DFAS IT Asset Management (ITAM) HAM/SAM Software

Form / Attachment / Pricing Sheet

This document outlines the specific functional and security requirements for a Hardware Asset Management (HAM) and Software Asset Management (SAM) solution. It details the technical specifications and capabilities the product must possess to meet the Defense Finance and Accounting Service (DFAS) needs.

Security Requirements:

• Compatibility with DoDI 8510.01 RMF, DISA STIGs, NIST SP 800-53.
• Compliance with DoD Cloud Computing SRG.
• Support for software/plugins (e.g., WebLogic, Java/Azul services).
• Integration with DoD PIV Card, CAC, and PKI security controls (FIPS 140-2, RFC 5280, relevant DoD Directives and Instructions).

HAM/SAM Required Functionality:

• Automated matching of software/hardware assets to DFAS devices.
• Configuration of HAM/SAM roles and permissions.
• Tracking of warranty, contracts, asset lifecycle, and hardware updates.
• Automated configuration management for DFAS virtual and shared environments.
• Automation of DFAS HAM/SAM audit processes.
• Configuration to meet DFAS governance policies for accountable property.
• Provision of training materials for DFAS sustainment.
• Direct integration with DFAS ServiceNow CMDB.
• Integration with industry and DFAS discovery sources, with filtering/mapping capabilities.
• Automated matching of software assets to the DFAS ServiceNow CMDB.
• Rationalization/reconciliation of DFAS Approved Software List (ASL) products.
• Normalization of discovery source data.
• Facilitation of Software Installation Requests (SIR).
• Automation of software versioning tracking, management, and reporting (including expiring versions).
• Automation of Software End of Life (EOL) tracking, management, and reporting.
• Automation of license assignment tracking, management, and reporting for desktop, AVD, and server software.
• Reporting capabilities via Microsoft Power Platform.
• Functionality to manage and report contracts (expiration, scope) and create custom metrics.
• Automatic management and reporting of software installations/removals.
• Compliance with Section 508 accessibility standards (36 CFR 1194.21 and 1194.22).

This document is critical for bidders to understand the detailed technical and functional requirements of the HAM/SAM solution. It specifies the security compliance, integration capabilities (especially with ServiceNow), asset management features, and reporting needs. Bidders must ensure their proposed solution meets all listed requirements to be considered compliant.

Questions & Answers / Clarifications

This document contains questions submitted by potential vendors and the government's responses regarding the HAM/SAM software opportunity. It aims to clarify requirements and provide additional details for bidders.

• COTS Software: The government requires Commercial Off-the-Shelf (COTS) HAM/SAM software for IT Asset Management (ITAM).
• Integration: The COTS software must fully integrate with a ServiceNow CMDB without additional software. Integration with a COBOL-based accounting system is also required, with a focus on secure file generation (e.g., PDF).
• DoD Cloud & Compliance: The product must support DoD Impact Levels (ILs) and be capable of hosting in DoD cloud environments. Support for DoD Common Access Card (CAC) Identity Provider (Id) authentication is required.
• Technical Requirements: The software must be compatible with Windows 11 (Version 23H2 x64), Windows Server 2016 Standard, and AVD/DBCE. It should also support monitoring of various operating systems and external hosting environments like DISA and AWS.
• Support & Warranty: Initial training, telephone, and electronic help desk support are required with purchase. The standard warranty details are requested.
• Uptime: For web-hosted solutions, a guaranteed level of uptime is required.
• Small Business Status: Vendors are asked to confirm if they are a small business and specify the type.
• Rough Order of Magnitude (ROM): Vendors are requested to provide a ROM estimate, including part numbers, rates, and any assumptions affecting the estimate (e.g., volume discounts).
• Federal Customers: Vendors must list up to five Federal Government and/or DoD customers, including names, locations, and contact information.

This RFI clarifies technical, integration, and compliance requirements. Vendors should use this information to prepare their responses, including ROM estimates and customer references. Specific product service codes (PSC) and NAICS codes are also requested.

Solicitation / RFP / RFQ

This document is a Description of Need (DoN) from the Defense Finance and Accounting (DFAS) Information Technology Asset Management (ITAM) division. DFAS is seeking commercial off-the-shelf (COTS) software to establish an ITAM capability. The goal is to discover, organize, and integrate DFAS-hosted hardware and software assets for management within the DFAS ServiceNow CMDB/Service Catalog.

• Vendors must provide software that meets DFAS requirements without requiring custom code development.

• Software products, agents, and components must be certified to operate on DoD Networks at the IL5 level.

• The contractor will provide the software, licenses, initial training, telephone and electronic help desk support, and software upgrades/updates.

• Software must offer security features including protection against unauthorized access, controlled access levels for authorized users (password/Windows authentication), and encryption capabilities.

• Installation (on-premise or government cloud) will be the government's responsibility, with contractor support for required security settings and technical configurations.

• A standard commercial warranty is required, in accordance with the existing Global License Agreement.

• The initial period of performance is estimated from October 1, 2026, through September 30, 2028.

• Estimated costs for the product, including options, should be provided.

• Vendors are requested to review the attached spreadsheet (not provided in this text) to determine which DFAS requirements their product can meet.

• Responses should address each individual DFAS requirement, indicating whether it can or cannot be met.

• Deliverables will be provided electronically. Support will be via telephone or electronic help desk.