Amendment_A0002_Section_J_Attachment_1_SOO_TRACKED_CHANGES.pdf

STATEMENT OF OBJECTIVES

FOR

DEPARTMENT OF DEFENSE (DOD) – JOINT SERVICE PROVIDER (JSP)

SOFTWARE DEFINED NETWORKING (SDN)

Amendment 0002

C.1. BACKGROUND

Joint Service Provider (JSP) provides a full range of information technology services, solutions and customer support to the Department of Defense (DoD) in the National Capital Region, including the Office of the Secretary of Defense (OSD), the Chairman of the Joint Chiefs of Staff

(CJCS) and the Joint Staff (JS), Washington Headquarters Services (WHS), and the Military

Departments (i.e., Army, Navy, Air Force). JSP also provides advice and assistance to the DoD

Chief Information Office and OSD to ensure IT and information resources are managed in a manner that implements the policies and procedures of legislation and the priorities established by the DoD.

The Pentagon’s Routing and Switching infrastructure is very complex, is nearing end of life support, and needs to be modernized to support optimization of network management. The JSP is currently consolidating networks, Pentagon Tenant IT support organizations, building an

Installation Processing Node (IPN) and developing a Joint Regional Security Stack (JRSS)

Migration plan.

The purpose of this document is to provide prospective service providers an overview of the objectives guiding JSP towards this state.

The JSP requires a fully mission-capable (i.e. "Turnkey Solution"), modernized, unclassified

Pentagon network; including service processes, tools, and workflow integration, across the entire compliment of the Pentagon’s 80,000 unclassified ports within 24 months.

C.2. PURPOSE

JSP’s objective is to replace the current Pentagon network infrastructure with a modernized SDN solution that will simplify, flatten, and optimize the network topology. The SDN solution must allow for rapid deployment and operation of the network, minimize impact to end users during deployment phases, and remain interoperable with the existing infrastructure until it is decommissioned. The SDN solution architecture must be extensible through the entirety of the JSP networks within the Pentagon Reservation proper, locations connected to the Metropolitan Area

Network/Wide Area Network (MAN/WAN), Raven Rock Mountain Complex (RRMC), and

Alternate Sites. However, under this acquisition, actual implementation will be limited to the

Pentagon Unclassified common user infrastructure at the Pentagon Reservation proper.

The SDN solution must support the execution of JSP’s mission over the next two (2) years by providing operational flexibility to effectively respond to change.

This SOO describes JSP’s goals, objectives and performance requirements to aid the contractor in developing a comprehensive Contractor Performance Work Statement (CPWS) that will achieve best-value related to the DoD’s Enterprise IT Infrastructure, while maintaining the highest levels of availability, system integrity, and ability to implement commercially available enhancements.

The requested Contractor’s Performance Work Statement (CPWS) covers the contractor services to fully address the overall objectives.

C.3. SCOPE

The scope is the unclassified Pentagon Multiprotocol Label Switching (MPLS)-cloud and down, from the Network Access Point (NAP)/ Joint Base Customer Edge Router (JBCE) boundary down;

exclusive of the IPN internal routers and switches. The flows coming in and out of the IPN are however within scope as they will utilize the solution’s transport. Likewise, as the current state, the scoped effort’s MPLS-cloud extends logically across our MAN/WAN to other sites. The solution must continue to interoperate logically through the NAP/JBCE to other remote sites.

In general, JSP seeks to move the unclassified Pentagon infrastructure to a Software Defined

Networking platform, as part of the National Capital Region ICAN. JSP seeks to simplify, flatten, and optimize its unclassified Pentagon network topology, design, and operations through use of modern routing and automated network orchestration methodologies, as well as network function virtualization technologies, through the use of SDN. JSP seeks to dramatically decrease operational overhead, and time to provision while increasing network efficiency, sustainability, network agility, network flexibility, network performance, and responsiveness to malicious cyber actors.

Concepts and designs for simplifying and optimizing the unclassified Pentagon Infrastructure must take in consideration the Joint Information Environment (JIE) and Joint Regional Security

Stack (JRSS) architectures. Solutions must integrate to or leverage the JRSS Management

System (JMS) through operational support systems (OSSs) and business support systems (BSSs).

The JMS currently is being extended to the JRSS, JBCE, and potentially network devices and switches below the JBCE for out of band network management.

As JSP looks to modernize its infrastructure, through SDN, it intends to take a phased approach to ensure the implementation of this new technology is at the appropriate size and scale. With that, JSP will have three phases that are required to meet the organizations objectives, these phases are:

1) Assessment and Evaluation: Working with current JSP environmental data, the vendor shall provide their own assessment of the JSP environment and provide a plan of action to implement SDN within the stated environment.

2) Test: Provide a plan on how an appropriate test of the proposed SDN solution can be conducted without causing any disruption to JSP day-to-day operations.

3) Implement: Detailed, step-by-step, plan of implementing SDN within the JSP environment.

Each of these phases will be accompanied by a robust review process before proceeding to the next phase. The aforementioned phases should be outlined and addressed in concert with the below objectives to appropriately demonstrate both pre and post-implementation approaches.

C.4. Objectives

The overall objectives of this effort are to enable JSP to have:

1. Automated management and provisioning

2. Reduced staffing and operational overhead

3. Improved capacity and service levels

4. Decreased time to implement and provision

5. Elimination of complexity within the network

6. Reduced cost of sustainment

7. Hardening against cyber threats

8. Scalable solutions with flexibly capacity

9. Open sourced solutions to maximize vendor neutrality

C.5. Sub-Functional Areas

In addition to the aforementioned primary objectives, JSP has identified the following sub-functional areas. It is important to note that the sub-functional areas detailed in this package are for informational purposes to help prospective bidders add fidelity to their approach of meeting

JSP’s objectives. The data has been organized in a manner relevant for collection, validation and maintenance of information.

1. A centralized SDN Controller plane that exerts direct programmatic control of forwarding behavior, thereby actually defining the network (e.g., its logical topology), not merely influencing/configuring it, while providing logical separation from the data plane.

2. A distributed, hierarchical and federated deployment of SDN Controller instances, with Intra-Domain and Inter-Domain connectivity between SDN Controller instances.

3. Northbound Application Programmable Interfaces (APIs), enabling the development of SDN Clients (within applications) that interact with the SDN Controller plane while permitting general views of the network to be created, interrogated and manipulated. These conceptual views can exist at various levels, and they can be combined with virtualization to develop sliced or partitioned views.

4. Southbound APIs to relay information to the switches and routers “below.” Modeling of forwarding and processing behavior, where processing includes computation, storage and physical or virtual network functions (VNF), whether these are directly related to traffic flows or whether they are associated with networking in general

(e.g., processing of aggregated statistics or monitoring of events).

5. Media and connectivity types (e.g. packet and circuit switching technologies; diverse hardware and software platforms, with varying port counts, throughput, capacity, and flexibility, e.g., platforms supporting a fixed set of protocols (i.e., pre-defined protocol parsing and fixed matching/action pipelines), platforms supporting protocol independent forwarding (configurable parsing, matching, and actions), as well as platforms supporting stateful classification and processing.

6. Network Functions Virtualization (NFV), L4-L7 Services, and data plane services:

Identifying relevant traffic and diverting it to / through individual services, service chains or Virtual Network Function forwarding graphs; service specific forwarding, e.g. application-aware QoS, or service specific processing, such as encryption and content replication; managing services and VNFs; static and dynamic network provisioning technologies; tunnels – used to create overlay networks.

7. Traditional and SDN controlled networks to coexist (“Hybrid” scenario) while moving towards partitioning elements with some ports being traditionally controlled, others SDN controlled; SDN control of an overlay network, with traditional control of the underlying network, and vice versa; partitioning of responsibilities, for example, traditional management/monitoring and SDN forwarding configuration or vice versa;

enabling legacy controlled and SDN controlled networks to be interconnected (for both intra-domain and inter-domain scenarios). Includes DoD mandated MPLS Joint

Regional Security Stack and Secure Cloud Computing Architecture.

8. Technologies that bring optical fiber cabling and signals most of the way or all of the way to the end user, with support for existing or future cabling/port standard.

9. Demonstrate a reduction in operational expense, physical labor and the time to provision, change network functions in minutes; consolidation of IT resources through the reduction of switches (to include top of rack), server racks and power consumption.

10. Compliance with Cyber Command (USCYBERCOM), Defense Information Systems

Agency (DISA) Security Technical Information Guidance, NIST Risk Management

Framework and Joint Interoperability Test Command guidance.

C.6. Reporting

At the request of the COR, the contractor shall provide the COR with separate written Project

Status Reports (PSRs) that monitor the progress, cost, schedule, and labor hours expended to date for each Task Assignment issued under this SOO. The PSR shall include a discussion of overall personnel, financial and other issues, including potential impacts on schedules or project plans and recommended actions. Where relevant, the reports shall discuss these issues for each

Task Assignment.

A summary of labor hours (and dollars) expended by Contractor/subcontractor employee by

Task Assignment shall be included in the reports. Each report shall be submitted to the COR in accordance with the delivery schedule agreed upon by the parties. The COR may change the format and content of the reports over time to reflect the dynamic nature of the assigned activities. Although the reports are due at the request of the COR, this shall not relieve the

Contractor of the responsibility to proactively keep the Government informed of issues or problems as they occur (including technical, cost or schedule issues).

The contractor shall also provide weekly updates that inform the COR about the status of each

Task Assignment. Supporting documentation to be developed includes but not limited to:

Critical Decision Point One o Requirements (Initial Conceptual Design (ICD)/ Conceptual Design Decision (CDD)/ Capability Provisioning Document (CPD)/ Operational Need (UONs)/ Joint Urgent

Operational Need Urgent (JUONs) o A signed Project Charter o A Project Management Plan (PMP) including Risk Log o A Financial Management Plan (FMP)

Critical Decision Point Two (Preliminary Design Review (PDR)/ Critical Design

Review (CDR) Assessment, Limited Rate Production (LRP), Full Rate Production

(FRP)

o Traceability (requirements to test cases)/Test Execution/Test Results/Defect

Log – entered directly into the repositories o Systems Capability & Manufacturing Process Demonstration (SCMDP) o Production Operations Manual/Technical Manual, including Deployment, Installation, Back-out, Rollback Plan, engineering change proposals (ECPs)

[if extensive deviations required], Troubleshooting Information, Process

Flowcharts, and Key Monitoring Indicators o Authority to Operate (ATO) including Contracts/Licensing/SLAs /OLAs

6.1. Period and Place of Performance

The base Period of Performance will be one year from date of award with a one-year option.

Services will be provided at DoD JSP and contractor locations within the United States (US).

C.7. OVERARCHING SOLUTION REQUIREMENTS

The Joint Service Provider is seeking a software defined network solution that introduces a carrier class1 approach for the Pentagon Unclassified common user infrastructure, in order to improve the survivability, performance, security, and availability for end points.

To meet the carrier class approach, network services delivered by this solution must not be “best

1 Carrier class is defined as a network that can guarantee a high level of availability and performance to end users.

effort” but instead guarantee a minimum service level for the modernized network. Objectives for the service levels provided by the delivered solution include: minimizing latency and packet delay variation, maximizing effective throughput, and guaranteeing packet delivery on a fully utilized network. The solution should be designed for survivability and should self-heal in the event of a failure without manual intervention.

The Government is not looking for a device only, Life Cycle Replacement (LCR) of the Pentagon’s current unclassified network. The solution is not required to match the current structure of the

Pentagon Core, Distribution, or Access Layers. For example, partial mesh solutions that connect all access switches and eliminate the current distribution and/or core layers will be considered and are encouraged to provide best value, manageability, and agility to the Government. The overall solution should singularly manage and orchestrate all elements (without Enterprise Management

System (EMS) underlays).

The architecture and design should maximize performance, provide the design to support scaling throughput by at least 10x for future expansion phases, and provide real-time telemetry that provides visibility into performance of the network.

The solution must guarantee a service level for:

Latency

Packet Delay Variation

Effective Throughput

Packet Loss in during periods of increased bandwidth utilization

The minimum service levels that the solution should guarantee are listed below:

Table 1. Service Levels

Client Services Value Measurement Interval

Aggregate

Availability

99.8% (Access Layer - Endpoint

Connection)

99.99% (non-access layers including core and distribution)

Minimum Measured Hourly

Reported by Day and Assessed

Monthly

Latency No more than 3ms Minimum Measured Hourly

Reported by Day and Assessed

Monthly

Packet Delay

Variation

No more than 1ms Minimum Measured Hourly

Reported by Day and Assessed

Monthly

Packet Loss No more than 0.1% Minimum Measured Hourly

Reported by Day and Assessed

Monthly

Upgrading connectivity inside of the Pentagon Consolidated Server Rooms (CSR) is not within the required solution scope for this effort. The desire is to extend automation/orchestration and modernize this connectivity in future phases. Interconnections to these locations are required as part of this solution.

End client connectivity at the Pentagon Metropolitan Area Network (MAN) locations is not within the required solution scope for this effort. However the design shall account for future expansion to cover these JSP managed locations in a modernized fashion. Interconnections to MAN locations is required as part of this solution.

C.7.1 Compliance

The Government understands that implementing a new and emerging technology, the

Contractor may not be able to comply with all appropriate JSP, DoD, and National Institute of

Standards and Technology (NIST) approved IA architecture, policies, programs, standards and guidelines. However, the Contractor should maximize compliance, and identify to the

Government those areas that they are unable to achieve compliance. For example, if the solution recommended is not Joint Test Interoperability Command (JTIC) certified, the contractor should identify this and develop a plan to get the solution into the JTIC testing pipeline and approved within the base year of the contract. Listed are key compliance references:

DOD Instruction 8530.01, “Cybersecurity Activities Support to DoD

Information Network Operations “ March 7, 2016

DoD Instruction 8500.01, “Cybersecurity,” March 14, 2014

Security Technical Implementation Guides (STIGs)

Global Information Grid (GIG) IA Technical Framework

NIST Special Publication 800-53

SD 527-1

DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information

Technology (IT),” March 12, 2014, or other DoD accreditation directives/guidance/instructions

IEEE 802.11 Wireless Local Area Network (LAN)

IEEE 802.1x Port Based Network Access Control

Chairman of the Joint Chiefs of Staff Manual 6510 (CJCSM 6510)

C.7.2 Architecture and design

Minimum requirements:

Include the Pentagon Reservation, all sites connected to the MAN/Wide Area Network

(WAN), and required external interfaces and connectivity.

Use SDN controllers and/or an orchestration capability to configure network elements.

Implementations that rely solely on command line configuration will not be considered.

Provide 10/40/100+Gbps (Gigabits per second) Inter-device connectivity via pluggable optics.

Collapse, and simplify the network to improve supportability and reduce labor, http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/853001p.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/853001p.pdf https://fas.org/irp/doddir/dod/i8500_01.pdf https://iase.disa.mil/stigs/Pages/index.aspx http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA606355 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://www.dtic.mil/get-tr-doc/pdf?AD=ADA475787 https://fas.org/irp/doddir/dod/i8510_01.pdf https://fas.org/irp/doddir/dod/i8510_01.pdf https://fas.org/irp/doddir/dod/i8510_01.pdf http://onlinelibrary.wiley.com/doi/10.1002/047086804X.app6/pdf https://standards.ieee.org/findstds/standard/802.1X-2010.html http://www.jcs.mil/Portals/36/Documents/Library/Manuals/m651001.pdf?ver=2016-02-05-175710-897 maintenance, and provisioning cost.

Support future scalability to at least 10 x capacity in future expansion phases.

Leverage open standards rather than relying on vendor-specific devices and protocols.

Provide Out-Of-Band (OOB) access in every telecommunications closet to connect transport devices and associated management infrastructure

Remain interoperable with the existing infrastructure

Utilize components which maintenance can be purchased for a minimum of five years

Support the Power Over Ethernet Plus (PoE +) standard for edge ports

Support Dynamic Host Configuration Protocol (DHCP) Helper or Relay Agents

C.7.3 Planning Factors

The following planning factors are provided as initial architecture and design inputs. Initial architecture and design shall be based on these planning factors. It is expected that during discovery these planning factors will be validated and updated where required for the final design.

Planning Factors

Number of end-points in the Pentagon Reservation 80,000

Number of Installation Processing Node (IPN), or Data Center end-points in the Pentagon Reservation 60,000

Number of end-points in the Pentagon Reservation (Including

IPN and Data Center Ports) 140,000

Number of end-points including the MAN/WAN locations 500,000

Number of unclassified/classified telecommunications closets in the Pentagon Reservation

Average Number of 10/100/1000Mbps RJ-45 Copper customer

Ports per access layer closet

Number of 1/10Gbps customer ports per closet via pluggable

MM/SM fiber optics

Committed Information Rate (CIR) for each copper customer port 100 Mbps

Committed Information Rate (CIR) for each fiber customer port 1000 Mbps

End Users in the Pentagon Reservation 25,000

VoIP Phones in the Pentagon Reservation 25,000

VTC End Points in the Pentagon Reservation 500

Number of Wireless Access Points in the Pentagon Reservation, currently copper connected with Dual RJ-45 10/100/1000Mbps interfaces

Current throughput to Internet/Other networks 1.3 Gbps

Current max routed throughput between various segmented

L3/L2 domains 6-8 Gbps

Current max throughput between any two segments of the current infrastructure 10 Gbps

Number of Consolidated Server Rooms in the Pentagon† 10

Number of Network Access Points (NAPs)‡ 3

† CSRs currently exist in Wedges 0, 1, 2, 4, and 5 of the Pentagon. In addition, the Mark Center, Target Site 1, and Target Site 2 host CSRs that are accessible over the MAN and Wide Area

Network (WAN). The connectivity to Mark Center, Target Site 1, and Target Site 2 locations must be incorporated into the proposed MAN interface connectivity solution. Future consolidation efforts will consolidate CSRs further into three redundant physical Installation

Processing Node (IPN) locations within the Pentagon Reservation, and two locations outside of the Pentagon (Mark Center and Target Site 1).

‡ The current NAPs separate traffic between the untrusted external networks and the multiple trusted internal security zones. The three NAPs are geographically dispersed between the

Pentagon Reservation and an external location. A project is currently underway to transition services from the NAPs to the DISA provided Joint Regional Security Stacks (JRSS). This migration is expected to be in progress during the execution of this contract’s Period of

Performance. It is required that coordination between this effort and the JRSS migration team occur both the programmatic and engineering level to minimize risks to both efforts.

C.8. Constraints

This section lists laws, rules, regulations, standards, technology limitations and other constraints that the service and/or service provider must adhere to or work under.

C.8.1. Security

This section shall be considered a supplement to the security requirements in the Government-provided DD Form 254, Contract Classification Specification. A DD Form 254, Contract

Security Classification Specification, shall be coordinated with the contracting office and the program office at the time of the contract award date. The work for this CPWS is focused on unclassified systems that are accredited for Sensitive but Unclassified (SBU) Information. A majority of the work will be accomplished in U.S. Secret accredited spaces. There may be certain circumstances where the work may need to be accomplished on equipment that processes NATO information. There may be certain circumstances where the work may need to be accomplished in a Sensitive Compartmented Information Facility (SCIF). Access for contractor personnel to any government space shall not be authorized without an approved DD Form 254 and the appropriate personnel security clearances. Classified work, if required, shall not be authorized without an approved DD Form 254 and the appropriate personnel security clearances.

The Contractor shall adhere to all security-related laws, requirements, and regulations that bind the Government. Subcontractors shall comply with the same security clearance requirements as the prime contractor. The Contractor shall issue DD Form 254s to each subcontractor, as directed by the Government, reflecting the level of security requirements applicable, based on the level of support provided by the subcontractor.

If security requirements are not met or maintained, the Government reserves the right to terminate the contract.

Physical Security

The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use at the Government facility. At the close of each work period, Government facilities, equipment, and materials shall be secured.

Facility Security Clearance

The Contractor shall possess and maintain a TOP SECRET facility clearance from the Defense

Security Service.

Home Land Security Presidential Directive -12 (HSPD-12)

The Contractor shall comply with DoD personal identity verification procedures that implement

Homeland Security Presidential Directive 12 and Federal Information Processing Standards

Publication (FIPS PUB) Number 201. The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have physical access to a federally controlled facility or access to a Federal Information system.

Personnel Security

If security requirements are not met or maintained, the Government reserves the right to terminate the contract. Visit Authorization Requests (VAR). Visit requests shall be processed and verified through the Joint Personnel Adjudication System (JPAS). Contractors shall submit visit authorizations to the Contracting Officer Representative (COR) identified in Section G of the solicitation.

The Contractor shall have sufficient number of cleared contractor personnel with unescorted access and escort privileges to classified network facilities throughout the period of performance.

All contractor personnel must have, at a minimum, an interim Secret clearance. Certain contractor personnel will require a Secret clearance with NATO eligibility. Certain contractor personnel will require up to Top Secret – Sensitive Compartmented Information (DIA

Adjudicated or capable of reciprocal acceptance by DIA). Therefore, the Contractor shall have personnel on contract that have a completed a Single Scope Background Investigation (SSBI) and be Sensitive Compartmented Information (SCI) access eligible. Key Personnel must have, at a minimum, valid clearances at proposal submission and shall maintain this status throughout their involvement with this contract. Contractor personnel shall have valid personnel security clearances at the appropriate level no later than thirty (30) business days prior to beginning work on this effort and shall maintain this status throughout their involvement with this contract.

Cyber Security

IT Sensitivity Levels

JSP supports workstations that reside on the NIPRNet, SIPRNet, and Joint Worldwide

Intelligence Communications System (JWICS). In accordance with DoD Instruction (DoDI)

8500.2, Information Assurance (IA) Implementation, certain investigative levels for contractors working on DoD Information Systems are required. The IT Sensitivity Levels identified in the IT

Sensitivity Levels Table shall apply.

Table 4. IT Sensitivity Levels

Circumstances IT LEVEL

Technicians with access to router ACLs, VPN devices, Firewall Rule sets; Technicians assigned to assist in data spills; Technicians that require access to Top Secret facilities; Supervisors of personnel who have these responsibilities.

IT-I Privileged, Final TS

Project Leaders, System Analysts, System

Architects, and Senior Technicians with administrative privileges to the devices.

IT-II Limited Privileged, Final Secret

Contractor personnel who perform work on DoD Automated Information Systems (AIS) must have one of three position sensitivity designations: ADP-I (AKA: Information Technology (IT)-

1): Single Scope Background Investigation (SSBI)/Single Scope Background Periodic

Reinvestigation (SBPR)/Phased Period Reinvestigation (PPR)ADP-II (AKA: IT-2): Access

National Agency Check with Inquiries (ANACI)/National Agency Check with Inquiries

(NACI)/National Agency Check, Local Agency Checks, Credit Checks (NACLC) ADP-III

(AKA: IT-3): National Agency Check (NAC)/Entry National Agency Check (ENTNAC) in accordance with DoDI 5200.2-R Personnel Security Program. These designations are Critical

Sensitive ADP-I or Non-Critical Sensitive ADP-II. The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoDD 8570.01-M, Information

Assurance Workforce Improvement Program.