Attachment_2_-_Statement_of_Work_(06042019).docx
DOCX document 34 KB Posted
- Attached to
- MPS Software, Training, and Maintenance Single Award IDIQ Federal contract opportunity
- Solicitation number
- SP7000-19-R-1002
- Issued by
- Defense Logistics Agency
About this file
This statement of work outlines requirements for a managed print services fleet assessment software solution. The Defense Logistics Agency seeks a commercial off-the-shelf software to manage up to 50,000 devices across DOD and federal agencies. The software must integrate fleet, device, and user data collection; print management and queueing; and reporting and analysis. It must comply with Section 508, support IPv4/IPv6, integrate with DOD PKI/CAC, and adhere to NIST, DISA, and DOD STIG security standards. The contractor must provide training, installation, maintenance, and technical support. The anticipated solicitation SP7000-19-R-1002 will be a single-award IDIQ for the software, training, and maintenance issued on August 12, 2019 with proposals due on January 12, 2020. The evaluation criteria will be price, technical capability, and past performance using lowest price technically acceptable determination. The contract duration is up to three years within CONUS and OCONUS locations.
Attachment 2 - Statement of Work (06042019)
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| SP700019R100205_(SF30).pdf | ||
| SP700019R100204_(SF30).pdf | ||
| Attachment_1_-_CLIN_Structure_(09092019).xlsx | XLSX spreadsheet | |
| Government_Rd2_Answers_(10072019).pdf | ||
| SP700019R100203.pdf | ||
| Attachment_2_-_Statement_of_Work_(09302019).docx | DOCX document | |
| SP700019R100202_(SF30).pdf | ||
| SP700019R1002_(Conformed_09092019).pdf | ||
| SP700019R100201_(SF30).pdf | ||
| Attachment_2_-_Statement_of_Work_(09092019).docx | DOCX document | |
| Government_Rd1_Answers_(09092019).pdf | ||
| Attachment_3_-_Procurex_Reverse_Auction_Instructions.pdf | ||
| Attachment_6_-_508_Compliance_Document.docx | DOCX document | |
| Attachment_5_-_Question_and_Comment_Form.xlsx | XLSX spreadsheet | |
| SP7000-19-R-1002.pdf | ||
| Attachment_1_-_CLIN_Structure_(03142019).xlsx | XLSX spreadsheet | |
| Attachment_4_-_Statement_of_Work_Compliance_Form.pdf |
Show all 17
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Managed Print Services Fleet Assessment Software Requirements for DLA Information Operations Data Management Services
STATEMENT OF WORK
(Version: 04/08/2019)
1.0 BACKGROUND
The Defense Logistics Agency (DLA) Information Operations Data Management Services’ mission is to provide document automation and output to the Department of Defense (DOD), as well as, to Federal Executive Branch Agencies. This includes the electronic conversion, retrieval, output, and distribution of both digital and hardcopy information.
As a part of this mission, DLA provides a successful managed print services program primarily to the DOD, through the provision of low cost Multi-functional devices (MFDs). This Equipment Management Solutions (EMS) program incorporates office device assessments, and the management of output devices, respective supplies and maintenance, specific to individual organizational needs.
2.0 SCOPE
As part of the EMS program, DLA must effectively manage its customers’ printing device fleets (devices that print, copy, scan, and fax) through the monitoring and analysis of device performance, with the goal of reducing the total-cost-of-ownership (TCO). DLA is seeking a single commercial-off-the-shelf (COTS) solution to support reducing TCO by improving efficiency, changing user print behavior, and by identifying opportunities for business improvements and cost savings.
The COTS solution must be vendor neutral and able to manage a range of device manufacturers. The COTS solution must also be flexible and scalable to support increased numbers of users and devices. The expected number of devices is a range of 25 to 50,000 devices from various DOD and Federal Executive Branch agencies in CONUS and Non-Foreign OCONUS locations (Hawaii, Alaska, Guam, and Puerto Rico).
3.0 OBJECTIVE
DLA will issue an Indefinite Delivery Indefinite Quantity (IDIQ) contract for Managed Print Services (MPS) fleet assessment software. The MPS software will be used by DLA to expand its MFD offering to include printer and print queue management for customer device fleets across various different networks. In addition, DLA will, at its discretion allow authorized customers to use the MPS software solution to monitor their own device fleets.
4.0 SOFTWARE REQUIREMENTS
The following are descriptions of the capabilities that the proposed MPS software shall have:
4.1 Fleet/Device Management
| 4.1.1 | Account for all fleet devices on the network (that print, copy, scan, and fax), in addition to, devices that are locally connected to a workstation on the network. |
| 4.1.2 | Maintain a centralized inventory that tracks all fleet devices. |
| 4.1.3 | Identify and update fleet device inventory when new devices are installed or removed. |
| 4.1.4 | Capability to build logical groupings of devices on the network (by floor, building, organization, department, etc.) for management analysis. |
4.2 Device & User Data Collection
| 4.2.1 | Data collection method via a network-based remote monitoring process. | |
| 4.2.2 | Device and user data must be collected from local or regional networks, and then forwarded to a central database located in the DLA network, or the customers’ agency network. | |
| 4.2.3 | Device and user data must be gathered in real time and must be made available for analysis or viewing for any given time or period. | |
| 4.2.4 | Collect device manufacturer make, model, serial number, and location. | |
| 4.2.5 | Collect device volumes/pages printed and meter reads for monochrome, color, one-sided, and duplex prints. | |
| 4.2.6 | Collect device volumes/pages printed and meter reads for scan and fax output. | |
| 4.2.7 | Collect user centric device data, which identifies the user and the following attributes for each file that the user sends to the device for printing: | |
| - | Pages and quantity of the file being printed | |
| - | Date and time of the file being printed | |
| - | Application and file type of the file being printed | |
| - | Color output of the file being printed | |
| - | User centric data must also identify the ranking of usage of all user | |
| printing by groups or departments | ||
| 4.2.8 | Collect device service/maintenance alert and down time data. | |
| 4.2.9 | Maintain all historical device and user data collected. |
4.3 Print Management
The proposed MPS software must capture all user-initiated print jobs from user workstations, and allow only the specified user to release the print job from any device on the network. The software must capture the print job with necessary user metadata to associate the print with the authenticated user at the output device. For authentication, the user must be able to authenticate at the device with CAC/PIV card to release the held print job(s). For auditing, the software must track username, print job name, and date/time stamp for all print jobs.
| 4.3.1 | Capability to implement printing via organizationally defined rules to restrict or allow printing (rules-based process), and to automatically send associated warnings and alerts to users. |
| 4.3.2 | Capability for users to authenticate and release print jobs from a queue to any device on the network (Secure-Release and Pull-Printing). |
| 4.3.3 | Capture all print job information to include file name, file type, date and time printed, quantity printed, black or color output, one or two sided printing, in addition to, user metadata to associate the print with the user and the output device. |
| 4.3.4 | Secure-Release and Pull-Printing function to work in compliance with the device DOD PKI/CAC and NIST FIPS 201/PIV standards. For authentication, the user must be able to authenticate at the output device with domain username/password (Active Directory/LDAP), and CAC/PIV card to release the held print job. |
| 4.3.5 | Capability to automatically send maintenance/service/network issue alerts back to a central IT/Admin support group or unique individuals via email, to facilitate rapid problem resolution. |
4.4 Reports & Analysis shall:
| 4.4.1 | Provide scheduled and adhoc utilization analysis reports, based on device and print management data collected (refer to Sections 4.2 and 4.3), to identify optimization or right-sizing opportunities. |
| 4.4.2 | Provide Spend Analysis reports encompassing consumables, maintenance, equipment, and usage costs. Analysis must be based on actual costs, or when actual costs are not available, a combination of assumptive analyses and industry standards. |
| 4.4.3 | Provide Change Management report, showing if devices have been removed, added, or relocated. |
| 4.4.4 | Provide Missing Meter Read report, showing devices where page counts were not captured. |
| 4.4.5 | Allow a government user to configure and develop customized reports using all historical device and user data collected (refer to Sections 4.2 and 4.3). |
| 4.4.6 | Able to export report data to MS Excel file formats, and text and common database file formats. |
4.5 Section 508 Compliance:
4.5.1 Comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. § 794d), and the Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards (36 CFR part 1194) as amended. See Attachment 6.
5.0 HARDWARE REQUIREMENTS
The contractor must provide documentation on the hardware requirements to run the MPS software, in addition to, server space, network bandwidth, and other network resources or network software required to support the software.
6.0 NETWORK FUNCTIONALITY
The MPS software must be able to be accredited on DOD and Federal networks within National Institute of Standards and Technology (NIST) and DOD Certification and Accreditation (C&A) guidelines.
6.1 Software Installation and Configuration Documentation
The contractor must provide an installation and configuration guide describing the mitigation or compliance of security standards identified in the following guidelines:
| 6.1.1 | Center for Internet Security (http://www.cisecurity.org/) | ||
| 6.1.2 | DISA (https://cyber.mil/)) | ||
| 6.1.3 | NIST (http://checklists.nist.gov) |
6.2 Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/) and take appropriate actions if their software is subject to a known vulnerability. In addition, the customer will notify the contractor via DLA as security vulnerabilities are identified concerning all software installed on the DOD Information Network (DODIN). When vulnerabilities are identified by either the contractor or the customer, the contractor shall provide remediation for distribution to all installed software in accordance with USCYBERCOM TASKORD 13-0670 unless a different time period is directed by USCYBERCOM via DLA. The TASKORD is For Official Use Only and is quoted below:
3.B.1.D.2. Assured Compliance Assessment Solution (ACAS) assigns severity scored of critical, high, medium and low to plug-in findings.
3.B.1.D.2.A. Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks. Actions to mitigate or remediate critical vulnerabilities should be initiated upon discovery with the goal of mitigation/remediation within 7 days.
3.B.1.D.2.B. Findings with a severity score of high should be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within 21 days of discovery.
3.B.1.D.2.C. Findings with severity scores of medium and low should be addressed in accordance with local Approving Official (AO), Information System Security Manager (ISSM), or Information System Security Officer (ISSO) guidance until further notice.
3.B.1.D.2.D. In all instances, DOD components should consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.
In the event remediation cannot be achieved within the mandated timeline, a Plan of Actions and Milestones will be approved by the Customer's Authorizing Official or designee for risk acceptance.
6.3 Software must comply with DOD Security Technical Implementation Guide (STIG) (https://cyber.mil/) and NIST Cybersecurity Framework standards as outlined in NIST Special Publication 800-53 Revision 4 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), and the Federal Information Security Management Act (FISMA) (http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf (Section 3.c)), and shall obtain approval to operate on any DoD Service or Agency as well as any U.S. Federal Government Agency Networks.
7.0 NETWORK SECURITY
Network testing will be conducted after award and in addition to the requirements set-forth in this SOW and it will also be conducted in-accordance-with the terms and conditions of the solicitation.
The following are network security requirements that shall be met for the proposed MPS software:
7.1 Encrypt all inbound/outbound communication with the device for printing or remote management.
7.2 Allow for all fleet device logs to be retrieved, reviewed, and archived.
7.3 Registration of all ports and protocols with the DISA PPSM database with source and destination IP information.
7.4 Use of HTTPS sockets for any approved web-enabled services.
7.5 Compliance with DOD wide SMARTCARD and DOD PKI standards, and support all approved physical cards related to CAC released print, throughout the contract term.
7.6 Utilize CAC/PIV for authentication related to CAC released print.
7.7 Enforce Secure-Release and Pull-Printing via user credentials with AD/LDAP, user name/password, and CAC/PIV identity certificate-based authentication.
7.8 Enforce SNMPv3 only for secure management of the device.
7.9 Allow for an overall administrator account, but also allow each site to manage their devices with appropriate permissions and responsibilities.
7.10 Protect and encrypt Personally Identifiable Information (PII).
7.11 Remove or conceal all IP addresses from displays, reports, etc.
7.12 Provide updates and patches to keep software compliant with future IA requirements. Any new IT security standards shall be added via contract modification IAW FAR 52.212-4(c).
7.13 Warrant that the software shall operate on a network supporting Internet Protocol Version 4 (IPv4), Internet Protocol Version 6 (IPv6), a hybrid of IPv4 and IPv6.
7.14 Software Testing and Evaluation:
| 7.14.1 | DLA and its customers’ agencies will perform software testing, within available capabilities, in accordance with the Network Functionality and Security requirements defined in Sections 6.0 and 7.0, all paragraphs and subparagraphs. |
| 7.14.2 | The contractor shall provide at no additional cost, engineering assistance and other support necessary to configure, setup, and test the software as needed. |
| 7.14.3 | DLA software testing and evaluation at the IDIQ level, which includes the submission of the software and any technical documentation requested, documentation of all ports used for full functionality, standard DoD vulnerability scan to include port scan and the mitigation of failed controls. |
| 7.14.4 | DLA customer agencies software testing and evaluation at the Task Order level, which includes the submission of the software and any technical documentation requested, and the mitigation of failed controls. |
8.0 SOFTWARE MAINTENANCE & TECHNICAL SUPPORT
8.1 The Contractor shall provide onsite support during installation. The end user's IT department shall be present for collaboration at time of installation.
8.2 The Contractor shall provide English-speaking service technician support Monday through Friday from 8:00 a.m. - 4:30 p.m. local time, with the exception of Federal or local Holidays.
8.3 Service for Non-Remote Areas: Non-Remote Areas are defined as service locations being within a fifty (50) mile radius commute of a metropolitan area, which for the purpose of this RFQ is defined as a statistical area with a population of 50,000 persons and above. For service in non-remote areas:
8.3.1. The Contractor shall respond to work stoppage situations within two
(2) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the key operator within an hour to discuss service problem and time of arrival. It is estimated that 10% of service calls will be classified as "work stoppage" across the total device population on a yearly basis.
8.3.2 The Contractor shall respond to non-work stoppage situations within four (4) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the key operator within an hour to discuss service problem and time of arrival.
8.4 Service for Remote Areas: Remote Areas are defined as being beyond a fifty-one (51) mile radius commute of a metropolitan area. For service in remote areas:
8.4.1 The Contractor shall respond to work stoppage situations within four
(4) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the key operator within an hour to discuss service problem and time of arrival. It is estimated that 10% of service calls will be classified as "work stoppage" across the total device population on a yearly basis.
8.4.2. The Contractor shall respond to non-work stoppage situations within eight (8) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the key operator within an hour to discuss service problem and time of arrival.
9.0 TRAINING
The contractor must provide training and materials. The training must be role-based training targeted for different users roles to include administrator, user, and all other roles defined in the proposed software. All training materials must be furnished by the contractor and made available in hardcopy and PDF electronic format. Training must be provided in-person or via webinar, as stated in each task order.
9.1 The contractor must provide General User and Administrator software training, and training for any other role that the software includes. Training guides must also be provided in hardcopy and PDF electronic formats, and include simple to follow step-by-step screen shots with detailed explanations.
9.2 The contractor must provide a Training Plan for DLA review and approval.
9.3 The Contractor shall provide services to educate, support and train DLA personnel in supporting their customer sites, as well as, training the DLA customer personnel in supporting its own implementation of the software. Follow-up training and consulting services may be required after the initial software installation upon request.
10.0 INSTALLATION
10.1 MPS software license must be transferable to a replacement device if original device is removed from the network during the contract period.
10.2 DOD policy prohibits the publishing of network configuration information. Therefore, DOD installations will not fill out pre‐installation site surveys. The required information will be provided at time of installation by the local IT support staff.
10.3 The contractor must provide on-site assistance to install and configure the software. The government will provide the prerequisite hardware and resources to support the installation and configurations. The government may also implement and maintain a test and development environment prior to the actual software installation and implementation. The contractor must also provide on-site assistance for this test and development environment, at no additional cost to the government.
10.4 In addition to the primary installation and configuration of the software, every other location may require onsite custom configurations. Therefore, the contractor shall provide consulting services in order to ensure that the training, configuration, and functionality maximize the efficient use of the government time and resources.
11.0 ECMRA
The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for DLA via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2019. Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil.
12.0 TRAVEL
The DLA Information Operations Point of Contact (POC) will recommend and approve all related travel in writing prior to travel being performed. Any travel performed and not pre-approved by the POC, shall not be reimbursed. Each travel period will be funded as FFP at the task order level and shall be issued prior to travel. Any travel performed prior to task order issuance/modification is at the sole risk of the contractor and shall not be reimbursed. All travel shall be calculated in accordance with the latest version of Joint Travel Regulations (JTR). Travel expenses in excess of the task order amount will not be reimbursed.
File details come from the government source that posted it. Updated .