MPS_Performance_Work_Statement_033117.docx

Source Selection Information - See FAR 2.101 and 3.104 TIRNO-17-R-00012

U.S. Department of Treasury

Managed Print Services (MPS)

Draft Performance Work Statement

Version 0.1

March 31, 2017

Source Selection Information - See FAR 2.101 and 3.104 Page C - 1 Table of Contents

List of Figures

Introduction This purpose of this Performance Work Statement (PWS) is to implement a new Managed Print Service (MPS) for the United States Department of the Treasury’s use of printing, copying, scanning, print-related purchasing practices, and paper and ink/toner usage. The MPS is a planned Enterprise Initiative to use enhanced technology and managed services to meet Treasury’s printing needs in a more cost-effective, secure, reliable, and environmentally friendly way. It affects the distribution, management, and servicing of printers and multifunctional devices (MFDs), which perform copying, printing, faxing, and scanning functions throughout Treasury. The MPS is expected to improve workforce productivity through reduced printer downtime and expanded print functionality; save Treasury significant printing costs over five years; better protect sensitive and private information; reduce paper waste; and comply with Government-wide and Treasury-wide “Green” guidance. An objective of the MPS is to reduce the number of personal desktop printers in offices and workstations to the greatest extent practicable. MPS will enable the workforce to:

· Print, copy, and scan to email using fast, high-volume, networked devices conveniently located for users

· Reduce demand on information technology (IT) staff by transitioning maintenance and upkeep to a Managed Service provider

· Print securely through the implementation of personal ID number (PIN) printing and secure pull printing technology, granting users the same security as a personal printer and helping to reduce burden on employees and IT staff to set up print drivers

· Standardize duplex (two-sided) printing for all Treasury printers and MFDs to comply with Government-wide policy and to reduce paper usage

· Standardize black-and-white printing as the MPS default.

The MPS Supplier will implement the network-based printing Treasury Print Policy (attached) and work with the Treasury and its Bureaus to facilitate the following outcomes:

· Network-based printing must be implemented in all Treasury participating organizations and/or other Federal agencies, as designated.

· Treasury and its Bureaus will work closely with the MPS Supplier to determine the optimum network printer locations. Depending on the number of employees, it may be necessary to stage multiple printers in a single office. Treasury and its Bureaus will determine the appropriate location option based on the Treasury MPS policy.

· Desktop printers will no longer be allowed except under compelling circumstances as defined in the Waivers Section of the Treasury Print Policy, including the adherence to the Rehabilitation Act requirements of Section 501 and Section 508.

Background and Current State The United States Department of the Treasury is comprised of over 100,000 employees spanning current and future Bureaus, Departmental Offices, and three Inspectors General, with their varied and distinct missions. The Treasury’s Bureaus, with their varied and distinct missions, have historically operated independently, with their own management structures, budgets, and procurement organizations. This structure resulted in overall mission success for the individual Bureaus, but it did not leverage Treasury’s collective buying power for commonly procured products and services, and resulted in significant duplicative work by Contracting Officers (COs) and Contracting Officers’ Representatives (CORs). In today’s budget environment, Bureaus can no longer afford to operate using Treasury’s historical stovepiped environments, where each Bureau develops its own set of unique requirements and procures a variety of different MFDs and printer models. The Treasury copy/print/fax/scan fleet today contains more than 100,000 devices comprised of over 400 different models, which results in a high cost of ownership and inefficient management processes.

Currently, there are a variety of contracts for acquiring and maintaining these devices across the Department, resulting in varying types of potentially outdated equipment and increasing operational costs. Each Bureau separately administers the procurement of MFDs, printers, equipment maintenance, and technical support. The presence of multiple systems increases costs and incompatibilities across the Bureaus. By moving to one enterprise-wide initiative for MPS, Treasury will be able to achieve improved economies of scale to drive significant cost savings.

Executive Order 13589 instructed Bureaus to maximize opportunities for efficient and effective spending. Multiple Office of Management and Budget (OMB) memorandums have provided specific direction encouraging strategic sourcing and implementing formal governance bodies over Government-wide strategic sourcing initiatives. During FY16, the General Services Administration (GSA) and OMB provided high visibility to the Federal IT Acquisition Reform Act (FITARA) and Category Management, which are both motivators for one Treasury-wide MPS contract vehicle. More information about FITARA and Category Management can be found at https://management.cio.gov.

The change to a predominantly network-based printing environment will benefit Treasury through lower energy, equipment, supply, and vendor-related service costs. In addition, the reduction in desktop printers will allow for the propagation of new, more energy-efficient print devices that use fewer toxic chemicals, ultimately reducing Treasury’s overall environmental impact. The costs related to printing and paper use can easily be overlooked, but by implementing the measures outlined in this PWS, the Department has the potential to reduce both its print-related power consumption and paper costs.

Purpose The purpose of this acquisition is to move the Treasury Department and all of its Bureaus to a predominantly network-based printing service that will benefit Treasury through lower energy, equipment, supply, and vendor-related service costs. The intent of the Government to purchase a service with guaranteed outcomes rather than to purchase hardware, software, consumables, or supplies.

The MPS will provide a single Department-wide contract vehicle to maximize efficiencies, manage spend, reduce risk, and maximize productivity. This contract is an Award Term contract with a one-year base, four option years and two award terms, Indefinite Delivery, Indefinite Quantity (IDIQ) contract that has the capability to address all mission-critical requirements for each Bureau, thereby replacing the many diverse contract vehicles across Treasury and eliminating the multiple types of equipment and service contracts. Award Term provides a contract performance incentive feature that ties the length of a contract’s term to the performance of the contractor. Treasury requires the MPS Supplier to provide full life-cycle management of Treasury printer, copier, scanner, and fax capabilities across all continental U.S. locations using a base-type model. Treasury expects this model to include all MPS support efforts following completion of the MPS transitioning and implementation phases described in the Services Section of this contract.

As a direct result of this contract performance, Treasury expects to achieve the following outcomes:

1. A high-performing partnership between Treasury and the Contractor Optimize organizational alignment, roles, and responsibilities to best leverage system support services resources, maximize organizational efficiency, and deliver continuous improvement. Build a strong, mutually beneficial partnership with clear, mutual accountability and delivery of services that are firmly aligned with Treasury’s dynamic business requirements throughout the period of performance.

2. A compelling managed service framework Ensure that desired outcomes are achieved through objective-based service-level metrics, key performance indicators, customer satisfaction measurements, executive performance indicators, and cost reductions.

3. Sustained industry-leading printing practices and innovations Promote process and quality management methodologies that incorporate industry-leading practices, standards, and innovations; produce repeatable positive outcomes; encourage the incorporation of lessons learned; reduce solution delivery time, costs, and defects; improve program productivity and reliability; and provide Treasury substantial visibility into the status and health of ongoing systems operations.

3. One cost-driven Help Desk to support Treasury and its Bureaus Provide one Help Desk for all of Treasury and its Bureaus. This will provide a single-source solution for management and oversight of Treasury Managed Print infrastructure(s).

4. A simple, manageable, and scalable Treasury MPS environment Simplify the MPS allocation, provisioning, capacity planning, support, maintenance, and equipment refresh. Implement the MPS based on prevailing industry standards. Adjust to demands in MPS based on varying printing consumption needs and increases or decreases in capacity.

5. Single point, end-to-end operational accountability and visibility Provide visibility into the new operations with access to performance and operational data for Treasury to guide management decisions. Implement responsive issue resolution and change management processes that provide acceptable financial, technical, deployment, and operational risk levels. Facilitate the use of consistent, integrated approaches and processes across line of business and geographies through an integrated service delivery model that employs a cohesive relationship and contract governance structure.

6. A cost-effective and affordable program cost structure Hardware and services rates remain competitive with market rates throughout the contract life cycle, and pricing structure mitigates transition cost spikes.

7. A successful program transition Complete the transition to the new MPS on schedule and without adverse customer impact.

Scope of Services The MPS Supplier will provide ongoing operations and maintenance. Services must also include all operational, assessment, provisioning, and sustainment efforts; all required accessories; and all usage as part of the base solution, and must fulfill all service level objectives defined in this contract. Treasury seeks to minimize risks with the base model and requires the MPS Supplier to offer solutions that include a combination base usage monthly.

The MPS Supplier will provide the required solutions, approaches, and ongoing services, including the people, processes, technologies, and mix of online and remote support to smaller sites for the scope outlined in this IDIQ contract. The MPS Supplier’s process will utilize the baseline information provided by each organization, and will analyze the top utilized devices of the print infrastructure, devising a recommended future state based on the trending volume information and the intelligence gained by Treasury staff in serving their environment.

The MPS Supplier will work with all Treasury employees to facilitate the removal of all all obsolete and underutilized networked and non-essential desktop printers, copiers, and plotters offline to be collected by the MPS Supplier. Desktop printers will no longer be allowed except under compelling circumstances as defined in the Waivers Section of the Treasury Print Policy (attached), including the adherence to the Rehabilitation Act requirements of Section 501 and Section 508.

The MPS Supplier will also install print servers at those sites that do not currently employ print servers. Other Bureaus will provide the print servers and the standard configuration, software, security requirements. With either option, the Supplier will take over the management of the print servers. Treasury will benefit through lower energy, equipment, supply, and vendor-related service costs. In addition, replacing obsolete printers will allow the use of new, more environmentally friendly network printers and MFDs that use fewer toxic chemicals, less energy, and result in a smaller carbon footprint. As part of the MPS program, the MPS Supplier will propose the consolidation of devices based on business need for each floor in each Treasury Organization, and will make recommendations as the business need changes.

Program Management Services The MPS program will be managed and governed through a virtual Program Management Office (PMO) structure comprised of the Department of Treasury executive level and each Treasury Bureau or designated organizaton serving as members of the virtual PMO as well as acting as the MPS representatives for their Bureau’s activities. Figure 1 shows the virtual Treasury and Bureau PMO structure.

BUREAUS

Figure 1: Virtual MPS Treasury PMO Structure for Current Bureaus The MPS Treasury PMO is responsible for:

· Overseeing, managing, and coordinating the MPS Supplier contract and work products to ensure overall successful delivery and implementation of the MPS contract and closeout of existing contracts on schedule

· Preparing and approving any interagency agreements with any Federal entities outside of Treasury that want to order goods as part of the MPS solution according to the Economy Act

· Overseeing and coordinating with the MPS Supplier Program Manager on contract progress and status – conducting periodic MPS Supplier Program Management Reviews

· Administering the Waiver Policy for all Treasury Bureaus

· Coordinating and developing all MPS Program-level reporting activities and processes including, program reviews, GAO and OMB reporting, etc.

· Reporting program and project status and risks to external and internal stakeholders and oversight Bureaus such as GAO and OMB

· Retaining an independent benchmarking service provider to conduct an annual program benchmark study that shall enable the Treasury PMO to compare fees and service levels that will ensure the Supplier’s fees and service levels are comparable to current market rates and service levels for such services.

· Aligning all Treasury Bureau MPS PMOs to support transition from the existing environment to the new MPS environment

· Providing tools to Bureau-level MPS PMOs to communicate with stakeholders on MPS capabilities and services to ensure optimum Treasury planning and use

· Developing and setting future MPS Strategy through coordination with Treasury Organizations, MPS stakeholders, and commercial industry

· Ensuring that all organizational interdependencies are clearly addressed and closely monitored and there is regular collaboration among the organizational entities

· Promoting and implementing environmentally friendly printing practices and paper use

· Establishing printing goals and strategies to comply with Government regulations

· Establishing policies and accepted behaviors regarding print, copy, fax, and scan

· Monitoring and managing Bureau implementation results over time to keep the printing environment optimal and to ensure that the benefits of these policies are maintained.

The list of Bureaus is subject to change depending upon potential future bureaus and/or other participating Federal Agencies. The MPS Supplier will provide their organizational structure to include levels of authority at corporate and task order level, approval process, roles and responsibilities, communication process, management of risk, and subcontractor management that maps to the Treasury tiered PMO structure.

The MPS Supplier must participate in a Contract Kick-Off Meeting at a place and time approved by Treasury. The meeting will provide an introduction between the MPS Supplier personnel and Treasury personnel who will be involved with administering and managing the Contract. The meeting will provide the opportunity to discuss management of the Contract, roles and responsibilities, terminology and processes, security, administrative issues, and Task Order procedures, including notification and communications processes, travel, reporting, and invoicing procedures. Attendees must include MPS Supplier personnel, including the Program Manager and Contracts Manager, and representatives from Treasury PMO and Contracting Activity.

The MPS Supplier must identify a Program Manager (PM) to serve as Treasury’s single focal point to provide management, direction, administration, quality assurance, and leadership in the execution of this Contract and all resultant Task Orders. The MPS Supplier’s PM will be required to meet frequently with Government personnel, at times on short notice and in person at a to-be-specified Ordering Organization Program Office location or via telephone, on weekdays from 8:00 a.m. to 5:00 p.m. Eastern Time (except for Federal Government holidays).

Subcontracting As a tool for “Risk Awareness,” Treasury must have insight into the use and nature of subcontracting activities under this agreement and requires a small business plan. The specific purpose is not to meddle in the Supplier’s business dealings but rather to have the ability to address issues and concerns should they arise. Treasury requests that Offerors provide an initial Subcontracting Plan as part of the response to this solicitation, detailing roles and responsibilities of sub-suppliers. For ongoing management of the Enterprise Printer Agreement, the MPS Supplier must notify Treasury Printer PMO prior to any changes and update the Subcontracting Plan accordingly.

Task Order Management Each Treasury Bureau will submit a separate Task Order against this contract for the work required in their Bureau, based upon the size and condition of their current printing environment. The task order process is depicted in Figure 2.

Figure 2: MPS Services Task Order Process Flow The scope of each Task Order will be comprised of three phases:

Phase 1–Assessment of Current State and Plan for New Solution This phase includes the activities immediately after award of contract, including assessing and validating the Ordering Organization’s printing asset inventory, confirming which print assets should be kept, repurposed, or removed, the buy-back of reusable Government-owned printing assets at fair market value (FMV), and the transfer of ownership of the usable printer hardware from the Ordering Organization to the MPS Supplier. This phase also includes the design of the new MPS solution addressing both usable and unusable assets that will be submitted to Treasury for approval, as well as a plan for destroying any print resources required by individual Ordering Organizations. Services generally included in Phase 1:

· Program and Operational Management – conducting the Program Management Kick-Off, developing a proposed outline for an Operational Management Framework , and providing a FedRAMP Peformance and Monitoring Tool

· Inventory Validation – validating and assessing the current printer and MFD inventory provided by Treasury and its Bureaus

· Exchange Sale of Reusable Assets – assessing the remaining value of any usable or valuable equipment at the end of its useful life based on its current value, and providing Treasury with service credits for these assets that will be used to offset billable services

· MPS Minimum Device Functionality – ensuring that the new MPS solution meets minimum device functionality requirements

· Security – assessing the security requirements of the Ordering Organization

· MPS Design – designing a new Treasury printing environment delivered at the Ordering Organization level that is consistent with the established Treasury Managed Print Policy

· Transition Planning – providing a Service Transition Plan that describes in detail the migration of all legacy services from the Treasury’s and/or Bureau’s current implementation to the MPS Supplier’s solution

· Training – developing a Training Plan to provide training on the new devices for all employees.

Phase 2 – Implementation of the New Solution This phase includes the implementation of the current printer environment to the new MPS solution for the Ordering Organization. Services generally included in Phase 2:

· Peformance Management and Monitoring Tool – providing access to a peformance management and monitoring tool to allow ad hoc investigation of printer and MFD utilization and performance, including adherence to service level objectives, self-service report generation, analytics, and MFD management and planning

· Installation – delivering, installating, and configuring the MFDs at Ordering Organizations’ locations

· Help Desk Installation –providing proactive maintenance and Helpdesk services

· Testing –providing equipment and on-site support for testing of all new MFD hardware and software components prior to any production deployments

· Security –ensuring that all printers are authorized by the appropriate authority prior to production Phase 3 – Management of the Ongoing Managed Print Solution This phase is the ongoing management of the MPS operations and maintenance services necessary to support Treasury’s goals and objectives, including the identification of future enhancements and new technologies that will continue to improve, enhance the environment, and ultimately reduce the costs of print services for Treasury. Services generally included in Phase 3:

· Operations and Maintenance – providing operations and maintenance, installation, upgrades, and refresh services in accordance with the service level objectives (SLOs) for the classes of MFDs

· Service Response Time – responding to service failures within the timeframes agreed to in the SLOs

· End of Life – ensuring removal and disposal of all assets in accordance with Ordering Organization’s policies.

· Equipment Maintenance and Support – providing ongoing maintenance and support

· Ongoing Secuirty Monitoring and Incident Tracking – maintaining security incident response/reporting services

· Performance Management and Monitoring Reporting – providing a Dashboard as part of the Performance Management and Monitoring suite of tools on overall MFD utilization and performance.

Security and Privacy Requirements The Offeror must demonstrate that the proposed MPS meets current and future security and privacy requirements defined by Treasury and Federal laws, regulations, and policies. Security and Privacy requirements apply to individuals and organizations having contractual arrangements with Treasury, including Suppliers, Sub-suppliers, and outsourcing partners. Security support services consist of security risk management, patch and vulnerability management, plans of action and milestone support, security continuous monitoring and analysis, security change and configuration management, security audits, incident handling, business continuity, security control assessments, secured gateway access, and access and authorization management. Security support also includes Treasury and Bureaus and designated Treasury and Bureaus contractor remote and onsite access, at Contractor facilities, to IT infrastructure and applications for periodic vulnerability scanning, penetration testing and independent validation and verification of security controls, including access to applications not developed by the Contractor and real-time/near real-time security-relative data access to key Treasury and Bureaus security stakeholders as needed for security monitoring. The objectives of the Security and Privacy Requirements are to provide security to protect the confidentiality of information on behalf of Treasury, commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction.

Ensure that the printer policies, processes, and procedures comply with Federal Government-approved standards and guidelines for a Federal Information Processing Standards (FIPS) 199 moderate to high system classification, and are consistently enforced.

Ensure that printer policies perpetually remain in compliance with the provisions of the Federal Information Security Management Act (FISMA), Title III of the e-Government Act of 2002, P. L. 107-347, and subsequent amendments, and other applicable laws, regulations, and policies as they are added, modified, or deleted.

Ensure that all security implementation is tested, documented, and monitored, with periodic reporting to Treasury of the status of compliance with requirements.

The MPS Supplier shall implement federally compliant security measures to prevent remote intrusion, virus infections, and service denial schemes to information systems, infrastructure support systems, and telecommunication services supporting Treasury’s intranet and internet websites. Therefore, the Offeror’s proposed MPS must ensure that:

Devices adhere to Treasury’s security standards and must meet regulatory and governance requirements.

Device configurations are password protected when feasible.

Devices are smart card (Personal Identity Verification [PIV]) enabled.

Secure printing capabilities (Lock Print/ Enhanced Lock Print) are available when required.

User information remains confidential.

The MPS Supplier shall be knowledgeable of National Institute of Standards and Technology (NIST) and Federal Information Processing Standard (FIPS) guidance and complete the Certification and Accreditation process, including risk assessment and Security Testing and Evaluation. The FIPS 200, Minimum Security Requirements for Federal Information and Information Systems impact rating at a minimum is moderate. The FIPS 199, Standards for Security Categorization of Federal Information and Information Systems defines a Moderate-Impact System as an information system in which at least one security objective (i.e., confidentiality, integrity, or availability) is assigned a FIPS 199 potential impact value of moderate and no security objective is assigned a FIPS 199 potential impact value of high.

Personally Identifiable Information Taxpayer data protection is a highly sensitive form of Personally Identifiable Information (PII) (refer to NIST Special Publication [SP] 800-144, Guidelines on Security and Privacy in Public Cloud Computing, and NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information [PII]) and should be protected as required by the Treasury and Bureaus (refer to Treasury and Bureaus Publication 4812, Contractor Security Controls, Internal Revenue Manual [IRM] 10.8.1, IT Security Policy and Guidance, and IRM 10.5.2, Privacy and Information Protection, Privacy Compliance and Assurance [PCA] Program); and OMB Memo (M) 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, and NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations. Treasury and Bureau policies prohibit unauthorized inspection or disclosure of taxpayer data.

Badging, Parking, and Building Access The MPS Supplier must comply with each facility’s badging, parking, and building access requirements. These requirements include the MPS Supplier’s responsibility to pursue temporary or permanent badges for on-site employees for performance under this Contract as well as the collection of badges for those no longer requiring access under this Contract, in compliance with the Homeland Security Presidential Directive 12 (HSPD 12), dated August 27, 2004,“Policy for a Common Identification Standard for Federal Employees and Contractors.” These requirements also include (but are not limited to) the following: badge must be worn at all times, above the waist, and easily visible to other personnel in the building. The MPS Supplier is responsible for the safekeeping, wearing, and visibilityof Government-furnished badges. [start Access to Network All devices provided under this Contract must require Treasury and Bureaus’ PIV (or other agency Common Access Card (CAC) for access to the network. Network devices must additionally meet the following PIV/CAC configuration: The capability for user authentication must comply with (HSPD 12) card readers, and support any PIV/CAC stock on the FIPS 201 Approved Products List. The MPS Supplier must ensure that users’ authentication credentials including PIV/CAC are not recorded or captured in print job submissions.

All MPS MFDs must be compatible with users’ network credentials when PIV/CAC is not available. The MPS Supplier must ensure the PIV/CAC solution is Section 508 compliant. The hardware solution for PIV/CAC card access must be Treasury/Bureau compliant/certified.

The MPS Supplier must ensure that MPS devices can only be accessed within Treasury and Bureaus’ networks. The MPS Supplier must centrally manage MFDs from the Treasury Bureaus’ Data Centers. The MPS Supplier solution must be compatible with each Treasury and Bureau’s baseline server configuration:

Security-Related Tasks The MPS Solution must support the following security-related tasks:

Support to analyze and actively manage security risks based on the severity of impact upon Treasury/Bureau Organizations to minimize risk to Treasury/Bureau systems and data and to maintain information systems authorization.

Support to develop and maintain a Security Risk Management Framework across the MPS environment that supports all areas of NIST SP 800-37 Rev. 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, with the exception of Authorization, which is a Treasury and Bureau responsibility.

Provide an automated risk management decision approach process supported by continuous monitoring and sharing of agency cybersecurity status and threats that improves security situational awareness, defense and response (refer to Office of OMB M 14-03, Enhancing the Security of Federal Information and Information Systems; OMB M 15-01, Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices, and NIST SP 800-137, Information Security Continuous Monitoring [ISCM] for Federal Information Systems and Organizations).

Develop varied security related artifacts such as an MPS Security Concept of Operations (CONOPS), Vulnerability Assessments, Security Incident Summary Reports, Mitigation Reports, Configuration Compliance Reports, Security Risk Assessments, and Information Security Status Packages (collection of artifacts that communicate the security posture of the Treasury/Bureau environments and the contractor’s statement of validation that services were provided as defined in associated plans and activities.

Patch and Vulnerability Management Support Services Implement and maintain security patch and vulnerability management process and procedures as required by Treasury and Bureau guidance, and consistent with NIST SP 800-40 Rev 3, Guide to Enterprise Patch Management Technologies, government best practices, as applicable, and NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations.

Design and implement a centralized Patch Management System which shall address impending threats to the MPS and related critical IT infrastructure via automated patch implementation on an as-needed basis.

Provide Plan of Action and Milestones (POA&M) support, including preparing, documenting, and maintaining a POA&M to correct deficiencies in the security controls and to address remaining vulnerabilities in the information system, as required by Treasury and Bureaus.

Provide Security Continuous Monitoring and Analysis support, which may consist of:

Security monitoring services (24x7x365) across all systems and devices within the Web-hosted IT infrastructure and associated application components as required by Treasury and Bureaus Monitoring services to detect, prevent, and address security threats to all MPS environments, exchange security status, and effectively interoperate with internal Treasury and Bureau Computer Security Incident Response Capabilities .

Provide reports that support Treasury and Bureau FISMA c compliance requirements (refer to NIST SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems) including but not limited to inventory, inventory change log, security configuration compliance reports, personal security, and POA&Ms.

Provide Security Change and Configuration Management services, which may consist of:

Implementing and maintaining a Security Change and Configuration Management process and procedures consistent with Government best practices (refer to NIST SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, and NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems).

Maintaining a Security Configuration Management Database or equivalent repository for tracking changes to the security configuration baseline.

Implementing a Security Impact Assessment process that is traceable throughout the entire change process and includes post-implementation validation per NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments.

Adhering to NIST United States Government Configuration Baseline using the Security Content Automation Protocol validated software, as specified by Treasury and Bureaus Publication 4812, Contractor Security Controls, or other appropriate guidance (refer to OMB M 08-22, Guidance on the Federal Desktop Core Configuration.

Security Audits The MPS Supplier must implement, manage, and maintain audit services for the MPS solution, including maintenance and retention of an audit plan, and audit and event logs. (Refer to Treasury and Bureaus Publication 4812, Contractor Security Controls, NIST SP 800-18 Rev. 1, Guide for Developing Security Plans for Federal Information Systems, IRM 10.8.3, Information Technology (IT) Security, Audit Logging Security Standards, NIST SP 800-12, Introduction to Computer Security, and NIST SP 800-92, Guide to Computer Security Log Management). Audit record retention shall comply with Treasury and Bureau requirements Incident Handling

· The MPS Supplier must implement and maintain security incident response/reporting services that comply with Treasury and Bureau requirements.

· The MPS Supplier shall document security incident response/reporting process and procedures in a Treasury and Bureau-approved MPS Security Incident Handling, Monitoring and Response Plan.

Business Continuity Support:

The MPS Supplier must provide business continuity support services for all MPS components and controls in accordance with Treasury and Bureaus Publication 4812, Contractor Security Controls, IRM 10.8.1, IT Security Policy and Guidance, and NIST SP 800-34 Rev .1, Contingency Planning Guide for Federal Information Systems) including providing an Alternate Site Processing Environment for disaster recovery services referred to in FIPS Pub 199, Standards for Security Categorization of Federal Information and Information Systems at a moderate or high level.

The MPS Supplier shall create the following security documentation as applicable, and update security documentation as each Treasury component is transitioned to the MPS solution:

· System Security Plan

· Indirect Transmission Control Protocol

· Boundary Scope Memo

· Privacy Impact Assessment

· Incident Response Plan

· Configuration Management Plan

· Continuous Monitoring Plan

· Incident Response Plan and Incident Response Training Plan

· Roles and Responsibilities, and Expected Behavior Rules Security Configuration Guidelines The MPS Supplier must also take into consideration that each Treasury Bureau may have differing security policies for the removal of the current printers. The security policies for each Bureau will be available to the MPS Supplier. Some Bureaus may require total destruction of some printers, in which case, the MPS Supplier must be able to provide a solution for the green destruction of those printer as part of its proposed solution. For any equipment removed by the MPS Supplier and scheduled to be destroyed per IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance, the MPS Supplier is required to demonstrate as part of its plan that those actions will be handled by a refurbisher or recycler that is third party certified to one of the known electronics recycling certification programs that is used in the United States─the Responsible Recycling Standard or the EStewards Standard.

Performance Standards and Monitoring Tool, Quality Assurance Survillence Plan, and Benchmarking FedRAMP Performance and Monitoring Tool The MPS Supplier must propose a suite of Cloud-based performance management and monitoring tools that is FedRAMP compliant to monitor the performance of the MPS Solution across the Treasury and its Bureaus and to manage and monitor help desk functions. The MPS Supplier tool must include access to a real-time dashboard showing performance information at the Bureau site and device level. The tool should allow for ad hoc investigation by the MPS Supplier and Treasury/Bureaus of MFDs’ utilization and performance, dashboard reporting and report generation, and MFD management and planning. This tool suite will have access to all MPS sites and networks, but will not access stored data or applications hosted on the Treasury/Buearu infrastructure. Each organization will be able to track only its own activities, except for Treasury PMO, which will have access to all participatiing Organizations.

Quality Assurance Surveillance Plan The MPS Supplier must propose a Draft Quality Assurance Surveillance Plan (QASP) that Treasury will use to evaluate the MPS Supplier’s performance under the contract. The Draft QASP must include, at a minimum, the Government-proposed performance metrics, expressed in the form of SLO), which are specific quality-of-service measurable characteristics. Treasury will describe specific Government-proposed performance metrics in the QASP. The final QASP will be agreed to by both the Government and MPS Supplier to ensure mutual understanding of how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable performance rate.

The MPS Supplier must collect and report on data that documents the success or failure to achieve the stated objectives. Post Award, the MPS Supplier may recommend additional or alternate performance metrics, with rationale supporting how those metrics will achieve the objectives for Treasury consideration and approval.

Benchmarking The Treasury PMO will apply program benchmarking methods in order to evaluate that (a) program service levels are no less favorable than industry’s best practices; and (b) program fees are no less favorable than industry’s best rates. The Offeror shall refer to the benchmarking clauses outlined in Section H of the Request for Quote for more information on this provision. The benchmark service provider will suitably adjust all Treasury PMO data to facilitate relevant peer-level fee and service-level comparisons, including factors such as (i) geographic location of the peer companies, (ii) industry differences affecting IT costs, (iii) economies of scale, (iv) workload and complexity aspects, (v) SLOs, (vi) duration and nature of the contractual commitment, and (vii) overhead costs. Once peer-level fee and service-level data is adjusted and approved by the Treasury PMO, the adjusted peer data will be considered the program’s accepted market-based standard for comparable services.

Place of Performance The place of performance will primarily be at the locations of the Treasury Bureaus and components. These locations will include Treasury and Internal Revenue Service (IRS) offices across the Continental United States, Puerto Rico, Alaska, and Hawaii. The geographical locations will be specified with each individual task order.

Period of Performance The period of performance will be one base year, four one-year options, plus the opportunity to earn two one-year award terms based on performance. Period of performance will be indicated in each individual task order.

End of Contract At the end of the Contract for any of the services defined in this procurement, the MPS Supplier must provide support in the form of expertise to provide an approach for participating in a possible transition to a new solution and/or vendor. The purpose of this support must be to ensure a smooth transition to a new printer solution, managed by Treasury and/or a new supplier. The MPS Supplier’s proposed response must include an approach, based on industry standards, and a committed level of effort for this support, to allow Treasury to evaluate the proposed solution. This solution should include methods of determining the value of the equipment being transitioned. Treasury reserves the right to review the current asset inventory, and if the Contract is ended unfavorably, the Supplier must allow Treasury to acquire the current printer assets at FMV, as determined by the independent assessor retained by Treasury at time of Contract end.

Government-Furnished Items and Services Government-Furnished Property Facility/Infrastructure Requirements Treasury and its Bureaus will provide MFD floor space and facility access. Treasury and its Bureaus will be responsible for all facility expenses and facility site preparation costs. Treasury and its Bureaus will be responsible for all paper utilized by the MFDs.

Treasury and its Bureaus will provide access to ticketing systems as well as laptop computers that can be used to access these systems. The laptops should also be able to be used to access the systems and tools for monitoring the MFDs.

Network Treasury and its Bureaus will provide Internet Protocol (IP)-based local area network and wide area network connections to the Treasury network for operational use, as well as the IP addresses to be used by the printer systems. This will include dedicated point-to-point circuits as needed. This may also include one or more secure connections to the MPS Contractor’s facilities for access to management and support facilities to be determined as part of design and implementation.

Government-Furnished Information It is anticipated that Government-furnished information will be required for contractor performance. A considerable volume of information will be made available to potential Offerors during the solicitation process.

Appendices

Appendix A: Treasury Print Policy To be provided

Appendix B: Printer Inventory To be provided

Appendix C : Peformance Benchmarking (will be in Section H of RFP) The Treasury PMO will apply program benchmarking methods to evaluate that:

the Contractor’s program service levels are no less favorable than industry’s best practices; and (b) the Contractor’s program fees are no less favorable than the industry’s best rates.

Upon contract award, the Treasury PMO will retain an independent benchmarking service provider to conduct an annual program benchmark study that shall enable the Treasury PMO to compare fees and service levels that will ensure the Contractor’s fees and service levels are comparable to current market rates and service levels for such services.

The program benchmark shall be conducted by an independent industry-recognized benchmarking service provider retained by the Treasury PMO. The benchmarking service provider shall: (i) be independent, (ii) have demonstrable and substantial experience in performing information technology benchmarks, (iii) have ready access to suitable peer level fee and service level data sources, (iv) agree to maintain the confidentiality of all data, and (v) have no conflicts of interest with respect to the Offeror or Treasury PMO.

The program benchmark shall be conducted in a manner that is fully transparent to the Treasury PMO.

The benchmark service provider will suitably adjust all Treasury PMO data to facilitate relevant peer level fee and service level comparisons including factors such as: (i) geographic location of the peer companies, (ii) industry differences affecting information technology costs, (iii) economies of scale, (iv) workload and complexity aspects, (v) service level objectives, (vi) duration and nature of the contractual commitment, and (vii) overhead costs. Once peer level fee and service level data are adjusted and approved by the Treasury PMO, the adjusted peer data will be considered the programs accepted market-based standard for comparable services. If the benchmark service provider reports that the Contractor’s aggregate fee is greater than 105% of the accepted market-based standard for comparable services (after adjusting for peer differences), then the Contractor shall incorporate reduced fee elements into all current and subsequent task order cost schedules such that Treasury PMO aggregate fees are at 100% of the accepted market-based standard for comparable services.

If the benchmark service provider reports that Treasury PMO service level standards, provided by the Contractor based on the price charged for that service level, are materially below prevailing market standards (after adjusting for peer differences), Treasury PMO service level standards will be increased for all current and subsequent task order service level agreements to match applicable service levels contained in the benchmark results.

Prior to commencing a program benchmark, the Treasury PMO and the Contractor shall agree on the specific services to be included within the scope of the study. At a minimum, a benchmarking report covering the requirements identified above must be provided.

At Treasury PMO’ sole discretion, Treasury PMO may opt to forego the annual benchmark or some portion of the annual benchmark. Exercising this option in no way relieves the Contractor from providing future program benchmarks. All costs associated with the identified benchmarking process will not be separately priced within issued task orders.

Appendix D : ITIL® Framework

Service Strategy Service Design Service Transition Service Operation Continual Service Improvement

i. Service Strategy Process

ii. Financial Management

iii. Business Case (ROI)

iv. Service Portfolio Management

v. Demand Management

i. Service Catalogue Management

ii. Service Level Management

iii. Capacity Management

iv. Availability Management

v. IT Service Continuity Management

vi. Information Security Management

vii. Supplier Management

i. Transition Planning and Support

ii. Change Management

iii. Service Asset and Configuration Management

iv. Release and Deployment Management

v. Service Validation and Testing

vi. Evaluation

vii. Knowledge Management

i. Event Management

ii. Incident Management

iii. Request Fulfillment

iv. Problem Management

v. Access Management

vi. Service Desk

vii. Technical Management

viii. IT Operations Management

ix. Application Management

i. Improvement Process

ii. Service Reporting

iii. Service Measurement

iv. Service Level Management

Note: The Operations Management Framework is adapted from the Office of Government Commerce (OGC) six core volumes of ITIL v3, The Official Introduction to the ITIL Service Lifecycle (ISBN 9780113310616), Service Strategy (ISBN 9780113310456), Service Design (ISBN 9780113310470), Service Transition (ISBN 9780113310487), Service Operation (ISBN 9780113310463), and Continual Service Improvement (ISBN 9780113310494).

Appendix E List of Federal Directives The Federal policies that authorize this initiative include but are not limited to:

· FITARA – Federal IT Acquisition Reform Act http://oversight.house.gov/release/fitara-included-ndaa-bill/ and https://management.cio.gov

· Federal Acquisitions Regulations (FAR) http://www.acquisition.gov/far/

· Clinger Cohen Act http://www.whitehouse.gov/omb/circulars_a130_a130appendix_iv/

· OMB Circular A-130 Management of Information Resources http://www.whitehouse.gov/omb/circulars_a130_a130trans4/

· OMB Circular M-13-02 Improving Acquisitions through Strategic Sourcing https://www.whitehouse.gov/sites/default/files/omb/memoranda/2013/m-13-02_0.pdf

· Executive Order 13589 Promoting Efficient Spending http://www.whitehouse.gov/the-press-office/2011/11/09/executive-order-promoting-efficient-spending

· Executive Order -- Planning for Federal Sustainability in the Next Decade https://www.whitehouse.gov/the-press-office/2015/03/19/executive-order-planning-federal-sustainability-next-decade

· GSA Bulletins B-37 Federal Print Management Practices…