Schedule A, Attachment 1- Network Managed Services Business Specifications Worksheet.docx

SCHEDULE A, ATTACHMENT 1: NETWORK MANAGED SERVICES BUSINESS SPECIFICATIONS WORKSHEET

Instructions for Completing the Business Specifications Worksheet

Contractor must respond to each business Specification on how they will meet the requirements below for each system or service it is bidding on. Contractor must not alter the document. The Business Specifications Worksheet contains columns and is defined as follows:

Column A: Business Specification number.

NOTE:

· The “Required” section of the Business Specifications Worksheet lists items that the State requires to be part of the Solution. “Required” items will be evaluated and scored upon per the State evaluation process.

· The “Optional” section of the Business Specifications Worksheet lists items that are not required at the time of the solicitation but may be desired by the State in the future. Such “Optional” items will be evaluated and used in a best value award recommendation Column B: Business Specification description.

Column C: Contractor must indicate how it will comply with the business Specification. Contractor must enter “Y” to one of the following:

Current Capability – This capability is available in the proposed Solution with no additional configuration or cost

· Requires Configuration – This capability can be met through Contractor-supported changes to existing settings and application options as part of the initial implementation at no additional cost (e.g., setting naming conventions, creating user-defined fields).

· Customizations to Software Required – The requirement can be met through Contractor modifying the underlying source code, which can be completed as part of the initial implementation.

· Future Enhancement – This capability is a planned enhancement to the base software and will be available within the next 12 months of contract execution at no additional cost.

· Not Available – This capability is not currently available, and a future enhancement is not planned.

NOTE: Configuration is referred to as a change to the Solution that must be completed by the awarded Contractor prior to Go-Live but allows an IT or non-IT end user to maintain or modify thereafter (i.e. no source code or structural data model changes occurring).

Customization is referred to a modification to the Solution's underlying source code, which can be completed as part of the initial implementation. All configuration changes or customization modifications made during the term of the awarded contract must be forward-compatible with future releases and be fully supported by the awarded Contractor without additional costs.

Contractor must understand that customizations (i.e. changes made to the underlying source code of the Solution) may not be considered and may impact the evaluation of the Contractor's proposal.

Column D: The Contractor must also fully disclose how they will meet the requirements in their proposal response. This column is for Contractor to describe how they will deliver the business Specification and if the Contractor proposes configurations or customizations, the Contractor must explain the details of the impacted risk that may be caused if configured or customized to meet the business Specification. Description must be no more than 250 words for each business Specification.

Contents

Requirements Network Security and Monitoring (NSM)

Network Security- The vendor network and the SOM managed “offender” Wi-Fi network will be physically connected via a SOM managed firewall at each MDOC location. The vendor must provide specific network, protocol and port requirements for connecting vendor managed Wi-Fi connected devices to the vendor network. Solution must be compliant with all network security requirements as indicated in DTMB Policy 1345.00.05 (ENTERPRISE WIRELESS LOCAL AREA NETWORK (WLAN) STANDARD) and must comply with all other applicable DTMB policies.

The Contractor will be responsible for participating through completion of the State’s Security Accreditation Process and achieving Authority to Operate before cutover to production. The Security Accreditation Process includes a framework-based, questionnaire-driven security assessment and automated scans. Contractor must remediate any identified vulnerabilities at the Contractors expense unless otherwise waived in writing by the State. Contractor must work closely with DTMB and the Michigan Cyber Security (MCS) team to document the security assessment in the State’s Governance, Risk and Compliance (GRC) tool, which is currently Lockpath Keylight software.

REQUIRED

Note: This infrastructure must be installed on-site at each serviced facility to prevent unauthorized traffic leaving approved network parameter.

Note: Solution must monitor traffic/services for performance, availability, and security. It must be able to detect and alert when network outages performance degradation, security incidents, and suspicious activity events occur.

Note: MDOC must approve the functionality.

· Service Level Agreement (SLA) metrics

· Circuit and device utilization

· NetFlow data

· Simple Network Management Protocol (SNMP) Events.

· Packet Loss

· Jitter

· Latency Metrics

· Unauthorized access logs

· Ability to generate reports using the above data/metrics

Note: This includes the initial MiSAP and the required 3-year renewals

Note: This includes but is not limited to unauthorized access to the internet, social media, video conferencing, texting etc.

Note: Contractor must remediate or address all vulnerabilities or concerns resulting from this assessment.

Note: Intervals must be approved by MDOC.

· Audit logs must be un-editable.

· Audit log capturing all data modifications.

· Audit Log for the security system for access, privacy, security controls, and audit functionalities if not built in.

· Maintain an audit log for all Prisoner Employee and Prisoner user and group activity and changes.

· Ability to run reports.

Note: Public companies must legally disclose and private companies do not have to.

OPTIONAL

NSM 32.0

NSM 33.0

Requirements Device Management (DM) Application Management - Enables the Contractor to manage MDOC approved applications, including software distribution, patch management, and license compliance. The solution should interface with Identity Management tools and MDM utilities, providing the ability to deploy applications to appropriate user groups, monitor application usage, and report on license compliance.

Asset and Endpoint Management - enables the vendor to manage Wi-Fi enabled mobile devices used in this service offering. The solution shall provide the ability to remotely lock and wipe devices, alert on suspicious activity, log and monitor usage, enforce security policies, and distribute applications. The vendor must be able to provide logs upon request to MDOC personnel and DTMB MiSOC personnel. The solution should support device provisioning, monitoring, and troubleshooting. Only the assigned user (offender) should be able to access their own device, and MDOC staff must have access to all devices. The solution must comply with all applicable DTMB policies.

REQUIRED

· Device provisioning

· Remote device wiping

· Automatic Device Enrollment (ADE)

· Mobile Threat Defense (MTD)

· Remote device locking

· Monitoring and alerts upon detection of suspicious activity

· User activity logging and monitoring

· Enforce security policies

· Application distribution

· Management of functionality for physical and wireless interfaces (Wi-Fi, Bluetooth, etc.).

Note: Detection must include functionality to lock, disable and shutdown the device. We must have the ability to enable the device remotely

· Stored Credentials

· Configuration settings

· Log’s and other meta data

Note: This must not allow a Prisoner to ‘reject’ an administrator’s attempt to remotely access the device.

The contractor must provide the ability to turn on camera, video and microphone at MDOC’s discretion.

Note: Device must report when it detects that it’s been manipulated so the device can be automatically disabled.

OPTIONAL

DM 14.0

Requirements Identity Access Management (IAM) Identity and Access Management - provide a Solution that enables the Contractor to manage user accounts, including user directory services, access control, and authentication. The solution will provide to administrators the ability to manage user profiles, reset passwords, and monitor user activity.

REQUIRED

· Create, manage, and delete user profiles (including groups, tags, and other account attributes)

· Create, manage, and delete user groups (including assigned users, tags, and other attributes)

· Reset user passwords

· Monitor user activity

Note: Cloud management services must be accessed via secure portal.

· Account making the change

· Time and date of change

· Actions taken

· Affected profiles/groups

· Activity (website accessed, application opened, file opened, etc.)

· Time and Date

· User Account

· Device Name

Note: MDOC must approve the support model.

The Contractor must work with MDOC to develop SLA’s and support structures for emergency and escalated requests- this will take place prior to contract award to ensure all expectations are clear.

· Full Name

· MDOC Number

· Cell Assignment

· Location (Facility)

· Group Memberships

· Tags

· Notes

· Assigned device name/tag

Note: No Prisoner account should be able to log into a device that isn’t assigned to that Prisoner. This must be done via biometrics.

OPTIONAL

Requirements Prisoner Device Support (PDS) Prisoner Device Support - Provide a Solution that enables the Contractor to manage and support prisoner devices. The Solution will provide to administrators the ability to manage user profiles, reset passwords, and monitor user activity. This support includes but is not limited to the operating system, hardware, firmware (i.e security and OS patches) and the application that resides on the device.

REQUIRED

Note: Resolving non-hardware issues i.e. software configuration, access, networking, etc.).

Note: No Prisoners should be able to submit requests for another Prisoner or device besides their own assigned device.

Note: This includes assisting (through support) with devices needing (offsite repairs), that require documentation, in-warranty requirements, out-of-warranty requirements, additional parts, delay, etc.)

Note: This includes from the initial support request analysis through resolution.

OPTIONAL

IDS 16.0

Requirements Prisoner Handheld Devices and Peripherals (PD) Prisoner Handheld Devices and Peripherals - Provide a Solution that provides a variety of devices so that MDOC can decide which devices are applicable for which prisoners.

REQUIRED

Note: Devices with a larger screen size may be allowed for specific Prisoner population subsets (e.g. Education, security level, etc.).

Note: Devices include but are not limited to tablets and laptops.

Note: Keyboard specifications must be assessed and approved by MDOC.

Note: The Contractor may include “water resistant” as a feature.

Note: Including but not limited to (remote locking, wiping, and locating) tablets as a part of the security solution.

OPTIONAL

Requirements Internet Service Provider (ISP) Internet Service Provider - Provide a Solution that gives a reasonable expectation of service of internet connectivity at each facility.

REQUIRED

Note: This must include any steps required to get subcontracted installers approved to access MDOC correctional facilities

Note: This is in regard to all approved MDOC applications and services.

· Current data network capacity

· Expansion capacity

· Capacity limits

· CPE equipment required for each speed and/or type of service

[should be standard language available for pricing adjustments for RFS, prefer to use Standard language]

All one-time and recurring charges must be identified.

Allow access, restrict access, or deny access to applications, websites, and functionalities of external systems via API, web services, and/or other authentication/monitoring methods.

OPTIONAL

Requirements Network Management & Maintenance (NMM) Network Monitoring – This includes the monitoring the network for performance, availability, and security. The Solution will be able to detect and alert on network outages, performance degradation, and security breaches. The Contractor will be expected to follow SOM reporting procedures for all network outages, performance degradation, and security breaches. The Contractor will monitor bandwidth usage and identify potential bottlenecks. The Contractor will be expected to provide bandwidth utilization reports and activity logs upon request, and some logs will need to be sent to State of Michigan cybersecurity personnel at regularly scheduled intervals.

Network Services - Including coordination with the ISP(s), troubleshooting and resolving service issues, planning and coordinating service upgrades/modifications as-needed or requested by MDOC, notifying impacted users of outages (planned/unplanned/emergency/etc.), and providing status updates of ongoing efforts within the scope of providing these internet services. These services would need to be managed for all MDOC correctional facilities within the State. The Solution must comply with all applicable DTMB policies.

Network Performance - The Contractor will be able to measure and report on common performance metrics (latency, jitter, wan circuit utilization, etc.), and provide these reports both upon request and at regular intervals to MDOC personnel, DTMB Agency Services, and DTMB Security Operations. The solution must comply with all applicable DTMB policies.

REQUIRED

Note: Contractor will need to work with DTMB on a network layer handoff. Services include but not limited to DHCP, DNS etc.

Note 2: DTMB Must provide the vendor with applicable SSID’s

software vendors.

Note: The Contractor must provide 24/7 support for critical issues.

demonstrate the Contractor’s ability to recover the system and transfer of operations to a failover site.

for use when the system becomes unusable.

system software upgrades. Key elements include an executive summary, hardware strategy (including server strategy, storage strategy, tape strategy, connectivity strategy, router environment, and network security strategy), and software strategy (including OS, DBMS, and independent software contractor product considerations).

OPTIONAL

NMM 24.0

Facility Locations

HANDLON

CORRECTIONAL FACILITY

1728 BLUEWATER HWY, IONIA, MI 48846

WOMEN'S HURON VALLEY

CORRECTIONAL FACILITY

3201 BEMIS RD., YPSILANTI, MI 4819

BARAGA CORRECTIONAL FACILITY

13924 WADAGA RD, BARAGA, MI 49908

COOPER STREET CORRECTIONAL FACILITY

3100 COOPER ST, JACKSON, MI 49201

SAGINAW

CORRECTIONAL FACILITY

9625 Pierce Rd, Freeland, MI 48625

OAKS CORRECTIONAL FACILITY

1500 Caberfae Highway Manistee, MI 49660-9200

PARNALL CORR. FACILITY

1780 E. Parnall Jackson, MI 49201-7138

THUMB CORRECTIONAL FACILITY

3225 John Conley Drive Lapeer, MI 48446

BELLAMY CREEK CORR. FACILITY

1727 W. Bluewater Hwy.

Ionia, MI 48846

IONIA CORRECTIONAL FACILITY

1576 W. Bluewater Highway Ionia, MI 48846

GUS HARRISON CORR FACILITY

2727 E. Beecher Street Adrian, MI 49221

ALGER CORRECTIONAL FACILITY

N6141 Industrial Park Drive Munising, MI 49862

CARSON CITY CORR. FACILITY

10274 Boyer Road Carson City, MI 48811

CENTRAL MICHIGAN CORR. FACILITY

320 N. Hubbard St. Louis, MI 48880

CHIPPEWA CORR. FACILITY

4269 West M-80 Kincheloe, MI 49784

LAKELAND CORR FACILITY

141 First Street Coldwater, MI 49036

MUSKEGON CORR. FACILITY

2400 South Sheridan Dr.

Muskegon, MI 49442

CHARLES E. EGELER RECEPTION

3855 Cooper Street Jackson, MI 49201

G. ROBERT COTTON CORR FACILITY

3500 N. Elm Road Jackson, MI 49201

EARNEST C. BROOKS CORR. FACILITY

2500 S. Sheridan Road Muskegon Heights, MI 49444

MACOMB CORR. FACILITY

34625 26 Mile Road Lenox Township, MI 48048

MARQUETTE BRANCH PRISON

1960 U.S. 41 South Marquette, MI 49855

NEWBERRY CORR. FACILITY

13747 E. County Road 428 Newberry, MI 49868

ST LOUIS CORR. FACILITY

8585 N. Croswell Road St. Louis, MI 48880

KINROSS CORR FACILITY

4533 W. Industrial Park Drive Kincheloe, MI 49788

WOODLAND CENTER CORR. FACILITY

9036 E. M-36 Whitmore Lake, MI 48189