The Contractor shall facilitate requirements-gathering activities (e.g., focus groups, interviews). The periodicity of these requirements sessions will be determined by the Government, The Contractor shall ensure requirements address DOT security policies. The Contractor shall define Migration Acceptance Test Criteria and test criteria for configuration changes for approval by the Government. The Contractor shall provide documented Requirements and Acceptance Test Criteria per approved requirements standards. The Contractor shall develop, document, and maintain Technical Design Plans and Environment Configuration based on DOT design specifications standards and requirements, including IT architecture, virtualization architecture (including active-active, active-passive, load balancing or other proposed virtualization methods), function, performance, availability, maintainability, security, and IT continuity and DR requirements. The Government will approve technical design plans and environment configuration. The Contractor shall maintain and make readily available to DOT all design specifications and requirements documentation in a form/format that is acceptable to and approved by DOT. The Contractor shall review and coordinate design plans through coordination with the appropriate DOT technology standards group and design architects. SUB-TASK 6.4: NETWORK HOSTING The Contractor conduct periodic audits and status reporting and shall be responsible for coordinating the installation, making changes, moves, disposition of network equipment, and coordinating the cabling and disconnection services and problem resolution. The Contractor shall perform network monitoring through systems with alerts/alarms supplemented with new or additional devices to ensure the network is operating within limits. The Contractor shall monitor networks (including QoS) and provide status and measurements for the operational environment. The Contractor shall execute an escalation process for alerts. The Contractor shall use automated tools to monitor networks, to respond to problems, and perform break/fix services (physical or logical), patch systems, provide 24x7x365 operational reporting of services availability, and proactively identify performance degradation in real time or near real time where appropriate. The Contractor shall continuously model networks to provide performance forecasting and measure networks with automated tools to predict capacity and potential impact to applications and network topology. The Contractor be responsible for coordinating the installation and removal of hardware and software, as well as making routine moves, adds, and changes. Such activities will be subject to change control procedures and require maintenance of the asset records. The Contractor shall manage license compliance for installed software provided by the Government, and report instances of installed software not part of the standard configuration. The Contractor shall provide a software release process for DOT and provide visibility into original equipment manufacturer (OEM) software
1 Written Monthly Status Report A summary of work performed in the preceding month for each task area which includes major milestones achieved or missed, deliverables, upcoming activities, and any anticipated issues that will prevent attainment of milestones and/or deliverables A summary of project financial status for each task area including funded amount, expended to date, funding remaining, and estimate to complete. A summary of all deliverables submitted from task inception to date showing the date submitted, and the status of the deliverable (i.e. accepted, rejected). For rejected deliverables, the Contractor shall provide an explanation why the deliverable was rejected, the corrective action charged. An attachment providing data, analysis, and reporting of performance against each contractual SLA; the Contractor include an improvement plan for any missed SLAs. plan, and the revised delivery date. A summary of funding status (e.g., funded amount, expended amount, planned burn percent, and actual burn percent) and burn chart (for T&M tasks only). A summary of the personnel who performed work (i.e., charged direct labor hours) during the month by task area to include their name, job title, task area worked, labor category, and hours. Due monthly on the first business day of each month throughout the TO POP. PERIODS: BASE OP1 OP2 OP3 OP4 OP5 Service Level Monitoring and Reporting Procedures Documented SLA performance across all SLAs with any improvement results coming from Contractor action. Monthly PERIODS: BASE OP1 OP2 OP3 OP4 OP5
2 SLA Performance and Improvement Results Documented SLA performance across all SLAs with any improvement results coming from Contractor action. Monthly PERIODS: BASE OP1 OP2 OP3 OP4 OP5 3 Meeting Minutes Meeting minutes including, but not limited to, all major discussion topics, decisions, and action items. Delivered on the following business day by close of business. PERIODS: BASE OP1 OP2 OP3 OP4 OP5 4 Canned, Custom, and Ad Hoc Reporting Canned, custom, and ad hoc reporting at government direction. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5 5 Technical Design Plans and Environment Configuration Based on DOT design specifications standards and requirements, including IT architecture, virtualization architecture including active-active, active-passive, load balancing or other proposed virtualization methods, function, performance, availability, maintainability, security, and IT continuity and DR requirements. Quarterly and at Government direction PERIODS: BASE OP1 OP2 OP3 OP4 OP5
6 Design Specifications and Requirements Documentation Design specifications and requirements documentation for application specified by the Government. At Government direction PERIODS: BASE OP1 OP2 OP3 OP4 OP5 7 Availability Management Procedures Describes processes, procedures, governance, roles and responsibilities for managing the availability of applications. Includes appropriate tools and methods that support DOT’s availability management requirements. Quarterly and at Government direction PERIODS: BASE OP1 OP2 OP3 OP4 OP5 8 Forward-looking Availability Plan Coordinates, prioritizes, and plans approved IT availability improvements. Quarterly PERIODS: BASE OP1 OP2 OP3 OP4 OP5
9 Capacity Management Procedures Documented procedures for capacity management. Quarterly and Government direction PERIODS: BASE OP1 OP2 OP3 OP4 OP5 10 Capacity Impacts When Adding, Removing or Modifying Applications Describes the impact on capacity when adding, removing, or modifying applications from the hosting environment. Due 15 business days prior to execution of the change throughout the TO PoP PERIODS: BASE OP1 OP2 OP3 OP4 OP5 11 Trade-Off Analysis and Business Case Assesses impact/risk and cost of capacity changes, reflecting impact on other applications. At Government direction BASE OP1 OP2 OP3 OP4 OP5
12 Incident Management Processes including service outages and degradations Documented procedures for Incident Management Processes including service outages and degradations Quarterly and at Government direction PERIODS: BASE OP1 OP2 OP3 OP4 OP5 13 Root Analysis Document For each Severity 1 incident resolution. The Government may also request Root Analysis Documents for specific Severity 2 incidents as well. Due in 2 business days the incident or 2 business days after the government request PERIODS: BASE OP1 OP2 OP3 OP4 OP5 14 Solutions to Resolved Incidents Solutions to resolved incidents in a central knowledge database with all information pertinent to trouble tickets including general verbiage, codes, etc. Ongoing throughout the TO PoP PERIODS: BASE OP1 OP2 OP3 OP4 OP5
15 Status and Resolution of Incidents Report of all incidents and their status. Monthly at the management meeting throughout the TO PoP PERIODS: BASE OP1 OP2 OP3 OP4 OP5 16 Problem Management Processes Documented procedures for problem management. Quarterly and at Government direction PERIODS: BASE OP1 OP2 OP3 OP4 OP5 Documented and Updated Problem Includes information regarding problem resolution actions, activities, Ongoing throughout the TO
17 Management Knowledge-base and status (e.g., root cause, known errors, workarounds, etc.). PoP BASE OP1 18 Problem Management Reporting Reports on existing and anticipated problems including recommended solutions and action plans for resolving the problems. Monthly on the 1st business day of each month throughout the TO PoP BASE OP1 19 Quality Plans Describes how the Contractor will embed quality into processes and procedures. Annually at Government direction throughout the TO POP PERIODS: BASE OP1 OP2 OP3 OP4 OP5 5
20 System Security Plan Compliant with the NIST SP , Guide for Developing Security Plans for Federal Information Systems final.pdf), the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems ips200/FIPS-200-final-march.pdf), and NIST SP 800-53 (latest revision) Security and Privacy Controls for Federal Information Systems and Organizations and other applicable NIST guidance. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5 21 Endpoint Engineering Technical Plan A written top-level plan for managing the endpoint engineering effort to produce a final operational endpoint solution from initial requirements. It describes how the efforts of endpoint team (e.g., designers, test engineers, and other engineering and technical disciplines) will be integrated, monitored, and controlled during the complete life cycle. not later than (NLT) 20 business days after TO award NLT 5 business days after receipt of government feedback on the draft. 22 Endpoint Engineering Design and Development SOPs Written SOPs for Endpoint Engineering Design and Development. not later than (NLT) 40 business days after TO award Final NLT 5 business days after receipt of government feedback on the draft. 23 Endpoint Technical Market Research Reports A written document providing the results of independent research on endpoint market developments and technical trends to include recommendations on products, solutions, and services with potential use for DOT. NLT quarterly commencing from the date of Task award.
24 Endpoint Solution Requirements & Acceptance Testing Criteria A representation of endpoint solution requirements (e.g., system requirements specifications, data models, upgrade requirements) in agreed-to formats. Per Endpoint Engineering project as defined in the baseline project schedule. 25 Endpoint Image Build Procedures Documented procedures for endpoint builds that meet DOT requirements and adhere to defined policies. Draft not later than (NLT) 40 business days after TO award Final NLT 5 business days after receipt of government feedback on the draft. 26 Endpoint Image Build Technical Specifications A written document containing detailed technical specifications that define and support the build and testing plans for all endpoint image builds. Draft NLT 40 business days after TO award Final NLT 5 business days after receipt of government feedback on the draft. 27 Endpoint Image Build Project Plan A written plan providing the tasks, activities, timeline, and milestones to complete a new endpoint image project. As new endpoint image build projects are approved by the COR. 28 Endpoint Image Builds A notification from the Contractor to the COR that the master endpoint as well as an endpoint image build for each DOT Operating Administration, is complete and ready for testing. Per endpoint build cycle; NLT 30 business days of receipt of endpoint image software. 29 Endpoint Tier 3 Report A report providing monthly Endpoint Tier 3 support trends to include, but not limited to, number of support requests; nature of support requests; DOT customer (if applicable) source of support request; mean time to resolution; top 5 support requests; and recommendations for addressing the top 5 support requests proactively. NLT 5 business days following the conclusion of each month
33 System Security Plan Compliant with the NIST SP 800-18 , Guide for Developing Security Plans for Federal Information Systems ubs/800-18-Rev1/sp800-18-Rev1- final.pdf), the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems ips200/FIPS-200-final-march.pdf), and NIST SP 800-53 (latest revision) Security and Privacy Controls for Federal Information Systems and Organizations and other applicable NIST guidance. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5 34 Security Assessment Plan/Report (SAP/SAR) Conducted by an independent assessor and consistent with NIST SP 800-53A, NIST SP 800-30 (latest revisions) and any additions or augmentations described in the DOT IS2P. The assessor will document the assessment results in the SAR. The Contractor shall update the SAR at annually thereafter. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5 35 Plan of Actions and Milestones (POA&M) Plan for mitigating all security risks found during continuous monitoring and security reviews. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5 36 Contingency Plan and Contingency Plan Test Developed in accordance with NIST SP 800-34, latest revision, DOTAR, and DOT IS2P. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5
45 Summary Reporting and Statistics On-demand including, but not limited to: Dashboard reporting on system performance; Real-time and historical performance against SLA; Account Mailbox and volumes; Reporting on Utilization Statistics; and End users approaching Mailbox Quota Limits. At Government request. [Note: Section 508 compliance required] PERIODS: BASE OP1 OP2 OP3 OP4 OP5 46 User Guides, Source Code, Manuals, Drawings, Diagrams, Design Documents, Equipment Lists, and Warranty Information User Guides, Source Code, Manuals, Drawings, Diagrams, Design Documents, Equipment Lists, and Warranty Information for all systems noted in Attachment J. Prior to system delivery (Note: Section 508 compliance required) PERIODS: BASE OP1 OP2 OP3 OP4 OP5 47 Disaster Recovery Plan Documented process or set of procedures to recover and protect the application portfolio in the event of a disaster. Specifies procedures to follow in the event of a disaster. Annually at Government direction throughout the TO POP PERIODS: BASE OP1 OP2 OP3 OP4 OP5
48 Record of Required In- Scope System Data, Libraries, And Databases As required to recover system software and the operating environment at the recovery site. At Government request PERIODS: BASE OP1 OP2 OP3 OP4 OP5 49 Network Administration Procedures Documented procedures for administration of network devices Quarterly and at Government direction throughout the TO POP PERIODS: BASE OP1 OP2 OP3 OP4 OP5 50 Database Administration Procedures Documented procedures for database administration. Quarterly and at Government direction throughout the TO POP PERIODS: BASE OP1 OP2 OP3 OP4 OP5 51 Email and Mobile Device Management Administration Procedures Documented procedures for Email and Mobile Device Management Administration Procedures Quarterly and at Government direction throughout the TO POP PERIODS: BASE OP1 OP2 OP3 OP4 OP5
52 Server Administration Procedures Documented procedures for server administration. Quarterly and at Government direction throughout the TO POP PERIODS: BASE OP1 OP2 OP3 OP4 OP5 53 Service Management System Administration Procedures Documented procedures for SMS administration Quarterly and at Government direction throughout the TO POP PERIODS: BASE OP1 OP2 OP3 OP4 OP5 54 End User ID Administration Processes and Standard Operating Procedures End User ID Administration Processes and standard operating procedures as new applications are introduced into the DOT environment. Quarterly [Note: Section 508 compliance required] PERIODS: BASE OP1 OP2 OP3 OP4 OP5 55 Security Plans, Security Remediation Plans, Programs, and Security Infrastructure. Security plans, security remediation plans, programs, and security infrastructure for the datacenter environment and facility. At Government request PERIODS: BASE OP1 OP2 OP3 OP4 OP5
56 Backup Reports Status of backup success or failure and remediation plan to resolve the issue Weekly report. PERIODS: BASE OP1 OP2 OP3 OP4 OP5 57 Physical and Logical Security Plans Physical and logical security plans consistent with DOT security policies and industry standards (e.g., ISO 27001). At Government request PERIODS: BASE OP1 OP2 OP3 OP4 OP5 58 Software and Source Code IAW FAR 52.227-14 DOT has unlimited rights in computer software, including source code, developed under the contract. At Government direction PERIODS: BASE OP1 OP2 OP3 OP4 OP5 59 Migration Plan Describes the process to be used for migration of applications, the resourcing to be utilized, the risks identified and mitigation plans for said risks. Due 30 calendar days after TO award PERIODS: BASE 60 Migration Duration, Metrics and Migration Steps Migration duration and metrics and documented migration steps and performance characteristics. Due 30 calendar days after TO award PERIODS: BASE
4H. EXCEPTIONS Image builds requiring a new or updated operating system. If the Engineering Test Lab is unavailable at any point when image build testing is planned, the period of unavailability may be subtracted from the calculation. The EITSS Program Management and Task Order Integration contractor fails to complete independent testing within their specific timeframe (i.e., 5 business days). 4I. POLICY N/A 5. SLA CALCULATION 5A. CALCULATION (NUMERATOR) Total Survey Image Builds Leveraging the Current Operating System (master and DOT OA’s unique) Ready for Deployment within the Target Service Level Objective ÷ (DENOMINATOR) Total Image Builds Requested * 100 = (RESULT) Service Level (%) Attained 5B. SUCCESS CRITERIA Contractor image builds are high quality and completed within SLA- designated timeframe. 5C. DEFINITIONS None. 6. SLA ADMINISTRATION 6A. REPORTING FREQUENCY Reporting to commence upon Contract Award and continue throughout the Period of Performance. Monthly reporting of SLA attainment in Task Order Monthly Status Report. 6B. NOTES AND COMMENTS None. On Schedule Delivery 1. SLA SUMMARY 1A. TASK Management Endpoint Engineering Infra. Engineering Infra. Operations Data Center Op. Application Hosting 1B. SUB-TASK Multiple 1C. SLA # Infrastructure – SLA 2 1D. SLA NAME On Schedule Delivery 2. SLA OVERVIEW 2A. SLA DESCRIPTION This SLA measures the timeline delivery of engineering projects per agreed upon and baselined project schedules based on the percentage of completed milestones by the agreed-upon due date. 2B. RATIONALE Incentivizes the Contractor to meet project schedule commitments.
4B. MEASUREMENT PERIOD The Measurement Period begins at 7:00:00 AM on the first day of the contract month and ends at 7:00:00 PM on the last day of the contract month 4C. SOURCE OF MEASUREMENT DATA The source of measurement data is the GFE SMS 4D. METHOD OF MEASUREMENT SLA attainment is measured by calculating the elapsed time from the creation of a network IMAC ticket to closure of the ticket in the GFE SMS 4E. TIMING OF MEASUREMENT SLA attainment is calculated after the Measurement Period has expired 4F. METHOD OF GOVERNMENT SURVEILLANCE Subject to random or planned audit by the Government or its designee 4G. ASSUMPTIONS/ CONDITIONS None 4H. EXCEPTIONS Tickets generated while during downtime of the GFE SMS due to a network outage or network performance degradation outside the control of the Contractor are excluded from the calculation Contacts that during the following periods are excluded from the Numerator and Denominator for calculation purposes: GFE SMS downtime approved by the Government (e.g., for scheduled maintenance) GFE SMS downtime due to events outside Contractor control and approved as such by the Government Failure of Monitoring Tools 5. SLA CALCULATION 5A. CALCULATION (NUMERATOR) Number of network completed in less than the Target Service Level Objective ÷ (DENOMINATOR) Total network IMACs * 100 = (RESULT) Service Level (%) Attained 5B. SUCCESS CRITERIA A successful network IMAC is one completed in less than the Target Service Level Objective 5C. DEFINITIONS None 6. SLA ADMINISTRATION 6A. REPORTING FREQUENCY Reporting planning and preparation to commence during Transition; reporting to commence at of Option Period 1 Daily reporting of results from prior day Weekly reporting of results from prior week Monthly reporting of results from prior month Quarterly reporting of results from quarter Monthly reporting of SLA attainment and root cause of SLA failures at the Monthly Status Meeting 6B. NOTES AND COMMENTS None
Managed Security Services (Firewall) 1. SLA SUMMARY 1A. TASK Infra. Engineering Infra. Operations Application Hosting 1B. SUB- TASK Multiple 1C. SLA # Infrastructure – SLA 6 1D. SLA NAME Managed Security Services (Firewall) 2. SLA OVERVIEW 2A. SLA DESCRIPTION Measures the effective management of firewalls and firewall rule sets. 2B. RATIONALE Incentivizes the Service Provider to staff their security operations support team with sufficient qualified staff. 2C. PERFORMANCE WORK STATEMENT REFERENCE The Contractor work with DOT IT personnel to modify and maintain firewall rule sets, implement those rule sets, and monitor the log files as well as the normal operation and maintenance of those firewalls. Network tools must automatically review firewall alarms and report them to the IT security team and network engineering team. 2D. PERFORMANCE PERIOD This SLA is in effect 24x7x365 3. SERVICE LEVEL OBJECTIVE 3A. HOLD HARMLESS PERIOD Until Assumption of Responsibility (AOR) 3B. TARGET SERVICE LEVEL OBJECTIVE 100% of required firewall rule sets modified and implemented within twenty-four (24) hours of request. 3C. DISINCENTIVE SERVICE LEVEL OBJECTIVE In the event of SLA failure, 5% of the Contractor’s invoice shall be deducted for that period for the following tasks: Task 3: Infrastructure Engineering Task 4: Infrastructure Operations Task 6: Application Hosting 4. SLA MEASUREMENT 4A. MEASUREMENT INTERVAL The Measurement Interval is one (1) 4B. MEASUREMENT PERIOD The Measurement Period begins at 00:00:00 on the first day of the contract month and ends at 23:59:59 on the last day of the contract month 4C. SOURCE OF MEASUREMENT DATA The source of measurement data is the GFE SMS 4D. METHOD OF MEASUREMENT SLA attainment is measured by calculating the elapsed time from the request from DOT to closure of the associated ticket in the GFE SMS. 4E. TIMING OF MEASUREMENT SLA attainment is calculated the Measurement Period has expired