OCC’s Application Management System Solution

Request for Information (RFI) OCC’s Application Management System Solution This is a request for information only - it does not constitute an Invitation for Bids (IFB), Request for Proposals (RFP), or Request for Quotation (RFQ). This RFI is issued solely for information and planning purposes and does not commit the OCC to issue a solicitation (RFP/RFQ) or award a contract for any supply or service whatsoever. The OCC will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the Respondents’ expense. Those who respond to this RFI should not anticipate feedback concerning its submission other than acknowledgement of receipt if the Submitter requests acknowledgement. The OCC elects to respond to comments and questions resulting from Respondents’ Q&A Worksheet submission if it is determined that doing so would benefit the agency. Background The OCC previously acquired and currently uses an application management services via Patch My PC since fiscal year (FY) 2021, to help automate the preparation of third-party software updates for automated patching and remediation of security vulnerabilities through Microsoft Endpoint Configuration Manager (MECM). The MECM is an on-premises endpoint management tool that enables the management, deployment, and security of devices and applications across OCC’s enterprise. Another OCC endpoint management tool, Microsoft Intune, also provides patch management and deployment, using cloud-based policies and configurations. Using both MECM and Intune enables the OCC to concurrently manage (or co-manage) devices running Windows 10 or later. The current solution offers maintenance services, which automatically publish third-party updates and create base-install applications in Configuration Manager and Microsoft Intune. Purpose The Office of the Comptroller of the Currency (OCC) is requesting information on an application management system solution that is considered a low-maintenance, software plug-in that provides seamless integration with the OCC’s MECM and Intune infrastructures, fulfilling a need for client security patching in an agentless way and to deploy patches for third-party applications. Requirements Description The Government (OCC) seeks an application management product/solution that, at minimum, meets the following requirements (operating in the OCC’s environment): Shall automatically download patches and updates in a prepared package format that can be distributed using the agency's Microsoft Endpoint Configuration Manager (MECM) and/or Intune infrastructures, with little or no configuration. Shall provide the capability to create custom prepared updates for custom solutions, such as in-house software, that can be easily distributed with little or no configuration. Shall offer the option of customizing patch and update installation options and can automatically apply customizations to subsequent versions of patches and updates. Shall include patch and update configuration options, including: Shall have provisions for pre- and/or post-patch/update-installation scripting capabilities using, at a minimum, the PowerShell scripting language; Shall include installation logging capabilities to support troubleshooting; and Shall support the customization of patch and update command line options Shall have the ability to create base MECM and/or Intune Application objects. Shall provide a non-web-based administrative interface having the ability to fully manage the software. Shall have the ability to automatically update its own installation files. Shall not store agency-specific information in non-agency, Cloud-based resources for the software to function. Shall not require non-agency, non-FedRAMP certified, Cloud-based services for functional operation. Shall integrate with, and not require the installation of additional infrastructure beyond, the agency's existing, FedRAMP-certified Microsoft MECM and Intune infrastructures for patch and update content deployments, installations, and monitoring. Shall not require additional client agent software beyond the agency's existing MECM and Windows OS infrastructure agents. Shall include statistical reporting compliance status and efficacy of distribution, installation, and completion of patches and updates. Shall integrate its reports with the agency's existing MECM web reporting system, and otherwise not require an additional reporting system and/or website. Shall include comprehensive learning and technical resources for basic through advanced installation, configuration, management, and troubleshooting strategies in the form of support articles, videos, and customer forums. Shall support at a minimum the following applications: Adobe Acrobat, Cisco AnyConnect Secure Mobility Client, FortiClient VPN, Google Chrome, KeePass, Microsoft Edge, Microsoft Office Suite, Microsoft Teams, Microsoft PowerBI, Microsoft PowerShell Core, Wireshark, Notepad++, Beyond Compare, Splunk Universal Forwarder, Tableau Desktop and Tableau Reader, TechSmith Snagit, WinZip, Zoom Meetings, Citrix Workspaces, PuTTY, DisplayLink, Java, with access to a wider catalog of potential options for the majority of deployed agency software titles with a significant user. This is not a complete list of software titles; other titles may be added during the course of the contract. RFI Submission Responses: Interested Respondents are requested to respond to this RFI electronically, that identifies the information below: Company Background - Provide summary information including company name, Unique Entity Identification number, CAGE code, Government-wide Acquisition Contracts (e.g., NASA SEWP, GSA Multiple Award Schedules, NIH National Institutes of Health Information Technology Acquisition and Assessment Center), schedule holder number(s) (if applicable), and designated point of contact's name, title, email address and phone number. Company Classifications – Relevant asserted North American Industry Classification System (NAICS) Code(s), and Product Service Code(s) (PSCs) (as applicable), business size, socioeconomic status, Provide recommended NAICS Code(s) Provide recommended PSC(s) Requirements Capability – Respondents should address its capability to meet the requirements listed in the requirements section above. Identify any assumptions, constraints, agreements, terms, conditions, and/or exhibits the Government would need to consider when entering into an agreement (i.e., order contract). Published Catalogs and Pricing Structure – Provide published price lists or catalog(s). If applicable, provided information on volume discounts, and favored customer discounts. ( NOTE: At this time, the Government is contemplating a FFP contract type.) Schedule Estimate/Delivery – Include specifics regarding delivery and installation lead times, transition services, and configuration or modeling. Subcontracting possibilities – Other than Small Business Respondents should identify any Small Business (SB) opportunities to allow SBs to expand its offering(s) and gain experience(s) in providing Application Management Systems services or for offering a total solution. State whether SB subcontracting is not available and why. RFI Submission Instructions: Responses shall be in single-spaced, Times New Roman or Arial, no less than 12-point font format, with one-inch margins all around, compatible with (readable) MS Office Word or Adobe Acrobat sent via email. Courier delivery will not be accepted. Responses to the RFI shall not exceed 10 pages nor 5 MB, and shall be printable on 8 ½” x 11” paper. If a Respondent elects to include pricing, it is limited to one page inclusive of a pricing narrative. Respondents shall avoid the use of excessive marketing language, submission of fancy brochures, and other unnecessary sales literature, which will not be considered. The email should include the following subject heading, “ Response to OCC’s Application Management RFI #2031JW24N00024. ” As noted above, this RFI is issued solely for information purposes, and therefore, documents received in response to this notice will not be returned, and any proprietary information contained within responses shall be clearly marked as ‘Proprietary’. All submissions in response to this RFI shall become the property of the Government. Any response submitted by Respondents to this request constitutes consent for its submission to be reviewed by OCC and its employees. Questions shall be submitted using the MS Excel QandA Worksheet attached for consideration. Please email your response to: [email protected] by 12:00 PM Eastern Time Friday, January 26, 2024.