RFP 19SA4026R0003 DIA Circuits services-.pdf

1 | P a g e

TABLE OF CONTENTS

Section 1 - The Schedule

• SF 1449 cover sheet

• Continuation To SF-1449, RFP Number 19SA4026R0003, Prices, Block 23

• Continuation To SF-1449, RFP Number 19SA4026R0003, Schedule Of

Supplies/Services, Block 20 Description/Specifications/Work Statement

• Attachment 1 CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

SOFTWARE PRODUCER ATTESTATION FORM’

Section 2 - Contract Clauses

• Contract Clauses

• Addendum to Contract Clauses - FAR and DOSAR Clauses not Prescribed in Part 12

Section 3 - Solicitation Provisions

• Solicitation Provisions

• Addendum to Solicitation Provisions - FAR and DOSAR Provisions not Prescribed in

Part 12

Section 4 - Evaluation Factors

• Evaluation Factors

• Addendum to Evaluation Factors - FAR and DOSAR Provisions not Prescribed in Part 12

Section 5 - Offeror Representations and Certifications

• Offeror Representations and Certifications

• Addendum to Offeror Representations and Certifications - FAR and DOSAR Provisions not Prescribed in Part 12

2 | P a g e

SECTION 1 - THE SCHEDULE

CONTINUATION TO SF-1449, RFP NUMBER 19SA4026R0003

PRICES BLOCK 23

I. SCOPE OF SERVICES

The Contractor shall complete all work, including furnishing all labor, material, equipment, and services, unless otherwise specified herein, required under this contract for stated services within the time specified herein. The price listed below shall include all labor, materials, overhead, and profit. In consideration of satisfactory performance of all scheduled services required under this contract, the Contractor shall be paid a firm fixed-price for all services.

II. PERIOD

The contract will be for a one-year period from the date of the contract award and a notice to proceed with 2 option years.

1. The Contractor shall furnish all engineering, labor, tools, equipment, materials, supplies and services to provide the required circuit as specified under Section 1, hereof:

2. Prices. In consideration of satisfactory performance of the services required under this contract, the Contractor shall be paid a firm fixed-price (FFP) per month as stated in the schedule below in SAR (Saudi Arabian Riyals). Carrier shall be responsible for payment end-to-end circuit billing.

2.1 VALUE ADDED TAX

VALUE ADDED TAX. Value Added Tax (VAT) is not included in the CLIN rates. Instead, it will be priced as a separate Line Item in the contract and on Invoices. Local law dictates the portion of the contract price that is subject to VAT; this percentage is multiplied only against that portion. It is reflected for each performance period. The portions of the solicitation subject to VAT are:

2.2 The firm fixed-prices are in SAR (Saudi Arabian Riyals) OR USD (United States Dollar

JAMES ZADROGA 9/11 VICTIMS HEALTH AND COMPENSATION ACT OF 2010 NOTICE:

UNLESS A WAIVER OR EXCEPTION APPLIES, PAYMENTS SUBSEQUENT TO THIS

PROCUREMENT ARE SUBJECT TO AN EXCISE TAX OF 2% PERSUANT TO 26 U.S.C.

5000C.

3 | P a g e

2.2.1 BASE YEAR:

CLIN

Sub

CLIN

Description of Services Number of

Months Monthly Price

Total Firm-Fixed Price

(NAICS

517111 532490)

OpenNet - VPN OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 61440Kbps (60Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

Price shall include ISP and Lease circuit.

2 Initial Installation (once off)

(NAICS

517111 532490)

ITC - VPN

OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 102400 Kbps (100 Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

Price shall include ISP and Lease circuit.

4 Initial Installation (once off)

(NAICS

517111 532490)

WiFi Circuit - VPN OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 30720 Kbps (30 Mbps) providing fault tolerance in the last mile.

4 | P a g e

HSRP protocol is required.

6 Initial Installation (once off)

SUB-TOTAL

VAT 15%

CLIN 0001 GRAND TOTAL

2.2.2 OPTION YEAR 1:

Sub

CLIN

Description of Services Number of

Months Monthly Price

Total Firm-Fixed Price

(NAICS

517111 532490)

OpenNet - VPN OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 61440Kbps (60Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

5 | P a g e

517111 532490)

ITC - VPN

OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 102400 Kbps (100 Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

Price shall include ISP and

4 Initial Installation (once off)

517111 532490)

WiFi - VPN WiFi (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 30720Kbps (30 Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

CLIN 1001 GRAND TOTAL

6 | P a g e

2.2.3 OPTION YEAR 2:

Sub

CLIN

Description of Services Number of

Months

517111 532490)

OpenNet - VPN OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 61440Kbps (60Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

Lease circuit

517111 532490)

ITC - VPN

OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 102400 Kbps (100 Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

Price shall include ISP and

517111 532490)

WiFi - VPN WiFi (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 30720 Kbps (30

7 | P a g e

Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

CLIN 2001 GRAND TOTAL

2.2.4 52-217-8 OPTION TO EXTEND SERVICES:

Offerors are encouraged to complete the following pricing table for FAR Clause 52.217-8 Option to Extend Services for 6 months. The cost/price information provided will also be used to evaluate total price for all options (52.217-5) to the total price for the basic requirement ONLY.

The price offered in the table below will not be included in the total contract award amount;

however, if you choose not to provide any cost/price information for each line item below, you

Sub

CLIN

Description of Services Number of

Months

517111 532490)

OpenNet - VPN OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 61440Kbps (60Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

Lease circuit

8 | P a g e

517111 532490)

ITC - VPN

OpenNet Plus (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 102400 Kbps (100 Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

Price shall include ISP and

517111 532490)

WiFi - VPN WiFi (VPN through the Internet) at the US Consulate Compound at Mohammedia District in Jeddah, Saudi Arabia. One (1) dedicated Internet channel at minimum 30720 Kbps (30 Mbps) providing fault tolerance in the last mile.

HSRP protocol is required.

CLIN 3001 GRAND TOTAL

9 | P a g e

2.2.5 GRAND TOTAL:

GRAND TOTAL CONTRACT PRICE, INCLUDING ALL OPTION YEARS

Base Period Total Price (CLIN 0001)

First Option Year Total Price (CLIN 1001)

Second Option Year Total Price (CLIN 2001)

52.217-8 (6 Months) (CLIN 3001

GRAND TOTAL FIRM-FIXED PRICE FOR

BASE YEAR PLUS ALL OPTIONS

_________________________________End of Price Table_____________________________

10 | P a g e

CONTINUATION TO SF-1449, RFP NUMBER 19SA4026R0003

SCHEDULE OF SUPPLIES/SERVICES, BLOCK 20

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

I SCOPE OF WORK

The purpose of this firm fixed price contract is to obtain VPN, Internet Services, and Circuitry for three (3) separate circuits (VNET, DTSPO and VNET WiFi) for the U.S. Consulate General in Jeddah.

The local Telecommunication’s Internet Service Provider (ISP) contracting firm must provide internet services and dedicated leased line channels and circuitry for connecting American Consulate General in Jeddah and remote U.S. Consulate Annex locations data links as shown below in this technical paper.

LIST OF CIRCUITS:

CLIN# Circuit Name Bandwidth Location Clin#1 VNET Opennet Plus 60 Mbps Jeddah Clin#2 DTSPO ITC 100 Mbps Jeddah Clin#3 VNET WiFi 30 Mbps Jeddah

CLIN#1 VNET Opennet Plus Circuit SERVICE: VENT - OpenNet-VPN NAME: OpenNet Plus (VPN through the Internet) at the U.S. Consulate

General Jeddah DESCRIPTION: One (1) dedicated Internet channel at minimum 61440 Kbps (60Mbps) providing fault tolerance in the last mile. HSRP protocol is required.

TYPE OF

SERVICE:

Dedicated Internet Channel Fiber

LOCATION: American Consulate General, Prince Sultan Street, Jeddah

THE PROVIDED INTERNET SERVICE SHALL COMPLY WITH THE FOLLOWING

REQUIREMENTS:

Internet Services Quality Internet Service Provider (ISP) shall provide dedicated (not shared or bundled) leased channel high-speed access to the Internet; data transport media must be fiber optic, terrestrial connectivity. Twenty-four (24) hours uplink. Post Internet Service Provider (ISP) connection must be "always on" with unlimited usage, and must not require the installation of any custom software on the client side.

11 | P a g e

Internet Service Provider (ISP) digital bandwidth is the amount or volume of data that may be sent through the channel, measured in kilobits per second (Kbps), without distortion. Required Bandwidth connection is defined in each service description.

For Internet Services the Internet Service Provider (ISP) must guarantee full contracted bandwidth availability 24X7X365 from the originator side to the ISP’s internet gateway.

Bandwidth sharing between other non-Consulate customers is not allowed. Connection Ratio must be 1/1.

Internet Service or data service transmission from the originating information server towards an end server is referred to as downstream; and a transmission from an end user towards the remote server is referred as upstream; Post Internet Service Provider (ISP) Contention Ratio (downstream / upstream) must be 1:1 /1:1.

Internet Service Provider (ISP) must provide excellent Quality of Service (QOS) for the connection, that represents the level of consistent download capacity provided, must be the higher QOS percentage possible but, at minimum, greater than 99.97% or the highest possible quality of service connection reaching 100%.

The ISP must provide a symmetrical internet connection, allowing upload and download data transfers simultaneously at the same speed.

Internet Service Provider (ISP) connection must NOT, repeat, NOT use Network Address Translation (NAT).

Internet Service Provider (ISP) Round Trip Time (RTT) reports the total time in milliseconds

(ms) time to send a small data packet and obtain a reply back; must be the faster than 100ms for the Round Trip Time (RTT) for internet service. Also, RTT must be faster than 7ms for local data services (for instance: point-to-point channels or web pages accessed through the Saudi Network Access Point (NAP).

Internet Service Provider (ISP) must permit the transit of all Internet Protocol (IP) protocols (especially IPSec), including but not limited to, User Datagram Protocol (UDP), Transmission Control Protocol (TCP), and IPSEC to transit without filters or proxies. Unfiltered access to the Internet is required without ISP firewall blocking. Filters or sniffers must not be established, connected, or introduced by the ISP for any Consulate channels. If there are any existing filters, sniffers, restrictions, or proxies, they must be identified, and removed prior lease line circuit installation.

Internet Service Provider (ISP) must permit installation of Customer VPN encryption devices on circuit.

12 | P a g e

Internet Service Provider (ISP) must provide detailed network topology map that shows all possible paths ISP use for the internet traffic between ISP hub in Jeddah and the ISP hub in United States of America (USA).

Internet Service Provider (ISP) must have redundancy in the Internet backbone between Saudi Arabia and USA. For instance, If NAP of the host country’s backbone fail, NAP Americas, NAP Sprint, or any other alternate backbone paths shall be available.

Internet Service Provider (ISP) must provide fault-tolerance Fiber Optic connectivity to the very end at the U.S. Consulate General compound Telecommunications Service Entrance Facilities (TSEF) Room.

Network Identification Internet Service Provider (ISP) must provide a block of sixteen (16) public internet IP addresses on a single subnet for Internet services.

Internet Service Provider (ISP) must provide IP addresses used to identify the single subnet address in Classless Inter-Domain Routing address specification (Network IP address / 28) or, equivalently, its subnet mask 255.255.255.240, and ISP Gateway IP addresses (virtual IP addresses).

Network Devices The network devices shall comply with the following characteristics:

Internet Service Provider (ISP) must permit ping and trace route traffic from 169.252.0.0/16 and 169.253.0.0/16 to the ISP connection RJ45 10/100BaseT router interface which terminates Customer VPN encryption device.

Services provided by the Internet Service Provider (ISP) must be delivered with RJ-45 interface connectors with a 10/100baseT interface.

Internet Service Provider (ISP) must provide routers and Data media converters or transmission devices in all cases.

Power standard sources must be dual voltage (110v/60hz and 220v/50hz)

Devices must be Rack mountable in a standard Commercial off-the-shelf (COTS) rack.

One separate or individual physical interface connector is required per service.

Service Support and Contingencies The awarded ISP must warrant service support 7X24X365.

13 | P a g e

The vendor must warrant service support on site if necessary 7X24X365, services must be coordinated directly with Consulate’s Contracting Office Representative (COR) or Information Technology (IT) representative from the Consulate Information Systems Center (ISC).

Expected service availability and reliability must be at minimum 99.97%.

The awarded ISP must have direct connection capability with major United States of America (U.S.A) telecommunication providers (ISPs) at Internet tier 1 level, having alternative line channels or backups in case of main Internet path malfunctioning.

The awarded ISP must provide on line web access data traffic analysis graphs capabilities.

Graphs must be updated on a daily basis. Graphs must retain traffic history behavior for at least one year.

The awarded ISP must provide a central Information Technology (IT) point of contact (POC) in order to promptly coordinate technical issues during the initial installation

14 | P a g e

CLIN# 2 – DTSPO - ITC

SERVICE: ITC-VPN

NAME: ITC (VPN through the Internet) at the U.S. Consulate General Jeddah

DESCRIPTION: One (1) dedicated Internet channel at minimum 102400 Kbps (100 Mbps) providing fault tolerance in the last mile. HSRP protocol is required.

TYPE OF

Dedicated Internet Channel

REQUIREMENTS:

Internet Services Quality Internet Service Provider (ISP) shall provide dedicated (not shared or bundled) leased channel high-speed access to the Internet; data transport media must be fiber optic, terrestrial connectivity. Twenty-four (24) hours uplink. Post Internet Service Provider (ISP) connection must be "always on" with unlimited usage, and must not require the installation of any custom software on the client side.

Internet Service Provider (ISP) digital bandwidth is the amount or volume of data that may be sent through the channel, measured in kilobits per second (Kbps), without distortion. Required Bandwidth connection is defined in each service description.

For Internet Services the Internet Service Provider (ISP) must guarantee full contracted bandwidth availability 24X7X365 from the originator side to the ISP’s internet gateway.

Bandwidth sharing between other non-Embassy customers is not allowed. Connection Ratio must be 1/1.

Internet Service or data service transmission from the originating information server towards an end server is referred to as downstream; and a transmission from an end user towards the remote server is referred as upstream; Post Internet Service Provider (ISP) Contention Ratio (downstream / upstream) must be 1:1 /1:1.

Internet Service Provider (ISP) must provide excellent Quality of Service (QOS) for the connection, that represents the level of consistent download capacity provided, must be the higher QOS percentage possible but, at minimum, greater than 99.97% or the highest possible quality of service connection reaching 100%.

The ISP must provide a symmetrical internet connection, allowing upload and download data transfers simultaneously at the same speed.

15 | P a g e

Internet Service Provider (ISP) connection must NOT, repeat, NOT use Network Address Translation (NAT).

Internet Service Provider (ISP) Round Trip Time (RTT) reports the total time in milliseconds (ms) time to send a small data packet and obtain a reply back; must be the faster than 100ms for the Round Trip Time (RTT) for internet service. Also, RTT must be faster than 7ms for local data services (for instance: point-to-point channels or web pages accessed through the Saudi Network Access Point (NAP).

Internet Service Provider (ISP) must permit the transit of all Internet Protocol (IP) protocols (especially IPSec), including but not limited to, User Datagram Protocol (UDP), Transmission Control Protocol (TCP), and IPSEC to transit without filters or proxies. Unfiltered access to the Internet is required without ISP firewall blocking. Filters or sniffers must not be established, connected, or introduced by the ISP for any Embassy channels. If there are any existing filters, sniffers, restrictions, or proxies, they must be identified, and removed prior lease line circuit installation.

Internet Service Provider (ISP) must permit installation of Customer VPN encryption devices on circuit.

Internet Service Provider (ISP) must provide detailed network topology map that shows all possible paths ISP use for the internet traffic between ISP hub in Jeddah and the ISP hub in United States of America (USA).

Internet Service Provider (ISP) must have redundancy in the Internet backbone between Saudi Arabia and USA. For instance, If NAP of the host country’s backbone fail, NAP Americas, NAP Sprint, or any other alternate backbone paths shall be available.

Internet Service Provider (ISP) must provide fault-tolerance Fiber Optic connectivity to the very end at the U.S. Consulate General compound Telecommunications Service Entrance Facilities (TSEF) Room.

Network Identification Internet Service Provider (ISP) must provide a block of sixteen (16) public internet IP addresses on a single subnet for Internet services.

Internet Service Provider (ISP) must provide IP addresses used to identify the single subnet address in Classless Inter-Domain Routing address specification (Network IP address / 28) or, equivalently, its subnet mask 255.255.255.240, and ISP Gateway IP addresses (virtual IP addresses).

16 | P a g e

Network Devices The network devices shall comply with the following characteristics:

Internet Service Provider (ISP) must permit ping and trace route traffic from 169.252.0.0/16 and 169.253.0.0/16 to the ISP connection RJ45 10/100BaseT router interface which terminates Customer VPN encryption device.

Services provided by the Internet Service Provider (ISP) must be delivered with RJ-45 interface connectors with a 10/100baseT interface.

Internet Service Provider (ISP) must provide routers and Data media converters or transmission devices in all cases.

Power standard sources must be dual voltage (110v/60hz and 220v/50hz)

Devices must be Rack mountable in a standard Commercial off-the-shelf (COTS) rack.

One separate or individual physical interface connector is required per service.

Service Support and Contingencies The awarded ISP must warrant service support 7X24X365.

The vendor must warrant service support on site if necessary 7X24X365, services must be coordinated directly with Embassy’s Contracting Office Representative (COR) or Information Technology (IT) representative from the Embassy Information Systems Center (ISC).

Expected service availability and reliability must be at minimum 99.97%.

The awarded ISP must have direct connection capability with major United States of America (U.S.A) telecommunication providers (ISPs) at Internet tier 1 level, having alternative line channels or backups in case of main Internet path malfunctioning.

The awarded ISP must provide on line web access data traffic analysis graphs capabilities.

Graphs must be updated on a daily basis. Graphs must retain traffic history behavior for at least one year.

The awarded ISP must provide a central Information Technology (IT) point of contact process.

17 | P a g e

CLIN# 3 – WiFi circuit

SERVICE: WiFi NAME: WiFi (VPN through the Internet) at the U.S. Consulate General

Jeddah DESCRIPTION: One (1) dedicated Internet channel at minimum 30720 Kbps (30 Mbps) providing fault tolerance in the last mile. HSRP protocol is required.

TYPE OF

Dedicated Internet Channel Fiber

REQUIREMENTS:

Internet Services Quality Internet Service Provider (ISP) shall provide dedicated (not shared or bundled) leased channel high-speed access to the Internet; data transport media must be fiber optic, terrestrial connectivity. Twenty-four (24) hours uplink. Post Internet Service Provider (ISP) connection must be "always on" with unlimited usage, and must not require the installation of any custom software on the client side.

Internet Service Provider (ISP) digital bandwidth is the amount or volume of data that may be sent through the channel, measured in kilobits per second (Kbps), without distortion. Required Bandwidth connection is defined in each service description.

For Internet Services the Internet Service Provider (ISP) must guarantee full contracted bandwidth availability 24X7X365 from the originator side to the ISP’s internet gateway.

Bandwidth sharing between other non-Consulate customers is not allowed. Connection Ratio must be 1/1.

Internet Service or data service transmission from the originating information server towards an end server is referred to as downstream; and a transmission from an end user towards the remote server is referred as upstream; Post Internet Service Provider (ISP) Contention Ratio (downstream / upstream) must be 1:1 /1:1.

Internet Service Provider (ISP) must provide excellent Quality of Service (QOS) for the connection, that represents the level of consistent download capacity provided, must be the higher QOS percentage possible but, at minimum, greater than 99.97% or the highest possible quality of service connection reaching 100%.

The ISP must provide a symmetrical internet connection, allowing upload and download data transfers simultaneously at the same speed.

18 | P a g e

Internet Service Provider (ISP) connection must NOT, repeat, NOT use Network Address Translation (NAT).

Internet Service Provider (ISP) Round Trip Time (RTT) reports the total time in milliseconds

(ms) time to send a small data packet and obtain a reply back; must be the faster than 100ms for the Round Trip Time (RTT) for internet service. Also, RTT must be faster than 7ms for local data services (for instance: point-to-point channels or web pages accessed through the Saudi Network Access Point (NAP).

Internet Service Provider (ISP) must permit the transit of all Internet Protocol (IP) protocols (especially IPSec), including but not limited to, User Datagram Protocol (UDP), Transmission Control Protocol (TCP), and IPSEC to transit without filters or proxies. Unfiltered access to the Internet is required without ISP firewall blocking. Filters or sniffers must not be established, connected, or introduced by the ISP for any Consulate channels. If there are any existing filters, sniffers, restrictions, or proxies, they must be identified, and removed prior lease line circuit installation.

Internet Service Provider (ISP) must permit installation of Customer VPN encryption devices on circuit.

Internet Service Provider (ISP) must provide detailed network topology map that shows all possible paths ISP use for the internet traffic between ISP hub in Jeddah and the ISP hub in United States of America (USA).

Internet Service Provider (ISP) must have redundancy in the Internet backbone between Saudi Arabia and USA. For instance, If NAP of the host country’s backbone fail, NAP Americas, NAP Sprint, or any other alternate backbone paths shall be available.

Internet Service Provider (ISP) must provide fault-tolerance Fiber Optic connectivity to the very end at the U.S. Consulate General compound Telecommunications Service Entrance Facilities (TSEF) Room.

Network Identification Internet Service Provider (ISP) must provide a block of sixteen (16) public internet IP addresses on a single subnet for Internet services.

Internet Service Provider (ISP) must provide IP addresses used to identify the single subnet address in Classless Inter-Domain Routing address specification (Network IP address / 28) or, equivalently, its subnet mask 255.255.255.240, and ISP Gateway IP addresses (virtual IP addresses).

Network Devices The network devices shall comply with the following characteristics:

19 | P a g e

Internet Service Provider (ISP) must permit ping and trace route traffic from 169.252.0.0/16 and 169.253.0.0/16 to the ISP connection RJ45 10/100BaseT router interface which terminates Customer VPN encryption device.

Services provided by the Internet Service Provider (ISP) must be delivered with RJ-45 interface connectors with a 10/100baseT interface.

Internet Service Provider (ISP) must provide routers and Data media converters or transmission devices in all cases.

Power standard sources must be dual voltage (110v/60hz and 220v/50hz)

Devices must be Rack mountable in a standard Commercial off-the-shelf (COTS) rack.

One separate or individual physical interface connector is required per service.

Service Support and Contingencies The awarded ISP must warrant service support 7X24X365.

The vendor must warrant service support on site if necessary 7X24X365, services must be coordinated directly with Consulate’s Contracting Office Representative (COR) or Information Technology (IT) representative from the Consulate Information Systems Center (ISC).

Expected service availability and reliability must be at minimum 99.97%.

The awarded ISP must have direct connection capability with major United States of America (U.S.A) telecommunication providers (ISPs) at Internet tier 1 level, having alternative line channels or backups in case of main Internet path malfunctioning.

The awarded ISP must provide on line web access data traffic analysis graphs capabilities.

Graphs must be updated on a daily basis. Graphs must retain traffic history behavior for at least one year.

The awarded ISP must provide a central Information Technology (IT) point of contact

20 | P a g e

II. GENERAL:

The Department of State has a requirement for one full period, full duplex, clear channels, and digital circuits capable of supporting synchronous traffic. Open net plus 46080 Kbps (45Mbps) & ITC 51200 Kbps (50Mbps), between the Main Distribution Frame [MDF] of U.S Consulate Jeddah and the Main Distribution Frame (MDF) STC (Saudi Telecom Company). For clear channel circuits, they shall be completely transparent to Open net plus 46080 Kbps (45Mbps) & ITC 51200 Kbps (50Mbps) data, with no bits added to or deleted from the bit stream provided to the interface of the Department of State equipment. The circuit shall be supplied for the transmission of a multiplexed aggregate bit stream for telegraphic and data signals.

These digital services shall be via Optic Fiber. The service shall be for the exclusive use of the Department of State, 24-hours per day, 7 days per week, and 52 weeks per year.

C. The Contractor shall coordinate the service and shall be responsible for the technical sufficiency of the circuit, including services necessary to establish, operate, and restore the circuit. Except for modems and terminal equipment furnished by the Government, the Contractor shall provide all equipment, materials, and supplies required to provide the service which includes the Data Service Unit (DSU) configured with Data Communications Equipment

(DCE) interface. If required, signal element timing shall be provided by the Contractor’s facility.

D. The Contractor shall provide sufficient technical support to ensure uninterrupted End-to-end service between such terminal points as are covered in this contract. The Contractor shall provide, properly adjust, and maintain the circuit for continuous Department of State use. The Contractor shall ensure that the circuit complies with service changes, additions, or deletions as required under this contract.

E. RESERVE

F. RESERVE

G. The Contractor shall supply a Data Service Unit(s) (DSUs) configured with a Data

Communications Equipment (DCE) interface. Signal element timing shall be provided as follows: (1) timing to the American Consulate will be provided by the Contractor’s facility.

H. The Contractor shall use the following for interface standards:

OVERSEAS: RS-530 electrical/mechanical where available, or RS-422 electrical interface and RS-449 mechanical interface will be required between the DSU/CSU and the Department of State furnished equipment located at the American Consulate Jeddah

21 | P a g e

NOTE: Where applicable for digital service and for information purposes:

I. Services. This is a firm fixed-price contract for the lease of one full period, full duplex, clear channel, digital circuit capable of supporting synchronous data transfer. The circuit shall be completely transparent to 46080 Kbps (45Mbps) data, with no bits added to or deleted from the bit stream provided to the interface of the Department of State equipment. The circuit shall be supplied for the transmission of a multiplexed aggregate bit stream for telegraphic and data signals.

J. Bit Error Rate Test (BERT) The bit error rate (BER) for the service shall not be greater than 1 in 10 to the 6 bits for 99.7% of the time, for all time.

K. Acceptable Level of Performance. The Standard of Performance (SP) for this contract is

99.7% percent availability per month (100 percent less 0.3 percent each month for corrective and preventive maintenance).

L. Inspection and Acceptance. Unless specified in the Contract, the Government shall require a period not to exceed 24 hours in order to perform testing to determine acceptance of the required circuit under Section C. The U.S. destination point or the U.S.

foreign post shall conduct the testing.

M. Term of Contract: The required circuits shall be installed and delivered to the Destination Point on or before 60 Days after Contract Award. Upon successful installation and acceptance by the Government of the required circuit under Section C, the Contractor shall be provided, in writing, notice to proceed and shall provide contractual services for a twelve (12) month period, commencing on the date specified in the notice to proceed.

N. The Contractor agrees that the work and services set forth in this contract shall be performed during the period commencing the effective date of this contract and shall continue through the end of the twelve month period of service (CLIN 1 through 8), excluding the exercise of any option.

P. An Invoice, suitable for payment, shall contain, but not limited to, the following information:

1. Name of Contractor;

2. Date of Invoice;

3. Original Invoice Number (Consecutive numbers);

4. Contract number;

5. Task or Delivery Order number, as applicable;

6. Government Specific Accounting and Appropriation Data (Funding Cite.)

(Example: 19X0113-2015-X75041-180100-5327-2332);

7. Contract Line Item Number (CLIN) of item or service provided;

8. Description of the item, or service actually provided;

9. Period of performance of service or date item is provided;

22 | P a g e

10. Block/Space reserved for COR acceptance signature and date;

11. Signature, Name and Phone number of Company representative authorized to sign invoices;

12. Remit to address

13. Name, phone number and Mailing address to whom any disputed invoices should be addressed;

14. Credits with explanation and period covered.

Failure to submit Invoices which do not identify this information shall be returned without payment to the Contractor for correction.

R. Authorized Instruction to Contractor

a. No person or agency other than the Contracting Officer (CO) is authorized to give instruction, orders or directions on behalf of the Government to the Contractor or his employees, unless such person or agency is authorized in writing by the CO to so act. The authority of such person or agency is strictly limited to the written authorization provided by the CO. The duty is upon the Contractor to determine the authority of such person or agency. Any questions regarding the authority of such person or agency should be directed to the CO in writing.

b. Contracting Officer’s Representative (COR): The CO may designate and authorize a representative(s) to act on his/her behalf under this contract. Such representative(s) as may be appointed shall be designated by a letter from the CO and a copy of the letter shall be given to the Contractor. The COR shall represent the CO as specified in his/her delegation of authority letter. The COR shall not be authorized to issue change orders or adjustments.

Changes in the Scope of Work/Specifications or any increase or decrease in the work called for by this contract shall be made by the CO by an executed modification to this contract.

S. Government-Furnished Equipment (GFE): None

T. Release of Information

1. The Contractor’s organization shall clear with the Information Office listed below any public release of information on this contract. This information includes news stories, articles, sales literature, advertisements, radio-TV spots, etc.

2. The request for public release of information should be addressed to: PDS

3. Limited Use of Data and Information. Performance of this contract may require the

Contractor to access and use data and information proprietary to the Government agency or agency personnel, or which is of such a nature that its dissemination or use, other than in performance of this contract would be adverse to the interests of the Government or others. The Contractor and Contractor personnel shall not divulge or

23 | P a g e release data or information developed or obtained in performance of this contract, until made public by the Government, except to authorize Government personnel or upon written approval of the Contracting Officer. The Contractor will not use, disclose, or reproduce proprietary data which bears a restrictive legend, other than as required in the performance of this contract. Nothing herein shall preclude the use of any data independently acquired by the Contractor without such limitations or prohibit an agreement at no costs to the Government between the Contractor and the data owner provides for greater rights to the Contractor.

U. Circuit Downtime and Credits

Credits shall be assessed against the Contractor in those instances where the circuit during any given month or year that fail to achieve and sustain the minimum acceptance standards stated above.

1. Definitions:

Circuit Availability Acceptance Level: Yearly Circuit Availability Acceptance Level is computed by 365 calendar days times 24 (hours per day) times 99.7% acceptance level equals 8,716.20 hours annum. (365 x 24 = 8760 x 99.7% = 8,733.72). Monthly Circuit Availability is computed by the calendar days per month times 24 (hours per day) times 99.7% acceptance level (example: 31 x 24 = 744 x 99.7% = 741.76).

Downtime: That period of time when the circuit becomes non-operational or unusable for communication or transfer of data or failures to meet the minimum acceptance standards. The maximum cumulative Annual downtime that shall be acceptable for corrective or preventative maintenance is 26.28 hours (8760 x .3%). The maximum cumulative Monthly downtime that shall be acceptable for corrective or preventative maintenance shall be .3% of the total available hours for the month (example: 31 x 24 = 744 x .3% = 2.23 hours).

Period of Downtime: Downtime shall commence at the time first attempt for contact is made by the Government (or its representative) to the Contractor’s Point of Contact and shall be annotated on the Remedy Ticket and shall continue until the circuit is returned into Service by the Government.

Downtime Credits: Monetary value returned to the Government for failure to meet the Circuit availability requirements. Downtime Credits shall be assessed based on cumulative downtime time with the minimum assessment being one hour. Downtime credit shall be equal to the hourly or daily rate (as applicable) as identified in the schedule in Section B. There are two

(2) situations when circuit Downtime Credits can be accumulated:

1) Below Availability Level,

2) Extended Downtime.

2. Credit for Circuit Downtime by Situation

24 | P a g e

Below Availability Level: If the downtime accumulated for a circuit adds up to 26.28 (8760 x 0.3%) cumulative hours or more during any one contract year (365 calendar days) or depending on the number of hours for the month (example 744 x .3%) cumulative hours per month (example: 31 calendar day month) the Contractor shall grant a hourly credit to the Government for each hour of downtime. Each additional one hour increment or portion thereof will be assessed as an additional hour.

Extended Downtime Credit(s): Cumulative time of more than 18 hours but not greater than 24 hours for any one outage shall be assessed at a daily rate. Any increment of 24 hours beyond the initial 24 hours of any one outage shall be assessed at the standards for the hourly rate up to 12 hours, however between 12 and 24 hours the credit shall be assessed at the daily rate.

3. Exceptions to Cumulating of Downtime

Cumulating of circuit downtime shall include all unscheduled downtime deemed to be the responsibility of the Contractor, with the following exceptions:

a. When the failure to perform arises out of causes beyond the control and without the fault or negligence of the Contractor or Sub-contractor as defined in the Termination for Default clause in Section I of this contract.

b. Malfunction of equipment, frequency fading and interference, errors of commission and/or omission by the Contractor or Sub-contractor, and commercial power surges or failures are considered to be normal hazards of the industry and therefore do not qualify as causes beyond the control of the Contractor or Sub-contractor. The Contractor shall be charged with credits for all reported outages determined “no trouble found” or “came clear while testing” but which exceed minutes.

The Contracting Officer shall make final determination as to whether downtime is the responsibility of the Contractor. If requested by the Contracting Officer, the Contractor shall provide documentation to support claims of excusable downtime. For downtime determined to be the Contractor’s responsibility, the Contracting Officer may elect to assess a credit for each instance of non-performance.

4. Payment Reduction for Downtime Credits

When Circuit Downtime credit(s) is owed to the Government, the total number of creditable hours shall be accumulated for the month and will be deducted from the payment due the Contractor in the month they accrued.

5. Trouble Escalation Procedure

25 | P a g e

a. The Government shall refer the problem to the carrier after performing tests as prescribed in the Trouble Analysis procedure. Obtain the name of the carrier test person and a carrier ticket number; record this information on the Government’s Remedy Ticket.

b. After the trouble has been referred to the carrier for two (2) hours, recall the carrier for an update on the current trouble. Record the carrier’s response, the name of the individual you talked with, and the carrier ticket number on the Remedy Ticket.

c. After the trouble has been referred to the carrier for four (4) hours, recall the carrier for an update on the current trouble. If the carrier’s response is not satisfactory escalate the trouble to the carrier’s management. Record the carrier’s response, the name of the individual you talked with, and the carrier ticket number on the Remedy Ticket.

d. After the trouble has been referred to the Contractor for six (6) hours the COR shall escalate the trouble to the Contractor’s manager; also notify IRM/IMO and the Contracting Officer and the STATE IRM/ISC Office. Record the contractor’s response, the name of the individual you talked with, the Contractor ticket number, and the names of the IRM managers that were notified on the Remedy Ticket.

e. Continue to status the Contractor for the remainder of the outage or until you have received a problem resolved status.

6. Technological Refreshment

After contract award, the Government may; pursuant to FAR clause 52.212-4 - Contract Terms and Conditions –Commercial Items, paragraph (c), Changes; request changes within the scope of the contract. These changes may be required to improve performance or react to changes in technology.

The Contractor may propose for the Government’s technological refreshment, substitutions or additions for any provided products or services that may become available as a result of technological improvements. The Government may, at any time during the term of this contract or any extensions thereof, modify the contract to acquire products which are similar to those under the contract and that the Contractor has, or has not, formally announced for marketing purposes. This action is considered to be within the scope of the contract. At the option of the Government, a demonstration of the substitute product may be required. The Government is under no obligation to modify the contract in response to the proposed additions or substitutions.

Such substitutions or additions may include any part of, or all of, a given product(s) provided that the following conditions are met and substantiated by documentation in the technological refreshment proposal:

a. The proposed product(s) shall meet all of the technical specifications of this document and conform to the terms and conditions cited in the contract.

26 | P a g e

b. The proposed product(s) shall have the capacity, performance, or functional characteristics equal to or greater than, the current product(s).

c. The proposal shall discuss the impact on hardware, services, and delivery schedules. The cost of the changes not specifically addressed in the proposal shall be borne entirely by the Contractor.

d. Contractor has the right to withdraw, in whole or in part, any technological refreshment proposal prior to acceptance by the Government. Contractor will use commercially reasonable efforts to ensure that prices for substitutions or additions are comparable to replaced or discontinued products. If a technological refreshment proposal is accepted and made a part of this contract, an equitable adjustment, increasing or decreasing the contract price, may be required and any other affected provisions of this contract shall be made in accordance with FAR clause 52.212-4, paragraph (c), Changes, and other applicable clauses of the contract.

7. QUALITY ASSURANCE AND SURVEILLANCE PLAN (QASP)

This plan provides an effective method to promote satisfactory contractor performance. The QASP provides a method for the Contracting Officer's Representative (COR) to monitor Contractor performance, advise the Contractor of unsatisfactory performance, and notify the Contracting Officer of continued unsatisfactory performance. The Contractor, not the Government, is responsible for management and quality control to meet the terms of the contract.

The role of the Government is to monitor quality to ensure that contract standards are achieved.

Performance Objective Scope of Work Para Performance Threshold Services.

Performs all Internet / circuitary services set forth in the scope of work.

1. thru 6.

All required services are performed and no more than one

(1) customer complaint is received per month.

IT

EM

N U

M B

ER

IT

EM

D

ES

C

R

IP

TI

O

N 1.

En te r t he n am e of th e so ftw ar e pr od uc er

1.

Pr ov id e a st at em en t a tte st in g th at th e so ftw ar e pr od uc ts li st ed in

It em

N um be r 1 .3 o f t hi s fo rm fo llo w th e se cu re d ev el op m en t " pr ac tic es " a nd

"ta sk s" id en tif ie d in N

IS

T

SP

-2

. A s um m ar y of th es e pr ac tic es a ta s ar e pr ov id ed b el ow fo r r ef er en ce fr om

N

IS

T

SP

-2

. I f y ou c an no t at te st to a ll pr ac tic es a nd ta sk s, id en tif y th e on es th at y ou a tte st to a nd th e on es th at y ou c an no t a tte st to . F or th os e pr ac tic es a nd ta sk s th at y ou c an no t at te st to , d es cr ib e th e pr ac tic es th at y ou h av e in p la ce to m iti ga te th os e ris ks

(i.

e.

, r is ks fo r p ra ct ic es o r t as ks y ou c an no n at te st to an d pr ov id e a Pl an o f Ac tio n

M ile st on es

(P O

A& M

) d et ai lin g ho w y ou r f irm w ill re ac h co m pl ia nc e fo r t ho se n on

-c om pl ia nt p ra ct ic es a nd ta sk s.

1.

A de sc rip tio n of w hi ch p ro du ct o r p ro du ct s th e st at em en t p ro vi de d fo r I te m be r 1

.2 re fe rs to (p re fe ra bl y fo cu se d at th e co m pa ny o r p ro du ct li ne le ve l an d in cl us iv e of a ll un cl as si fie d pr od uc ts s ol d to

F ed er al a ge nc ie s)

VE

N

D O

R R

ES

PO

SE

C

YB

ER

SE

C

U R

IT

Y

SU

PP

LY

C

H A

IN

R

IS

K

M A

N A

G

EM

EN

T

(C -S

C R

M ) S

O

FT

W A

R E

PR

O

D U

C

ER

A

TT

ES

TA

TI

O

N F

O R

M

Th is fo rm m us t b e co m pl et ed b y th e so ftw ar e pr od uc er

#SE

N

SI

TI

V E

B U

T U

N C

LA

SS

IF

IE

D

Pr ac tic es

Ta sk s N ot io na l I m pl em en ta tio n Ex am pl es R ef er en ce s Ex am pl e 1:

D ef in e po lic ie s fo r s ec ur in g so ftw ar e de ve lo pm en t in fra st ru ct ur es a nd th ei r c om po ne nt s, in cl ud in g de ve lo pm en t en dp oi nt s, th ro ug ho ut th e

SD

LC

a nd m ai nt ai ni ng th at s ec ur ity

B

SA

FS

S:

S M

.3 , D

E.

1, IA

.1

, I A.

Ex am pl e

2:

D ef in e po lic ie s fo r s ec ur in g so ftw ar e de ve lo pm en t pr oc es se s th ro ug ho ut th e

SD

LC

a nd m ai nt ai ni ng th at s ec ur ity in cl ud in g fo r o pe n-so ur ce a nd o th er th ird -p ar ty s of tw ar e co m po ne nt s ut iliz ed b y so ftw ar e be in g de ve lo pe d.

B

SI

M M

: C P1

.1 , C

P1 .3

, S R

1.

1, S R

2.

2, S E1

.2

SE

2.

Ex am pl e

3:

R ev ie w a nd u pd at e se cu rit y re qu ire m en ts a t l ea st an nu al ly

, o r s oo ne r i f t he re a re n ew re qu ire m en ts fr om in te rn al or e xt er na l s ou rc es

, o r a m aj or s ec ur ity in ci de nt ta rg et in g so ftw ar e de ve lo pm en t i nf ra st ru ct ur e ha s oc cu rre d.

EO

8:

e( ix

Ex am pl e

4:

E du ca te a ffe ct ed in di vi du al s on im pe nd in g ch an ge s to re qu ire m en ts

IE

C

3:

S M

-7 , S

M -9

N

IS

TC

SF

: I D

.G V-

O

W A

SP

A

SV

S:

.1

.1 O

W A

SP

M

A

SV

S:

.1

O W

A

SP

SA

M

M : P

C 1-

A, P

C 1-

B, P

C 2-

A

PC

IS

SL

C : 2

.1 , 2

.2

SC

FP

SS

D : P la nn in g th e

Im pl em en ta tio n an d D ep lo ym en t o f S ec ur e D ev el op m en t P ra ct ic es

SP

3:

S A-

1, S

A- 8, S A-

, S

R -3

SP

: 3 .1

.2 , 3

.2 .1

, 3 .2

.2 , 3

.3 .1

, 3 .4

.2 , 3

.4 .3

SP

: S A-

1, S

A- 8, S A-

, S

R -3

SP

: T

; K

, K

, K

K0

7, K

, K

, K

, K

, K

K0

2, K

; S

, S

, S

; A

A0

3, A

Ex am pl e 1:

D ef in e po lic ie s th at s pe ci fy ri sk

-b as ed s of tw ar e ar ch ite ct ur e an d de si gn re qu ire m en ts , s uc h as m ak in g co de od ul ar to fa ci lit at e co de re us e an d up da te s;

is ol at in g se cu rit y co m po ne nt s fro m o th er c om po ne nt s du rin g ex ec ut io n;

a vo id in g un do cu m en te d co m m an ds a nd s et tin gs

; a nd p ro vi di ng fe at ur es th at w ill ai d so ftw ar e ac qu ire rs w ith th e se cu re d ep lo ym en t, op er at io n, a nd m ai nt en an ce o f t he s of tw ar e.

B

SA

FS

S:

S C

.1 -1

, S C

.2 , P

D .1

-1 , P

D .1

-2 , P

D .1

3, P D

.2 -2

, S I, PA

, C

S, A

A, L

O , E

E

Ex am pl e

2:

D ef in e po lic ie s th at s pe ci fy th e se cu rit y re qu ire m en ts fo r t he o rg an iz at io n’ s so ftw ar e, a nd v er ify c om pl ia nc e at k ey po in ts in th e

SD

LC

(e .g cl as se s of s of tw ar e fla w s ve rif ie d by ga s, re sp on se s to v ul ne ra bi lit ie s di sc ov er ed in re le as ed so ftw ar e)

B

SI

M M

: S M

1.

1, S M

1.

4, S M

2.

2, C P1

.1 , C

P1 .2

C

P1 .3

, C P2

.1 , C

P2 .3

, A M

1.

2, S

FD

1.

1, S

FD

2.

1, SF

3.

2, S

R 1.

1, S

R 1.

3, S

R 2.

2, S

R 3.

3, S

R 3.

Ex am pl e

3:

A na ly ze th e ris k of a pp lic ab le te ch no lo gy s ta ck s

(e .g la ng ua ge s, e nv iro nm en ts

, d ep lo ym en t m od el

s) , a re m m en d or re qu ire th e us e of s ta ck s th at w ill re du ce ri pa re d to o th er s.

EO

8:

e( ix

Ex am pl e

4:

D ef in e po lic ie s th at s pe ci fy w ha t n ee ds to b e ar ch iv ed fo r e ac h so ftw ar e re le as e (e

.g co de

, p ac ka ge fi le s, ird

-p ar ty li br ar ie s, d oc um en ta tio n, d at a in ve nt or

y) a nd h ow lo ng it ne ed s to b e re ta in ed b as ed o n th e

SD

LC

m od el , s of tw ar e en d-of -li fe , a nd o th er fa ct or s.

IE

C

3:

S

R -3

, S R

-4 , S

R -5

, S D

-4

Ex am pl e

5:

E ns ur e th at p ol ic ie s co ve r t he e nt ire s of tw ar e lif e cy cl e, in cl ud in g no tif yi ng u se rs o f t he im pe nd in g en d of s of tw ar e su pp or t a nd th e da te o f s of tw ar e en d-of -li fe

IS

O

4:

.3 .2

D ef in e

Se cu rit y

R eq ui re m en ts fo r S of tw ar e D ev el op m en t (

PO

.1

En su re se cu rit y re qu ire m en ts fo r s of tw ar e de ve lo pm en t a re k no w n at a ll tim es s o ey c an b e ta ke n in to a cc ou nt th ro ug ho ut th e

SD

LC

a nd d up lic at io n of e ffo rt ca n be m in im iz ed b ec au se th e re qu ire m en ts in fo rm at io n ca n be c ol le ct ed o nc e an d sh ar ed

. T hi s in cl ud es re qu ire m en ts fr om…