TIB-2019-RFI-0007.pdf

Solicitation Number: TIB-2019-RFI-0007

Title: Agency Information Technology Services (AITS) Agency: Federal Retirement Thrift Investment Board Office: Office of Technology Services Location: Office of Technology Services-Procurement and Contracts

A. General

The Federal Retirement Thrift Investment Board (FRTIB or “Agency”) seeks information from experienced Managed Service Providers that are knowledgeable and capable of providing the transition, implementation and sustainment of end-user, infrastructure, application, and managed security services via a single or multiple integrated Managed Service contracts. In doing so, the FRTIB aims to transition to a more practical, cost efficient, predictable and reliable technology service delivery model, allowing the Agency to focus on more strategic initiatives.

B. Background The FRTIB was created by the Federal Employees' Retirement System Act of 1986 (FERSA) to administer the Thrift Savings Plan (TSP) as one element in the three-part retirement program for employees covered under the Federal Employee Retirement System (FERS). In the nearly thirty years since the TSP received the first civilian contribution, it has expanded to cover members of the uniformed services (largely voluntary, non-matched contributions) and spousal beneficiaries. It is now the largest defined contribution retirement plan with more than 5 million participants and over $500 billion in assets under management. While the TSP’s growth over the past thirty years represents a tremendous success, expectations of additional growth, demographic changes, and the need for infrastructure and service enhancements present new challenges for the Agency.

The existing enterprise Information Technology (IT) architecture and infrastructure dates back to 2003 and is comprised of legacy and custom-built systems and applications. Since 2003, the FRTIB has incrementally improved the functionality and capacity of its IT architecture to support participant and beneficiaries’ (Ps & Bs) needs, comply with changing legislative requirements, and meet the Agency’s internal technology and data storage needs. The custom, ad-hoc modifications to the IT environment often introduced duplicative capabilities that were not fully integrated with the Agency’s enterprise IT architecture and are not scalable and adaptable to the latest available technology. As a result, the current IT environment limits FRTIB’s ability to fully leverage technology such as cloud-based services and service-oriented architecture, to improve the user experience and ensure the availability and cost effective delivery of technology services.

While FRTIB has implemented necessary security controls and monitors systems for threats and vulnerabilities, the current environment’s technological constraints and the evolving cyber threat landscape limits FRTIB’s ability to quickly adapt and deploy advanced protection, detection, and response capabilities. Likewise, the disparate legacy IT systems do not facilitate integration of cybersecurity best practices into business processes to further strengthen FRTIB’s security posture and ensure that the IT environment is trustworthy, resilient, and adequately protected against adversaries.

The FRTIB’s support systems and services (end user, infrastructure, application and security operations center (SOC)) are currently operated and maintained by a single integrator. Moving forward, the FRTIB is interested in modernizing the existing IT environment through a single or a set of integrated Managed Service contracts that leverage more modern technology (e.g., cloud-based and virtualization solutions) based on industry leading practices and in compliance with existing security requirements. The Agency is looking for a comprehensive set of managed services that will provide the HQ staff with a seamless technology experience and allow the IT staff to focus on strategic initiatives. The managed services include, but are not limited to, email and messaging;

document management services; workstations/laptops/virtual desktop infrastructure (VDI); web services; application services, mobile device management; infrastructure and network access; end-user support; identification, credentialing, and authentication; system/application operations and maintenance; security operations; and risk management.

C. Requested Information

This announcement constitutes an official Request for Information (RFI). This RFI is issued solely for information and planning purposes - it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI is the initial step in the Market Research process to capture information that would ultimately be used to competitively select one or more firms to provide a broad range of managed IT support services (across four service lines:

End User Services; Infrastructure Services; Applications Services; and Managed Security Services), at the FRTIB Headquarters (HQ) located in Washington, DC. In doing so, the Agency intends to:

• Deploy integrated systems and related processes in accordance with Federal and FRTIB guidance (e.g. FISMA, NIST RMF 2.0, FRTIB policies);

• Support mission-critical activities on a 24/7 basis;

• Provide best in class services such as email, document management, single-sign on, workstations, web services, application development, network access and authentication functions based on industry standard benchmarks;

• Effectively secure the Agency’s broader IT environment; and

• Proactively address security vulnerabilities and audit findings.

The FRTIB will follow the guiding principles that would allow the Agency to:

• Minimize the number of vendors providing technology services;

• Maximize the use of managed, or performance-based services with standardized pricing;

• Maximize the use of cloud-based data storage as well as “as a service” capabilities;

• Provide centralized end-user device management, with automated configuration of new devices/services;

• Have complete visibility in terms of boundary and device security monitoring and compliance;

• Enable a zero-trust model.

D. Announcement Disclosure The FRTIB is a self-funded agency with independent budgetary authority that receives no annual appropriations from Congress. FRTIB is not strictly bound to adhere to the Federal Acquisition Regulation (FAR). However, FRTIB procurements will largely adhere to the FAR, unless doing so might infringe upon the Agency’s fiduciary obligations under Federal Employees’ Retirement System Act (FERSA). FRTIB has adopted the FAR as its primary contracting policy and procedures for procuring its goods and services.

The Thrift Federal Acquisition Supplement (T-FAS) specifies when the Agency’s policies and practices deviate from the FAR. See link to T-FAS below.

https://www.frtib.gov/Procurement/DoingBusiness.html

This Announcement is issued solely for information and planning purposes. It does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This request for information does not commit the FRTIB to contract whatsoever. Further, the FRTIB is not at this time seeking proposals and will not accept unsolicited proposals.

Respondents are advised that the FRTIB will not pay for any information or administrative costs incurred in response to this Announcement; all costs associated with responding to this Announcement will be solely at the interested party's expense. Not responding to this Announcement does not preclude participation in any future solicitation.

E. Proprietary Information Disclosure Any information that the respondent considers proprietary should be clearly marked as such. All submissions become Agency property and will not be returned, including any proprietary information.

F. Response Instructions

Respondents are requested to provide a description of their capabilities, suggestions and recommendations in as much detail as possible. The response should address the goals outlined above as well as the requested information depicted below. Please limit your response to a maximum of 20 pages. This maximum excludes cover and separator pages, and any exhibits.

Following a review of the responses received, FRTIB may elect to request additional information, or schedule one-on-one meetings with some respondents to gain additional information about their recommended solution(s). Respondents will not be notified of the results of the review.

https://www.frtib.gov/Procurement/DoingBusiness.html

General Information

1. Provide the following information regarding your company:

a. Company name, address, and telephone.

b. Name, title, mailing address, telephone number, fax number, and e-mail address of contact person for this Announcement.

c. Company website(s)

d. Associated NAICS codes

e. Socio- Economic status

f. If the respondent has a government contract vehicle such as a Federal Supply Schedule or other government-wide use contract

Technical

a. Provide a high-level description of infrastructure or managed service capabilities your recommended technical alternative(s) would provide in support of end user services, infrastructure services, applications services, and managed security services. This will help FRTIB in assessing industry managed services.

b. Given the background and goals that FRTIB has outlined, what are the technical alternative(s) FRTIB should consider? Please be sure to address Data Recovery, Data Management, Service Level Agreements (SLAs), and Cybersecurity. Cloud solution recommendations must be Federal Risk and Authorization Management Program (FedRAMP) compliant. Do not provide a technical proposal, but rather a high-level description of technical solution(s). This information will assist FRTIB in identifying alternative solutions.

c. If cloud-based services are part of your recommended solutions, what would be the pricing structure?

d. Discuss your capability and experience running managed security services. Include a sample of best practices that will inform FRTIB on what to expect.

e. Address the advantages, disadvantages, and risks of dividing this work among multiple vendors. What aspects of the work can be effectively procured separately?

f. Provide a breakdown of potential cost-per-user/cost-per-unit/cost-per-seat pricing models. What services and capabilities would be included in each offering?

g. Provide a description on how you would ensure a multi-Service Provider environment will deliver successful integrated services. This will assist FRTIB in identifying the best working structure for a multi-Service Provider environment.

h. Provide constraints and assumptions associated with your recommended technical alternative(s). This information will assist FRTIB with preparing and having available processes and support required to assist with implementing a new solution.

i. Provide a high-level description of an approach for decommissioning legacy services, transitioning and implementing new services. This information will inform FRTIB of transition and implementation approaches for managed services.

j. Provide a high-level Work Breakdown Structure (WBS) for implementing and transitioning to your recommended technical alternative(s). This will help FRTIB obtain an understanding of key activities involved in the solution transition and implementation.

k. Identify implementation and transition risks associated with moving to your recommended solution or managed service. This will assist FRTIB with establishing mitigation strategies for high risk items.

Contracting

a. Provide a recommended contract type alternative(s) and incentive structure (award fee and/or incentive fee) that would best suit your recommended technical alternative(s).

b. If the FRTIB were to pursue a contract for this effort, identify if work to be performed is organic to your company or if sub-contracting will be required.

c. If possible, identify any Government Furnished Equipment/Information that may be required.

Service Level Agreements

a. What Service Level Agreements (SLA), including metrics, targets, measurements and exceptions would you recommend for your recommended solution(s)?

b. Describe the recommended SLA reporting method and any SLA reporting limitations and challenges expected for your recommended solution(s).

G. Submission

This information is due no later than April 8, 2019 at 3:00pm ET. Please email responses to:

Senica.Crowder@tsp.gov and frtibcontracting@tsp.gov . In the subject line insert: TIB-2019-RFI- 0007, [Agency Information Technology Services (AITS)] Attn: Senica Crowder, Contract Officer].

H. Questions

Questions regarding this RFI should be submitted in writing via e-mail to Senica Crowder at Senica.Crowder@tsp.gov and FRTIBContracting@tsp.gov in the subject line insert: TIB-2019-RFI- 0007. Verbal questions will not be accepted in response to this RFI and questions shall not contain proprietary, sensitive or classified information.

mailto:Senica.Crowder@tsp.gov mailto:frtibcontracting@tsp.gov mailto:FRTIBContracting@tsp.gov

I. Industry Day

FRTIB Industry Day, Wednesday, March 20, 2019 at the MITRE Corporation in McLean, VA from 10:00am – 2:00pm Eastern Time. Parties that intend to participate shall submit an intent to attend notice to Senica Crowder by 5:00 PM Eastern Time on March 15, 2019 at Senica.Crowder@tsp.gov and FRTIBContracting@tsp.gov . The intent to attend notice shall include the interested party company name, number of participants (Maximum of 3 in person representatives per company) and all participants full name. To accommodate security procedures participants attending in person should arrive 45 minutes before start time on the day of the event. In person access will be cut off 15 minutes prior to start time. Due to facility restrictions, only 100 US citizens will be allowed to attend in person. All in person attendees will be required to provide two forms of Government issued identification.

Additional Industry Day information is as follows:

The MITRE Corporation 7525 Colshire Drive McLean, VA 22102-7539 Reception Desk ext. 703 983-6004.

Parking for visitors is on the right side of the building. Only U.S Citizens can gain entry into the MITRE building.

Point of Contact:

Senica Crowder Contracting Officer Senica.crowder@tsp.gov mailto:FRTIBContracting@tsp.gov mailto:Senica.crowder@tsp.gov

Appendix - Definitions

End User Services include deployment and ongoing maintenance of the computing devices (workstations, mobile and peripherals), software and connectivity to: enable the workforce to access business applications; communicate with other employees, partners and customers; and create content using productivity software. The services will include Helpdesk and Deskside support for approximately 500 on-site users in Washington, DC and approximately 15 remote and traveling users across the country, as well as Service Management services to enhance incident, problem and change management as necessary for IT to plan, deliver, operate and control the services offered to the end-users.

Infrastructure Services include the core infrastructure — facilities, compute, storage and network services — that are required to deliver technology automation, including: WAN/LAN connectivity for HQ; server deployment and maintenance; datacenter support services to include 2 fully redundant, fault tolerant locations; ongoing maintenance and support of hardware, application and software systems to include upgrades and security patches; and network design and architecture.

Application Services encompass development, deployment and maintenance of custom and Commercial Off-The-Shelf (COTS) applications using Mac OS, Windows and Linux based operating systems, including software revision management; software patching management; data management and analytics; and software and license inventory management. The agency plans to leverage cloud services such as Microsoft Office 365 as much as feasible.

Managed Security Services include monitoring and analysis of agency’s security posture on an ongoing basis to ensure that potential security incidents are correctly identified, analyzed, defended, investigated and reported; working closely with the organizational incident response teams to ensure security issues are addressed quickly upon discovery; and supporting compliance with FISMA requirements, including efforts to increase and maintain maturity across all FISMA domains.

FRTIB Technical Fact Sheet

Currently FRTIB Headquarters (HQ) has IT support for approximately 500 users as follows:

1. Current Infrastructure

a. Network Infrastructure

i. LAN support for approximately 500 users

ii. WAN connectivity/support to agency backbone

iii. Internet network connectivity/support via Managed Trusted Internet Protocol Service (MTIPS) MTIPS provider

1. Redundancy is provided via geographically distributed circuit delivery

iv. HQ typically moves roughly 200Mbps of network traffic in and out

1. Redundancy is provided by multiple Multiprotocol Label Switching

(MPLS) circuit vendors

b. Distributed Infrastructure

i. LDAP, Mail, Document and Mobile Device Management is being moved to cloud and should be completed by fall of 2019

ii. A small amount of distributed infrastructure (~ 50 -100) requires HQ to support a variety of application-based services to include less than fifteen

(15) custom web applications, Identity, Credential, and Access Management (ICAM) systems, and a host of security systems. These systems are co-located at FRTIB’s datacenters.

c. Data Storage, Transitions & Transactions

i. HQ moves approximately thirty (30) Terabytes of data daily

ii. Transactions occur using document services, web services and email. HQ is using only 20% of its available bandwidth

iii. The agency stores approximately three (3) Petabytes of non-record keeping data

2. Current End User Support

a. Workstations (Windows and MAC) to support approximately 500 users

b. Apple Smart Phones to support approximately 500 users

c. Video Teleconferencing (VTC)

d. Approximately 30 – 40 networked printers

e. Additional peripheral devices such as scanners are required in small numbers

f. Patches to systems are applied remotely on a weekly basis

g. All systems are baselined with an application whitelist documented

h. Incident Management

i. Approximately 150 new incidents are received daily (to include locations outside of HQ)

ii. Approximately 170 incidents are closed daily (to include locations outside of HQ)

iii. Approximately 350 incidents are in work in progress daily (to include locations outside of HQ)

i. Change Management

i. FRTIB maintains its own Change Advisory Board which meets weekly and approves changes across all technical service areas for the enterprise

1. Approximately 30 changes are approved for production weekly across the enterprise

2. An additional standard 100 changes are pre-approved to be implemented weekly during approved hours

3. Applications

a. COTS Applications

i. The agency maintains a variety of (~50) COTS applications to interact and integrate with its record keeping business and for each of its business offices.

ii. Included are:

1. Data Loss Prevention (DLP)applications

2. ICAM applications

3. Applications to support Security operations such as xacta

4. Exchange, Mobile Device, DNS and Office 365

5. The agency has a substantial Service Now deployment

b. Custom Applications

i. FRTIB maintains approximately 20 custom applications

ii. 90% of the custom applications are tied to record keeping

c. Additional Application FAQ

i. Application to support Operations Management, Service Management and Business Management such as Service Now Platform. The agency has a substantial Service Now deployment

ii. Applications to support End-Users daily operation such as Office Suite, Adobe, Java, etc.

iii. Application to support testing/development environments

iv. Application to manage software deployment, patching cycle, event management, audit level logging and reporting tools such as Big Fix, Splunk, etc.

v. Application to host and manage databases

vi. Mainframe application

vii. Application to support distributed system such as VMWare, Windows, Oracle, Linux,

viii. Application to support Disaster Recovery Plan and Business Operation Continuity.

ix. Applications to monitor availability of other applications, mainframe, and networking functions.

4. Managed Security Services

a. FRTIB is seeking a vendor to support the agency’s Incident Response mission which is aligned with the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover. The Agency’s will explore maintaining an on premise SOC capability and the possibly of transitioning to a cloud-based (FedRAMP approved) or hybrid solution with on premise access and support. The vendor will serve as a Managed Security Service Provider that will build and maintain a 24/7 security monitoring infrastructure, provide actionable threat intelligence, and will be capable of providing a rapid response to emerging threats to protect Agency’s information and information systems from internal and external threat actors. The MSSP shall contain and eradicate cyber threats to limit the impact of loss regarding confidentiality, integrity, or availability of resources. The Agency requires complete visibility into the enterprise leveraging SOC tools and dashboards that will provide continuous monitoring.

The Threat Mitigation and Incident Response Branch must be able to independently review or corroborate information or reporting from MSSP.

b. Current Managed Security Services

Risk Management and Compliance:

• Risk Management Tool

• Vulnerability Management

SOC:

• Security logs collections and correlations

• Hardware/software assets management

• Email security/SPAM filtering

• Web filtering

• Data-Loss-Prevention

• End-Point Protection

• End-Point Encryption

• Files Integrity and configuration Monitoring

• Vulnerability scanning

• Web-Application testing

• Databases vulnerabilities management and configuration monitoring