ISS_RFP_-_Draft.docx

The US Securities and Exchange Commission (SEC) is planning to issue a solicitation for the re-competition of its critical Infrastructure Support Services (ISS) contract. The anticipated release of the Request for Proposal (RFP) is on or about June 19, 2015. The SEC is currently releasing this Draft RFP in order to solicit comment and feedback from the industry and potential service providers. Please note that we will not be answering questions during this Draft RFP phase but do seek constructive comments from an engaged industry to help shape areas of the RFP as needed, prior to its final release. All comments regarding this RFP must be submitted no later than June 1st, 2015, but we encourage the submission of comments before the May 28th Industry Day. Additional comments can be submitted at any time before and after the Industry Day, but no later than June 1st, 2015.

Although the entire Draft RFP is open for comment, we are specifically requesting comments from the industry in the following areas:

· Proposed methodology for the Automatic Renewal criteria outlined in Attachment 17

· Proposed Service Levels for each Task Area relative to the market in terms of the number of service levels per Task Area, and the associated measurements methodology outlined in Attachment 9

· Mechanism and proposals for continuous improvement in proposed service and reductions in cost every year

· Modifications to, or additional evaluation criteria to be considered as outlined in Section M of the Draft RFP

· Proposed Statement of work in section C5, and any additional services or modifications to proposed services

An Industry Day is tentatively scheduled for May 28, 2015 from 9:00am – 12:00pm at the SEC Headquarters building located at 100 F Street, NE., Washington, DC 20549-1104. The event will also be webcast live. Both the onsite event and the webcast will be free and open to the public. Pre-registration is required for onsite attendance, as space is limited, each company may only register up to 3 participants. To preregister for the onsite event, please send an email to ISS_Industry_Day@SEC.gov with the following information:

· Company Name

· Participant(s) Name

· Contact Information

The Government anticipates a single-award Time and Materials (T&M) contract

SECTION B – SUPPLIES OR SERVICES AND PRICES / COSTS

Note to Offerors: Provide a Time and Materials (T&M) quote that includes labor categories and on-site rates for each year in the one year base and nine-one option years ordering periods. See Section L.6 on for complete instructions on preparing your price quotes.

For evaluation purposes only, On-site Hourly Rates should be based on a Full-Time Equivalent (FTE) with 1,920 hours and Place of Performance to be Washington, D.C (SEC Headquarters). Offerors must submit pricing by completing Attachment 7 – Pricing Sheet - Revised. Failure to complete the Pricing Sheet will result in exclusion of Offeror for consideration of award.

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

C.1 Introduction This is a single award to a Contractor to provide Infrastructure Support Services (ISS) and related Services for all Divisions and Offices of the U.S. Securities and Exchange Commission (SEC) both in Washington, DC and its regional locations. Upon the award of this contract, work requests will be issued in a series of individual Task Orders for distinct scopes of work, which will require separate proposals and negotiations.

C.1.1 General Description of Services Provide comprehensive Infrastructure Support Services that Enterprise Operations, Enterprise Infrastructure, Enterprise Operations Support and Common Services in support of Office of Information Technology (OIT) including support services to the SEC Headquarter Offices in Washington, DC, the eleven Regional Offices and in any location where the SEC operates in the future.

C.1.2 Limits of Services This is not a Personal Services Contract. The Government will not exercise any supervision or direct control of the Contractor’s staff during the performance of the services herein. The Contractor shall provide direct control and supervision of their staff during the execution of the Contract and each Task Order.

C.1.3 Background The mission of the U.S. Securities and Exchange Commission (SEC) is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation. In the pursuit of its mission, the SEC receives hundreds of thousands of incoming communications through a variety of means into each of the agency's divisions, offices and regions.

The SEC’s Strategic goals include:

· Establish and Maintain an Effective Regulatory Environment

· Foster and Enforce Compliance with the Federal Securities Law

· Facilitate Access to the Information Investors Need to Make Informed Decisions

· Enhance the Commission’s Performance through Effective Alignment and Management of Human Information and Financial Capital.

Federal securities law and regulation is rapidly changing as is the commercial securities markets and industry. In order to meet these challenges, the SEC must continually innovate and improve its technologies and internal business process. More information on the SEC’s mission, strategic plan and organizational structure may be found at: www.sec.gov.

C 1.4 Needs The SEC requires Information Support Services (ISS), commission-wide, to provide the Office of Information Technology (OIT) support in all aspect of information technology. These services primarily include, but are not limited to, the management and operations of all SEC IT Infrastructure operations for the Service Desk, End User Computing, Asset Management, as well as Infrastructure Support for Engineering and Operations.

C.1.5 Objectives The Contractor shall provide the U.S. Securities and Exchange Commission (SEC) and all its subordinate Offices and Divisions with Information Technology and Infrastructure Support Services in the following areas described in detail in Section 5.

With information technology providing all aspects of its business, the SEC depends on Contractor support for problem resolution and support services to meet its business needs. The SEC expects the Contractor to deliver optimal daily performance of the SEC IT operations and take day-to-day responsibility for the SEC IT operations, achieving the minimum performance objectives on a daily basis, and taking a proactive approach with the SEC in improving the operations and efficiencies of the SEC IT environment.

The Contractor will perform functions that are operational in nature, and will not be expected or permitted to perform any inherently government functions, such as defining requirements, establishing government policies, performing risk analysis or cost benefit analysis.

Under this task order, the Contractor shall provide the SEC support for the following task areas and tasks:

Task Area 1.0 – Enterprise Operations

· Task 1.1 – Service Desk Support

· Task 1.2 – End User Computing (EUC)

· Task 1.3 – Network Operations Center (NOC)

· Task 1.4 – IT Specialist Support Task Area 2.0 – Enterprise Infrastructure

· Task 2.1 – Managed Network Support

· Task 2.2 – Server and Storage Support

· Task 2.3 – Messaging and Active Director (AD) Support

· Task 2.4 – Electronic Data Warehouse (EDW) Support

· Task 2.5 – Data Center Operations Support and Engineering

· Task 2.6 – Disaster Recovery Support Task Area 3.0 – Enterprise Architecture

· Task 3.1 – Enterprise Engineering

· Task 3.2 – Preproduction Environment

· Task 3.3 – Testing and Development Task Area 4.0 – Common Services

· Task 4.1 – Asset Management

· Task 4.2 – Transition Support

· Task 4.3 – Other Project and Operations Support

· Task 4.4 – Audit Remediation

· Task 4.5 – eDiscovery

· Task 4.6 – Infrastructure Delivery Management

· Task 4.7 – Overarching Process Support

C.1.6 Scope The Office of Information Technology (OIT) supports the Commission and staff of the SEC in all aspects of information technology. OIT has overall management responsibility for the Commission's IT program including infrastructure operations and engineering, user support, and enterprise architecture.

The Contractor will support all current and any future SEC locations. Contractor support will span across the SEC Headquarters building, located in the Washington, D.C. metropolitan area, its primary and alternate data centers, and its 11 regional offices located throughout the country. The contractor will support all SEC employees now and in the future, which is approximately 6000 current users.

The Contractor shall provide services for the entire life-span of desktop, mobile hardware and software, telephones, and audio / video resources. The Contractor shall develop and maintain desktop images, patches, and upgrades. The Contractor shall deploy, maintain, and replace equipment and software. The Contractor shall manage equipment and software assets. The contractor shall also communicate with employees about the equipment and software, including planned and unplanned changes in the IT environment, retirement, and disposal of all equipment and software.

The Contractor shall manage and operate all SEC IT Infrastructure facilities, hardware, software, and systems as defined. The Contractor shall manage and operate the Network Operations Centers (NOC) and Data Centers. The Contractor shall manage and operate the operations management services for the SEC IT Servers, Storage, and Network. The Contractor shall manage and operate technology deployments. The Contractor shall manage and operate the Infrastructure Engineering function in designing as well as implementing SEC IT solutions.

The Contractor shall be responsible to maintain and support the underlying infrastructure supporting the SEC operated applications, to include the Electronic Data Gathering Analysis and Retrieval (EDGAR) system, which electronically receives, processes, and disseminates more than 500,000 financial statements every year. The Contractor shall also support the underlying infrastructure for a very active website that contains a wealth of information about the Commission and the securities industry, and also hosts the EDGAR database for free public access.

The Contractor shall respond to current requirements and proactively anticipate new requirements. The Contractor shall work with the SEC to assess the impact of new requirements on the SEC operating environment. The Contractor shall handle requirements for new services through the SEC Change Control process and shall adjust services accordingly.

The Contractor shall transition the current SEC IT Infrastructure Support to the contractor's Support while ensuring the continuity of operations at each SEC location. The Contractor shall minimize disruption to the existing operations, optimize the use of existing assets, and improve customer satisfaction.

C.2 Service Levels The Contractor shall develop and maintain effective services levels as defined in Attachment 9 – Service Levels ISS and all services are performed in accordance with this SOW. The Contractor will measure and report on the Service Levels as defined in Attachment 9. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract.

C.2.1 Security Requirements The security classification for work performed under this Contract is Unclassified. The documents and information that will be reviewed and produced are non-public and sensitive in nature and shall be protected from unauthorized disclosure. Work on this Contract requires that personnel may have access to Privacy Act information. Personnel shall adhere to the Privacy Act, 5 U.S.C. Section 552a and applicable agency rules regulations.

C.2.2 Physical Security The Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

C.2.3 Key Control The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Assurance Surveillance Plan (QASP). Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

C.2.4 Staff Controls Using the SEC established procedures; the Contractor shall report weekly the staff on board and changes in staff working under the contract. The Contractor will enter data daily in the Contractor Time Management System (CTMS) and follow On/Off Board procedures provided in supplemental documentation.

C.2.5 Quality Assurance The government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the performance threshold and the method of surveillance.

C.3 Post Award Conference/Periodic Progress Meetings The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the Contracting Officer will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

C.4 Organizational Conflict of Interest Contractor and subcontractor personnel performing work under this Contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5). The Contractor shall provide the Government an Organizational Conflict of Interest Plan for purposes of identifying, mitigating, or avoiding Organizational Conflicts of Interest (OCIs) in accordance with FAR Subpart 9.5. Contractors shall identify any possible OCI issues and provide a mitigation plan for them and for any other OCI issues that may subsequently arise during performance of the contract. Contractor analysis should include, but is not necessarily limited to, financial interests, and any contract work that involves the review of goods or services produced by industry competitors. The Contractor shall be excluded from any and all follow-on work related to all programmatic/portfolio data from this contract. If during the course of performing the requirements under this Contract, where those requirements are used for future acquisitions, the Contractor shall not respond or participate as a prime contractor, sub-contractor, or team member against those future acquisitions. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

C.4.1 Phase In/Phase Out Period The Contractor shall provide an Exit Transition Plan that shall identify transition support activities for all transition efforts for follow-on requirements to minimize disruption of services. The Exit Transition Plan and support shall include the following:

· Inventory all Government Furnished Equipment (GFE) and Government Furnished Information (GFI) in Contractor possession

· Status of all deliverables

· Current issues, problems, or activities in process that require immediate action

· The most current and up to date Policy and Procedures Manual

· The most current and up to date Operations Manual for each sub task

· The plan on how the Contractor intends to support the transition to the new follow-on contractor, and

· the list of key personnel involved in this effort

The Task Order COR shall approve this plan and transition support. Upon award of a follow-on contract, the Contractor shall work with the new contractor to provide knowledge transfer and transition support as required by the COR.

C.5 Specific Tasks The Contractor shall perform management support services in all task areas below. Under the scope of this SOW, the Contractor shall assist the SEC with developing project and program plans, making recommendations to the SEC in improving existing management processes and practices, and executing government decisions upon approval of the plan by SEC officials. The Contractor cannot exercise discretions in applying Federal government authority or commit the government to a course of action without approval.

C.5.1 Task Area 1.0 – Enterprise Operations The Contractor shall provide Enterprise Operations support to the SEC OIT management personnel, which range from Service Desk support, End User Computing, Network Operations Center (NOC) and Regional field Office Support. The Contractor shall provide services and personnel who meet the minimum requirements as defined in each Task.

Enterprise Operations provides support services that entail incident and request management, executive users support, regional field office support, NOC management and monitoring, access control, technology deployment and refresh, computer imaging, and administration of the SEC’s Service Management system. They further research, develop, and implement new technologies to satisfy business requirements in an effective and efficient way.

C.5.1.1 Task 1.1 – Service Desk Support The Contractor shall operate a Service Desk as the single point of contact for SEC employees and contractors, with incidents received via telephone call, by a web-based self-service portal, chat, by walk-up at the SEC headquarters, and by email from IT Specialists representing end users at all office locations.

The Contractor shall provide the SEC with a Service Desk environment that adheres to the following core principles:

· The contractors shall provide a comprehensive Service Desk that serves as a single point of contact for all IT related issues.

· The Service Desk shall deliver service in a customer focused method with an emphasis on active communication that sets and then exceeds customer expectations. This customer focused method shall provide an experience in which the Service Desk appears to have an intimate knowledge of the customer and their issues.

· The Service Desk shall engage all IT teams (internal/external) on behalf of the user needs and remain as a customer advocate throughout the resolution of the service.

· The Service Desk shall develop technical expertise within the Service Desk staff to allow for prompt and comprehensive resolution of issues to minimize the need for escalation and customer delay and to reduce overall incident volume.

· The Service Desk shall engage in aggressive problem management and process improvement to deliver high quality customer service.

Service Desk call volume and statistics are provided in Attachment 16 – ISS Demand Volume[footnoteRef:2] [2: The call volume and statistics listed in Attachment 16 are for estimation purposes only and do not represent a binding number of problems anticipated by the SEC. ]

Subtask Areas: The Contractor shall provide Service Desk support in the following areas:

· General Service Desk Support

· Application Support

· Access Control

· Executive Users Support

· Service Desk Reports and Deliverables

An overview of the current SEC Service Desk environment can be found in Attachment 18 - Service Desk Overview.

C.5.1.1. 1 General Service Desk Support The following table identifies general roles and responsibilities the Contractor would be responsible for to support the Service Desk under the ISS contract.

Contractor Roles and Responsibilities for General Service Desk Support

Provide both proactive and reactive onsite 24x7x365 global support and technical assistance to all SEC employees and contractors, including remote users (virtual workforce)

1. Provide support for end user and all requests are documented and tracked in the SEC’s Service Management system. Support includes, but may not be limited to, the following:

· Fielding and resolving questions related to all user hardware and software

· Fielding and resolving questions related to network connectivity including the Internet

· Installing user-requested desktop software when authorized

· Mobile device support including deployment, incidents, questions and retirement

· Fielding and resolving telephone problems

· Workstation hardware troubleshooting and repair

· First level SEC Application software support

· Account management

· Installations, moves, adds refreshes and retirement

Maintain Service Desk processes and procedures and review with SEC annually to ensure documentation is up-to-date

Develop a plan to provide on a daily basis, a walk around service (mobile service desk) inside the SEC HQ building to proactively assist and support end users with Service Desk supported functions. After approval of plan from SEC, implement mobile service desk

2. Provide full data recovery services on failed hard drive media using contractor resources and available tools. When recovery is deemed necessary by the SEC and cannot be accomplished with current contractor resources and software tools available, utilize 3rd party vendor to recover data, when approved by SEC. SEC will be responsible for third party costs (directly or indirectly)

3. Minimize SEC equipment costs by various means, to include working with manufactures and third party vendors to replace parts to support break/fix of equipment that are under warranty or are covered by a maintenance agreement

4. Ensure that all Service Desk personnel involved in the movement, deployment, and refreshment of any and all desktop equipment, software or mobile computing devices update relevant data asset inventory databases, SEC service management system, or Spare Parts database as appropriate. Ensure SEC processes are being followed during asset recapture, ensuring tracking of recaptured equipment

5. Develop and maintain an ongoing Knowledge Management plan to include such factors as creation, categorization, approval, review, and retirement of knowledge, with an emphasis on ensuring ongoing review of all knowledge articles

6. Support all areas of the SEC service management system, including but may not be limited to, incident, request, change, knowledge, and problem

7. Provide day to day administration of the SEC service management system to include, at minimum, account management, report generation, modification of existing workflow, creation of new workflow, requested enhancement, and self-service support

8. Provide to the SEC and authorized users, appropriate training in using the SEC service management system

9. Perform all database administration support on the SEC service management system

10. Proactively coordinate with all other internal and external third parties to resolve incidents and action service requests.

11. Classify all Incident Management tickets based on the four-tiered priority system detailed in Attachment 9 – Service Levels ISS

12. Ensure that appropriate approvals for new hardware and software requests are obtained as necessary, as well as follow any SEC policies for the distribution of any hardware and software

13. Provide full lifecycle support for all local and network printers and faxes. Support includes, but may not be limited to:

· Performing remedial and preventive maintenance of designated systems and components

· Coordinating with warranty and maintenance services from third party vendors

· Configuration / Security

· Monitoring for all issues such as paper jams, low toner and hardware errors

· Toner replacement

· Installations, moves, refreshes and retirement

· Reporting

14. Provide first line of support for all SEC copiers, to include performing simple maintenance (e.g. clearing paper jams) not covered under hardware support contract maintained by external vendor. Coordinate with external copier vendor any problems requiring hardware repairs

15. Proactively identify, resolve or escalate to SEC any issues or special requirements needed to execute the IMAC so that customer requested schedules are met

16. Provide broadly skilled engineers to maximize single point of contact resolution

17. Manage the SEC remote access token program and any future technologies the SEC may adopt

18. Monitor and process requests for new or replacement tokens, manage the database of issued tokens, and perform assignment and network configuration for issued tokens

19. Track the expiration dates of issued tokens and ensure users receive new tokens prior to the token’s expiration date

20. Ensure adequate license levels of remote access tokens to ensure the availability of tokens when requested

C.5.1.1.2 Productivity Application Support The SEC Service Desk provides support for common office productivity applications. The Contractor will be responsible for providing Level I and Level II application support on common office productivity tools and devices. Such support shall include basic “how do I” type questions as well as more complex questions. The Contractor shall perform research as needed to answer more complex questions. Examples of the type of support expected to be provided include the answering questions related to:

· Formulas in Excel

· Pivot Tables in Excel

· Creation of complex rules in Outlook

· Complex formatting in Word

· Customization of Windows 7 environment

Common office applications include, but may not be limited to:

· Microsoft Office Suite (Word, Excel, Outlook, PowerPoint, Access)

· Telecom tools (Jabber, WebEx)

· Approved mobile applications for SEC mobile devices (Blackberry, IOS)

Application support call volume and statistics are provided in Attachment 16 – ISS Demand Volume.

C.5.1.1.3 Access Control The Contractor shall provide access control services and activities associated with managing and coordinating account activation, termination, changes, and expiration of SEC user’s accounts. The following table identifies the Contractors roles and responsibilities for access control:

Contractor Roles and Responsibilities for Access Control

1. Perform account and group/lists administration related functions in Active Directory and any other SEC designated systems to ensure end users have access to all authorized resources

2. Ensure the following of all SEC process and procedures to ensure no unauthorized access is granted. Provide timely, accurate, and auditable support for all access related functions and services

3. Administer, configure, enhance and integrate the SEC identity management system with other SEC systems (when required). The current SEC identity management system is Avatier

C.5.1.1.4 Executive User Support The Contractor shall provide enhanced Service Desk support to certain executive level employees to ensure continuity of services and relationship with these designated employees. The SEC will designate Executive Users at its sole discretion and may change the list of designated Executive Users at its sole discretion from time to time. The SEC currently has approximately 100 designated executive users that would require executive user support.

The Contractor shall provide 24x7x365 global support and technical assistance to designated SEC executives, ensuring the following support is met for all request made by executive users:

· Ensure executive users is contacted within 15 minutes of initiating a service request

· Ensure issue resolution is begun immediately and worked continuously until resolved

The SEC will provide a complete list of executive users at contract award.

C.5.1.1.5 Service Desk Reports and Deliverables The following table identifies reports and deliverables the Contractor shall be responsible to provide the SEC in support of the Service Desk:

Contractor Roles and Responsibilities for General Service Desk Support

1. Develop a quarterly Action Plan to include suggested improvements from SEC employees and contractors on the services provided by the Contractor and plans to address suggested improvements with specific steps that the Contractor shall take to adopt such recommendations for service improvement

2. Maintain list of supported printers and copiers to include, but not limited to, IP addresses, make and model, serial number, bar code, location, and queue name. Ensure list is aligned with Asset Management system. Provide SEC with audit of list monthly

3. Develop a quarterly report on problem management, to include, list of all problem reported by the Service Desk, status of opened problems, and plan of action for the upcoming quarter

4. Provide a report to the SEC showing inactive account usage in a monthly interval or as designated by the SEC

5. Perform an annual audit to ensure the accuracy of the Active Directory system, to include comparisons to external systems such as HR Databases

6. Report on previous business day’s service desk call volume and SLAs to be incorporated into the OIT Morning Meeting report slides. Content may change as the government reporting requirements change over time. Due daily by 7:30am.

7. Report monthly on outstanding tickets dependent on third party action. Report to include ticket, item awaiting action, third party, duration and if known estimated resolution time.

8. Develop monthly service desk reporting for SLAs and KPIs. Can be delivered as a report or government accepted dashboard

9. Develop a Help Desk SOP to be delivered to the SEC within 90 days after contract award date and updated as appropriate

10. Develop a User Account Management SOP to be delivered to the SEC within 60 days after contract award date and updated as appropriate

11. Develop a Hardware and Asset Management Plan to be delivered to the SEC within 30 days after contract award date and updated as appropriate

12. Develop a Service Level Agreement (SLA) Management Plan to be delivered to the SEC within 30 days after contract award date and updated as appropriate

13. Develop a monthly Customer Satisfaction report base on the results of customer satisfaction surveys for the previous month

C.5.1.2 Task 1.2 – End User Computing (EUC) The SEC End-User Computing environment encompasses approximately 6,000 employees and contractors in one HQ location in Washington, DC and 11 regional locations. In addition to these core sites, the End User Computing environment has hardware installed and managed in two off-site data centers. The EUC supports desktops, laptops, tablets, mobile devices, standalone and network printers; standalone and network scanners, fax machines, a collection of core and non-core SEC approved workstation applications; and a number of infrastructure management servers and applications.

The SEC End User Computing staff constantly reviews upgrades to SEC existing technology and reviews new and emerging technology trends in the attempt to identify opportunities for the Commission to satisfy business requirements in a more efficient manner. Research, development and implementation of new technologies is completed to meet OIT directive as well as to satisfy customer driven requests that satisfy SEC business requirements.

The Contractor under this task will provide the SEC with End User Computing support services to manage and operate all SEC end user hardware and software. The Contractor shall support the achievement of SEC performance objectives in the areas of foundation management; commercial-off-the-shelf (COTS) software management; desktop and laptop hardware management; patch management and deployment; management of infrastructure support tools; end user policy and information technology usage compliancy; adaptive technologies; and new and emerging end user hardware and software technologies.

Subtask Areas: The Contractor shall provide Service Desk support in the following areas:

· General EUC Support

· Computer Imaging

· Software Support

· Technology Refresh

· EUC Security

· EUC Reports and Deliverables

An overview of the current SEC EUC environment can be found in Attachment 19 – End User Computing (EUC) Overview. Current SEC EUC asset counts and volumes are provided in Attachment 16 – ISS Demand Volumes.

C.5.1.2.1 General EUC Support The following table identifies general roles and responsibilities the Contractor would be responsible for to support the EUC under the ISS contract:

Contractor Roles and Responsibilities for General Service Desk Support

1. Provide recommendation to improve services and standards for supporting the desktop computing and End-User environment

2. Coordinate activities with the Service Desk, and provide Tier 3 Support to the Service Desk and authorized users

3. Provide Tier 3 resolution for incidents and problems associated with EUC equipment and software

4. Provide support onsite or dispatch support specialists as necessary to offsite locations to provide authorized users with operational and technical support

5. Provide both proactive and reactive troubleshooting to effectively identify potential Incidents or Problems, and attempt to eliminate them before they occur

6. Support authorized users in correctly using EUC equipment and software, and in accessing and using related technologies and services

7. Deploy and manage desktop and laptop hardware and software

8. Promptly report to SEC management on End User violations of SEC policies related to End User devices and peripheral equipment in accordance with SEC policies

9. Provide Incident Determination, Resolution and Root Cause Analysis

10. Support SEC employees who require the use of Adaptive Technologies, to include the use of sign-language and specialized equipment for those who are hearing and vision impaired

11. Support, install, and configure Adaptive Technology tools for all employees requiring their use through specialized equipment and software

12. Maintain a document that describes the minimum equipment and software requirements and/or the specific equipment and software designated for standard use within the SEC (the “Standard Products”)

13. Develop recommendations based on strategies and approaches that will result in the elimination of unnecessary equipment or software, or modifications to existing equipment and software that will provide the SEC with competitive advantages, increased efficiency, increased performance, or cost savings

14. Provide oversight to the removal of nonstandard and unapproved products from SEC equipment as requested by authorized SEC personnel

C.5.1.2.2 Computer Imaging EUC builds, test, supports, and maintains all approved SEC computer images. The Contractor shall be responsible to provide Computer Imaging support services to meet, at a minimum, the roles and responsibilities outlined in the following table:

Contractor Roles and Responsibilities for Computer Imaging Support

1. Build, test, support, and maintain SEC computer image(s)

2. Provide technical assistance for defining computer image(s) specifications for end user devices

3. Develop and document detailed technical specifications that define and support the build, test, and deployment plans for the standard computer image(s)

4. Conduct system-level and End-User testing of computer image(s) to validate that they perform in accordance with the approved specifications

5. Conduct deployment testing to verify that images can be deployed successfully and operate with all supported applications, hardware and Software

6. Recreate End-User desktop environment to previous state including base build plus all End-User specific features, functions and applications, as required

7. Automate computer image deployment processes (e.g., remote electronic upgrading of desktop images)

8. Conduct deployment reviews and provide results to SEC

9. Gather information on deployed End User profiles and recommend changes to the standard images

10. Document, coordinate and maintain changes to the standard images utilizing SEC-approved process

11. Provide data restoration for End User devices using SEC-approved processes for mass deployment of devices as per project schedule

C.5.1.2.3 Software Support EUC manages and supports all end user software, to include, distribution and maintenance. The Contractor will be responsible for the distribution, installation, and maintenance, such as upgrading and patching, of approved software.

The Contractor shall be responsible to provide Software support services to meet, at a minimum, the roles and responsibilities outlined in the following table:

Contractor Roles and Responsibilities for Software Support

1. Distribute software, install software, and install upgrades as required by the SEC

2. Monitor recommended and required corrections to software from third-party software vendors for software maintained by the EUT Team

3. Install corrections and patches supplied by third-party vendors to all software as necessary for software maintained by the EUT Team

4. Ensure that third-party software provided by vendors has been approved for use in the SEC environment before widespread installation

5. Create and maintain a library of documentation (e.g., Standard Operating Procedures) that reflects the complexity and diversity of the environment and that enhances the software support process

6. Recommend appropriate methods and tools to improve and increase automation in the SEC EUC environment

7. Check the presence and version of software on specific devices

8. Monitor the use of licensed software, including license metering

9. Provide technical assistance for defining software and deployment plans

10. Conduct deployment testing to verify that images can be deployed successfully and operate with all supported applications, hardware and Software

11. Conduct and provide results on software deployment reviews

12. Provide support for ad-hoc requests for S/W packaging and distribution

Patch Management

13. Maintain and update software patch process

14. Ensure that necessary routine and emergency operating system, application, and security patches are deployed to SEC workstations efficiently and as transparently as possible

15. Monitor patch activity on a daily basis, providing SEC with Patch Management Reports, and deploy patches requested by the SEC

16. Establish contingency plans and rollback plans to effectively and efficiently restore network deployed software patches to their original state as necessary

17. Develop and maintain automated tools and monitoring mechanisms to ensure that the regional office IT community staff maintains compliancy in patch management

Software Distribution

18. Schedule software distributions to support time-critical release upgrades, to deploy urgent patches, and to maintain current projects while minimizing the disruption to authorized users

19. Utilize an electronic software distribution system that effectively and efficiently distributes new software to LAN-connected workstations located at the SEC sites and to remotely connected workstations in a timely manner using SEC approved tools (BigFix and SCCM)

20. Employ an automated software distribution solution and procedure that provides consistent and efficient software deployments for software configuration changes

21. Install, upgrade, and change all software as required and in accordance with the SEC technical architecture standards

22. For any changes, upgrades, or enhancements, the Contractor shall advise the SEC of any additional equipment, network, environmental, or other requirements needed during integration testing and/or otherwise known to be necessary for the implementation

C.5.1.2.4 Technology Refresh The Contractor shall support the SEC in deploying new hardware, software and operating systems as part of the SEC standard and emerging technology refreshment cycle as designated by the SEC.

The SEC technology refresh rates are listed in Attachment 13 - SEC Technology Refresh Rates.

The Contractor shall be responsible to provide Technology Refresh support services to meet, at a minimum, the roles and responsibilities outlined in the following table:

Contractor Roles and Responsibilities for Technology Refresh

1. Identify and develop Enhancement and Upgrade Recommendations to be presented to the SEC management that shall include: potential improvements to current SEC technology and business processes, forecasting of viable future technologies, and new business processes that may be considered

2. Develop and maintain a Technology Refresh Plan and schedule

3. Assess the usability of the assets and review alternatives to replace, re-lease, consolidate, or retain the assets. Deliver an initial recommendation regarding the assets to the SEC for review and approval

4. Implement a technology refresh plan and provide status reports regarding implementation status as required

5. Perform quarterly reviews of technology refresh plans to ensure they properly support SEC business requirements

6. Upgrade and replace equipment and software in accordance with the standards of the SEC technical architecture and Long-Range IT Plan. Accommodate the timeframes and other requirements associated with Refresh at the SEC

7. Develop a Technology Roll-Out Plan/Timeline for each deployment

C.5.1.2.5 EUC Security EUC provides virus protection to all SEC end user devices. The Contractor will be responsible to deploy virus protection software to all end user devices, and ensure the software is up-to-date.

The Contractor shall be responsible to provide EUC Security services to meet, at a minimum, the roles and responsibilities outlined in the following table:

Contractor Roles and Responsibilities for EUC Security

1. Develop, update, and maintain Virus Protections Plans

2. Install, update, operate, and maintain virus protection software on all equipment used to deliver or support SEC Services.

3. Install updates to virus-protection software as needed, according to the Service Levels required by the SEC

4. Install, update, operate, and maintain intrusion protection software on all equipment used to deliver or support SEC Services.

5. Develop and maintain end-user policies and standards for data protection and intrusion detection

6. Provide the SEC with recommendations for improved end-user security.

C.5.1.2.6 EUC Reports and Deliverables The following table identifies reports and deliverables the Contractor shall be responsible to provide the SEC in support of End User Computing (EUC):

Contractor Roles and Responsibilities for General Service Desk Support

1. Develop a monthly Patch Management report to include list and count of; affected systems EUT supports, affected Microsoft applications, and affected systems grouped by Microsoft Windows Update as “Important” and “Recommended”

2. Develop a monthly Patch Summary Report to include a roll-up of the total number of patches (deployed, failed, pending, and restarted) and system images deployed (successful, failed, and average time to complete) per day.

3. Develop recommendations to improve EUC operations and provide the SEC with a EUC Improvement Report on a monthly basis to include plans to implement recommendations

4. Provide a weekly Patch Status Report to include a list and count of system that are missing EUT Approved updates (30-60 days, 61-90 days, 91-180 days, 181-365 days, and > 365 days) and a list of systems that are missing 10 or more patches/updates list

5. Provide a weekly Qualys/Splunk Report to include a list and count of affected systems for applications found to be vulnerable system that are missing EUT Approved updates (30-60 days, 61-90 days, 91-180 days, 181-365 days, and > 365 days)

6. Provide a weekly BigFix Discrepancy Report to include a list and count of workstations present in Active Directory (AD) that are not present in BigFix

7. Provide a daily updated on the health of BigFix. Update can be either a dashboard or a report

8. Provide a report of all systems that have unapproved software installed on a quarterly basis. The report shall include the affected system information, date and time unapproved software detected, and date and time of remediation for all systems affected during the measured quarter

C.5.1.3 Task 1.3 – Network Operations Center (NOC) Support The Contractor shall provide the SEC support in operating, twenty-four hours a day, seven days a week, 365 days a year (24x7x365), the Network Operations Center (NOC), to include, the monitoring of the entire SEC infrastructure for availability, performance, capacity, and events/alerts.

Support for the NOC is broken up into two functions:

· Enterprise Operations Center (EOC)

· Enterprise Monitoring Systems (EMS)

The Contractor shall be responsible to provide NOC support services to meet, at a minimum, the roles and responsibilities outlined in the following table:

Contractor Roles and Responsibilities for NOC Support Services

Enterprise Operations Center (EOC)

1. Provide support to all functions of the SEC NOC

2. Coordinate and manage the resolution of events and alerts

3. Manage system hardware and software releases, changes, moves, and installation to minimize disruption

4. Monitor SEC-designated critical production system components to predict and detect failures and degraded performance

5. Monitor and Identify problem areas and coordinate corrective action with appropriate SEC SMEs and personnel proactively

6. Contact and coordinate with the SEC system owners and points of contact (POC) and the appropriate third parry vendors when applicable

7. Develop an provide recommendations to improve the NOC procedures and documentation

8. Analyze all operational aspects of the NOC and provide recommendations for preventing potential problems and for making improvements

9. Participate in root-cause analysis of problems that are mission critical or have recurring negative effects on the SEC Information Technology Infrastructure

Enterprise Monitoring Systems (EMS)

10. Provide support to the SEC NOC

11. Manage monitoring system hardware and software releases, changes, moves, and installation to minimize disruption

12. Monitor SEC-designated critical production system components to predict and detect failures and degraded performance

13. Ensure monitoring systems are free of duplicate elements

14. Monitor and Identify problem areas and coordinate corrective action with appropriate SEC SMEs and personnel proactively

15. Provide report on utilization, capacity, performance, and availability on components monitored by the NOC

16. Participate in root-cause analysis of problems that are mission critical or have recurring negative effects on the SEC Information Technology Infrastructure

17. Adhere to Incident, Event, Change, and Configuration Management processes

18. Review and validate all aspects of the enterprise network operating procedures to ensure that the service can be sustained in optimal operational condition

19. Monitor all networked production devices in Infrastructure and measure aspects of capacity, performance, and availability and develop reports. Based on SEC provided list of critical systems and applications

20. Review the availability, capacity, and performance reports to identify the problem areas and coordinate with various teams to plan, design, and implement corrective actions

21. Review and reevaluate any alerts and events recorded by SEC tools or generated by the infrastructure for validity

22. Maintain a complete list of all the thresholds configured in the monitoring tools and ensure list is updated to reflect any changes

23. Provide an Executive Management and Trending Analysis Report that includes high-level analysis and trending of key SEC system metrics. Based on SEC-provided list of critical systems and Apps

24. Develop and provide a quarterly staffing status report

25. Plan, design, and configure the tools used by the NOC and ensure these tools can generate a daily, monthly, and yearly availability, performance, and capacity reports to be…