VITA-RFP 2026-03 - 02.1 Exh (Description of Services).xlsx
XLSX spreadsheet 170 KB Posted
- Attached to
- End User Computing (EUC) Services
- Solicitation number
- RFP-123896
- Issued by
- Richmond City, Roanoke City, Virginia
About this file
Summary of VITA-RFP 2026-03: End User Computing Services
This document is Exhibit 2.1 (Description of Services) for RFP 2026-03, issued by the Virginia IT Agency (VITA) on behalf of the Commonwealth of Virginia, soliciting an enterprise-wide End User Computing (EUC) Services supplier. VITA seeks a strategic partner to deliver fully managed, secure, and compliant end-user services to Virginia Executive Branch agencies and other public bodies, including device support, software support, troubleshooting, and lifecycle management for both supplier-owned and Commonwealth-owned/leased devices. The supplier will provide end-to-end service delivery with required financial and asset tracking processes (CMDB, GASB compliance) and will be required to integrate as a full Tier 1 supplier within VITA's multisourcing service integrator (MSI) framework. The supplier may propose value-added or premium services as optional capabilities and will be expected to continually improve service and device offerings throughout the contract term, focusing on service quality, operational efficiency, and customer experience. VITA anticipates a single award to one supplier.
The Description of Services outlines extensive requirements across cross-functional services, enterprise architecture, and security domains. The supplier must comply with VITA Rules, Commonwealth security policies, and multiple federal standards (FedRAMP, CJIS, FISMA, PCI, ISO 27001, HIPAA-HITECH, FERPA, and others). All Commonwealth data must remain within the United States and be protected according to data classification standards with FIPS 140-3 compliant encryption. The supplier must integrate with VITA's Service Management Systems, participate in governance forums, establish Operating Level Agreements with the MSI, maintain baseline security configurations, and support 24x7x365 operations with Priority 1 incident response. The supplier is responsible for background checks on all personnel, participation in security assessments (including SOC 1 and SOC 2 Type II audits twice annually), and compliance with the Virginia Public Records Act and COV ESA Data Availability requirements. All personnel must be U.S. citizens or possess valid H1B visas, and the supplier must ensure no proprietary tools or formats hinder integration into the MSI platform, with VITA and the MSI integrator maintaining full, uninhibited real-time visibility into all EUC-provided tools.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| VITA-RFP 2026-03 - 01.0 Exh (Integrated Services Platform).docx | DOCX document | |
| VITA-RFP 2026-03 - 02.3.1 Exh (Solution - End User Computing (EUC) Services).docx | DOCX document | |
| VITA-RFP 2026-03 - 02.0 Exh (Description of Services and Solution).docx | DOCX document | |
| VITA-RFP 2026-03 - 01.2 Exh (Governance Framework).docx | DOCX document | |
| VITA-RFP 2026-03 - 00 MSA.docx | DOCX document | |
| VITA-RFP 2026-03 - 01.4 Exh (Operating Level Agreement Outline).docx | DOCX document | |
| VITA-RFP 2026-03 - 02.3 Exh (Solution - Aspects).docx | DOCX document | |
| VITA-RFP 2026-03 - 01.1 Exh (Definitions).docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Title Page
RFP 2026-03: End User Computing Services Exhibit 2.1: Description of Services
| Exhibit 2.1 |
| Description of Services |
RFP 2026-03: End User Computing Services
| COMMONWEALTH OF VIRGINIA |
| VIRGINIA IT AGENCY |
| SUPPLY CHAIN MANAGEMENT |
| 7325 BEAUFONT SPRINGS DR. |
| RICHMOND, VA, 23225 |
Format for Response
| RFP 2026-03: End User Computing Services |
| Example - Format of Required Responses |
| Ref # | Requirement | Comply (Y/N) | Supplier Response |
| R1. | x.0 Enterprise Collaboration Services | ||
| R2. | Enterprise Collaboration Services Support the sharing of documents, approval request workflow, and collaboration within and between Agencies. | ||
| R3. | 1) Install and manage the Enterprise Collaboration Services infrastructure service (e.g. front-ed web Servers, Application Servers, search Server, Database platform). | N | Install the Enterprise Collaboration Services infrastructure service (e.g. front-ed web Servers, Application Servers, search Server, Database platform). |
&"Calibri (Body),Regular"&A &"Calibri (Body),Regular"Page &P of &N
Requirements are indicated in this column.
Supplier should enter a “Y” (Yes) or “N” (No) to indicate if it complies with the requirement as written.
Where a cell is shaded under the “Comply (Y/N)” column, no response is required.
If Supplier does not comply with a requirement exactly as written, Supplier must enter an “N” in the “Comply (Y/N)” column and copy the original requirement to the “Supplier Response” column.
Supplier should make proposed changes to text using “revisions” or some other method to clearly indicate changes to original text.
Where Supplier complies with requirements, Supplier should explain its solution completely in the aligned sections in Exhibit 2.3 (Solution) document.
1.0 Introduction
RFP 2026-03: End User Computing Services
1.0 Introduction:
This Description of Services sets forth the Services that Supplier will provide, as of the Commencement Date unless otherwise specified. Further, this Description of Services sets forth the processes and systems that Supplier will provide and describes Supplier’s obligations to work with the other Suppliers to deliver integrated end-to-end Services to Customers.
Supplier confirms that unless otherwise specifically stated, it will provide a solution that supports all of the business processes described in this Description of Services and its Exhibits, and that all Services, unless otherwise specifically stated, are included within the Base Charges described in Exhibit 4 (Pricing and Financial Provisions). The solution shall be fully described and requirements demonstrated in the Suppliers narrative in Exhibit 2.3.1 (Solution - End User Computing (EUC) Services). Accordingly, Supplier also confirms that Customers will not incur any other Charges in relation to the Services described in this Description of Services.
The primary goals and challenges associated with this tower are described in the VITA RFP 2026- 03 Admin (RFP Instructions) document.
2.0 Cross Functional Services
| Ref # | Requirement | Comply (Y/N) | Supplier Response |
| 2.0 Cross -Functional Services | |||
| The Multisourcing Service Integrator (MSI) is the single organization in the Information Technology Infrastructure Services Program (ITISP) that is responsible for administration and coordination across all Service Tower Suppliers. The Supplier will work in integration with the MSI and other Suppliers and adhere to ITISP Governance to support the seamless delivery of Services to VITA and Customers. |
This Tab sets forth the cross-functional Services that the Supplier will provide, as of the Commencement Date unless otherwise specified. Further, this Description of Services sets forth the Supplier's obligations to work with the MSI to deliver integrated end-to-end Services to VITA and Customers.
Narrative explanation shall be provided by the Supplier in Exhibit 2.3.1 (Solution - End User Services)
The Supplier’s responsibilities common to all platforms are described in this Exhibit, which include:
| 1 | Supplier shall follow the processes and procedures covering the coordination, management, and reporting of the Integrated Suppliers across the Managed Environment as set forth in the Service Management Manual (SMM). See Exhibit 1.0 (Integrated Services Platform) and Tab 5.0 (SMM Responsibilities) for additional information regarding the Managed Environment and SMMs. |
| 2 | Establish Operating Level Agreements, and other supporting measures and controls with the MSI, as approved by VITA. |
| 3 | In cooperation with the MSI, the Supplier is required to provide a set of actions in the Continual Service Improvements Register on a quarterly basis to establish and improve Operating Level Agreements (OLAs) and other supporting measures and controls with the MSI and other Service Tower Suppliers, as approved by VITA. |
| 4 | The Supplier shall define and maintain Operational Level Agreements (OLAs) that clearly identify responsibilities, task boundaries, escalation paths, authorization requirements, and ownership distinctions between Smart Hands personnel and requesting suppliers. |
| 5 | Deploy and integrate any tools and systems necessary to enable processes, procedures and controls referenced in section 2.2 (Service Management Systems), below. |
| 6 | Actively participate in information exchange between and among the Supplier, the MSI, other Service Tower Suppliers, VITA, Customers, and Third-Party Vendors to improve execution of the Service Management Manual processes. |
| 7 | Participate in the development and Documentation of processes, sub-processes, and procedures for the Service Management Manual Processes with the MSI and other Service Tower Supplier(s), as approved by VITA. |
| 8 | Create the Documentation, in collaboration with the MSI, of sub-processes, procedures, and work instructions for the Service Management Manual Processes that supports VITA and the Customers’ environments. |
| 9 | Routinely participate in the verification of the effective compliance with these policies, processes, and procedures by the MSI. |
| 10 | Integrate Supplier’s Process with the Service Management Manual Processes of the MSI, other Service Tower Suppliers, Customers, and authorized Third Party Vendors, where the processes interact. |
| 11 | In cooperation with the MSI, Supplier is required to follow relevant SMMs (e.g., SMM 4.1.6 Continual Improvement) which shall include contributing to a quarterly Single process compliance assessment & Continual Service Improvement Register (CSIR) entries with Action Plans and report progress towards closure of the Supplier’s assigned actions. |
| 12 | Participate in the MSI Governance framework, described in Exhibit 1.2 (Governance Framework). |
| 13 | Support the periodic audit by Third-Parties as directed by the MSI, VITA, or Customers. |
| 14 | Supplier shall respond to and participate in VITA Joint Operations Center (JOC) activities 24x7x365, as it relates to issues, Incidents, or interdependencies associated with service delivery from the Supplier. |
| 15 | Supplier shall respond to Priority 1 Incidents 24x7x365. |
| 16 | Provide continuous 24x7x365 operational support through appropriately trained and qualified personnel to support service operations, incident response, escalation management, and operational activities in accordance with applicable service level requirements. |
| 17 | Support the MSI and respond as required to deprovisioning requests (including handling investigations and terminations on an emergency basis) in accordance with the SMM and VITA Rules. |
| 18 | Provide additional temporary resources as needed or at VITA’s or the MSI’s direction in the event of a Major Incident, Problem, or Event to restore Services to the normal state. |
| 2.1 General | |
| Supplier’s responsibilities include: | |
| 1 | As per the relevant SMM(s) (e.g SMM 4.1.2.4 Service Portfolio Management), among others, supplier will onboard their services with VITA, then manage their lifecycle. Service Portfolio Management (SVPM) is to allow the Virginia IT Agency (VITA) to offer the right mix of services to balance the Commonwealth’s investment in IT with the ability to meet or exceed the desires of Commonwealth Agencies and citizens. |
| 2 | Perform Project Management as directed by the MSI in accordance with the relevant SMM(s) (e.g. SMM 4.1.1.2 Project Portfolio Management). |
| 3 | Provide and describe the capability for disentanglement and retention of any Intellectual Property owned by the Commonwealth (i.e., any Cloud capability established on behalf of the Commonwealth becomes property of the Commonwealth at the end of the contract). |
| 4 | Ensure that the environment is in compliance with VITA Rules: |
https://www.vita.virginia.gov/policy--governance/governance/vita-rules/
| 5 | Work with the MSI to schedule, define, and document maintenance windows. |
| 6 | Manage Supplier relationships and integrate with to MSI, VITA, VITA Customers, other Service Tower Suppliers (STS), and Third-Party Vendors. There is a list of 20 integration points in the Transition Planning effort prior to Commencement |
| 2.2 Service Management Systems | |
| Supplier is required to use or integrate, through e-bonding or another preapproved integration method, with systems provided by VITA and/or the MSI (i.e., Incident Management System, Change Management System, Configuration Management System and Configuration Management Database (CMDB), etc.). These systems and any systems Supplier provides that integrate with VITA and/or the MSI systems are collectively referred to herein as Service Management Systems (SMS). Exhibit 2.4.2 (Integration Points) defines the specific MSI toolset. |
The list below describes the purpose, as defined by VITA, to guide the MSI in providing the SMS, of which the Service Tower Suppliers (STS) will be Users and providers of management information. Not all tools below will be applicable to the End User Services (EUS) Service Tower nor require integration and are provided for environmental awareness to the benefit of understanding interactions. Service Management Systems employed in VITA's managed environment are as follows:
| 1 | IT Information Portal: Provides an integrated Portal which provides access and customizable views for the data processed in the Service Management Systems. Displays service measurements, including overall program measures and other reports which include, but are not limited to those in Exhibit 3.0 (Reporting and Service Level Management). Provides a dashboard that is customizable by each User. |
| 2 | Data Warehouse System: Provides a mechanism to collect data from all Service Management Systems and provide access to the Customers for report generation, with ability to save queries by Customer and individual. |
| 3 | Billing, Chargeback, and Utilization Tracking System: Provides a mechanism for billing VITA for Services across all Service Tower Suppliers and enable VITA to establish overhead charges and provide billing to Customers. |
| 4 | Service Portfolio Database: Provides database of all Services including those under development, in operations, or in process of retirement. |
| 5 | Service Catalog and Request Management System(s): Provides a mechanism for Customers to view, order, and track Standard Service and Solution Requests/Proposals. |
| 6 | Asset Management System: Provides a mechanism for Customers to track all assets. |
| 7 | Service Level Management and Reporting System: Provides a system that tracks current and historic Service Levels and the current and historic performance of the Supplier and Service Tower Suppliers. Provides a method for Customers to view and generate reports for current and previous Service Level metrics. |
All Service Level Agreements will report out of the system of record.
| 8 | Security Clearance System: Provides a mechanism to manage, validate, and allow Customers and Users to view the security clearance check status for all individuals providing Services under the MSI and STS. |
| 9 | Document Data Store: Provides a mechanism for the common storage of artifacts and data related to projects and program management. |
| 10 | Change Management System: Provides a mechanism to track and facilitate the Change Management process. |
| 11 | Project Portfolio Management and Project Management Reporting System: Provides the mechanism to track and report the portfolio of projects and programs associated with the ITISP. The system enables reporting of status, schedules, task assignments, issues, and risks. |
| 12 | Incident Management System : Provide a mechanism for the tracking and managing Incidents. |
| 13 | Knowledge Database: Provides a mechanism for User self-help. |
| 14 | Event Management and Correlation System: Provides a mechanism for designated Users to establish alerts and notifications for status changes within any Service Management Systems. |
| 15 | Problem Management System and Known Error Database: Provides a mechanism to collect previous errors and resolutions which are accessible by MSI, STS, VITA, Third Party Suppliers, and designated Users. |
| 16 | Software License Management System: Provides a mechanism to track Enterprise (VITA owned) software license and subscriptions used across all managed Equipment assets. |
| 17 | Risk Management System: Provides a mechanism to identify, track, analyze, report, and demonstrate remediation of identified risks as part of Risk Management. |
| 18 | Information Security Management System (ISMS): Provides an Information Security Management System (ISMS) to maintain the policies, processes, standards, guidelines, and tools to support Customers in achieving their Information Security Management objectives. |
| 19 | Service Desk Telephony: Provides a contact center system to handle MSI Service Desk contacts via telephone. |
| 20 | IT Infrastructure Monitoring System: Provides a system that will monitor all assets, providing real-time status (e.g., software versions, patch levels, uptime, hardware performance). |
| 21 | Identity and Access Management System: Provides a system that will allow for identity and access management. |
| 22 | Service Continuity Management System: Provides a system that will allow MSI to coordinate all Service Tower Service Continuity Management (including planning and testing). |
| 23 | Remote administration system: Provides tools and staff to remote into a User’s PC to improve first call resolution and reduce mean time to resolution. |
| 24 | Capacity Management System: Provides a system that will support capacity management process scope. |
| 2.3 Service Management System Processes | |
| For all Service Management Systems, in collaboration with and coordinated through the MSI, Supplier responsibilities include: | |
| 1 | Compliance with VITA Rules (e.g., Security Standards, Federal and Commonwealth mandates, records retention policies). |
https://www.vita.virginia.gov/policy--governance/governance/vita-rules/
| 2 | Utilize the Service Management System provided by the MSI to meet the objectives for the Service Management Manual Processes. |
| 3 | Participate in the integration of the MSI’s Service Management Systems with the other systems used by Supplier to meet the objectives of the Service Management Manual Processes. |
| 4 | Provide service related data to the MSI for collection or archive in a format that can be integrated in the Data Warehouse System. |
| 5 | Limit access to the Supplier’s systems to the agreed levels (e.g., by business unit) for the type of Users who require access to the system. |
| 6 | Ensure all designated Supplier Personnel and authorized Third-Party Vendors are trained by the MSI in the use of the MSI’s Service Management Systems. |
| 7 | Support efforts to verify the Service Management System contents and correctness of the information contained therein by MSI, Customers, and other designated Third-Parties (e.g., auditing organizations). |
| 8 | The Supplier is required to contribute to the MSI’s production of a set of actions in the Continual Service Improvements Register for modifications to the systems during and after the Transition plan in accordance with RCD 2.1. |
| 9 | Secure systems that integrate to the MSI’s Service Management Systems and any supporting system(s) and database(s) such that commonwealth data is clearly separated from the data of all other customers of Supplier and the customers of Supplier’s Subcontractors or other vendors. |
| 10 | Where Supplier chooses to host those systems outside of a VITA authorized and approved environment (e.g. Data Center, Customer Data Center, Cloud), Supplier will provision and maintain all necessary Connectivity into the VITA authorized and approved environment and manage that Connectivity to meet the MSI designated performance standards. |
3.0 Enterprise Architecture
| Ref # | Requirement | Comply (Y/N) | Supplier Response |
| 3.0 Enterprise Architecture | |||
| The Supplier’s responsibilities for all Enterprise Architecture requirements shall include adherence to the following Standards. Compliance with any and all Enterprise Architecture requirements, found in this tab, by the Supplier shall be visible, measurable, demonstrable, and auditable to VITA when requested by VITA and to the satisfaction of VITA: | |||
| 1 | Provide Enterprise Architecture solutions that align with all COV EA Standards. | ||
| https://www.vita.virginia.gov/policy--governance/enterprise-architecture/ | |||
| 3.1 General Architecture Requirements | |||
| The supplier's responsibilities include: | |||
| 1 | Supplier shall document the services they provide in a manner compliant with VITA policies and processes. | ||
| 2 | Collaborate with VITA to create and maintain COV Technology Roadmaps in support of the service tower as requested by VITA. | ||
| 3 | Only use Approved versions of the technologies covered within the COV Technology Roadmaps. | ||
| https://www.vita.virginia.gov/policy--governance/enterprise-architecture/#roadmaps | |||
| 4 | For IT solutions and technologies that are not covered within COV Technology Roadmaps suppliers shall only use versions or models of IT solutions and technologies that are current (N and N-1) and have vendor or equivalent support. |
Note 1: support is defined as a minimum of having available and deployable security patching for IT software
Note 2: it is not allowed to utilize an IT solution or technology that requires an unsupported or N-2 or older technology to work.
Example: an IT management utility that only works with a EOL database or N-2 operating system
Note 3: many N and N-1 versions are defined in the COV Technology Roadmaps (See EA Technology Roadmaps Section)
5 IT solutions and services as well as everything supporting supplier provided or managed technologies, IT solutions, and services shall comply with VITA Rules for all supplier provided and managed technologies.
Note: This includes processes, IT solutions, technologies, devices, personnel, etc.
| 6 | A documented lifecycle including information on currency, general availability, and support (end of service life and end of support) for all supplier provided or managed IT solutions and technologies. (See EA Technology Roadmaps Section) |
| https://www.vita.virginia.gov/policy--governance/enterprise-architecture/ | |
| 7 | Document all versions of software that their services consume or provide in VITA-supplied architecture platform. This includes all software that the service providers use to host, develop, support, test, and deploy their IT solutions (operating systems, languages, databases, editors, etc.) |
Note: This requirement does not apply to SaaS (addressed by COV Ramp)
| 8 | The Supplier shall track the lifecycle of all Software and Hardware used to deliver Services in the Service Management System (SMS) provided by the MSI per relevant SMMs ( SMM 4.1.2.2 IT Technology Planning, SMM 4.1.4.4 Service Asset and Configuration Management, and SMM 4.1.4.1 Change Management). |
| 9 | The Supplier shall generate technology roadmaps to include Refresh schedule, Software Upgrades, and new technology to ensure Supplier service offerings stay current per relevant SMMs (e.g., SMM 4.1.2.2 IT Technology Planning). |
| 10 | Perform Equipment Maintenance, Refreshes, Installations, and Retirement in accordance with the Refresh and Currency Plans and schedules established by MSI, VITA, and ITISP Governance as per relevant SMMs (e.g., SMM 4.1.1.4 Ongoing Programs). |
| 11 | Meet the following five essential NIST cloud characteristics: On-demand self-service, Broad network access, Resource pooling, Rapid elasticity, and Measured service. |
| https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-145.pdf | |
| 12 | Online Review and Comment Application (ORCA) is a web-based application that allows public comment and review of proposed policies, standards, and guidelines. The Supplier shall be responsible for registering for an account after contract award and reviewing any changes posted to ORCA. The link can be found here: |
| https://orca.vita.virginia.gov/ | |
| 13 | Any changes posted in ORCA related to any Enterprise Architecture standards, or other VITA standards (e.g. VITA Rules), shall be the responsibility of the Supplier to notify the appropriate Commercial Contract Manager of the impacts to the solution delivery for review and consideration in accordance with the published review timelines in ORCA. |
| 3.1.1 Design/Architecture Requirements | |
| The supplier's responsibilities include: | |
| 1 | Coordinate all architecture, design, strategy, and planning activities with MSI, VITA, and VITA Customers (including business units and Project managers) per the relevant SMMs (e.g., SMM 4.1.2 Service Strategy, SMM 4.1.3 Service Design). |
| 2 | Ensure that all new, changes, or updates to IT solutions go through a formal architecture review process coordinated by the MSI per relevant SMMs (e.g., SMM 4.1.3 Service Design, SMM 4.1.3.1 Solution Design Management). |
| 3 | Ensure all new IT solutions and technologies utilized by supplier or provided to COV customers shall appear on the supplier’s high-level service model diagram as approved by VITA. This diagram shall include all technology and service components. |
Note: This applies to technology components not specific devices (Servers vs. a particular Dell model)
| 4 | Ensure all new and changes to supplier provided or managed IT solutions and technologies shall go through a formal VITA approved architecture review process and document within a VITA approved architecture format. | |
| 5 | Provide architecture that supports service continuity where required by VITA per relevant SMMs (e.g. SMM 4.1.3.5 IT Service Continuity Management.) | |
| 6 | Provide an engineered solution to allow for choices in hosted geographic data locations that align with VITA Rules, to optimize throughput and remove risk of latency due to Network constraints. | |
| 7 | Isolate VITA & customer environments as required to meet VITA Rules. | |
| 8 | Provide a configuration which optimizes the solution to meet a high availability outcome of the environment as dictated by required business outcomes. | |
| 9 | Maintain and update the environment and supporting documentation for their solution's full footprint which shall always reflect the current state. Supplier will continuously leverage new tools and technologies to improve VITA and VITA Customer business processes and performance in accordance with ITISP Governance processes and procedures as defined in relevant SMMs with prior approval obtained by VITA. | |
| 3.1.2 Availability / Performance Requirements | ||
| The supplier's responsibilities include: | ||
| 1 | Ensure Network Performance Simulation Modeling and Application Emulation (NPMAE) is performed, and reported to VITA through the MSI for all proposed Supplier IT solutions that can Impact the Wide Area Network (WAN), | |
| 2 | Have defined expected and quarterly measured Mean Time Between Failure (MTBF) metrics for supplier provided and managed IT solutions and technologies | |
| 3 | The Solution's IT Components Supporting COV IT services shall have better Availability than the SLAs for the services that consume those components. | |
| 4 | Provide monitoring consistent with Service Level requirements and reporting of System performance, utilization, and efficiency per relevent SMMs (e.g., SMM 4.1.3.4 Availability Management). | |
| 5 | Establish System tuning and performance processes where necessary and Upgrade and tune Services Infrastructure to meet capacity changes per relevant SMMs (e.g., SMM 4.1.3.4 Availability Management, SMM 4.1.3.6 Capacity Management). | |
| 6 | Establish and maintain event management mechanisms which apply to the services, per relevant SMMs (e.g., SMM 4.1.5.3.Event Management). | |
| 7 | Establish and maintain monitoring Systems for their solutions, which apply to platforms and services. | |
| 8 | Monitor all phases of their solution's Systems performance. | |
| 9 | For all COV IT services, the Supplier shall have SLA's or key measures for availability and performance. | |
| 10 | Provide appropriate real-time and analysis of historical performance data obtained through monitoring of all phases of their solution's Systems performance. | |
| 11 | Conduct System performance testing of their entire solution to include in on-demand reporting. | |
| 12 | Provide Systems performance review report(s), including recommendations and advice, after conducting required System performance testing of their solutions. | |
| 3.1.3 Capacity and Performance Requirements | ||
| The supplier's responsibilities include: | ||
| 1 | Perform strategic, tactical, and operational procedures per relevant SMMs (e.g., SMM 4.1.3.6 Capacity Management). | |
| 2 | Perform Infrastructure or Platform Upgrades of their solutions to provide effective capacity to meet VITA and VITA customer needs. Coordinate their Projects with VITA, VITA business partners, VITA Customers, Third Party vendors, and other vendors as appropriate to manage Infrastructure capacity. | |
| 3 | Perform activities required for optimizing performance of their solutions to reduce costs per relevant SMMs (e.g., SMM 4.1.6.3 Service Measurement). | |
| 4 | Perform activities required for optimizing performance of their solutions to improve Service Levels per relevant SMMs (e.g., SMM 4.1.6.3 Service Measurement). | |
| 5 | Identify estimated bandwidth usage per Application. In addition to requirements stipulated in SMM's, the following shall be maintained in the VITA approved repository for each Solution Application. | |
| 5.1 | Number of average concurrent Users on the Application (concurrent is defined as Users transmitting or receiving application data at the same time). | |
| 5.2 | Provide the bandwidth required for each concurrent User. | |
| 5.3 | Provide the total Users for each Application. | |
| 5.4 | Provide the number of concurrent Users during highest Application usage. (i.e. visitors during tax season, hurricanes, document submissions, etc.). | |
| 5.5 | Provide Application throughput estimates. (i.e. how much network traffic can be processed at once). | |
| 3.1.4 Continuity Requirements | ||
| The supplier's responsibilities include: | ||
| 1 | Support service continuity per relevant SMMs (e.g., SMM 4.1.3.5 IT Service Continuity Management). | |
| 2 | Recommend service recovery point objectives (RPO) and recovery time objectives (RTO) for their services, on demand, for VITA to review and approve. | |
| 3 | Design, configure and deploy, either supplier provided or managed IT solutions and technologies, which meet VITA defined service recovery point objectives (RPO) and recovery time objectives (RTO) and any additional refinements identified by agencies and/or customers. | |
| 4 | Test and determine that all their services are free of defects and compliant with VITA Rules. | |
| 5 | Ensure that any vendors and VITA Customer approved maintenance providers used by the supplier, properly maintain all Hardware and Software. | |
| 6 | The Solution shall have a Technical Recovery Guide and/or runbook for all of its Application Components and Configurations. | |
| 7 | The Solution shall comply with the Virginia Public Records Act, Code of Virginia §42.1-76-42.1-91, which requires uniform management and preservation of public records in Commonwealth government agencies. | |
| 8 | The Solution shall consider and address the Impact on Commonwealth Data of both System outages and data corruption in meeting established RPOs. | |
| 9 | The Solution shall comply with COV ESA Data Availability requirements for all Commonwealth Data. | |
| https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Data-Availability.pdf | ||
| 10 | Ensure that the additional sites used for data replication and backup provide geo-diversity, including: | |
| 10.1 | Data locations shall be geographically diverse, located within the continental US, account for potential man-made and natural risks, and be acceptable to COV. | |
| 11 | Supplier will describe the techniques and solutions utilized to address data corruption. | |
| 12 | The Solution shall provide Customers the ability to perform backups and restores of their Commonwealth Data. | |
| 13 | The Solution shall test for data corruption and notify the Customer when corruption occurs in accordance with the EA Data Availability standard. | |
| https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Data-Availability.pdf | ||
| 3.1.5 Technology Requirements | ||
| The supplier's responsibilities include: | ||
| 1 | Use components in solutions whose currency lifecycle phase includes update-level support. Do not use components that do not meet VITA Rules for currency. | |
| 2 | Provide Support for heterogeneous platforms in various geographic locations within the United States. | |
| 3 | Provide Support for heterogeneous platforms that interface with Cloud or premise-based Systems. The Commonwealth currently operates in both commercial and government cloud environments, as well as traditional data centers. Supplier must provide support to all types of environments. | |
| 3.1.6 Integration/Interoperability Requirements | ||
| The supplier's responsibilities include: | https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Enterprise-Information-Architecture-EIA.pdf | |
| 1 | Ensure the Solution integrates into all System and Application logging with VITA and/or other Service Tower Suppliers. | |
| 2 | Ensure the Solution complies with COV Event Log Management requirements. | |
| https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Event-Log-Management.pdf | ||
| 3 | Ensure the Solution integrates monitoring consoles with MSI to allow MSI, VITA and Customers the ability to establish notifications. | |
| 4 | Ensure the Solution integrates monitoring consoles with MSI to allow MSI and VITA Customers the ability to set notification thresholds. | |
| 5 | Ensure the Solution is tested and documented for integration in accordance with VITA requirements and the documentation shall be provided to VITA. | |
| 6 | Ensure the Solution is tested and documented for interoperability in accordance with VITA requirements and the documentation shall be provided to VITA. | |
| 7 | Ensure the Solution enables all Services to interact regardless of where and how they are hosted. | |
| 8 | Ensure the Solution Components integrate across all supported form factors, such that they seamlessly interact with each other while leveraging their native capabilities in a way where they do not require additional Configuration or administration. | |
| 9 | Ensure the Solution supports the creation and update of all data types covered by VITA Rules. |
| https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Enterprise-Information-Architecture-EIA.pdf | |
| 3.1.7 Accessibility Standards | |
| The Commonwealth follows the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA or better, for Accessibility standards. Supplier's responsibilities include: | |
| 1 | Following the accessibility requirements in the Web Systems Standard: |
| https://www.w3.org/TR/WCAG21/#sotd | |
| 2 | Ensure web content is designed to be interpreted reliably by a wide range of user agents, including assistive technologies, and allowing users to access content through different browsers and devices without losing functionality. |
| 3 | Demonstrate conformity or intent to confirm with the Code of Virginia § 2.2-3502, with the term “accessibility” defined in Virginia Code § 2.2-3501 in the following ways: |
| 3.1 | Certify by providing a current Supplier-paid and completed Accessibility Conformance Report indicating the level of the proposed solution’s conformance with the accessibility requirements. |
| 3.2 | Document any areas of nonconformance with a Supplier-paid and completed Vendor Accessibility Roadmap highlighting areas requiring improved accessibility, including a timeline for each nonconforming area’s completion. |
| 3.1.8 Artificial Intelligence (AI) Requirements | |
| The Supplier’s responsibilities include the following: | |
| 1 | Any proposed Solution that utilizes AI or contains an AI component by the Supplier shall be documented in Exhibit 4.7, Tab Sftw Assets (TOWER). |
| 2 | Any proposed Solution(s) that utilizes AI or contains an AI component by Adhere to the following AI Standard and Policy: |
| 2.1 | https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/EA-Solutions-Artificial-Intelligence-Standard.pdf |
| 2.2 | https://www.vita.virginia.gov/policy--governance/governance/artificial-intelligence/ |
| 3 | Any future Solution(s) that utilizes AI or contains an AI component by the Supplier proposed or offered in support of this agreement shall adhere to VITA's AI Standard and Policy as referenced above. |
| 4 | Describe the Solution(s) that utilizes AI or contains an AI component proposed to be used for the delivery of services in response to this RFP. The description shall include, at a minimum, the following: |
| 4.1 | Name of the AI technology being used. |
| 4.2 | Functionality that the AI technology provides in their solution/toolset. |
| 4.3 | Integrations/connections that are part of what the AI component/tool does. |
| 4.4 | Any other relevent information the Supplier believes will help VITA evaluate the proposed AI technology. |
| 5 | Describe how the Solution(s) that utilizes AI or contains an AI component proposed supports VITA's AI Techonolgy Roadmap as found at the following (See EA Technology Roadmaps Section): |
| https://www.vita.virginia.gov/policy--governance/enterprise-architecture/ | |
| 5.1 | Any other relevent information the Supplier believes will help VITA evaluate the proposed AI technology. |
| 5.2 | Describe how the Solution(s) that utilizes AI or contains an AI component proposed supports VITA's AI Techonolgy Roadmap as found at the following: |
| https://www.vita.virginia.gov/policy--governance/enterprise-architecture/ |
https://www.vita.virginia.gov/policy--governance/enterprise-architecture/https://www.vita.virginia.gov/policy--governance/enterprise-architecture/https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Data-Availability.pdfhttps://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Data-Availability.pdfhttps://orca.vita.virginia.gov/https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Enterprise-Information-Architecture-EIA.pdfhttps://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Enterprise-Information-Architecture-EIA.pdfhttps://www.vita.virginia.gov/policy--governance/enterprise-architecture/https://www.w3.org/TR/WCAG21/https://www.vita.virginia.gov/policy--governance/enterprise-architecture/https://www.vita.virginia.gov/policy--governance/enterprise-architecture/https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-145.pdfhttps://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Event-Log-Management.pdfhttps://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/EA-Solutions-Artificial-Intelligence-Standard.pdfhttps://www.vita.virginia.gov/policy--governance/governance/artificial-intelligence/
4.0 Security Requirements
| Ref # | Requirement | Comply (Y/N) | Supplier Response |
| 4.0 Security Requirements | |||
| The Supplier’s responsibilities for all Security Requirements shall include adherence to the following Standards and Controls. Compliance with any and all Security Requirements, found in this tab, by the Supplier shall be visible, measurable, demonstrable, and auditable: | |||
| 1 | Services and Solution shall comply with Commonwealth security policies and standards, VITA Rules, and relevant SMMs, and all Customers’ individual Information Security Policies and applicable Federal standards (e.g., FedRAMP moderate or high, SEC530, CJIS, FISMA, PCI, ISO27001, FERPA, FTI (IRS PUB-1075), SSA, HIPAA-HITECH, Rehabilitation Act of 1973 (Section 508 and others), NIST, and any updates to these listed standards.). | ||
| https://www.vita.virginia.gov/policy--governance/governance/vita-rules/ | |||
| 2 | In the space below, supplier shall list any additional security standards with which it can comply. Suppliers may add rows below should additional space be needed. | ||
| 2.1 | <To be filled in by supplier> | ||
| 2.2 | <To be filled in by supplier> | ||
| 2.3 | <To be filled in by supplier> | ||
| 4.1 General Security Requirements | |||
| The Supplier's responsibilities include: | |||
| 1 | Upon request, grant access to specified systems, services, and/or other technologies containing, accessing, manipulating, or otherwise interacting with Commonwealth Data to the Chief Information Officer and/or the Chief Information Security Officer for the Commonwealth of Virginia, and/or an identified COV designee with approved access credentials. | ||
| 2 | Provide informed advice on Security policy, standards (including national security, international, customer and industry standards, practices, solutions and technologies, and threats) in the form and manner requested by VITA. | ||
| 3 | Implement Security management processes, procedures and controls with VITA and other service tower suppliers to address interdependencies, use of tools and workflows required to operate integrated Security Management across the Services. | ||
| 4 | Online Review and Comment Application (ORCA) is a web-based application that allows public comment and review of proposed policies, standards, and guidelines. The Supplier shall be responsible for registering for an account after contract award and reviewing any changes posted to ORCA. The link can be found here: | ||
| https://orca.vita.virginia.gov/ | |||
| 5 | Any changes posted in ORCA related to any Security standards, or other VITA standards (e.g. VITA Rules), shall be the responsibility of the Supplier to notify the appropriate Commercial Contract Manager of the impacts to the solution delivery for review and consideration in accordance with the published review timelines in ORCA. | ||
| 6 | Codify and implement security policies to enforce compliance, and operational best practices across all service provisioning. A “shift left” approach must be used to automate enforcement, ensuring that changes are in compliance without creating a manual review bottleneck. | ||
| 7 | Enforce policies on the types of infrastructure created, how it is used, and what can be created and by who. Appropriate and approved policy-as-code framework must be adopted to provide compliance and governance without requiring a shift in the overall team workflow. | ||
| 8 | Solution shall support multiple levels of administration (e.g. multi-tenancy) to allow Configuration changes at the Enterprise and Agency level. | ||
| 4.2 List of Software and Tools | |||
| The Supplier's responsibilities include: | |||
| 1 | Provide a narrative description of all Software and Tools the Supplier is planning to use as a part of the Solution, including those utilizing the Cloud in Exhibit 2.3.1 (Solution - End User Computing (EUC) Services). | ||
| 2 | Any Software or Tools which utilize the Cloud shall be identified as such in Exhibit 4.7 Software Assets (Supplier). | ||
| 3 | Any and all Software and Tools utilizing the Cloud shall be subject to COV Ramp review and approval. Review the COV Ramp summary: | ||
| https://www.vita.virginia.gov/cov-ramp/ | |||
| 4.3 Security Integration | |||
| Any and all Software and Tools identified by the Supplier in Exhibit 4.7 Software Assets (Supplier) shall integrate with the various security systems, programs, tools, software, or solutions as required by VITA. The Supplier's responsibilities include: | |||
| 1 | Integrate with current security systems, programs, tools, software, or solutions for reporting, tracking, detection, prevention and/or other function as approved by VITA and provided by the MSI. A list of these toolsets can be found in Exhibit 2.4.2 (Integration Points). | ||
| 2 | If the Supplier is unable to integrate with any of the enterprise software listed in Exhibit 2.4.2 (Integration Points) as stated in requirement 1 above, the Supplier shall be responsible for performing those activities and/or functions. The Supplier shall ensure this is identified in their response to Section 4.2 of this Tab. | ||
| 3 | Perform or integrate with new systems, programs, tools, software, or solutions, as directed by VITA. | ||
| 4 | Assist in the naming, installing, operating, configuring, supporting, and managing of the VITA Managed Environment toolsets in accordance VITA Rules and the SMMs. | ||
| 5 | Supplier shall provide documentation for all Supplier API integrations with all VITA Managed Environment toolsets. | ||
| 6 | Ensure all Events are logged in accordance with the Enterprise Logging Standard. These Events shall be provided to the VITA Managed Security Service Provider for analysis, in a VITA approved format, utilizing a VITA approved automated method. Ensure VITA Agencies logged events are provide for Agencies view and use. | ||
| 6.1 | Ensure that Solution will log all access attempts (successful / unsuccessful) by an administrative User or by personnel supporting the solution from any service provider associated with the Solution. | ||
| 6.2 | Ensure that Solution will log all actions taken by an administrative User or by personnel supporting the solution from any service provider associated with the Solution. | ||
| 6.3 | Ensure that no personnel supporting or administrating the Solution can alter or delete any log associated with the support or operation of the Solution. | ||
| 6.4 | Ensure that no personnel supporting or administrating the Solution can alter or stop any logging service associated with the support or operation of the Solution. | ||
| 7 | Proactively monitor for vulnerabilities, patches, and pattern updates for their managed systems and services. Provide VITA notification and plan to remediate published Common Vulnerabilities and Exposures (CVE) or vulnerabilities in accordance with VITA Rules. | ||
| 8 | Support and/or Install available updates, in accordance with the Change Management Process (e.g. SMM 4.1.4.1 Change Management), to Managed Environment software and services as needed, requested, or as directed by VITA. These updates shall be performed within the timeframes specified by relevant Third Parties, vendors, or industry experts – except as otherwise approved by VITA. | ||
| 4.4 Security Management | |||
| Security Management will assess that all security risks associated with the delivery of Services are appropriately identified, evaluated, assessed, remediated, and appropriate controls are implemented and maintained. Security Management will be performed in a manner consistent with VITA Rules (e.g. SMM 4.1.3.7 Security Management). Refer to Environment Overview Appendix C: Security environment overview for an overview of the existing environment. |
The Supplier's responsibilities include:
| 1 | Utilize the Information Security Management System (ISMS) as provided by the MSI, to maintain the policies, processes, standards, guidelines and tools to support VITA and Customers in achieving Information Security Management objectives. Additional Supplier's responsibilities shall include but not be limited to: |
| 1.1 | Update the ISMS in a timely manner based on Changes to the technical environment and in accordance with VITA Rules and/or SMMs. |
| 1.2 | Validate the ISMS contents to ensure the accuracy and completeness of the data contained therein on a routine basis, in accordance with the SMM. |
| 2 | Understand VITA Rules (e.g. SMM 4.1.3.7 Security Management) in detail, to enable informed interactions with the MSI, Customers and End Users, VITA and other Service Tower Suppliers. |
| 3 | Assist Customers in the definition of security requirements based upon business needs and Customer’s individual information security policies and regulatory requirements (e.g. VITA Rules), as those needs and policies relate to the Services, and as requested by the MSI. |
| 4 | Implement and comply with all VITA Rules and Customers’ individual information security policies, and all security requirements defined for the Managed Environment. |
| 5 | Implement safeguards that are compliant with Customers’ Information Security Policies and Standards in accordance with VITA Rules. |
| 6 | Provide informed advice on security policy, standards (including national security, international, customer and industry standards), practices, solutions and technologies, and threats related to the Services. |
| 7 | Implement Operating Level Agreements, as defined in Exhibit 1.4 (Operating Level Agreements), and Security Management processes, procedures and controls across Supplier Services, and the other Service Tower Suppliers to address interdependencies, use of tools and workflows required to operate integrated Security Management across the Services. |
| 8 | Participate in the integrated compliance and Security Management Service performance Plans of Action and Milestones (POAM), and reports for all Service security requirements to meet Customers’ informational reporting requirements and Service Levels in a regular and timely manner. |
| 9 | Track, expedite, and report upon actions raised against any and all documented findings of security non-compliance, including but not limited to managed environment plans, reports and self-assurance statements. |
| 10 | Escalate security management improvement opportunities, issues, risks, events or any other pertinent security matter identified per the relevant SMMs (e.g., 4.1.6 Continual Improvement). |
| 11 | Respond to Security Incidents (which may arise as a result of changing security standards, threats or industry practices) under direction from the MSI, per relevant SMMs (e.g. 4.1.3.7 Security Management). |
| 12 | Respond to emerging security requirements (which may arise as a result of changing security standards, threats or industry practices) under direction from the MSI, per relevant SMMs. |
| 13 | Ensure that access privileges for Supplier Personnel are promptly removed upon departure from the ITISP in accordance with VITA Rules. |
| 14 | Establish and maintain mechanisms to safeguard against the unauthorized access, destruction, loss or alteration of Customers’ data. |
| 15 | Utilize controls and processes such that the integrated Services are compliant with all relevant regulations, policies and standards for the processing, storage and transmission of information based on its classification and impact categorization, and ensure that Customers are able to gain assurance and evidence that such compliance is being maintained upon request (e.g. audit results). |
| 16 | Provide reporting to the MSI that highlights emerging threats and the status of known risks. Provide proactive alerts to VITA, the MSI, or Customers as appropriate relative to current code threats either specific to VITA’s environment, encountered in Supplier’s environment, or based on industry information. |
| 17 | Deploy security processes to enable effective monitoring and reporting of Services and provide data to the MSI from monitoring controls and processes related to emerging threats and known risks. |
| 18 | On an on-going basis, check the effectiveness of the security procedures and controls, and compliance with regulations. |
| 19 | Initiate corrective actions with respect to any potential or actual security issues or noncompliance with the procedures. |
| 20 | Produce a security status report to detail on-going work and actions identified and completed upon request by VITA. |
| 21 | Monitor and control remote data communication access to Customers’ Infrastructure, Software, Equipment, and all other data. |
| 22 | Routinely perform feasibility studies and evaluations for the implementation of new security technologies, based on threat trends, which meet Commonwealth requirements and objectives and report these to MSI and VITA. |
| 23 | Develop and maintain a System Security Plan (SSP) and actively participate in the SSP approval process. The current templates shall be available upon award and access to the ISMS. Publicly available example templates can be found using the following link (When on the page, the navigation is as follows: Information Security > Tools and Templates > SEC530 SSP Template - _____): |
| https://www.vita.virginia.gov/policy--governance/governance/policies-standards--guidelines/ | |
| 4.5 Security Program | |
| Security Program requirements define a Supplier’s responsibility to follow VITA’s security policies (e.g. VITA Rules), actively participate in the ongoing Security Program, maintain internal security controls and training, ensure proper account management, and provide transparency of security-related processes and documentation to VITA, the MSI, and Customers. |
The Supplier's responsibilities include:
1 Participate in the continuous Security Program, which will comprise the on-going activities that accomplish the goals for security management and coordinate the activities of Customers, Supplier, the MSI, and designated Third-Party Vendors.
Note: The VITA Security Plan and Policy will govern the periodic activities for Security Management conducted by the MSI and Service Tower Suppliers including periodic patching, plans for implementing security measures, security performance monitoring and periodic security assessments and testing.
| 2 | Adhere to the comprehensive VITA Security Plan and Policy that defines the security requirements of the ITISP environment and supports the security of Customers’ systems, Software and information. |
| 3 | Develop, implement and maintain internal standards, policies, processes and procedures that enable compliance with VITA Rules and Customer requirements. Provide the MSI, VITA and Customers access to all standards, policies, processes and procedure Documentation. |
| 4 | Implement and maintain internal security awareness training processes and procedures and provide communications that ensure Supplier Personnel are aware of the security and operational requirements of the program. |
| 5 | Disable or delete accounts in accordance with VITA Rules for standard expiration (e.g., 90 days without use) or promptly as requested. |
| 6 | Ensure there are no shared accounts and that each account (human or service) is owned/has a responsible party assigned. |
| 7 | Continuously monitor the Managed Environment to detect and prevent intrusions. |
| 8 | Communicate and report any intrusion detected in the Managed Environment. |
| 4.6 Security Assessments | |
| Supplier’s responsibilities include: |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .