DRAFT_SOO_FOR_Sources_Sought.docx

IT Operations and Engineering Services (ITOES) - Statement of Objectives

Department of Health and Human Services (HHS) Office of Inspector General (OIG)

IT Operations and Engineering Services (ITOES)

Statement of Objectives

Department of Health and Human Services Office of Management and Policy, Acquisition Division 330 Independence Ave SW Washington DC 20201

IT Operations and Engineering Services (ITOES)

Page | 3

Background The Inspector General Act establishes the initial statutory authority and responsibilities for the Offices of the Inspector General (OIG). The HHS OIG mission is to improve HHS programs and operations and protect them against fraud, waste and abuse. By conducting independent and objective audits, evaluations, and investigations, we provide timely, useful, and reliable information and advice to Department officials, the Administration, Congress, and the public.

The Office of Inspector General (OIG) at the Department of Health and Human Services (DHHS) consists of 6 components –

· Office of Audit Services (OAS) – 647 staff

· Office of Evaluation and Inspections (OEI) – 139 staff

· Office of Counsel to the Inspector General (OCIG) – 109 staff

· Immediate Office (IO) – 29 staff

· Office of Management and Policy (OMP) – 249 staff

· Office of Investigations (OI) – 664 staff Figured 1 - OMD Organization

Information Technology (IT) Operations activities are managed within OMP through the Office of Information Technology (OIT) Operations Management Division (OMD).

OIG is a geographically diverse organization. The approximately 1,900 OIG federal staff and contractors are distributed throughout the United States in the headquarters at Washington, DC, 11 major (regional) offices, and over 70 field offices.

Table 1 - Major HHS OIG Locations Among other responsibilities, OMP OIT OMD ensures the correct design, deployment, and operation of infrastructure information systems and technologies that enable mission and administrative activities for all OIG personnel. Infrastructure Operations Support and Engineering includes all aspects of the information technology services lifecycle – plan, evaluate, design, procure, build, test, transition, operate, and decommission. In other words, any technology operating at HHS OIG is built, deployed, and maintained by OMD, except those solutions principally involving business applications and middleware, or IT Security Policy and Compliance.

· Business Applications and Middleware – Development and troubleshooting for layers of solutions or configuration above or external to infrastructure services.

· OMD retains infrastructure responsibility that supports applications including device operating system, endpoint management agents, and supporting database and authentication services.

· Common commercial off the shelf (COTS) applications like MS Office, Adobe Acrobat are OMD supported through the full application tier.

· A few less common mission COTS are OMD supported through the application tier (e.g. Accellion Kiteworks, Wolters Kluwer TeamMate, AIT CFIS).

· Infrastructure and security applications are principally delivered by OMD (e.g. IBM BigFix, Splunk, ForeScout CounterAct, Cisco ISE)

· Cloud solutions are addressed by OMD for connectivity, storage, and machine instances. Business application platforms on Amazon Web Services (AWS) are supported outside of OMD. Office automation (O365, Azure) are managed within OMD.

· IT Security Policy and Compliance – Security evaluation of requested technologies, compensating controls, and periodic assessments.

Service Desk and End-User Services Overview Service Desk – The Service Desk represents the technical staff capable of performing First Call Resolution (FCR) for Incidents and Service Requests, performing advanced remote troubleshooting and fault isolation, and dispatching/escalating Incidents and Service Requests required for further desk side support.

HHS OIG currently uses Ivanti Service Desk for incident, request, and change definition, categorization, and tracking. HHS OIG will be migrating to ServiceNow for Service Desk functions. To facilitate common understanding of support Tiers, the following descriptions apply.

Service Desk Functions Service Desk functions provide Tier 1 & 2 services to the OIG headquarters personnel, OIG executive staff members, OIG government employees, and OIG contractors. The core hours for non-VIP support are Monday to Friday from 6:30AM to 6:30PM, Local Time (excluding Federal holidays). Given the time zones of HHS OIG locations (AST to PST), this is equivalent to 10:30a GMT to 02:30a GMT, with the majority of users working in the Eastern Time Zone. About 50 users in the Washington Office are considered VIPs and incidents they report are treated as critical with 24x7 remote support.

Service Desk and End-User Services activities include:

First contact with customer – responsive accessibility of technicians of various modes (walk-up, phone, ticket, e-mail); technicians provide a balance between technical expertise and interpersonal skills to achieve quality resolutions from the customer perspective. Walk-up services are provided at HQ only, with the intention of being available to the HHS OIG VIPs and their associated staff. But, if not otherwise VIP engaged, HQ based personal can accept walk-up or call from any user In-Person Remediation (Tier 2) - OIG site visit as arranged with the requesting OIG staff member where location is relevant or advantageous to issue resolution.

End-User Services (Tier 2) - enabling end users with technology including device configuration and delivery, application authorization and deployment, peripheral ordering / access, service access authorization and provisioning.

Enroll additional organizational members into the existing service - As new users, workstations, groups, phones are added or removed with the organization; connect them appropriately to existing services in accordance with organizational policy and standard procedures. Provision OIG resources (accounts, workstations, mobile devices, peripherals) to entitled OIG requestors. For hardware enrollment, Service Desk maintains sufficient warehousing of components (laptops, monitors, peripherals, phones) to meet the weekly ebbs of demand. Large scale rollouts (>100) of new equipment are included in the scope of work for the sponsoring project.

Address most frequently encountered customer transactions - Based on an implemented supporting solution (e.g. e-mail, share drive, application deployment, workstation repair), technicians document, investigate, trend, and report issues. With limited admin tool access, admin tool training, and standard operating procedures from solution engineering team, Service Desk technicians seek rapid resolution of the most frequent issues or requests.

Leverage and augment lessons learned - As established in knowledge base and standard operating procedures, technicians apply organizational policy in granting resources and privileges in response to customer requests and incidents Apply troubleshooting process across all technical areas to 1) identify root cause, 2) resolve if possible, 3) capture relevant information for another to determine root cause. Escalate tickets, requests, or supporting tasks (e.g. create new share) to relevant Tier 2 or Tier 3 team when required activity exceeds Tier 1 authority or expertise.

Facilitate ticket from customer notification through participating contributing teams to customer confirmation.

End-User Services (Tier 2) - Historically, these operations have been based out of the HHS OIG HQ for staging and shipped to end user at their nearest OIG office.

Tier 2 provides the following Government Furnished Equipment (GFE) to OIG users:

· workstations, laptops, tablets, virtual desktops, cellular wireless devices, desk VoIP (Skype) devices

· approved networked and locally connect peripherals,

· operating systems, drivers, all approved software applications, shared drives, and other enterprise services Tier 2 services also includes execution, delivery, monitoring, and managing of the desktop operating system and software patching to support Federal Information Security Management Act (FISMA) compliance. Tier 2 support entails the endpoint image delivery approach including: installation, distribution, and delivery of all physical assets as well as additions and changes necessary to maintain, upgrade, install/reinstall, inventory, document image build process, document asset identification in HHS tracking system (PMIS),and disposing of hardware and software in accordance with Government Security Standards.

HSPD12 – Activator Role The PIV Activator is the individual who is responsible for processing USAccess PIV credential activations. The activator verifies that an applicant is the person to whom a USAccess credential is to be issued and guides the applicant through the activation process. Activators close the chain of trust begun by the registrar when they verify the identity of an applicant activating a credential. The activator may also fulfill requests to update credentials due to various reasons and to unblock credentials via pin reset.

For role holders to learn how to use the USAccess system and become proficient with their assigned roles, the USAccess program offers a series of web based training courses using the GSA USAccess Role Holder On-line Training Course Portal for each system role holder.

HHS OIG Service Desk provides the activation role at HQ. For field locations that request local activation resources, Tier 2 delivers a specific instance of image on a workstation for the activation role, but the activation labor is delivered by HHS OIG staff on site.

Engineering – Tier 3 HHS OIG Tier 3 activities include the following activities in support of the service categories of Table 6 and technology inventory of Table 10:

Solution engineer (design and build) and operational maintenance or support. technical in the products supporting the relevant requirement or root cause service, interpersonal (mostly written skills). Intended to quickly identify the root cause more than engage the customer. Document resolution and transitions that resolution to Tier 1, if appropriate. Assess solution ability to meet user requirements. Qualify solution for efficient, reliable delivery of services via Tier 1 to the customer Full administrative access to applicable technical components – Engineers document the standard operating procedures and administrative tool training for Tiers 1 and 2; contribute solution guidance to a shared Support Knowledge Base.

Point of escalation for tasks or root causes that exceed Tier 1 authority or expertise and not already addressed in an existing, correct SOP. Note, tickets escalated in presence of applicable Tier 1 SOP are returned to Tier 1. Tickets from Tier 1 that lack the triage and initial resolution efforts are returned to Tier 1. Engineers provide surge capacity to Tier 1 during demand scenarios Troubleshoot solution. Engineers capture technical logs and relevant details of incident / request for escalation to Tier 4. They apply troubleshooting process across solution technical areas to 1) identify root cause, 2) resolve if possible, 3) capture relevant information for another to determine root cause. Refer Tier 1 to existing SOP or Knowledge Base where appropriate.

Enable and facilitate Tier 4. Engineers grant limited access to Tier 4 developers, who are segregated from the operating environment. Engineers monitor and maintain access relationship (support subscription) to Tier 4; follow up on Tier 4 service level in accordance with priority. Identify Tier 4 renewal of appropriate support level contract / resources to IT management.

Apply recommended maintenance and continuous improvement. Engineers analyze patterns in incidents / requests and recommend solution changes to improve service delivery. They accomplish approved solution change actions; reconfigure the behavior of the solution (e.g. role definitions, communication paths, security control options, server configuration), not the inventory of data to which solution is applied (e.g. user account, user password, user role assignment).

Vendor / Developer – Tier 4 HHS OIG owns the equipment, licensing, and vendor support agreements by which those products are maintained. Access to HHS OIG Tier 4 support subscriptions are provided to designated engineers with Federal lead oversight. The assumed Tier 4 services are not expected by the operations and management (O&M) team, but Tier 4 services are used by engineers and include:

Final solution authority. Solution developer in narrowly focused technical areas. Almost always a vendor organization. Only enough interpersonal skills required to collect and communicate the issues to other Tier 4 collaborators. Priority is deep tool expertise in a variety of customer usage scenarios.

Technology product vendors may have their own Tier 1, 2, 3, and 4 – but relative to customer organization, they’re all product specific Tier 4.

Tier 4 is the last line of escalation for a particular combination of the product and the customer use case.

Provide hands on troubleshooting and log analysis beyond standard operating procedures to determine how the solution is behaving in the conditions identified by Tier 3. Resolve or bypass impact to customer through combination of known resolution, technical workaround, or feature request.

Establish and publish knowledgebase of product behavior and interaction with complementary technologies in observed use cases.

Tickets A ticket is a unique work description that seeks to achieve an end result from the customer or service perspective. It is not appropriate to create new tickets for an action that directly relates to the functional objective of another ticket. Such duplicates should be closed with reference to the original or most developed ticket and not added to totals of resolved tickets. A single ticket represents a modest functional objective (average of 30 minutes of labor, with a peak of 30 hours) including all the contributors required to assess, plan, deliver, and verify that functional objective. Tickets are assigned by a tracking system that generally distinguishes between:

Incidents – A prior, consistent service has been disrupted, diminished, or at increased likelihood of such. The resolution of an incident includes appropriate capture of the events, warnings, logs of the diminished condition, brief documentation of resolution actions, and restoration of prior service level.

Requests – Expansion of same services to a new consumer of services (e.g. user, workstation, database instance) or change of existing configuration to achieve a new service baseline for a technical solution (e.g. patch, new spam policy, new COTS application packaging request). Similar to incidents, but also like mini-projects, request engineers will appropriately capture the objective of the request, ensure notification of relevant stakeholders, document the intended resolution approach, and test commensurate with risk. Where existing documentation requires update (design, security plan, Tier 1 Standard Operating Procedure) the original ticket captures the necessary work for the system documentation update. The boundary of the ticket is all the activities (assessment, research, troubleshoot / design, test, resolve, document, verify) to achieve the restoration of service or intended change. Consequently, there can be a substantial variation in the necessary effort and participation to resolve a ticket. Tier 1 tickets are likely to be addressed in an average of 10 minutes. Tier 2 on site support would add the time needed to coordinate schedule and visit the customer. For tickets escalated to Tier 3 Support, an order of magnitude estimate for average resolution effort is 3.5 hours.

HHS OIG seeks Offerer insight into efficient capture and delivery of all operational work. This could be a ticket or Kanban card tracking mechanism that:

1) Throttles the work-in-progress activities to the most relevant tickets

2) Reconciles work-in-progress consumption with available support capacity by technology or category

3) Identifies quantity and categories of work backlog for analysis of capacity surge options and estimated impact to resolution timelines.

The Offerer should accomplish their own estimate or structure an optimal planning approach for ticket capacity. As an example, a blended rate and estimate of tickets would allow a simplified subscription model (e.g. 2,000 tickets per month) so long as all tickets (big and small) are efficiently routed and resolved in accordance with their priority and subscribed capacity.

Tier 1 or Tier 2 service staff create tickets in response to automatic ticketing system interaction, observed incidents, user requests, or periodic maintenance activities.

Currently tickets that require the contribution of other HHS OIG teams include task definitions and notification to those teams within the same overall ticket. Tasks that address a substantially larger scope than the original ticket result in appropriate new tickets with identified scope. For example, patching an affected server to enable an application install would be a task. Patching all servers after discovery of an application dependency would be a new ticket.

Change requests can include small solution design, build, and test lifecycles. However, any change estimated over 30 hours of effort are broken into multiple changes. And, any cohesive change effort exceeding, for example, 120 hours are elevated to a project.

Service Level Expectations This section describes the service level expectations for incidents and service requests related to OIG systems.

Incidents Per ITIL 2011, an incident is an unplanned interruption to an IT Service or a reduction in the Quality of an IT Service, or the failure of a Configuration Item that has not yet impacted Service.

Incidents are currently prioritized based on the size, scope and complexity of the Incident and the Impact on OIG operations, and the Urgency with which resolution is required to restore Operations as described below:

Impact Impact is a measure of business criticality of an Incident. The Impact of an Incident is usually closely tied to the extent to which the incident leads to a degradation of an OIG service relative to the agreed upon service levels. In most instances, the extent of systems affected and/or the number of users affected will dictate the scope of the Impact.

Multi Site Impact and/or Incident impacts a significant number of users (over 50 OIG Users)

Outage of Non-Critical Business System, and/or Incidents with an impact population of more than 20 but less than 50 OIG users

Incidents with an Impact population of more than 5 but less than 20 OIG Users

Table 2 - HHS OIG Approach to Ticket Impact Urgency Urgency is a second measure which indicates the speed required to achieve resolution or the extent to which OIG can bear delay in the resolution of any specific Incident. VIP status as indicated in the approved / VIP list may also influence the Urgency status.

Third party vendor support required and/or Customers are unable to work and no work around is available. Incidents from VIP Users shall be treated as Critcal.

Affected OIG users require expedited restoration of service, but can bear minimal delays and/or Affected OIG users may or may not have a work around available or workaround may only provide partial relief

OIG Users have a work around available, workaround provides partial relief to address impacts to non-critical functions/services, delays in resolution are not acceptable

OIG users may be inconvenienced, but a suitable workaround is available to allow OIG users to continue working, or a delay in resolution is considered acceptable Note: all service requests will initially be classified under this urgency categorization

Table 3 - HHS OIG Current Approach to Ticket Urgency Service Requests Service requests considered part of Operations and Maintenance Activities are also captured as tickets. These requests are resolved with a well understood and procedure facilitated change to the environment to enable modest expansion of services to additional consumers. For example, adding users, changing security groups, new virtual machines, software install requests, security assessment of new software product or version, etc. Specific service requests may be expedited by the Service Desk Deputy Director or delegate.

If a service is degraded or no longer functioning as designed, its resolution would be treated as an incident. If a new capability or instance of consumption of existing capability is needed, that is tracked with a request.

Response Levels Response Level is defined as the sequence in which Incidents and Requests are to be worked. Based on the combination of assigned Impact and Urgency, the Response Level is currently calculated as shown in the table below with “Critical” being the most rapid Response Level and “Low” being the lowest. Within the Ivanti (formerly LANDesk) Service Desk ticketing system, a standard weighting is assigned to each combination of Urgency and Impact. HHS OIG currently uses Ivanti Service Desk and provides the current operating concept as a basis of reference and initial assumed capability upon award. HHS OIG is seeking to transition to ServiceNow for IT Service Management and IT Project Portfolio Management within the scope of this contract.

As a current Ivanti capability, the overall Response Level can be adjusted by increasing or decreasing this weighting without having to modify the actual Impact and Urgency values. VIP Status, which is based on organizational hierarchy (e.g. Director, Assistant Director, etc.), is considered when determining Response Level (weighting) of any Incident and will also be based on the sensitivity designation assigned within the Ivanti Service Desk ticketing system. VIP users identified and marked as Level 1 in the Ivanti Service Desk ticketing system User Profile will be processed in accordance with the service levels identified for a Critical Response Level.

Response Level Model

Urgency

High Medium Low

Medium Medium Low

Medium Low Low

Medium Low Low

Table 4 - HHS OIG Current Ticket Response Weighting Response Times Based on the Response Level classification, the OIG Service Desk begins work on the issue within the target timeframes identified in the table below, and will escalate the call as necessary to meet the target max escalation times so as to allow Tier 2 or Tier 3 and other operational support activities sufficient time to address the issue if the OIG Service Desk is unable to do so. The reasonable resolution time for incidents and requests depend upon identifying and ability to control the underlying root cause and cannot be reasonably guaranteed. However, initial action and triage of the ticket can be assured. triage includes identification of affected assets, users, use case, evidence capture (e.g. description, screenshots, error messages, event logs), and likely functional area for next level investigation.

(Tier 3)

Table 5 - HHS OIG Current Target Operating Hour Response Time for Initial Action Infrastructure Operations Overview For Tier 3 Services, OMD provides lifecycle support for the listed activities identified in Table 2.

Table 6 - HHS OIG Current Engineering (Tier 3) Service Categories

Firewall – site categorization, URL blocking, stateful inspection, permit rules between trusted / untrusted network zones.

Authorization – infrastructure security control compliance inspection, contingency planning, and documentation update Continuous Diagnostics and Mitigation (CDM) – See CDM[footnoteRef:1] and functional control areas HWAM, SWAM, VUL, CM, PRIV, CRED, BEHAVE. [1: https://www.us-cert.gov/cdm/faq]

OMD provides lifecycle services to include the following activities and supporting documentation for:

· New system or Large Change – assess, design, build, test, deploy, transition

· Requirements gathering,

· Alternatives analysis

· Solution or change design, build, test

· Transition to operations - frequent administrative actions and Tier 1 standard procedures

· Security control plan

· Existing System Operations

· Performance monitoring and planning with subscription / license tracking

· Periodic maintenance actions, failover testing, event reporting, and actions to return solution to designed service level

· End user enablement activities including:

· Provisioning of assets (laptop, monitor, phone, accounts, software, peripherals)

· Customer Services – (Network connect, printer, fax, copier)

· IT Service Management (ITSM) capabilities including

· IT Service Support

· Service Desk

· Incident Management

· Request Management

· Change and Release Management

· IT Service Delivery

· Availability Management

· Capacity Management

· Service Level Management

· Financial Management for IT Services OMD Program Management Office The OMD Program Management Office enables definition, stakeholder acceptance, budgeting, milestone tracking, impediment management, and close-out of all OMD projects. Project Management staff are proficient in and able to employ project management methodologies, frameworks, and best practices to ensure the success of OIG projects including:

· Integrated Master Schedule creation and updates

· Document repository administration

· Industry frameworks and project management methodology including ITILv3, PMBOK, Agile, or Waterfall.

· Proficiency with ServiceNow components such as

· Service Catalog,

· Change/Incident/Problem Management,

· Project Management,

· Asset Management,

· Discovery, Knowledge, and CMDB.

Project Management and Support Staff support the design, development, procurement, implementation, accreditation, and O&M for OIG requests. Back-Office support staff assist OIG teams with planning, requirements gathering and validation, cost development, market research, reporting, and change orders through the design, development, procurement, implementation, accreditation, and O&M phases of each OIG project.

Projects Projects are a larger body of work with a defined scope and objective. While small efforts (<30 hours) could be a project entirely completed within a ticket, the HHS OIG discussion of projects intends an high visibility and high impact demand or an effort larger than 120 hours that will result in a change of operating services or configuration to achieve the intended results. Projects will consist of initiation (definition, scope, assumptions, estimation), design, build, test, deploy, security authorization, and transition activities, although a waterfall methodology is not implied.

When the task dependency graph of a project is determined, it is likely that IT operations changes are required. When those tasks require delivery, especially if the project contributors are also ticket contributors, those project tasks should be reflected in the overall work prioritization queue or integrated project plan. For example, an Active Directory operations support engineer would need visibility into a team or individual work queue where the expected tasks of tickets and projects are prioritized. Where possible, project work should not significantly impact ticket resolution capacity. But, all work, especially among shared resources, must be identified and prioritized relative to each other.

HHS OIG currently uses MS Project Online to track project tasks, project baselines, and resource leveled allocation and scheduling. HHS OIG will be migrating to ServiceNow for project portfolio management.

HHS OIG seeks to accelerate project definition, prioritization, and delivery. Small projects can be allocated within ticket “budget”. For example, three tickets could address a well understood 100hour effort. Or, perhaps, accomplish the initial feasibility and requirements gathering for a larger project. Often, scaling up project staff takes two months (project definition and bid, identify candidates, background checks, team enrollment and GFE provisioning).

Large projects should begin design and build tasks at award of a relevant task order, perhaps using contractor facilities (isolated from OIG). Deploy and test actions could either follow the co-requisite background checks that completed during earlier phases or be delivered via existing cleared staff (e.g. over-the-shoulder).

Purpose The purpose of the SOO is to procure best in class Service Desk, End User Services, Operations Engineering, Infrastructure Architecture, and Technical Program Management for delivering the information technology services of the HHS OIG. In particular, for the size, topology, and investigative mission requirement of HHS OIG there are scalable, cost-effective, and responsive methods of managing IT work. The best repository of expertise for these results-oriented, work management procedures are industry service vendors who have a history of various approaches to their client base. In particular, HHS OIG is seeking a service model, likely shared service model, by which the Offerer has maximum flexibility to staff and address “work bundles” (e.g. tickets, Kanban cards) and achieves industry class solution coverage, effectiveness, cost efficiency, and agility.

Scope The contractor shall provide a transition plan and sufficient number of labor resources possessing the skills, knowledge, training, and security clearance to perform the services required. Contractor shall also provide supervision, equipment and materials necessary to support the OIG’s required technologies and services listed below:

· Service Desk and End-User Services

· Infrastructure Operations and Engineering

· Core Engineering

· Systems Engineering Projects

· Program Management Office Services HHS OIG is familiar with a direct labor approach to operations and management, but has had frequent delivery issues by which the technology inventory of HHS OIG is not covered by the adopted staffing set of hires, or experiences significant surge or capacity gaps as a function of team member availability. For example, there are more than 40 significant technologies with varying demand for change and operational support. Even if HHS OIG hired a dedicated engineer for each technology, deficiencies would still occur as many are idle for low change technologies and areas exposed to poor support based upon individual availability.

HHS OIG experienced poor efficiency of individual staffing for a particular set of technologies. Top Tier labor category staff are hired for a primary technical solution (and commensurate bill rate), but address a preponderance of junior tier tickets or secondary skill sets.

The advantage of direct labor is the ability to absorb and become familiar with HHS OIG systems and dependencies. Often issues on one side of the technical inventory are caused through a pipeline of dependent services. Familiarity of all contributors with the HHS OIG environment is seen as an enabling feature.

· - Ongoing operational activities without a prerequisite work definition

· - mismatch of technology inventory and affordable quantity of team members

· - inefficient resource allocation to junior or tertiary duties while charging highest skill bill rate

· - vendor staff management and optimization of skill to task costs

· - unfamiliar work approach that may not achieve objectives

· - limited environment familiarity and degradation of time to resolution

· - scalable level of dedicated contributors with opportunity to gain expertise in HHS OIG environment

· - Risk of emphasizing current named contributor approach and its limitations

Table 7 - HHS OIG Operations Delivery Options

Objectives Principal Objectives HHS OIG seeks more effective, efficient, predictable, and scalable performance of Service Desk and IT Infrastructure Operations and Solution Project Delivery.

Consistent Pace of Resolution

a. Consistent resolution for work ticket volume in accordance with contracted baseline level.

Resilient delivery, regardless of individual contributor schedules and availability

b. Minimal delay to address issue on any solution in the technology inventory. Broad talent capacity allows a particular assigned engineer to be working their primary competency, not assigned an unfamiliar or tertiary competency.

c. Flexibility for contractor to experiment and measure optimal approach (e.g. staffing, skill mix, workflow) for service delivery

d. With efficient solution transition from a deployment project, OIG technology changes are adopted into steady state support like any other solution. HHS OIG observes low impact to overall target resolution pace.

Simplified Access to Services OIG stakeholders can access Contractor points of contact to facilitate:

1. Insight, methods of access, and capacity implications for new requests Active work inventory planned work inventory, and schedule / capacity implications of alternatives Elaborated status on any named active initiative including dependencies, resources bottlenecks, and impediments for active task delivery

i. remediation options Increased Quality of Ticket Resolution

1. Standardize and apply quality criteria to work tickets to illuminate and address variation in delivery. For example, each ticket should include ensure:

i. Minimal ticket creation (tracking complexity) for an objective scope of work

ii. Informative triage notes as handoff between support tiers,

iii. Resolution notes,

iv. Knowledge base contributions,

v. Documentation updates as part of ticket scope Enable predictable queue times and improved visibility to customer (e.g. easier to be satisfied when realistic expectations can be set and updated) Quantified Insight into Demand and Delivery Efficiency

1. Categorize tickets (customer demand) into the services that contribute to the resolution. See the participating contributors (i.e. support teams) by associating their tasks and quantify effort.

Detect, quantify, dissuade, and provide accountability for delivery issues like inappropriate ticket creation, handoff, documentation, delays.

Integrate entire demand picture and group related efforts for cotemporaneous delivery. Project task resource consumption are managed in consideration of operational ticket workflow to enable most important work to be delivered with their dependencies.

Predict required capacity scale up to exceed operational baseline (integrated project schedule overlay).

Stakeholders can view inventory of backlog, in progress, and recently delivered work for insight into quantity, categories, capacity, and status of key initiatives.

Service managers can assess the efficiency of delivery and work with Contractor to manage the work ingest or the delivery configuration.

Options to Temporarily Expand Work Ticket Capacity Per planned changes or precipitating events, order increased work ticket capacity accordingly.

Quality Monitoring and Controls with IT Operations Delivery –

1. Consequential feedback on measurable performance of Contractor ticket resolution.

Quantitative indicators of progress, quality, and areas of emphasis for future investment.

Work ingress consistency for categorizing and efficiently assigning work.

Enable quantity and quality assessment metrics to align OIG investment (e.g high or low ticket delivery rate or quality).

Gain recommendations to improve efficiency and cost. Shared interest in making ticket resolution more efficient.

Reduced Time to Solution for Projects Upon task order definition and award, Contractor is able to rapidly proceed through the appropriate

· requirements definition,

· solution design, validation, and HHS OIG acceptance

· solution build

· solution security review and approval

· transition to operations Competition and flexibility.

Cooperation with other vendors supporting OIG engineering projects. Intellectual property of systems design & operations as well as ticket history & metadata developed in this contract will be contained in OIG owned repositories for portability to any participating provider. OIG seeks to mitigate risk of a locked in performance levels for any portion of Service Desk and Engineer scope.

Incremental Value Increase.

HHS OIG acknowledges the current state of operations and efficiencies that depend on Contractor familiarity with OIG systems would limit initial services delivery. But, each phase of performance (transition, base, options) would allow increasing opportunities to align and achieve the objectives of this section. Contractor proposal should identify the value opportunities of each phase in consideration of legacy operations and structure the proposal accordingly. For example, initially, transition or base periods may be limited in quantity of services delivered via Firm Fixed Price (FFP). But, upon Contractor increasing insight of OIG systems, the tickets associated with the OIG systems, and implementation of Contractor improvement efforts; new solutions can be built that incrementally progress to economies in monitoring and change automation.

Requirements Service Desk and End-User Services Service Desk Support (Tier 1) OIG has a tiered service desk system (currently based on Ivanti) that handles requests for IT support nationwide. Requests for service are received by phone, email, or Self-Service Portal from OIG personnel across the country. HQ location supports 50 VIPs and 250 non-VIPs during core hours including walk-in service (HQ location only). Contractor shall provide 24x7x365 phone and remote support to VIPs. HHS OIG will provide onsite seating for Tier I Contractor staff and inventory storage at HQ as requested by the Contractor.

All service requests must be logged as tickets and tracked using an ITIL certified ticketing system. The contractor shall plan, implement, and manage an integrated IT Service Management (ITSM) system using the ServiceNow platform.

The contractor shall leverage the existing, as-is state with regard to ticket management as part of transition activities. The existing ticketing system is based on Ivanti Service Management product, but, Contractor’s transition plan shall include, a deployment plan and deliver that plan for ServiceNow implementation on the HHS OIG ServiceNow tenant for IT Service Management ® based ticket handling and integrated IT Portfolio Management. The Contractor shall recommend improvements to the current state of ITSM and IT Portfolio Management as part of transition. The Contractor shall identify opportunities to change the tools or enterprise technology in order to more efficiently address ticket resolution.

The Contractor shall be resourced to support an approximate baseline of 3,000 tickets per month, of which approximately 1,500 are received via phone, resulting in an incident, service request, or information request. The number of tickets may increase during OIG-wide software upgrades or deployments of other tools or may decrease once tools such as a Self-Service catalog and Knowledge Base are implemented. Contractor shall provide surge support during large scale deployments.

The Contractor shall be responsible for the overall operation of the ticketing system, including deployment of ServiceNow onto the HHS OIG tenant to achieve initial Service Desk and Project Portfolio Management capabilities. The Contractor should leverage, but improve, existing Ivanti category structure and metrics.

The Contractor shall follow ITIL best practices and IT Service Management (ITSM) and ensure a successful resolution process from the initial contact with the User to resolution of the Incident, Problem or Service Request.

Contractor shall provide leadership resource(s) availability during OIG’s core hours of operation to provide the following services:

· Insight, methods of access, and capacity implications for new requests

· Active work inventory, planned work inventory, and schedule / capacity implications of alternatives

· Elaborated status on any named active ticket including

· dependencies, resources bottlenecks, and impediments for timely delivery

· remediation options

Table 8 - Tier 1 Task Descriptions

· Ensure completeness of all tickets entered in the ticketing system, classify and forward to the appropriate team.

· Escalate to Tier 2 & 3 only after initial triage and data collection as defined by the relevant subject matter SOP.

· Ensure that call center voice greetings, menu choices, alerts, and notifications are fully functional and accurate.

· Handle All PIV activation and PIN Reset Requests.

· Perform a Health Check of OIG Systems twice a day.

· Replace Printer Consumables as needed.

· Onboard, Transfer, and Offboard users according to SOP

· Manage User Accounts in Active Directory via NetIQ DRA interface.

· Maintain User Templates in NetIQ Domain Rights Administrator (DRA)

· Update Global Address List Information (location, phone number, group membership)

· Escalate any tickets that cannot be resolved at the Tier 1 level to the Tier 2 or 3 technicians and monitor for status and then close ticket when resolved.

· Report all known service disruption, outages, and errors and manage and track all tickets for outages and on-gong issues.

· Alert Tier 2 service Points of Contact when relevant SOPs are not achieving the desired resolution quality or timeliness.

HSPD-12 Activator Role

To perform tasks associated with the USAccess Activator role, individual must become familiar with the use of the Light Activation Credential Kit. Contractor shall take Activator training and provide proof of training (certificate) to ensure familiarity with the contents of the Kit, including:

· Peripherals: 2 card readers and a single fingerprint device

· CD with easy-to-use required installation software

· Network Connection Test Utility

· Light Activation Installation Guide and User’s Guide The Installation Guide provides comprehensive instructions and troubleshooting procedures for the agencies technical support team. The User Guide supplements online web-based training courses, stepping through all the procedures for conducting activations and performing updates.

· Contractor shall create, manage, and use troubleshooting or problem-isolation scripts to expedite and facilitate identification and resolutions of known issues.

· Contractor shall manage entire ticket life cycle of all IT technical problems, issues, requirements, as well as other requests recorded in the service desk system. This includes ticket closures after service-provider’s service level agreements

· Contractor shall monitor the service desk queues in compliance with the SLAs.

· Contractor shall follow up on all Customer Satisfaction Survey responses that are flagged as requiring review in compliance with the SLA.

· Contractor shall develop a list of Incident and Request types that can and should be resolved upon first contact with the customer (the FCR Incident and Service Request List).

· Contractor shall obtain Government approval of the FCR comprehensive list per Deliverable schedule and use the list to operate and manage the Service Desk.

· Contractor shall continuously revise the FCR Incidents and Service Request list per Deliverable schedule to ensure optimal coverage and accuracy.

End-User Support Services (Tier 2) End-User Support services specifically provision and enable end user devices (laptop, mobile phone, peripherals, copiers, printers, fax) for OIG staff use. The Contractor shall escalate hardware repair/replacement issues to Government-contracted hardware vendors, if applicable. The Contractor is encouraged to propose Contractor facility-based device fulfillment, but must address facility security.

If applicable, the Contractor shall ensure that the proposed facility addresses appropriate Federal controls as listed in NIST 800-53 such that GFE endpoints are protected from physical tampering by unauthorized actors and returned / surrendered equipment is both protected from unauthorized data retrieval prior to wiping and securely wiped.

Table 9 - Tier 2 Task Descriptions

· Ensure that the user is presented with the post-installation setup instructions)

· Top off with component specific software applications.

· Encrypt Laptop (McAfee)

· Notification of on-boarding will come from OIG’s people management system (ATA) by email

· Workstation must be ready at least one business day before person reports for duty

· Setup workstation in user’s assigned workspace (HQ or Category B locations) or ship the devices to the end-user’s locations

· Coordinate on-site repair of workstations under Warranty. Should be treated as an incident if it impacts user’s ability to perform duties.

· Maintain a small inventory of spares at each OIG location

Maintain a pool of loaner mobile devices.

· Provide Access to Scan and Print Devices

· Provide stand-alone laptops and mobile phones with IA approval (Region 6 computer lab, international travel, etc.)

· Maintain Scan and Print Devices used by executives in Headquarters.

· Conference Room setup in Headquarters.

· Maintain pool of loaner workstations, for temporary use when a workstation needs to be repaired or is required for travel.

· Ensure…