statement of work - wikileaks web viewstatement of work, ... design and deploy active directory...

GlobalSOWv9.0(GAEO)(English)(July2011)

Statement of WorkADRMS

Prepared forMOFA

Tuesday, 20 November 2012

Prepared by

M. Omer SiddiquiSenior Consultant

[email protected]

000MOFA0

Revision and Signoff Sheet

Change Record

Date Author Version Change reference

07/08/2012 M. Omer Siddiqui 1.0 Initial draft for review/discussion

09/08/2012 M. Omer Siddiqui 1.1 Updated based on team’s review

20/11/2012 M. Omer Siddiqui 1.2 Updated based on Mohammed AlGhannam’s feedback

Reviewers

Name Version approved Position Date

Page iiStatement of Work, ADRMSPrepared by M. Omer Siddiqui"document.docx" last modified on 20 Nov. 12, Rev 7

000MOFA0

Table of ContentsIntroduction......................................................................................................11 Project Objectives and Scope......................................................................2

1.1 Objectives..............................................................................................................21.2 Areas Within Scope................................................................................................2

1.2.1 Envisioning Phase.......................................................................................21.2.2 Planning Phase............................................................................................31.2.3 Stabilization and Deployment Phase...........................................................31.2.4 Software Products / Technologies...............................................................41.2.5 Training and Knowledge Transfer................................................................4

1.3 Areas Out of Scope.................................................................................................52 Project Approach, Timeline and Service Deliverables....................................7

2.1 Approach................................................................................................................72.2 Timeline.................................................................................................................82.3 Key Service Deliverables and Acceptance Process.................................................8

2.3.1 Project Service Deliverables........................................................................82.3.2 Service Deliverable Acceptance Process.....................................................8

2.4 Project Governance Approach..............................................................................102.4.1 Part-Time Project Management.................................................................102.4.2 Communication Plan.................................................................................102.4.3 Issue/Risk Management Procedure...........................................................112.4.4 Change Management Process...................................................................112.4.5 Executive Steering Committee..................................................................122.4.6 Escalation Process.....................................................................................12

2.5 Project Completion...............................................................................................133 Project Organization and Staffing..............................................................14

3.1 Project Organization Structure.............................................................................143.2 Project Roles and Responsibilities........................................................................14

3.2.1 Customer Project Roles and Responsibilities.............................................143.2.2 Microsoft Project Roles and Responsibilities..............................................15

4 General Customer Responsibilities and Project Assumptions.......................164.1 General Customer Responsibilities.......................................................................164.2 Project Assumptions.............................................................................................17

Page iiiStatement of Work, ADRMSPrepared by M. Omer Siddiqui"document.docx" last modified on 20 Nov. 12, Rev 7

000MOFA0

Page ivStatement of Work, ADRMSPrepared by M. Omer Siddiqui"document.docx" last modified on 20 Nov. 12, Rev 7

000MOFA0

IntroductionThis Statement of Work (SOW) and any exhibits, appendices, schedules, and attachments to it are made pursuant to the Work Order No. XXXX, the terms of which are incorporated herein by reference, by and between MOFA (“Customer”, “you”, “your”) and Microsoft Corporation (“Microsoft”, “us”, “we”, “our) or Microsoft’s affiliate, and sets forth the services to be performed by us related to Infrastructure Upgrade Project (“project”). This SOW, together with the Work Order, represents the complete baseline for scope, services, Service Deliverables, and acceptance applicable to this project. All changes to this document will be managed in accordance with the Change Management Process defined below. Any terms not otherwise defined herein will assume the meanings set forth in the Work Order.

This SOW and the associated Work Order expire 30 days after their publication date, unless they have been formally extended in writing by Microsoft.

MOFA requested Microsoft to complete the following and this document will provide required details for the work to be delivered.

Design and deploy Active Directory Rights Management services for information protection

Statement of Work, ADRMS Prepared by M. Omer Siddiqui"document.docx" last modified on 20 Nov. 12, Rev 7

000MOFA0

1 Project Objectives and Scope

1.1 ObjectivesMOFA would like to introduce Active Directory Rights Management Services (ADRMS) into the environment to enhance information protection. The solution creates an additional layer of data protection enabling you to encrypt your data, apply rights to documents, and specify who is allowed to access the documents.

We believe we understand the scope and complexity associated with this effort and believe this scope is with the same understanding.

1.2 Areas Within ScopeWe will deliver a design/deployment for ADRMS solution, as described below.

1.2.1 Envisioning PhaseWe will perform the following activities:

Initiation, preparation and kick-off

Facilitate the solution envisioning workshop, consisting of meetings with members of MOFA IT staff and/or other decision makers, in which the following activities will be conducted:

o Review existing Active Directory core infrastructure.

o Review existing Exchange 2010 infrastructure

o Interview MOFA IT and business decision makers, and document your environmental and solution requirements.

o Determine business and technical requirements for the server infrastructure and pilot deployment.

o Determine functional and operational requirements for the server infrastructure and pilot deployment.

o Determine availability, service level agreement and operating level agreement requirements for the server infrastructure and pilot deployment.

Assessment of the data center production environment to confirm readiness for proceeding with solution deployment.

Confirm project approach and objectives


000MOFA0

1.2.2 Planning PhaseDuring the Planning phase, the team will identify the current state of the customer’s environment and design the solution to meet customer requirements.

The Planning phase is concentrated on the detailed planning of the solution. The project team will review the document protection strategy in addition to the network, client, and directory environments to design a solution and a deployment plan that meet the MOFA requirements and expectations.

Key Microsoft activities:

Assess and document current environment:

o Determine Active Directory architecture.

o Determine networking architecture.

o Determine AD RMS-aware application use.

Define AD RMS solution architecture:

o Review the existing / Create Windows groups.

o Review the existing / Create Exemption List definitions.

o Review the existing / Create AD RMS Templates List definitions, but limited to 5

Solution Design Document.

Solution Deployment Plan.

Key Customer activities:

Required personnel should provide the underlying architectures.

Accept the created documents.

1.2.3 Stabilization and Deployment PhaseThe Stabilizing and Deployment phase involves pilot testing, preparing for solution operation and monitoring, and final acceptance of the solution for deployment.

During the Stabilizing and Deployment phase, a limited pilot stabilization of the solution is conducted in the production environment. The project team will use the validated scripts, create all Active Directory objects and solution components, and validate the deployment checklist. These tasks will be executed in a limited environment, so the project team can finalize the Deployment plan and solution design. This phase can also help the customer diagnose other potential risks to the deployment and determine how to extend the implementation to include additional business scenarios and users who require documentation enforcement using AD RMS.


000MOFA0

Key Microsoft activities:

Configure AD RMS solution in production environment (maximum 2 servers), analyze test results, and apply changes.

Deploy the ADRMS Database on the existing SQL cluster or server available at MOFA, if not MCS will deploy single SQL server

Assisting to publish ADRMS license pipeline URL with F5 (this task needs to be done by MOFA however MCS Consultant can assist depending on time availability)

Create and deploy ADRMS template but limited to 5

Integrate with Exchange 2010

Enable ADRMS functionality for pilot 10 users and test the ADRMS

Enable ADRMS functionality for additional pilot 100 users (mix of LAN, Internet, embassy clients) and test the ADRMS (optional)

Deploying ADRMS clients to Windows XP machines or deploying ADRMS templates on clients is usually done by SCCM, however if SCCM is not deployed by that time then Microsoft will assist MOFA using other ways within the timeline of the project, however in some case, may need more time.

Finalize:

o Solution Design Document

o Solution Deployment Plan

o Create an operations procedure document

Key Customer activities:

Accept the Finalized documents.

1.2.4 Software Products / TechnologiesMicrosoft requires the following software and application media during the project. Table 1: Solution Software Required

Operating Systems

Core Apps Databases Development Languages

Provided by

Windows Server 2008 R2 Std. Edition

ADRMS SQL 2008 R2 English Customer


000MOFA0

1.2.5 Training and Knowledge TransferMicrosoft will provide informal Knowledge Transfer during the entire project lifecycle at the customer site in Riyadh. Microsoft recommends official training for complete understanding of the techno lies which are going to be deployed.

1.3 Areas Out of ScopeAny area that is not explicitly listed in section 1.2 as “within scope” is out of scope for this engagement. The areas that are out of scope for this engagement include, but are not limited to, the following:

Products Training

Repair of major problems of the existing Infrastructure.

Documentation of MOFA network.

Investigation of any non-Microsoft products compatibility with the proposed environment.

Microsoft is not accountable for providing information relevant to any third party software. However Microsoft can provide recommendations for the optimum selection of third party products during the envisioning phase.

Investigation and analysis of Network Utilization

Planning and Designing of an Enterprise CA / PKI Infrastructure. The existing CA servers will be used. PKI upgrade design and deployment has been included as optional item in the SOW. In case MoFA plans to move forward with PKI upgrade, scope items can be provided separately.

Monitoring of solution using Microsoft Systems Centre Operations Manager or 3rd party monitoring tools

Design of Internal/external Firewall environment

Checking the OS Anti-Virus/Backup solutions compatibility with the new Infrastructure.

Hardware/Operating System deployment

Automation / Customization or scripting towards operations if any

The installation or configuration of third party applications in this engagement will be the responsibility of the customer team.

Post-deployment technical support (this should be covered by Premier contracts)

Any client OS Deployment

Define the customer document management strategy and align it with customer business objectives.


000MOFA0

AD RMS pipeline smart card authentication.

Host hardening.

Hardware security module (HSM) key, AD RMS keys protection.

Service Kit training execution and materials.

Product licenses. Product licenses (Microsoft or non-Microsoft) will not be provided under this Work Order. Customer is responsible for acquiring all necessary product licenses required as a result of Work Order.

Hardware will not be provided under this Work Order. Customer is responsible for acquiring all necessary hardware required as a result of Work Order.

Source code review. Customer will not provide Microsoft with access to non-Microsoft source code or source code information. For any non-Microsoft code, Microsoft’s services will be limited to analysis of binary data only, such as a process dump or network monitor trace.


000MOFA0

2 Project Approach, Timeline and Service Deliverables

2.1 ApproachMicrosoft Services leverages the Microsoft Solutions Framework (MSF), a five-phase project approach that has been executed across multiple customer engagements of various project types and sizes. The MSF phases are defined below.

Envisioning: Envisioning is about creating a business vision and defining the scope of work necessary to bring the vision to reality for the entire project. This phase will be done by the lead Architect

Planning: Planning continues until we have detailed functional requirements, system and application architectures, the user interface prototype, and a detailed project plan for the remainder of the project.

Development: Development begins with the first iteration of development and culminates with the functionality complete milestone (or Beta release).

Stabilization: Stabilization represents testing and acceptance.

Deployment: Deployment includes final development, release management, and deployment.

Figure 1 - MSF Phases and Milestones


000MOFA0

Microsoft further enhanced this framework and developed the Services Delivery Methodology (SDM). SDM provides guidance on activities and deliverables that may be executed within each of the MSF phases.

2.2 TimelineIt is estimated that this engagement will be performed according to the timeline depicted below and will include the phases and milestones noted. The actual timeline for this engagement will be relative to the project start date, and the duration provided below is estimate only.

Technology Envision + Plan Develop DeployADRMS 5 X 12ADRMS (300 clients) *

X X 12

Figure 2 - Project Timeline

* The timeline needed to deploy additional ADRMS clients might change depending on type and accessibility of the client.

2.3 Key Service Deliverables and Acceptance Process

2.3.1 Project Service DeliverablesThe following is a list of the project Service Deliverables that will be produced within the scope of this SOW and which must be formally reviewed and accepted under the process described in Section 2.3.2.Table 2: Engagement deliverables

Project Phase

Service Deliverable

Name

Service Deliverable Descriptions

Acceptance Criteria

Envisioning + Plan

Functional Specification

Description of the technical functionalities in a document according to the agreed format defined in the MSF template

Document accurately reflects in-scope requirements and recommended design.

Stabilization and Deployment

Deployment of ADRMS

Deployed ADRMS infrastructure

ADRMS should be working smoothly

2.3.2 Service Deliverable Acceptance ProcessAt specified milestones throughout the project, Microsoft will submit completed project Service Deliverables for Customer’s review and approval. Service Deliverables will fall into the following category:


000MOFA0

- Document Deliverables (e.g. Word, Excel, Visio, Project, etc.);

Customer’s use or partial use of a Service Deliverable will constitute acceptance of that Service Deliverable. Customer may provide its acceptance and/or rejection of deliverables electronically via email. The following details the acceptance process for each of the deliverable types.

Document Deliverables: Within 5 business days from the date of submittal, Customer must either

(i) Accept the Document Deliverable by signing, dating and returning the Service Deliverable Acceptance Form, or

(ii) Provide a written notice rejecting the Document Deliverable, including a single and complete list describing every reason for rejection.

Document Deliverables shall be deemed accepted unless Customer provides a timely, written rejection notice as described above.

Microsoft will correct problems with a Document Deliverable that are identified in the written rejection notice, as described above, and within the scope of this Statement of Work, after which the Document Deliverable will be deemed accepted.

Issues that are outside the scope of this Statement of Work and feedback provided after a Document Deliverable has been deemed accepted will be addressed as a potential change of scope pursuant to the Change Management process outlined in this SOW.


000MOFA0

2.4 Project Governance Approach2.4.1 Part-Time Project Management The project will be managed by a part-time Project Manager; typically this would be a remote role with mutually agreed customer visits. Prior to the start of the engagement, a mutually agreed to coverage plan / meeting schedule will be documented in writing. As this resource is part-time, the following operational constraints are assumed:Table 3: Project Management Activities

Project Management

Description

Communications Provide 1 weekly status Report. Prepare and lead 1 status meeting per week of no more than 1 hour in duration. Remotely attend / participate 1 Steering Committee Meeting per month. Note: All customer meetings will NOT be attended.

Scope Management / Change Control

Attend 1 Scope meeting per week remotely. Manage project Change Control.

Finance Provide weekly Budget Burn Report as part of the weekly status report.

Schedule Manage the schedule for the MCS scope of work and MCS resources.Human Resources / Staff Management

Coordinates MCS resources (only), including staffing, task assignments and status reporting.

The scope of the Microsoft Part-Time Project Management Service is limited to managing Microsoft Consulting Resources (MCS) and Microsoft Partners subcontracted through MCS.

Microsoft will provide project management for the duration defined in the Work Order. Changes to this duration or the amount of hours will be handled by the Change Management Process.

2.4.2 Communication PlanThe following will be used to provide formal communication during the course of the project:

The Microsoft Project Manager, working in conjunction with the Customer Project Manager, will document a detailed Communication Plan as part of the Master Project Management Plan.

The Microsoft Project Manager, working in conjunction with the Customer Project Manager, will compile weekly status reports for distribution to both Customer and Microsoft management

Weekly status meetings will be held to review the project’s overall status, the acceptance of deliverables, the project schedule, and open issues noted in the status report


000MOFA0

An Executive Steering Committee will conduct monthly meetings and produce status reports pursuant to section 2.4.4, below

2.4.3 Issue/Risk Management ProcedureThe following general procedure will be used to manage active project issues and risks during the project:

Identify: Identify and document project issues (current problems) and risks (potential events that impact the project)

Analyze & Prioritize: Assess the impact and determine the highest priority risks and issues that will be managed actively

Plan & Schedule: Decide how high-priority risks are to be managed and assign responsibility for risk management and issue resolution

Track & Report: Monitor and report the status of risks and issues and communicate issue resolutions

Control: Review the effectiveness of the risk and issue management actions

Active issues and risks will be monitored and reassessed on a weekly basis. Mutually agreed upon issue escalation and risk management processes will be defined at the outset of the project.

2.4.4 Change Management ProcessDuring the project, either party may request, in writing, additions, deletions, or modifications to the services described in this SOW (“change request”).

For all change requests, regardless of origin, Microsoft shall submit to Customer Microsoft’s standard Change Request Form, which shall describe the proposed change(s) to the project, including the impact of the change(s) on the project scope, schedule, fees, and expenses.

For all change requests which Customer originates, Microsoft shall have a minimum of 3 business days from receipt of the change request to research and document the proposed change, and prepare the Change Request Form.

Customer shall have 3 business days from your receipt of a completed Change Request Form to accept the proposed change(s) by signing and returning the Change Request Form. If Customer does not sign and return the Change Request Form within the time period prescribed above, the change request will be deemed rejected and Microsoft will not perform the proposed change(s).

No change to this project shall be made unless it is requested and accepted in accordance with the process described in this section. Microsoft shall have no obligation to perform or commence work in connection with any proposed change until a Change Request Form is approved and signed by the designated Project Managers from both parties.


000MOFA0

At Microsoft’s discretion, time required to research and document customer originated change requests will be billed at the standard rates specified in the project Work Order.

2.4.5 Executive Steering CommitteeOverall senior management oversight and strategic direction for this project will be provided by an Executive Steering Committee, which will consist of the following key executive business sponsors and project management representatives:

The Executive Steering Committee will hold meetings and produce meeting minutes on a weekly basis. Customer and Microsoft Managers will share joint responsibility for reporting to the Steering Committee.

The Executive Steering Committee is responsible for the following:

Making decisions on project strategic direction

Serving as the final arbiter of Project issues (refer to the Escalation Process)

Approving significant Change Requests

2.4.6 Escalation ProcessThe Microsoft Project Manager will work closely with the Customer Project Manager, Sponsor, and other designees to manage Project issues, risks, and Change Requests, as described in Sections 2.4.3 and 2.4.4 above. The standard escalation process for review and approval and/or dispute resolution is as follows:

Escalation Path Project Team member (Microsoft or Customer)

Project Manager (Microsoft and Customer)

Microsoft Engagement Manager / Project Sponsor

Executive Steering Committee

Guiding PrinciplesThe escalation path and the related process will be discussed and finalized at the project kickoff, but the following general guiding principles are expected to apply:

Significant project issues/risks, as well as material Change Requests that cannot be resolved by the core project team, will be escalated to the Executive Steering Committee as the final decision maker. The expectation is that the Executive Steering Committee will take positive action to get the issue(s) resolved in a timely manner, accept or implement recommended mitigations for identified risk(s), and/or make final decisions on the disposition of proposed Change Requests.

If a major unresolved item requires escalation prior to a scheduled Executive Steering Committee meeting, a special meeting will be scheduled, or the item will be escalated to the committee in writing.


000MOFA0

It is understood and agreed that if the Executive Steering Committee does not act to resolve items that are presented to it in a timely fashion, project schedule and/or cost slippage may result, which may result in additional Change Requests.

2.5 Project CompletionThe project will be considered complete when any of the following conditions is met:

1. All of the service deliverables identified within this SOW and any Change Requests accepted pursuant to the Change Management Process defined in this document, delivered and accepted or deemed accepted; or

2. The fee provisions of the Work Order have been met; or

3. This SOW is terminated pursuant to the provisions of the agreement.


000MOFA0

3 Project Organization and Staffing

3.1 Project Organization StructureThis section describes the overall project organization structure, reporting relationships, and key project roles.

The project will be organized as depicted in the following diagram.

Figure 3 - Project Organization Chart

3.2 Project Roles and ResponsibilitiesThis section provides a brief description of key project roles and responsibilities.

3.2.1 Customer Project Roles and ResponsibilitiesTable 4: Customer roles and responsibilities

Role Responsibilities Project CommitmentCustomer Project Sponsor

▪ Makes key project decisions, assists in escalating unresolved issues to the Executive Steering Committee, and clears project roadblocks

Customer Project Manager

▪ Primary point of contact for Microsoft team

▪ Responsible for managing and coordinating the overall project

▪ Responsible for resource allocation, risk management, project priorities, and


000MOFA0

Role Responsibilities Project Commitmentcommunication to executive management

▪ Manages day-to-day activities of the project

▪ Coordinates the activities of the team to deliver deliverables according to the project schedule

Technical Team Lead

▪ Primary technical point of contact for the team that is responsible for technical architecture and code deliverables

Lead Business Analyst

▪ Primary functional point of contact for the team that is responsible for functional business analysis

3.2.2 Microsoft Project Roles and ResponsibilitiesTable 5: Microsoft roles and responsibilities

Role Responsibilities Project CommitmentMicrosoft Engagement Manager

▪ Responsible for deliverable quality and Customer’s overall satisfaction with Microsoft’s services

▪ Single point of contact for billing issues, personnel matters, contract extensions, and MCS project status

▪ Facilitate project governance activities and leading the Project Steering Committee

▪ Facilitate project governance activities and leading the Project Steering Committee, providing advice and guidance on:− Project direction and scope− Stakeholder communication issue

resolution and escalation

Part time

Microsoft Project Manager

▪ Responsible for managing and coordinating the overall Microsoft project

▪ Responsible for Microsoft resource allocation, risk management, project priorities, and communication to executive management

▪ Manages day-to-day activities of project

▪ Coordinates the activities of the team to deliver deliverables according to the project schedule

Part time

Microsoft Technical Role (Architect / Consultants)

▪ Provide technical oversight▪ Verifies whether Microsoft

recommended practices are followed▪ Responsible for overall solution

deployment

Part time / Fulltime


000MOFA0

Role Responsibilities Project Commitment▪ Responsible for Knowledge Transfer


000MOFA0

4 General Customer Responsibilities and Project Assumptions

4.1 General Customer ResponsibilitiesDelivery of Microsoft’s services depends upon, among other things, the following:

Customer’s involvement in all aspects of the services

Customer’s ability to provide accurate and complete information, as needed

Customer’s timely and effective completion of the responsibilities, as identified herein

The accuracy and completeness of the Assumptions, identified below

Timely decisions and approvals by Customer’s management

Customer’s completion of site readiness activities (if applicable)

In addition to any Customer activities identified elsewhere in this SOW, Customer will perform or provide the following:

Troubleshooting & redeploying ADRMS clients.

Work with the Microsoft Project Manager to deliver the Project on schedule

Manage Project plan(s), schedules, etc.

Make key day-to-day decisions and provide a single point of contact

Accept deliverables

Provide personnel who are knowledgeable about the current Customer systems

Provide business user representatives as required by the project plan

Provide all test cases, test data, procedures, and personnel needed to conduct the acceptance testing of the solution, including interfaces

Provide access to all necessary Customer work sites, systems logon and passwords

Provide access to other materials and resources as needed, and as advised by us in advance

Provide suitable work spaces with desks, chairs, telephones, etc.


000MOFA0

Provide LAN connections giving the Microsoft onsite team access to the Internet and e-mail

Assume responsibility for management of all non-Microsoft managed vendors

Provide access with proper licenses to all necessary tools and third party products required for Microsoft to complete its assigned tasks

Acquire and install the appropriate server capacity required to support the development and test environments as defined in the scope section of this SOW.

In performing services under this SOW and the applicable Work Order, Microsoft will rely upon any instructions, authorizations, approvals, or other information provided by Customer’s Project Manager or personnel duly designated by Customer’s Project Manager.

4.2 Project AssumptionsThe Services, fees, and delivery schedule for this project are based on the following assumptions:

Throughout the project, Microsoft will submit requests for decisions or feedback for Customer to complete. Decisions are assigned due dates, and it is assumed that Customer will provide the required feedback or make decisions on either the due date agreed upon or (3) business days from the date of submittal. If a decision or feedback is not provided within the due date or (3) business days, it will be addressed as a potential change of scope pursuant to the Change Management process outlined in this SOW.

Current Active Directory and Exchange deployment should be healthy and operational without any issues that affects ADRMS process. In case of technical difficulties, Microsoft recommends logging case from Microsoft Premier Support Services. Your TAM will assist you on these matters.

Current hardware and client operating systems should fulfill solutions requirements for your specific needs.

The availability of your representatives to perform their roles on the project team.

The availability of all the information required for properly envisioning and designing the solution.

Timely availability of the hardware, software, and physical space for the solution test environment.

Product licenses. Product licenses (Microsoft or non-Microsoft) will not be provided under this Work Order. You are responsible for acquiring all necessary product licenses required as a result of Work Order.

Source code review. You will not provide us with access to non-Microsoft source code or source code information. For any non-Microsoft code, our services will be limited to analysis of binary data only, such as a process dump or network monitor trace.


000MOFA0

Troubleshooting is out of scope and will require MOFA to open support ticket via the Microsoft Premier Support which is outside the scope of this project.

All document deliverables will be in English language.


statement of work - wikileaks web viewstatement of work, ... design and deploy active directory...

Documents