Intend to award HUBZone Sole Source to Summit Technologies, Inc. - Modernization and FISMA Compliance Support

The National Endowment for the Arts (NEA) intends to issue a sole source, firm-fixed price award to Summit Technologies Inc. under the Small Business Administration (SBA) Historically Underutilized Business Zone (HUBZone) program per FAR 19.1306.

In FY 2017 the National Endowment for the Arts (NEA), Office of the Inspector General (OIG) conducted a FISMA audit to evaluate the NEA cybersecurity program. The purpose of this contract is to obtain services to provide recommendations and assistance in remediating the audit findings and help prepare the Agency for the FY 2018 FISMA audit.

The focus of the scope of work requires a specific skill set in the fields of IT cybersecurity operations and IT infrastruction modernization. A necessity to have NEA expert domain knowledge and past performance to facilitate overall cost reduction, risk, meet overall organizational deliverables based upon compressed timeframes. Additionally, institutional knowledge is key to reducing overall cost, risk and meeting overall organizational deliverables based upon timelines needed.

A one (1)12 month base period and one (1) 12 month option period from 7/31/18-7/30/20 is anticipated for this award.

The scope of this effort is to include infrastructure modernization, cyber security, FISMA and Privacy compliance, the contractor shall perform the following tasks: 

A. FISMA Audit Preparation Activities

This task includes:

a)      Assist NEA in gathering documentation needed for the FISMA Audit

b)      Work with NEA staff to complete missing documentation required for the FISMA audit

c)      Perform required FISMA and operational activities and produce the required reports

                   i.      Security scans

                  ii.      Network scans

                 iii.      Review of system logs

                iv.      Review and update Active Directory Domain
Services

                v.      Documentation for closed account

d)      Review reports and documentation related to NEA and FISMA activities

             i.      Hardware and Assets report

             ii.      Software and Licensing report

             iii.      White/Black lists

              iv.      System Logs

e)      Perform mock audit against FISMA FY2017 and FY2018 requirements

 

B. Infrastructure Modernization Activities  

This task includes:

a)      Design and Implementation of a modernized network for NEA

b)      Perform a network audit to produce baseline documentation

a.       Develop current state Network Architecture and supporting documents

c)      Determine and Implement the best interconnection strategies for NEA

            i.      VPN

           ii.      TIC

      iii.      Express Routes

d)   Develop Disaster Recovery/COOP capabilities accompanied by supporting policy and procedure language for NEA Information Technology systems

e)   Design and Implement a network topology of a Hybrid onsite/Cloud environment with a focus on long term cost reductions and redundancy

Deliverables:

All deliverables are broken out by Task as follows:

 

Task: Audit Preparation
Deliverable Number	Deliverable Description	Deliverable Due Date
D001	Security Scans and Reports: Weekly security Reports need to be performed and gathered on a regular basis.	Ongoing: Weekly, Monthly, Quarterly
D002	Assist in the review and gather documentation related to FISMA audit	30 days from start
D003	Assist Complete missing training and security records	43 days from start
D004	Gather and review system logs	43 days from start
D005	Documentation of closed accounts	30 days from start
D006	Review accounts in AD to ensure compliance	30 days from start
D007	Review of Inventory of software and licenses	31 days from start
D008	Review of Inventory of hardware and assets	32 days from start
D009	Perform mock audit against FISMA FY2017 and FY2018 requirements and address deficiencies	43 days from start
Task: Modernization Activities
Deliverable Number	Deliverable Description	Deliverable Due Date
D010	TIC Initiative	180 days from start
D011	Hybrid / Cloud layout.	180 days from start
D012	Express Route	120 days from start
D013	VPN Solution	90 days from start
D014	Implementation of a Mobile Device Management solution	120 days from start
D015	Disaster Recovery Plan Architect and Implement a Network topology that is a hybrid combination of Cloud and On-Site resources	120 days from start
D016	One Drive Migration	270 days from start
D017	Implement cloud-based data backup solution to meet archival requirements.	180 days from start
D018	Network Audit Baseline and supporting documents	60 days from start

The Government will award a sole source contract resulting from this solicitation based upon an assessment of the technical and business proposals that, in the Government's estimation, provides the best value and gives the Government the greatest confidence that it will best meet or exceed the requirements for a fair and reasonable cost.

The non-price technical evaluation under Volume 1 will include four (4)major areas:

A.     Technical Approach

B.     Staffing and Personnel Qualifications

C.     Past Performance

D.     Management Plan

E.     Conflict of Interest

The price evaluation under Volume 2 will include a price analysis to evaluate the contractor's proposal to determine the reasonableness of the total proposed price.


The Contractor shall submit their proposal no later than 3:30 p.m. EST on July 16, 2018 for evaluation based on the factors above.