.4 Service Level Requirements were designed to correlate with technical requirements of the SOW and should be referred to when the offeror is developing its proposal.

C.5.1.1 BlackBerry The contractor shall be responsible for providing blackberry service for NRC staff located in the United States and outside of the United States within the parameters described below.

The NRC currently furnishes approximately 1000 BlackBerrys. The current device and service providers are Verizon, T-Mobile, and AT&T. Mobile access to email, the Web, and mobile applications has become increasingly important as the mission of the Agency has expanded, the Agency workforce has changed, and flexibility in the workplace has increased. Many Agency users are regularly away from their offices but still have a need to stay connected to their co-workers to meet mission objectives. Other users are required to attend meetings and still respond rapidly to staff decision requests.

Some Agency users frequently travel outside of the country and need to maintain access to the same functionality on their BlackBerry that they have locally. There are other users that only travel oversees occasionally, but require that same continuity of service internationally.

Since NRC users are based all over the United States, it is also important that service plans provide availability where the staff member is located.

In addition, the offeror shall:

1. Manage BlackBerry accounts and the interface with corresponding Microsoft (MS) Exchange email accounts according to optimization standards recommended by Research In Motion (RIM) Corporation;

2. Maintain the high-availability BlackBerry infrastructure within the NRC so that a BlackBerry Enterprise Server (BES) failure will not result in loss of availability to BlackBerry users;

3. Monitor BlackBerry infrastructure for any events and manages capacity of the service;

4. Provide all BlackBerry capabilities available by the device and service plan providers that meet Federal IT security policy requirements and NRC-specific security requirements as requested and approved by the NRC;

5. Enforce secure access to BlackBerry devices through a strong device password policy; Remotely erase data contained on BlackBerry devices that have been lost or stolen at the request of the NRC.

6. Minimize the amount of time that a user is without a blackberry unit (due to either provisioning or repair); and,

7. Minimize the length and frequency of service outages.

Currently BlackBerry support is performed under two separate contracts. Support under the core services is limited to:

1. BlackBerry Integration with Exchange

2. BlackBerry Enterprise Server(s) (BES) Management: Manage accounts for BlackBerry users and links between e-mail device and BlackBerry devices.

3. BlackBerry Services Monitoring

4. User Support for account issues and minor device issues

5. BlackBerry Policy Management

6. BlackBerry Device Firmware Upgrades and Management

7. BlackBerry Device and Function Testing: Evaluate new BlackBerry devices and/or functions and test them to ensure appropriate security and functionality.

Other BlackBerry support is included in the additional wireless services task in Section C.6.4 Wireless Communications Services. The following services are not included in the Core Services and are listed in this section only to provide clarity around BlackBerry support. The services included in the additional task are:

1. Inventory and reconciliation of the wireless inventory of services and hardware in the Office of Information Services (OIS) Infrastructure and Computer Operations Division (ICOD) Computer Operations and Telecommunications Branch (COTB) NRC Space and Property Management System (SPMS) property account and the telecommunications expense management (TEM) tool;

2. Property storage and control of on-hand wireless hardware;

3. Service request processing using both the Government provided service desk ticket request system and the TEM tool to process and fill the appropriate orders to meet the Government’s approved requirements;

4. Offeror acquisition of BlackBerry devices for lease to NRC;

5. Property distribution/return;

6. BlackBerry server support in the area of assisting the Government in identifying service problems for the end users that may make their appearance known on the server; such as a missing PIN, etc;

7. User device/service training to ensure that the user is familiar with the device they are issued; to allow them to place and receive cellular calls; unlock their BlackBerry, the procedures for charging and caring for the devices, etc;

8. Coordinating with the wireless carriers and the Government customer on the movement of a cellular number from one device to another using the same carrier or between carriers;

9. Pairing Bluetooth hardware (headsets, vehicle mount, vehicle charger, and GPS navigation utility, etc.) with cellular devices when…