Attachment_2_-_Statement_of_Work_(09302019).docx

Managed Print Services Fleet Assessment Software Requirements for DLA Information Operations Data Management Services

STATEMENT OF WORK

(Version: 09/30/2019)

1.0 BACKGROUND

The Defense Logistics Agency (DLA) Information Operations Data Management Services’ mission is to provide document automation and output to the Department of Defense (DOD), as well as, to Federal Executive Branch Agencies. This includes the electronic conversion, retrieval, output, and distribution of both digital and hardcopy information.

As a part of this mission, DLA provides a successful managed print services program primarily to the DOD, through the provision of low cost Multi-functional devices (MFDs). This Equipment Management Solutions (EMS) program incorporates office device assessments, and the management of output devices, respective supplies and maintenance, specific to individual organizational needs.

2.0 SCOPE

As part of the EMS program, DLA must effectively manage its customers’ printing device fleets (devices that print, copy, scan, and fax) through the monitoring and analysis of device performance, with the goal of reducing the total-cost-of-ownership (TCO). DLA is seeking a commercial-off-the-shelf (COTS) solution to support reducing TCO by improving efficiency, changing user print behavior, and by identifying opportunities for business improvements and cost savings.

The COTS solution may be part of a software suite that share common user interface, features and theme, provide seamless and integrated functionality, and is developed and sold together by one vendor/manufacturer.

The COTS solution must be vendor neutral and able to manage a range of device manufacturers. The COTS solution must also be flexible and scalable to support increased numbers of users and devices. The expected number of devices is a range of 25 to 50,000 devices from various DOD and Federal Executive Branch agencies in CONUS and Non-Foreign OCONUS locations (Hawaii, Alaska, Guam, and Puerto Rico).

3.0 OBJECTIVE

DLA will issue an Indefinite Delivery Indefinite Quantity (IDIQ) contract for Managed Print Services (MPS) fleet assessment software. The MPS software will be used by DLA to expand its MFD offering to include printer and print queue management for customer device fleets across various different networks. In addition, DLA will, at its discretion allow authorized customers to use the MPS software solution to monitor their own device fleets.

4.0 SOFTWARE REQUIREMENTS

The following are descriptions of the capabilities that the proposed MPS software shall have:

4.1 Device/Inventory Auditing

4.2 Device & User Data Collection

4.3 Print Management

The proposed MPS software must capture all user-initiated print jobs from user workstations, and allow only the specified user to release the print job from any device on the network. The software must capture the print job with necessary user metadata to associate the print with the authenticated user at the output device. For authentication, the user must be able to authenticate at the device with CAC/PIV card to release the held print job(s). For auditing, the software must track username, print job name, and date/time stamp for all print jobs.

4.4 Reports & Analysis shall:

4.5 Section 508 Compliance:

4.5.1 Comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. § 794d), and the Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards (36 CFR part 1194) as amended. See Attachment 6.

5.0 HARDWARE REQUIREMENTS

The contractor must provide documentation on the hardware requirements to run the MPS software, in addition to, server space, network bandwidth, and other network resources or network software required to support the software.

6.0 NETWORK FUNCTIONALITY

The MPS software must be able to be accredited on DOD and Federal networks within National Institute of Standards and Technology (NIST) and DOD Certification and Accreditation (C&A) guidelines.

6.1 Software Installation and Configuration Documentation

The contractor must provide an installation and configuration guide describing the mitigation or compliance of security standards identified in the following guidelines:

6.2 Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/) and take appropriate actions if their software is subject to a known vulnerability. In addition, the customer will notify the contractor via DLA as security vulnerabilities are identified concerning all software installed on the DOD Information Network (DODIN). When vulnerabilities are identified by either the contractor or the customer, the contractor shall provide remediation for distribution to all installed software in accordance with USCYBERCOM TASKORD 13-0670 unless a different time period is directed by USCYBERCOM via DLA. The TASKORD is For Official Use Only and is quoted below:

3.B.1.D.2. Assured Compliance Assessment Solution (ACAS) assigns severity scored of critical, high, medium and low to plug-in findings.

3.B.1.D.2.A. Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks. Actions to mitigate or remediate critical vulnerabilities should be initiated upon discovery with the goal of mitigation/remediation within 7 days.

3.B.1.D.2.B. Findings with a severity score of high should be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within 21 days of discovery.

3.B.1.D.2.C. Findings with severity scores of medium and low should be addressed in accordance with local Approving Official (AO), Information System Security Manager (ISSM), or Information System Security Officer (ISSO) guidance until further notice.

3.B.1.D.2.D. In all instances, DOD components should consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.

In the event remediation cannot be achieved within the mandated timeline, a Plan of Actions and Milestones will be approved by the Customer's Authorizing Official or designee for risk acceptance.

6.3 Software must comply with DOD Security Technical Implementation Guide (STIG) (https://cyber.mil/) and NIST Cybersecurity Framework standards as outlined in NIST Special Publication 800-53 Revision 4 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), and the Federal Information Security Management Act (FISMA) (http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf (Section 3.c)), and shall obtain approval to operate on any DoD Service or Agency as well as any U.S. Federal Government Agency Networks.

7.0 NETWORK SECURITY

Network testing will be conducted after award and in addition to the requirements set-forth in this SOW and it will also be conducted in-accordance-with the terms and conditions of the solicitation.

The following are network security requirements that shall be met for the proposed MPS software:

7.1 Encrypt all inbound/outbound communication with the device for printing or remote management.

7.2 Allow for all fleet device logs to be retrieved, reviewed, and archived.

7.3 Registration of all ports and protocols with the DISA PPSM database with source and destination IP information.

7.4 Use of HTTPS sockets for any approved web-enabled services.

7.5 Compliance with DOD wide SMARTCARD and DOD PKI standards throughout the contract term.

7.6 Utilize CAC/PIV for authentication related to CAC released print.

7.7 Enforce Secure-Release and Pull-Printing via CAC/PIV to Active Directory.

7.8 Allow for an overall administrator account, but also allow each site to manage their devices with appropriate permissions and responsibilities.

7.9 Protect and encrypt Personally Identifiable Information (PII).

7.10 Remove or conceal all IP addresses from displays, reports, etc.

7.11 Provide updates and patches to keep software compliant with future IA requirements. Any new IT security standards shall be added via contract modification IAW FAR 52.212-4(c).

7.12 Warrant that the software shall operate on a network supporting Internet Protocol Version 4 (IPv4), Internet Protocol Version 6 (IPv6), a hybrid of IPv4 and IPv6.

7.13 Software Testing and Evaluation:

8.0 SOFTWARE MAINTENANCE & TECHNICAL SUPPORT

8.1 The Contractor shall provide onsite support during installation. The end user's IT department shall be present for collaboration at time of installation.

8.2 The Contractor shall provide English-speaking Help Desk support Monday through Friday from 8:00 a.m. - 4:30 p.m. local time, with the exception of Federal Holidays.

9.0 TRAINING

The contractor must provide training and materials. The training must be role-based training targeted for different users roles to include administrator, user, and all other roles defined in the proposed software. All training materials must be furnished by the contractor and made available in hardcopy and PDF electronic format. Training must be provided in-person or via webinar, as stated in each task order.

9.1 The contractor must provide General User and Administrator software training, and training for any other role that the software includes. Training guides must also be provided in hardcopy and PDF electronic formats, and include simple to follow step-by-step screen shots with detailed explanations.

9.2 The contractor must provide a Training Plan for DLA review and approval.

9.3 The Contractor shall provide services to educate, support and train DLA personnel in supporting their customer sites, as well as, training the DLA customer personnel in supporting its own implementation of the software. Follow-up training and consulting services may be required after the initial software installation upon request.

10.0 INSTALLATION

10.1 MPS software license must be transferable to a replacement device if original device is removed from the network during the contract period.

10.2 DOD policy prohibits the publishing of network configuration information. Therefore, DOD installations will not fill out pre‐installation site surveys. The required information will be provided at time of installation by the local IT support staff.

10.3 The contractor must provide on-site assistance to install and configure the software. The government will provide the prerequisite hardware and resources to support the installation and configurations. The government may also implement and maintain a test and development environment prior to the actual software installation and implementation. The contractor must also provide on-site assistance for this test and development environment, at no additional cost to the government.

10.4 In addition to the primary installation and configuration of the software, every other location may require onsite custom configurations. Therefore, the contractor shall provide consulting services in order to ensure that the training, configuration, and functionality maximize the efficient use of the government time and resources.

10.5 Upon request, the contractor shall provide support to reconfigure or rebuild the software server, to accommodate the government’s implementation of server updates/patches, or if the server becomes corrupted.

11.0 ECMRA

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for DLA via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2019. Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil.

12.0 TRAVEL

The DLA Information Operations Point of Contact (POC) will recommend and approve all related travel in writing prior to travel being performed. Any travel performed and not pre-approved by the POC, shall not be reimbursed. Each travel period will be funded as FFP at the task order level and shall be issued prior to travel. Any travel performed prior to task order issuance/modification is at the sole risk of the contractor and shall not be reimbursed. All travel shall be calculated in accordance with the latest version of Joint Travel Regulations (JTR). Travel expenses in excess of the task order amount will not be reimbursed.

13.0 BASE INSTALLATION ACCESS & SECURITY CLEARANCES

13.1 The contractor must ensure all onsite service technicians are eligible for access to Department of Defense facilities in accordance with the authority in Directive Type Memorandum (DTM09-012) which establishes DoD access control policy and the minimum DoD security standards for controlling entry to DoD installations and stand-alone facilities. Contractors must also check and follow installation access policies specific to each DoD installation. Onsite service technicians must be eligible at time of the award.

13.2 The contractor must obtain appropriate security clearances, up to “secret,” for its onsite service technicians who must provide service to restricted-access facilities. DLA will assist the contractor with this requirement. The process to obtain a clearance will include filing a DLA form 1728, for each contractor onsite service technician, in order to perform background verifications.