Workspace Resource Reservation System

This Request for Information (RFI) is to identify available systems to meet the following functional requirements: 1. License Structure and Locations a. License structure shall maximize flexibility as GSA evaluates and responds to our changing real estate needs; and, b. Licenses shall allow flexibility for the Government to assign, remove and reassign a license to an unlimited number (one at a time) of reservable resources. GSA may add untraditional reservable/ licensable resources such as zones or blocks of space as we respond to our changing real estate needs. 2. Reservation System Features a. Robust search functionality to provide optimal resource for user needs; b. System to include a User Management Process(UMP) that pulls from Active Directory and/or other GSA system(s) for user provisioning; c. Make and manage reservations through web page and mobile app functionality; d. Integration with Google Workspace calendar and email systems for scheduling, managing, and notification reminders of reservations; e. Convenient mechanisms for users to check-in to active reservations; f. Intuitive and comprehensive web page experience; g. Feature parity between desktop and mobile experience; h. Native communication capability for end users to initiate resource requests, complaints, or customizations to local administrator role; i. Device integration (vendor provided) to visually cue resource availability for making on-demand reservations; j. Live floor plan mapping for real time resource availability; k. Reporting system for utilization summaries, inclusive of reservation data, turnstile data, and potential occupancy sensor data; and l. Administrator role function to manage system parameters, allocate additional administrator (concierge) responsibilities, access reporting functions. 3. Critical System Functionality a. Required Migration Capabilities: i. Migrate available GSA data from the legacy, on premise system. The data includes reservable asset information and reservations from January 1, 2022 through date of go live to include all future reservations. ii. Maintain data integrity and traceability across time zones. iii. Provide hands-on implementation support and technical assistance for the period of migration. iv. Establish integrations between the Contractor's proposed Workplace Reservation System platform and the following services/devices: 1. GSA's Active Directory (user data); 2. Electronic physical access controllers (e.g., turnstiles) - Brivo Apparato and Gallagher Command Centre (badge-in data); 3. Existing SteelCase RoomWizards or optionally, some other vendor-provided device(s); 4. GSA-issued mobile devices (serviced by the AT&T network); and 5. Google Workspace for the purpose of facilitating creation of an event invitation with reservation details. b. Platform Required Capabilities: i. Offers a set of application programming interfaces (APIs) that support development of custom integrations of the platform with other services and data sources thereby extending functionality of the platform to solve future business needs. An ideal solution would provide the ability to construct outbound API calls to other systems as well as accept incoming API requests (vendor must specify the available APIs in its response).; ii. Fully integrates with business intelligence/analytic tools (vendor must specify which business intelligence tools in its response); and iii. Stores data in the cloud. c. System Availability i. Service Description: Operations are successful when the Workplace Reservation System platform provides 99.9% service availability. ii. Performance Measure Description: Operations are successful when the system is available 99.9% of the time with no more than 0.1% of unplanned downtime. Unplanned downtime is defined as unscheduled system outages. d. Cloud Information Systems - IT Security And Privacy Requirements i. The cloud-based solution must be FedRAMP authorized at the FISMA Moderate level to be considered for award and remain FedRAMP authorized for the entire period of performance (PoP). A solution that is not explicitly FedRAMP authorized, but hosted in a FedRAMP authorized environment is not considered FedRAMP authorized. The Workspace Reservation System must be able to integrate seamlessly with Google Workspace. The Contractor must implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for Moderate impact systems (as defined in PUB 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for Moderate impact systems. The FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 5, - Security and Privacy Controls for Federal Information Systems and Organizations (as amended), and also includes a set of additional controls for use within systems providing cloud services to the Federal Government. The Privacy and Security acquisitions guide 09-48 provides specific guidance for controls required to secure GSA systems. Link to the guide: Security Language for IT Acquisition Efforts The solution must support configurable integrations with GSA operated identity and authentication / single sign-on services. The vendor must support SAML 2.0 and/or OpenID Connect integrations. GSA will identify and provide the services upon award. ii. In addition, the solution must adhere to all current GSA IT Standards for hosting such a system and meet GSA's current Information Technology (IT) Security Policy, CIO 2100.1 GSA Information Technology (IT). Link to policy: https://www.gsa.gov/policy-regulations/policy/information-integrity-and-access/gsa-it-security-policies&sa=D&source=editors&ust=1632250402911000&usg=AOvVaw2dOFdqYqLW52Chio247WVq and other Government-wide laws and regulations for protection and security of information technology. iii. The solution must have the ability to manage users and/or have the ability to allow administrators to regulate who and what type of access the user is granted. e. Authority to Operate (ATO): i. The Contractor must participate in the process to obtain an Authority to Operate (ATO) within estimated ninety (90) days after award. The level of involvement will vary, but it could require up to full-time availability of system architects, IT security and other subject matter experts. f. Section 508 Compliance i. The Contractor and/or manufacturer must provide accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. - 794d). All Electronic and Information Technology (EIT) procured through the contract must meet the applicable accessibility standards at 36 CFR Part 1194, unless an agency exception to this requirement exists. The 36 CFR Part 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. All deliverables will be Section 508 compliant and will be reviewed for compliance by the Government which reserves the right to reject the deliverable(s) until remediation of deficiencies has been successfully completed by the Contractor. Complete technical descriptions are provided on the following website: http://www.section508.gov. ii. Where appropriate, the Contractor and/or manufacturer must indicate whether each product is compliant or noncompliant with the accessibility standards at 36 CFR Part 1194. Further, the quote must indicate where full details of compliance can be found (e.g., Contractor's website or other exact location). iii. The Contractor and/or manufacturer must describe how their proposed Electronic and Information Technology (EIT) solution meets at least those technical provisions, functional or business criteria, and information, documentation, and support requirements identified in the Government or Contractor Product/Service Accessibility (GPAT/VPAT). See http://www.section508.gov/. g. The following GSA policy(ies) must be followed as applicable: i. CIO 09-48, IT Security Procedural Guide: Security and Privacy IT Acquisition Requirements https://www.gsa.gov/cdnstatic/Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_%5BCIO_IT_Security_09-48_Rev_6%5D_04-15-2021%20(1).pdf In addition, the solution shall adhere to all current GSA IT Standards for hosting such a system and meet CIO 2100.1M GSA Information Technology (IT) Security Policy (March 26, 2021) https://www.gsa.gov/cdnstatic/CIO_21001M_GSA_Information_Technology_(IT)_Security_Policy_03-26-2021_CC044215.pdf [PDF - 793 KB]; and CIO 2104.1B GSA Information Technology (IT) Rules of Behavior (April 2, 2019) https://www.gsa.gov/cdnstatic/IT_General_Rules_of_Behavior_CIO_21041B_CHGE_1_04-02-2019.pdf [PDSF - 247 KB]; and all applicable GSA and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of information technology.