Atch J-1 Performance Work Statement (PWS).docx

PERFORMANCE WORK STATEMENT (PWS)

as of 15 April 20

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name:

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Contract or Task Order Title. Defense Information Systems Agency (DISA), Global Content Delivery Services II (GCDS II).

3. Background. DISA Infrastructure Special Services Division (IE7) is a provider of Information Technology (IT) solutions for the Department of Defense (DoD). DISA requires processing, storage, communications, and content delivery services for a variety of its customer applications across DoD. The purpose of this PWS and resulting contract is to provide state-of-the-art global content delivery capacity to meet current and future DoD customer requirements across the Defense Information System Network (DISN) and any other networks utilized by DoD users. DISA is required by DoD to enhance communication effectiveness through improved information interoperability. The Under Secretary for Defense for Acquisition, Technology and Logistics (OUSD (AT&L)) has articulated a vision for transforming the information environment in the DoD. The envisioned changes represent a fundamental paradigm shift from providing platform centric applications to platform independent, web-enabled, Net-Centric services that require the support of a ubiquitous network environment, that meet the requirements of the end users, and which are highly available, secure, and reliable. As a result of the shift to Net-Centric services, requires content delivery capabilities at DISA-owned and other DISA approved processing locations.

The acquisition of all Information Assurance (IA)- and IA-enabled Commercial Off-The-Shelf (COTS) IT products is limited to products that have been evaluated by the National Security Agency (NSA) or in accordance with NSA-approved processes. These products will be evaluated or validated through one of the following sources: The Common Criteria for Information Technology Security Evaluation (CC), Mutual Recognition Arrangement (MRA), The National Information Assurance Partnership (NIAP) Evaluation and Validation Program, or the Federal Information Processing Standards (FIPS) validation program. Robustness requirements, the mission, and customer needs will enable an experienced information systems security engineer to recommend a Protection Profile, a particular evaluated product or a security target with the appropriate assurance requirements for a product to be submitted for evaluation.

4. Objectives: The objective is to obtain reliable, responsive, and cost effective content delivery services that are dynamically scalable and utilize an on-demand service approach to support DISA and other DISA-approved locations in the continental United States (CONUS) and outside of the continental United States (OCONUS).

The Contractor shall procure, install, uninstall, transport, perform power up configuration, and provide all areas of hardware, technical personnel, software, data replication services, worldwide travel to install managed service, vendor-owned hardware and provide hardware/software upgrades, maintenance, replacement, and disposal/coordinate with Defense Reutilization and Marketing Services (DRMO) in accordance with DoD policy. Additional procurements will include the provision of switches, servers, racks, remote power distribution units, universal power supply devices, storage area network and network-attached storage devices, and monitoring/reporting software used to support the content delivery services at all locations worldwide. This includes Navy vessels or tactical locations. The Contractor shall provide full Network Operations Command Center (NOCC) capability and support for all service offerings. The Contractor will continuously maintain an innovative solution to include technology refresh and upgrades to stay avoid of any end of sale, end of life and/or end of support at no additional cost to the Government.

5. Scope. The Contractor will accredit, deliver, install, maintain, and dispose GCDS capacity on the DISA GCDS content delivery and caching network. This work will be completed at any of the current DISA computing facilities or future DISA computing facilities, both in the CONUS and OCONUS based on new missions and workload requirements or DISA approved locations worldwide. This may include “non-DISA managed sites which can access the DISN. Service will be integrated IAW DISA and DoD policies. The objective is for the Contractor to provide content delivery, network optimization and information assurance (protection) services using a “utility based contract concept”. This concept requires that the Contractor provide all assets and services needed for the content delivery service, network optimization and information assurance (protection) with the exception of type I cryptographic devices, firewalls, and intrusion detection systems (IDS). These assets shall include, but are not limited to, hardware, software, software maintenance and licensing, design capabilities, logistical support, field maintenance, engineering support and professional services. These services will also include, but are not limited to, installation, racking and stacking of equipment, cabling, powering of device, and configuration related to the deployment and sustainment of the provided GCDS service. The scope will also include transitioning existing and new customer applications. The Contractor shall provide customer outreach activities and consulting services. This initiative will support unclassified and classified networks:

· Non-Classified Internet Protocol Router Network (NIPRNet)

· Secret Internet Protocol Router Network (SIPRNet)

· Similar type networks deployed over time

The Contractor must bundle essential managed services to support the successful deployment and ongoing operation of provided solution. The bundled Managed Services include but are not limited to the following major elements:

· Perform startup and shutdown

· Monitoring, Incident Response and Problem Management

· Backup and Recovery

· Patch/Change Management

· Capacity Planning and Reporting

· Customer support/integration and sustainment services

· Advise/ market new customer requirements, cross-sell current DOD customers on GCDS services

· Present technical aspects of the GCDS current platform

The Government will maintain day-to-day operational control of the processing environment and complete oversight responsibility. All operating system software as well as any other software required for the Contractor solution to operate, such as software maintenance and licensing will be included under this contract. It is expected that the Contractor will share operational responsibility with the Government as a capacity service provider does in the commercial place. DISA, however, will maintain governance over the totality of the service environment.

DISA is committed to maintaining secure IA and delivery of application data to geographically dispersed user communities. Inherent in the secure delivery is the capability to encrypt data transmissions, provide the ability for public key infrastructure (PKI) enablement of distributed applications and content to authenticate individuals requesting application access, prevent inadvertent disclosure of sensitive information, and assure access controls are appropriately executed. An additional tenet of IA is availability. The overlay network shall be fully capable of automatically detecting, without user intervention, when a content delivery location at the edge of the network (so forth referred to as “edge”) is not available and continue to provide service without the end user experiencing outage or delay.

DISA research conducted over the last 6 years determined that the distributed computing environment would meet mission content delivery requirements for global application availability and performance. This capability shall include the ability to provide various forms of content to users at the extreme edge of the DoD managed wide area networks (WANs) employed by war fighters world-wide on both classified and unclassified networks, including the NIPRNet, the SIPRNet and the Internet. Other similar networks utilized by DoD users will be deployed over time. At a minimum, the requirements detailed in this PWS shall include the ability to store and forward content in the form of web hypertext transfer protocol (HTTP) and hypertext transfer protocol secure (HTTPS) objects of all types. Distribute data and databases across the Federal and DOD networks; execute applications operating on locally available (cached) data and databases, and deliver streaming video to end user populations on disadvantaged networks throughout the world.

Content delivery shall also include cache capabilities and the acceleration of content that is HTTP or HTTPS, utilizing compression and front-end optimization or similar techniques. The capability of streaming video and audio delivery is required at all edge locations worldwide. This capability shall allow for a single stream of video/audio to traverse the network unbroken into multiple user streams until it reaches the edge locations worldwide. Transcoding of the device type being used (Blackberry, Flash, etc.) shall be made at the edge location in a single stream and format. In addition, multiple occurrences (i.e. 3) shall be delivered across the network and have consistency in delivery to be put together at the edge to ensure a full stream without breaks is delivered to users. The capability to automatically detect bandwidth congestion in bandwidth-disadvantaged networks is required and this shall not affect the stream of data.

DISA recognizes the importance of delivery of Domain Name Service (DNS) from remote edge locations to meet the availability of DNS service on both NIPRNet and SIPRNet and various other networks. The Contractor shall, without human intervention, integrate and utilize existing DISA global DNS services. Source Network Address Translating (NATing) shall be disabled on all GCDS related systems, components and equipment.

5.1 Task 1 - Unclassified and Classified Level Environments/Job Performance. The Contractor will have access to the Non-classified Internet Protocol (IP) Router (NIPR) and Secret Internet Protocol (IP) Router (SIPR). Reference PWS Section 12.2 for individual personnel security requirements.

6.0 Performance Requirements

6.1 Task 1 – Global Content Delivery System Support. The Contractor shall provide the overall management and administrative effort necessary to ensure that the requirements of this contract are accomplished. The Contractor shall track program progress utilizing utility-based (as used) metrics. The Contractor shall define and monitor metrics to evaluate the performance of each critical technical and management process and conformance of the evolving Global Content Delivery Service platform with contract requirements and objectives including Configuration Management and Product Line requirements and objectives that will affect program schedule, performance and risk.

Deliverable/s: Project Management Plan that documents the business processes the Contractor will conduct within these knowledge areas in order to complete project management activities on the GCDS program. These business processes encapsulate the series of methods that enable the project managers and team members to complete project management tasks, artifacts and deliverables in a consistent, effective and efficient manner. The project management plan shall at a minimum address these plans: Project Plan, Change Management Plan, Issues Management Plan, Communication Plan, Risk Management Plan, and Configuration Management Plan.

6.1.1 Subtask 1.1 - Technical Requirements. The Contractor will accredit, deliver, install, maintain and dispose GCDS capacity infrastructure in concert with the Government, at any of the current DISA computing facilities or future DISA computing facilities in the continental US (CONUS), outside CONUS (OCONUS) and other DISA or DISA approved locations worldwide. Service shall be integrated IAW DISA and DoD policies. DoD requires all systems services to be IPv6 compatible. If FOC is required, Contractor shall ensure this is addressed in detail in the deliverable required under Accredited Global Content Delivery Service.

Deliverable/s: GCDS proposed system documentation.

6.1.2 Subtask 1.2 - Supported Networks. This service will support unclassified and classified network environments:

6.1.2.1 Non-Classified Internet Protocol Router Network (NIPRNet)

6.1.2.2 Secret Internet Protocol Router Network (SIPRNet)

6.1.2.3 Similar type networks deployed over time

6.1.3 Subtask 1.3 - Ancillary Components. The Contractor shall provide solutions that include all required ancillary components such as racks, cables, power cables, etc. See Attachment 2 for rack and power details.

Deliverable/s: Solutions that conform to rack and power details identified in Attachment 2. Drawings/topologies.

6.1.3.1 Subtask 1.3.1: All GCDS / managed service provider hardware deployed in austere environments (see section 9.1.3), to include tactical Edge, shall be solid-state devices.

6.1.4 Subtask 1.4 - Accredited Global Content Delivery Service. The Contractor shall provide a fully DoD certified and accredited content delivery solution, which can be deployed globally, provide network storage and management of content, maximize bandwidth, deliver static, dynamic and streaming content, cache management, load balancing, and offer performance measurement /reporting capabilities. Contractor provided content delivery solution shall be sustained and maintained by the Contractor, and shall be subject to DOD certification and accreditation processes. Certification and accreditation must be achieved before the first order can be placed. The Contractor shall address their proposed hardware requirements with proposed delivery dates and installation timelines and responsibilities; proposed software development and delivery to include conversion of software and data. The Contractor shall provide a utility-based solution that can be increased or decreased at any time based on actual usage.

Deliverable/s: Proposed hardware requirements with delivery dates and installation responsibilities, software development and delivery, successful conversion of software and data.

6.1.4.1 Subtask 1.4.1. The following new features are to be added to the current GCDS baseline as stand-alone options. These new features are to be proposed separately as OPTIONAL priced CLINs within base year 1 and each subsequent period of performance. See the specific PWS sections for further detail.

- Optional CLIN 024, Single-Sign-On Capability (6.24)

- Optional CLIN 025, Internet Access Point (IAP) Production (6.25)

- Optional CLIN 026, GCDS SSO MFA Capability, Single Community (6.26)

6.1.5 Subtask 1.5 - Provide Security Accreditation. The Contractor shall work with DISA IE74 to implement DOD security standards and Security Technical Implementation Guides (STIGs), scan systems, record results (currently employing VMS), and complete Plan of Action and Milestones (POA&Ms). The Contractor shall also provide technical input, such as ports and protocols, to the DOD certification and accreditation package. Contractor shall provide support for the creation and deployment of security patches as dictated by IAVAs that are applicable to the software; this includes performing scanning, recording results and running reports. The Contractor shall provide support for yearly Security Testing and Evaluation audits by the DISA Risk Management Executive (RME) Staff.

6.1.5.1 Subtask 1.5.1 – Security Regulations. The GCDS deployed on the DISN in satisfaction of the service request must meet applicable DoD and DISA security regulations and standards. It is the responsibility of the service provider to maintain the systems in accordance with these and, using any system or systems specified by DISA, to properly document the system's security posture and currency under existing IAVA program. Contractor shall comply with DoD patch management procedures (DoD currently uses WSUS and HBSS).

The Contractor shall ensure that all Contractor infrastructure, servers and workstations connected to the DISN and/or containing customer sensitive data are configured in compliance with the DISA STIG applicable for that operating system.

The Contractor shall comply with the following DoD-approved architectures, programs, standards and guidelines:

DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), March 12, 2014 DoD Directive 8500.1, "Cybersecurity", March 14, 2014 DoD Instruction 8551.01, "Ports, Protocols, and Services Management (PPSM)," July 27, 2017 DoD CSC-STD-002-85, "DOD Password Management Guideline," April 12, 1985 CJCSM 6510.01, "Defense-in-Depth: Information Assurance (IA) and Computer Network Defense (CND)", March 25, 2003 DoD CM-400-260-01, "Software Requirements Specification (SRS) for the Network Management (NM) Functional Area Of The Defense Information Infrastructure (DII)," July 8, 1997 DoD Directive Number 3020.26, Continuity of Operations (COOP) Policy and Planning, May 26, 1995 DoD Instruction Number 3020.39, Integrated Continuity Planning for Defense Intelligence, ASD (C3I), August 3, 2001 DoD Directive Number O-8530.1, Computer Network Defense (CND), January 8, 2001 Defense Information Systems Agency Instruction (DISAI) 630-230-19, "Security Requirements for Automated Information Systems (AIS)," August 1991, and Supplements 1 and 2, not dated.

ASD (NII) Memo, "Internet Protocol Version 6" (IPv6), June 9, 2003 DoD 8570.1M, Information Assurance Workforce Improvement Program, November 10, 2015 DoDM 8530.1-M, "Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Process Program Manual", December 17, 2003 CJCS Manual 6510.01, Defense-In-Depth, Information Assurance (IA) and Computer Network Defense (CDNDoD Security Technical Implementation Guides (STIGs)FSO Process Guides FSO Penetration SOP FSO Security Features User Guide (SFUG) FSO Security Review Methodology FSO Risk Assessment Guide National Security Agency (NSA) Security Guides Net-Centric Enterprise Services (NCES) Framework Section 508 Accessibility Standards as appropriate DoD Manual 5200.02, "Procedures for the DoD Personnel Security Program (PSP)", April 3, 2017 DISAI 240-110-36, Personnel Security, April 9, 2013 DoD 5220.22-M, National Industrial Security Program Operating Manual, May 18, 2016 DoD 5220.22-R, Industrial Security Regulation, December 1985 Federal Information Processing Standards Publication (FIPS) 140-2 Compliance NIST Special Publication 800-53 r4 Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

6.1.6 Subtask 1.6 - Rapid Deployment of GCDS for emergency responses. The Contractor shall be able to rapidly deploy service to austere locations using innovative solutions such as a compact mobile node at the edge of the network. New edges shall be maintained by the Contractor while the edge is deployed, and bring the edge down (decommission) at the direction of the Government. This node must have the capability to function as any other node at the edge of the network and must be able to deliver content, stream video and audio and work to reduce the page size and optimize page render time. This deployable unit must be a maximum of 4U, which includes all necessary equipment to function independently. The unit must be all solid state with a box that is dust resistant and can withstand, without degradation, a max high temperature of 122F with a range of 15% to 90% humidity and a max low of 32F with a range of 15% to 90% humidity. GCDS shall be able to provide a deployable 4U Edge racked in a shock travel case. The edge must be up and running in a GCDS production environment at either a vender location or Chambersburg location as to meet a minimum of 24-hour notice for shipping to CONUS and OCONUS locations. This edge will be employed to support crisis and/or federal disasters.

6.1.7 Subtask 1.7 - Electrical Power Configuration. Devices and/or units must be configured with a standard electrical plug fully compatible with the area of deployment (adapter if necessary) as well as an Ethernet connection. Neither of these plugs/wires can jeopardize the integrity of the case.

6.1.8 Subtask 1.8 - Origin Load Balancing. GCDS shall provide the capability to load balance between multiple application origins and edge points for each application based on configurable network conditions to reduce perceived latency and optimize performance. The Contractor’s solution will align demand with resources and resources with demand to maximize throughput, minimize response time, combat “flash crowds”, and increase reliability. The GCDS and the Contractor’s solution shall continue to automatically direct traffic away from an origin should the origin not be reachable or have network problems, which reduce the origin server from not being optimal to the delivery of traffic to the global edge locations.

6.1.8.1 Subtask 1.8.1 - Node load balancing. GCDS node servers must be able to load balance for DoD applications that require session stickiness. The Contractor’s solution must include this functionality.

6.1.9 Subtask 1.9 – Interface. The Contractor shall ensure the GCDS solution will interface, without capability loss or degradation, with Government Furnished Equipment (GFE) that includes firewalls (currently employing Juniper), IDS (currently using Sourcefires or Security), and cryptography.

6.1.10 Subtask 1.10 – User Credentials. The GCDS and the Contractor’s solution shall provide the capability to validate user credentials from a Common Access Card (CAC), Smart Card or other authentication methods from the established edge locations based on DoD standards utilizing a revocation list created from an Online Certificate Status Protocol (OCSP) responder.

6.1.11 Subtask 1.11 - GCDS SSL Delivery. GCDS delivers both static as well as dynamic content. To ensure dynamic content delivery, Contractor shall provide the capability to perform SSL processing and certificate management at the scale required to handle encrypted SSL tunnels. Each GCDS edge location shall have the capability of independently passing and handling SSL applications. Within the scope of dynamic content, the Contractor shall provide the capability to support logic for statements, conditionally assembling fragmented HTML content to enable separation of dynamic pages into cacheable and un-cacheable components, while improving application performance by minimizing the amount of content that needs to be retrieved from the origin server for that application.

6.1.11.1 Subtask 1.11.1 - Support Non-HTTP/S. Contractor shall provide support for Non-HTTP/S applications with highly dynamic data. Service shall accelerate delivery of TCP protocols such as virtual desktops/client server apps as well as interactive web conferencing, virtualized applications over Citrix ICA and Microsoft RDP protocols, and accommodate large files transferred through secure FTP or SSH to meet a minimum threshold of 30 seconds for files equal or exceeding 100MB. Capabilities shall employ real time route optimization to support the acceleration and delivery of dynamic content.

6.1.12 Subtask 1.12 - Customer Portal. The Contractor shall provide a customer portal for GCDS DoD (.mil) and Government (.gov) customers to control essential aspects of service delivery for their applications. Provision simple services, obtain statistics of how the service is delivering applications, provide alerts when thresholds are exceeded, and information with logs, which can easily be accessed and made into reports with information readily stored for one year. Customers shall be able to purge their own content in the cases of spillage and cache issues automatically from a purge button on the portal for that application owner. The customer application portal shall only display the content for that application owner, and shall be authenticated and validated in compliance with OSCP guidance. The portal shall also display to the user the capability to view areas of their application, Uniform Resource Locators (URLs), and the usage in Mb/month, MB/month, GB/month or Gb/month in a report format. All data from the portal shall be conformed to allow users to create reports from that data and produce them in a Portable Document Format (PDF) file, a raw data file and an Excel data file at a minimum.

6.1.12.1 Subtask 1.12.1 - GCDS PM Dashboard. GCDS and the Contractor’s solution shall include a management dashboard that allows GCDS PMO to review the status of applications, run reports, gather statistics, and see a view(s).

6.1.13 Subtask 1.13 - Adverse Network Detection. GCDS and the Contractor’s solution shall detect adverse network conditions immediately and demonstrate the ability to continuously and efficiently obtain and distribute applications and content to end users. GCDS and the Contractor’s solution shall provide a visual tool to provide the GISMC, TNCs, and others the capability to view network conditions and create reports for these conditions. This application shall be CAC enabled and communicate in real time.

GCDS content shall be provided by the best performing source infrastructure relative to the end user (such as from a region in closest topological proximity to the end user) with the goal of providing optimal performance from the perspective of that user.

6.1.14 Subtask 1.14 - GEO Location. GCDS and the Contractor’s solution shall provide a global map application, which displays latitude, longitude, country, state and city for an IP address of an end user in real-time, automatically with attributes gained from network heuristics from the GCDS edges placed globally. This information shall be incorporated to allow for identification of an end users location in real-time.

6.1.15 Subtask 1.15 - Cache Content. The Contractor shall provide capability to cache all content browsed by end users, whether on GCDS or not. GCDS service shall automatically apply developed metadata for the end user. If the application requested by the end user does not have metadata established for the application requested by the end user, then the GCDS service shall determine the cacheable content in the application automatically and apply this cacheable content to the GCDS cache at that edge location. This capability is required to reduce transport costs across the DISN. GCDS shall act as a forward cache providing non-GCDS traffic (DoD sites not on GCDS or Internet sites), making intelligent decisions on caching the content at the edge location. The capability to fragment an application page into cacheable content as to allow for a statement or a section of metadata to be excluded from the cache, providing that cache content to others at that edge location, and storing that cache at that established edge location. The edge location cache must handle any cache from any content provider i.e. Internet, Facebook, YouTube, Spotify, CNN and Fox News.

6.1.15.1 Subtask 1.15.1 - Advanced Cache Controls. The Contractor’s solution shall provide the capabilities within GCDS to automatically modify an objects cache label (or cache key) to contain only URL components and request attributes that are appropriate for the defined content. Items within the content such as IP address, header or cookies shall be able to be automatically determined as the cache key as opposed to the URL. Contractor shall also provide for session management, with GCDS being capable of generating redirects acting on behalf of the application, following redirects on behalf of the end user or even the ability to tweak an HTTP header to accommodate unique configurations.

6.1.16 Subtask 1.16 - Enterprise Recursive Service (ERS) Compatibility. The purpose of the ERS program is to provide centralized control of recursive DNS queries on the NIPRNET. To implement this control, each local recursive name server is configured to forward all queries from local end-users to a set of IP Anycast-enabled ERS servers. ERS functionally acts as a DNS proxy; it will recursively resolve the forwarded requests. With ERS in place, all external DNS queries can be controlled via policy as directed by the Cyber Command. Under this scheme, all authoritative name servers will see IP addresses of ERS rather than the more numerous and distributed local name servers. GCDS and the Contractor’s solution must be able to coexist with the ERS application and not adversely affect ERS’s functionality or allow ERS to adversely affect its functionality and mission to provide dramatic performance increases in availability, fault tolerance, and security for critical DoD web applications. GCDS must remain compatible with all of DISA's enterprise and infrastructure services such as ERS

6.1.17 Subtask 1.17 - PKI/CAC enabled applications for non-SharePoint sites. GCDS and the Contractor’s solution must be able to recognize and take corrective action for DoD certificates and non-DoD certificates, extract CAC info and forward to application for authorization for role based access.

6.1.18 Subtask 1.18 - PKI/CAC enabled applications for SharePoint sites. GCDS and the Contractor’s solution shall re-sign the certificate and send it forward to SharePoint environment for authentication and authorization.

6.1.19 Subtask 1.19. GCDS and the Contractor’s solution shall provide established edge locations at the edge of the network the ability to solely validate with the applications source (origin) server (in various locations globally) before providing the application content to the end user or denying application content to the end user without a reach back to a central repository. Support HTTP basic authentication and form based login at the node located at the edge of the network. Upon denial from the origin application server, the node at the edge of the network will automatically provide a customized error page for that application indicating the denial to the end user.

6.1.20 Subtask 1.20 - Global Network Operations Support 24 x 7. The Network Operations (NetOps) tool includes the following features:

· Active sensors distributed worldwide monitoring network performance

· Sensors setup to do tests such as pings, DNS lookup and downloads of an HTTP object

· Provides an aggregated view over any time period and at any rate which the end user requires for the tests to be run between any GCDS location and any IP routable assets on the NIPRNet and SIPRNet

· Early warning for network activity

· Provides alerts and situational awareness

· Provides a baseline and monitoring changes in baseline

· Provide alerts if differs from baseline for that reporting of a point to point test

· Passive sensors distributed worldwide monitoring intrusive activity

· While sitting in un-advertised IP space, the sensor will listen for any activity

· Records the IP address and port for which the intrusive activity is coming from

· That information is then relayed to the portal to be displayed

· One year worth of data for comparison would be stored for the portal

· This tool will be fully supported by the 24X7 NOCC

· Utilize passive tools that are compatible with intrusion detection devices, which are utilized today as Sourcefire IDS’s.

· The Contractor will perform one free relocation of a GCDS sensor location at the edge of the network per fiscal year

6.2 Task 2 - GCDS Repository with Global Traffic Management (GTM). GCDS and the Contractor’s solution shall meet the requirement for a global traffic management solution that provides both performance mapping and automatic testing of websites to ensure customer facing content has optimal responsiveness and availability to user requests. The solution shall provide global traffic management service in a fault tolerant system that makes intelligent routing decisions based on real-time server and WAN conditions. The service will help customers balance traffic between origin datacenters across the WAN.

The Contractor monitors website availability through widely deployed points-of-presence to capture WAN traffic conditions relative to the customer’s datacenters. Based on these conditions, customer-specific policy rules are evaluated against real-time WAN traffic conditions.

The Contractor will provide full NOCC capability and support for the global traffic management and repository services on NIPRNet and SIPRNet 24x7x365.

There are three service variants:

1. Failover- The Failover feature monitors the primary website datacenter and can automatically direct requests to alternate locations when there is a failure at the primary site.

2. IP Intelligence- Requests can be directed to datacenters based upon IP rules.

3. Performance- Requests can be directed through policy rules that feature percentage-based load balancing and load feedback. This allows for server specific load balancing within a datacenter.

6.2.1 Subtask 2.1 - DNS Resolution. GCDS and the Contractor’s solution shall use resolution consistent with the Internet Protocol (IP) standard DNS or other technologies to direct users of the service to the best performing infrastructure that will provide content or execute an application for those remote users. The domain name resolution or other technology provided by the service shall be integrated into the technology of delivery to eliminate any incompatibilities, technology inconsistencies, or any other interoperability problems, which could adversely affect a user if a region becomes unavailable mid-session. GCDS and the Contractor’s solution shall inherently provide the capability to determine which of the diverse infrastructures is appropriately loaded to service the users. GCDS and the Contractor’s solution shall also be aware of its own geographic and topological diversity to optimize routes between regional infrastructures to provide application level routing over the WAN, both to and from origin applications and to and from user bases. GCDS and the Contractor’s solution shall be able to utilize various storage infrastructures, both local and remote, to provide best value for rapid delivery of data to end users. GCDS and the Contractor’s solution shall be effectively self-aware relative to its infrastructure capabilities (meaning system outages, network latencies, diminished capacity or degraded performance of any type for the various dispersed nodes) to most effectively utilize those components, nodes, regions, etcetera to limit the negative impacts of any degradation. SIPRNet, NIPRNet, and other classified/unclassified network connections shall be provided to the Contractor facility not to exceed a DS-3line, if the Government requires this capability.

6.2.1.1 Subtask 2.1.1 - TCP Optimization. The Contractor shall provide for Terminal Control Protocol (TCP) Optimization. The Contractor shall support (through real-time network conditions and statistics) a complete understanding and knowledge of the GCDS overlay network and conditions of connections. The TCP optimization techniques shall be utilized including the ability to initiate more aggressive TCP compressions when appropriate and to reduce packet loss by enabling error correction at the edge.

6.2.2 Subtask 2.2 - WAN Traffic. GCDS and the Contractor’s solution shall use multiple techniques effectively and concurrently to minimize the back-end WAN traffic distributing content across regions and to deliver applications and content to end users. The distribution of content across regions will be performed in a way or at a time when it shall have the minimal impact on network operations and available bandwidth. GCDS and the Contractor’s solution shall control all accesses to origin servers providing applications and content so that no users actually access the origin servers. Security built into GCDS and the Contractor’s solution shall allow for an end user to only access the content delivery edge, and that the content delivery edge shall only access the origin. This protection is mandatory as it prohibits Distributed Denial of Service (DDOS) attacks by the attack concentrating on the content provider’s network and not the origin server. The content provider shall ensure that if a DDOS were to occur that immediate notification will be given to the TNCs, GISMC, etc. for NetOPs reporting and the capability to isolate that traffic for the DDOS into one of more edges prohibiting the network from being affected by the DDOS as a whole.

6.2.2.1 Subtask 2.2.1 - Application Firewall. The Contractor shall provide the capability of a layer 7 Application Firewall within the GCDS service to prevent malicious attacks to include cross-site scripting, SQL injection and others. This capability must detect the signature of the attack and block the attack if it were to occur across the GCDS service.

6.2.2.2 Subtask 2.2.2 - Session Based Firewall. The Contractor shall provide the capability to block users from edge locations identified IP blocks, and the capability to provide edge IP addresses to application providers to allow for blocking all traffic at their location besides the Canonical Name (CNAME) application edges, which are serving their traffic. With the GCDS application being CNAME’d over to the GCDS overlay network to prevent DDOS attacks as well as handling flash crowds and load balancing globally for the loads; the application origin server is only accessible from the GCDS edges globally, and end users accessing the application shall only access the GCDS edge locations. The capability shall exist to allow certain applications to only accept data from certain edges globally and provide the application owner the IP addresses of the edges so all unwanted traffic can be blocked at their origin, except the GCDS edges which they have chosen to accept content. Additionally, in reverse, GCDS shall have the capability of blocking certain users from global edge locations based on IP blocks of the end user location within DNS. This capability is needed to block non-theater users from accessing edges, which are within theater as well as other situations. Decisions regarding firewall blocks shall be determined and directed by the Government.

6.2.2.3 Subtask 2.2.3 - Cache Hierarchy. The Contractor shall provide the capability to not only support the storage and optimal delivery of the application from the edge location, but also within the GCDS overlay network. Edges shall be divided to support both parent and child edges. Parent edges shall have the capability of holding more cache information to support applications such as Facebook (user information is available; however, data is not accessed often and usually by one or two users). GCDS and the Contractor’s solution shall have the capability as needed to store infrequent used data or data used by few users to be gradually moved from a child edge to a parent edge before being removed from the GCDS overlay network.

6.2.3 Subtask 2.3 - GCDS Repository. The Contractor shall provide integrated storage capability for large amounts of data at various global existing locations and/or future locations that replicate globally between all units, two or three units, per the choice of the application owner and is integrated into the GCDS application. Purchase of storage data by the Government shall be measured and priced per gigabyte based on actual usage and following a utility-based concept.

6.2.4 Subtask 2.4 - Repository Performance. The Contractor shall provide for a GCDS Repository that facilitates fast transfer of content to Contractor edge locations by replicating content to multiple locations and by selecting the optimal location from which to retrieve content. Replication brings content closer to the edge – this provides a significant improvement over content retrieval from a traditionally deployed single-location customer origin deployment.

6.2.5 Subtask 2.5 - Repository Scalability. The Contractor shall provide for a GCDS Repository that offers scalability as customer’s content needs growth and mirroring of content to multiple locations on the NIPRNet and SIPRNet. The Government shall mandate platform growth.

6.2.6 Subtask 2.6 - Highly Available Repository. The Contractor shall provide for redundancy and fault tolerance, which are currently built into the GCDS Repository architecture – redundant server configurations with automatic failover, high availability repository hardware, content mirroring to multiple locations, and traffic management.

6.2.7 Subtask 2.7 - Intelligent Routing. The Contractor shall provide for routing decisions that are based upon constant monitoring and analysis of network performance, congestion, and server load.

6.2.8 Subtask 2.8 - Data Mirroring. The Contractor shall provide for uploaded content that is replicated across multiple repository centers in different locations. This ensures fault tolerance for both high performance and high reliability.

6.2.9 Subtask 2.9 - Failover. The Contractor shall provide for failover to storage based conditions of origin server i.e. 500 level response (server not found cannot be reached), 400 level response (connection to server exists but content is unavailable. Based on user requirements GCDS could return apology page or error message. GTM used for mapping and load balancing based on performance, load, geography and can be used as a standalone failover solution.

6.3 Task 3 - GCDS High Definition (HD) Video Streaming.

The Contractor shall deliver HD video over HTTP/HTTPS, a one to many broadcast format. The solution must have the following capabilities:

1. Provides for live stream and video on demand

1. Ability to encrypt video stream

1. Ability to step up or step down the size of the video stream according current bandwidth conditions

1. Broadcast video with synchronized slide view and an ask-a-question feature where the presenter can view questions from attendees

1. Stream on-demand video by uploading pre-recorded video for future playback

1. Customizable player support Digital Video Recorder (DVR)

1. Access Control – via token security

1. Adaptive bit rate

1. Purchase of storage by the Government shall follow a utility based consumption concept

6.3.1 Subtask 3.1 - Flash Streaming. The Contractor shall provide flash streaming at a minimum with adaptive bit rate technology at the established edge locations with full DVR functionality and live streaming with streaming authentication capabilities using PKI authentication of CAC cards or Smart Cards.

6.4 Task 4 - Industry Standards. The Contractor shall provide for implementation of components of the Information Technology Infrastructure Library (ITIL) will improve overall management of DISA’s storage infrastructure. Companies and Government agencies that have followed the methodologies of these models have improved their service and reliability of their processing infrastructure reducing their long-term costs. The following ITIL principles shall be incorporated in the Contractor’s proposal:

1. Change Management,

1. Configuration Management,

1. Asset Management,

1. Release Management.

6.4.1 Subtask 4.1 - Change Management. The Contractor shall provide an established process for handling change to the GCDS infrastructure on a continual basis shall be provided in the Contractor’s proposal. Technologies will change, software will be revised, and hardware will be phased out by the manufacture. By having a process in place to handle these inevitable events, time and money can be saved. It will also be necessary to incorporate DISA customer requests for new or revised functionality.

6.4.2 Subtask 4.2 - Configuration Management. The Contractor shall provide an established process for managing the infrastructure’s GCDS configuration shall be provided in the Contractor’s proposal. The Contractor shall provide monthly configuration/asset summary reports for configuration/asset validation by the Government.

6.4.3 Subtask 4.3 - Asset Management. The Contractor shall provide an established process for handling asset returns and redeployment shall be provided in the Contractor’s proposal.

6.4.4 Subtask 4.4 - Release Management. The Contractor shall provide an established process for performing package releases to the infrastructure shall be provided in the Contractor’s proposal. Release Management works to ensure strong Configuration Management and Change Management, and works alongside Asset Management to ensure that any assets are introduced into the infrastructure correctly and with the minimum of difficulty.

Deliverable/s: Methodology for ensuring established quality processes for change management, configuration management, asset management and release management that will integrate with DISA processes.

6.5 Task 5 - Situational Awareness. The contractor shall provide situational awareness 24x7x365 to various DOD entities such as Cyber Command (CYBERCOM), the Global NetOps Support Center (GNSC), the Theater NetOps Centers (TNCs) and the Global Infrastructure Service Management Center (GISMC). Situational awareness reporting shall provide information on how the service is performing in accordance with NetOps reporting requirements. Reporting information will be derived from the DISA performance monitoring tools.

6.5.1 Subtask 5.1 - Performance Optimization. The Contractor shall provide solutions to optimize performance - Maintain and configure the GCDS environments to ensure that the service is optimized for flexibility and performance.

6.5.2 Subtask 5.2 - Application Support. The Contractor shall provide solutions for application support - Maintain and configure the GCDS to ensure that it supports all application owners’ requirements including multiple large and/or complex portal style applications as well as interface with third party monitoring system for performance and availability.

6.5.3 Subtask 5.3 - Real time monitoring. The Contractor shall provide solutions for a near real time tool to monitor the locations at the edge to Central Communications Centers (CCCs), TNC GISMC and all other sites the PMO designates as receiving the tool. This tool shall monitor performance being served from the edge with the capability of reaching back in logs to one year, total bandwidth being used across all edge locations in the service, the number of hits, which are occurring across all the locations in the service as well as the number of hits per edge location.

6.6 Task 6 - Standard Implementation Services. The Contractor shall provide for all standard GCDS capabilities and services identified in the performance work statement (PWS). For existing DISA customer applications, transition of applications to the GCDS platform shall support the following standard implementation services:

Standard Implementation Services are included as part of the GCDS, and allow the customer to integrate their site leveraging the following standard GCDS capabilities:

Extending the Infrastructure:

- Hyper Text Transfer Protocol (HTTP) Dynamic Site Delivery

- Secure Object Delivery (Secure Socket Layer Objects)

- Secure Content Delivery - Hyper Text Transfer Protocol Secure (HTTPs)

- Last Mile Accelerator (Compression)

- Streaming Delivery (Audio/Video)

- Dynamic End User Mapping

- Basic Cache Control (Prefetching, Standard TTLs, etc.)

- Capacity On-Demand

- Object delivery

- Domain Name Resolution (CNAME, A-Records etc.)- Control

- Monitoring

- Customer Reporting and Log Delivery

- Unique Customer/Application Identifier

- Alerts (Adjustable threshold settings, E-mail delivery, etc.)

- Customer Content Control Utilities (Purging, etc.)

- Standard Break/Fix Customer Care Support (24x7x365)

6.7 Task 7 - IPv6 Compliance. The Contractor shall provide solutions that are Internet Protocol Version 6 (IPv6) capable. An IPv6 capable system or product is capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

· Conformance to the DoD Information Technology Standards Repository (DISR) developed DoD IPv6 Standards Profile. Systems being developed, procured or acquired shall comply with the Global Information Global Architecture and DISR standard IPv6 Capable definition. An IPv6 Capable system shall meet the IPv6 base requirements defined in the latest “DoD IPv6 Standards Profile” available from the DISR.

· Maintenance of interoperability with Internet Protocol Version 4 (IPv4). Systems developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities. Systems should implement IPv4/IPv6dualstack and should also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket.

6.8 Task 8 - Mobile Device Support. The Contractor shall provide full support with mobile device capabilities. The solution shall determine the type of device at the established edge location the end user is interacting with worldwide, and deliver that mobile content in the appropriate format from the edge. GCDS and the Contractor’s solution shall have the capability to transcode from the edge and deliver appropriate formats from the edge for the end users device.

6.9 Task 9 - Automated Capabilities. In support of cloud services, the Contractor shall provide the capability within GCDS to have automated capabilities to generate metadata on GCDS from Application Program Interfaces (API) that can link with Cloud environments within DISA.

6.10 Task 10 - Data Deduplication Technologies.