Attachment 01c2 Task Order 2 IT Environment Document FPTS Master.pdf

APPENDIX A

Pentagon Force Protection Agency (PFPA)

Force Protection Technology Support

(FPTS)

Joint Provider PFPA (JPP)

Life Safety Backbone (LSB)

Information Technology Environment

APPENDIX A

CONTENTS

PURPOSE

SCOPE

PENTAGON FORCE PROTECTION AGENCY MISSION

LSB IT ENVIRONMENT

DISA/JSP IT HOSTED ENVIRONMENT

IT CLOUD ENVIRONMENT

HISTORICAL ENVIRONMENT / IT ENVIRONMENT STAFFING ESTIMATE

EXAMPLE OF POSITION DESCRIPTIONS

EXAMPLE OF POSITION DESCRIPTIONS (CONTINUED)

TABLE 1: PFPA INFRASTRUCTURE HARDWARE COMPONENTS

TABLE 2: PFPA INFRASTRUCTURE SYSTEM COMPONENTS

PFPA MISSION SYSTEMS INCIDENT RESPONSE POSTURE

TABLE 3: SPECIAL KNOWLEDGE AND EXPERIENCE

TABLE 4: LSB ENGINEERING PROJECTS

TABLE 5: DISA/JSP IT HOSTED ENVIRONMENT

PURPOSE

The purpose of this document is to present an overview of the Force Protection Technology

Support (FPTS) Life Safety Backbone (LSB) IT environment.

SCOPE

The scope of this document is limited to the PFPA Unclassified LSB IT environment and not meant to be a complete inventory or architecture description.

PENTAGON FORCE PROTECTION AGENCY MISSION

Pentagon Force Protection Agency’s (PFPA) mission is to provide force protection, security, and law enforcement, as required for the people, facilities, infrastructure and other resources at the

Pentagon Reservation and for Department of Defense (DoD) activities and DoD-occupied facilities not under the jurisdiction of a Military Department within the National Capital Region

(NCR). This responsibility includes security of the buildings; Access Control; anti-terrorism and force protection; chemical, biological, radiological, nuclear and explosive (CBRNE) protection and detection; and other key functions. The Agency is divided into multiple directorates, each performing specific responsibilities to carry out the mission of the Agency.

LSB IT ENVIRONMENT

The PFPA Force Protection Technology Support (FPTS) systems are currently made up of unclassified networks (LANs) known as the Life Safety Backbone, Coral Network, and

Metropolitan Area Networks (MANs) located at the “Pentagon Reservation” and within the

“National Capital Region” as defined in 10 U.S.C. 2674. This includes but not limited to the

Pentagon, Defense Health Headquarters (DHHQ), The Mark Center, Military Court of Appeals

(MCoA), and Raven Rock Mountain Complex (RRMC). The current PFPA LSB architecture is centered on the Microsoft Windows operating systems platform (i.e. Windows 10, Server 2012, etc.). There are UNIX/ Linux, MSSQL, Oracle databases, COTS, GOTS and custom software based applications/systems connected to the network. Currently there are approximately 263 enabled LSB user accounts, 56 LSB service accounts, and 264 Workstations, 228 Servers, 52

Switches. Additionally, PFPA has stand-alone networks/systems not connected to any external networks.

In support of our mission, PFPA relies on the Defense Information Systems Agency (DISA)

Joint Service Provider (JSP) for Desktop/ Common IT functions and support. This support does

NOT include support for the LSB infrastructure and desktop environment. The LSB infrastructure and desktop environment support will be covered under this FPTS requirement.

PFPA LSB systems architecture operates on approximately 158 physical and virtual servers with several base Windows Server operating systems (2008 R2, 2012, and 2016). PFPA has a configured virtual environment with approximately 70 ESXi hosts. PFPA has a layered network defense architecture, including firewalls, routers, intrusion detection systems, anti-virus software and an established Demilitarized Zone (DMZ) providing protection from intrusion via external systems and networks. The PFPA Force Protection Technology Division (JPP) is responsible for complete oversight of the LSB IT environment and requires support for the PFPA LSB Systems

Infrastructure specific to PFPA mission needs. This includes but is not limited to the following:

Hardware, Software, and Network Components Maintenance Services.

Hardware repair maintenance for PFPA infrastructure components (see table 1).

COTS and GOTS software (see table 2).

Meeting incident response per Mission Criteria and application or system (see table 3).

Software maintenance support services for Microsoft products, Oracle Database, LINUX, antivirus, network and infrastructure monitoring and management tools (see table 4).

Support for current and future projects (see table 5)

The JPP PFPA LSB Environment also includes operations and maintenance support for law enforcement vehicles with approximately 39 Toughbooks; and two (2) Mobile Command

Centers (MCC). The MCC IT assets consist of 2 servers, 7 Panasonic Toughbooks, 2 laptops, 1 network consisting of Cisco 2811 Router and one Catalyst 3560-G, and satellite communications equipment supported by a 3rd party vendor, Knight Sky.

JPP utilizes a MS SharePoint site and Coral Network NetShare folders as the primary repositories for storage and access of SOPs, Work Instructions, Forms, Software, etc. The

SharePoint site is broken down by several sub-sites (i.e. Engineering and Architecture, Information Assurance, Operations, Taskers, JPP Change Management, Policy and Governance, Transition Library, and Program Management). This will be the central knowledge base used for a successful transition.

INCIDENTS/ MAINTENANCE (PLANNED/ UNPLANNED)

During the past year (12 months) the PFPA JPP supported the following number of incident/ service requests:

Serviced (744) LSB incident requests over the last consecutive 12 months (approximately

62 averaged per month)

Serviced (644) LSB service requests over the last consecutive 12 months (approximately

54 averaged per month) Approximately (55) Planned maintenance outages for LSB IT systems over the last consecutive 12 months, averaging (5) per month. (this includes, patch management & scanning)

Approximately (108) Planned building maintenance power outages effecting LSB IT systems over the last consecutive 12 months, averaging nine (9) per month.

DISA/JSP IT HOSTED ENVIRONMENT

DISA/JSP’s IT environment (USER domain) is an unclassified network consisting of common IT services (e.g., e-mail, file, print, storage, telephones and mobile device operations). DISA/JSP has full operations and maintenance responsibility over this environment.

PFPA has mission specific applications (e.g. ADORE, Computer Aided Dispatch and Reporting

Management System (CAD/RMS), Computer Emergency Notification System (CENS), Parking

Management application, Workforce Telestaff, WebEOC, Human Resource Management

System (HRMS), and Visitor Management System (VMS) that reside on the DISA/JSP’s IT hosted environment the External (EXTNet) and Resource Network (RSRCNet). These applications are categorized LSB applications and may require support (application only) as part of the FPTS requirement (see table 5).

IT CLOUD ENVIRONMENT

DoD Cloud Environment:

PFPA has approximately seven (7) cloud environment projects ongoing:

Salesforce – PFPA Recruit Management Tool

Metrological Modeling System (MMS) – CBRNE Weather Modeling

PFPA Intranet Extranet Website (PIEWS) – PFPA internal website

Counter Small Unmanned Aircraft System (C-sUAS)

EVOLV security screening system

John Hopkin University Applied Physical Labratory (JHU-APL)

• Reach back for CBRNE Protection Division (CPD) Interior Chemical

Sensor Network (ICSN)

Qmatic/Qless queue management system

The cloud projects listed above will have shared responsibility for management, security, and administration. We anticipate vendor responsibility to be limited, however it is currently being defined.

HISTORICAL ENVIRONMENT / IT ENVIRONMENT STAFFING ESTIMATE

(For Information Purpose Only)

Based on the JPP’s current operations tempo and increasing workload, JPP subject matter experts have estimated the following number of full time equivalents (FTEs) would meet the FPTS requirements. The number of FTEs is based on requirements and position descriptions within the

PWS and table provided below along with 2080 hours per FTE:

Program Management (1)

Operations (19)

Engineering (15)

Cybersecurity (14)

Change Management (1)

Configuration Management (1)

EXAMPLE OF POSITION DESCRIPTIONS

LABOR CATEGORY DESCRIPTION

Task Order Project Manager FPTS Program Manager

Project Control Specialist Project Manager. Responsible for ensuring project management plans (as defined by PMI) are developed and available for GOV and stakeholder access

Operations Manager Lead - Managing Daily Operations, Service Desk, Systems

Administration, and Network Operations

Principal Systems Engineer Lead

Principal Information Engineer Responsible to apply an enterprise-wide set of disciplines for the planning, analysis, design and construction of information systems on an enterprise-wide basis or across a major sector of the enterprise in support of PFPA requirements.

Senior Systems Administrator Lead – SysAdmin specific

System Administrator Support is required to focus on O&M, patching, engineering support, monitoring, conducting surveys, backup and recovery, imaging management, and implementing efficiencies. Skillsets should include proficient knowledge with automation and monitoring tools (e.g. Solarwinds SAM, MS System Center

Configuration Manager (SCCM), VEEAM (backup and recovery), VMWare, etc.) in addition to the platforms identified within the

PWS.

Configuration Management Specialist

(Lead)

1 position responsible for configuration management and 1 for change management

Configuration Management Specialist

(Intermediate)

Refer to Configuration Management Specialist (Lead) position description

Communications Specialist NetOps support personnel required to provide sufficient support to the PFPA (i.e. monitoring, troubleshooting, conducting surveys, submitting requirements to DISA/JSP, and O&M of networking devices within the NCR)

Senior Systems Architect Designs architecture to include the software, hardware, and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces

EXAMPLE OF POSITION DESCRIPTIONS (CONTINUED)

LABOR CATEGORY DESCRIPTION

Senior Information Assurance (IA)

Analyst

Team Lead – 1 (IAM Level III Certified)

Intermediate Information Assurance

(IA) Analyst

Support focused on ACAS(All areas of scanning and remediation tracking), RMF (20+ systems/applications AA and AO’s), HBSS

(management of the EPO and all associated tasks)

Information Assurance/System Security

Architect Level 2

Provide input and expertise guidance on acquisition, design, implementation, and environment changes.

Information Assurance/System Security

Architect Level 3

Focused on Team support for all areas

Database Management Specialist Lead – Database specific

Database Administrator

Assigned to implement, monitor, code, test, troubleshoot, ensure backup and recovery, etc.)

TABLE 1: PFPA INFRASTRUCTURE HARDWARE COMPONENTS

This is an approximate listing of PFPA managed assets

EA. COMPONENT TYPE MODEL

264 Workstations Dell Optiplex 7040

8 Laptops Dell Precission 7015

22 Tablets Microsoft Surface Pro 6

39 Toughbooks PANASONIC CF-3117598VM

1 Servers Physical

227 Servers Virtual

39 ESXI Hosts ProLiant BL460c Gen10

31 ESXI Hosts ProLiant BL460c Gen9

2 Switches CISCO WS-C6506-E

29 Switches CISCO WS-C3560X-48P

2 Switches JUNIPER SRX320

1 Switches JUNIPER ex9208

1 Switches CISCO WS-C6506-E

17 Switches JUNIPER EX4300-48-P

TABLE 2: PFPA INFRASTRUCTURE SYSTEM COMPONENTS

This is an approximate listing of systems residing on the PFPA Infrastructure. The contractor shall be responsible for continuous monitoring and oversight of the LSB Systems

LSB IT ENVIRONMENT SHORT DESCRIPTION

IT Management Tools

ACAS, Active Directory, BELMANAGE, DameWare, HBSS, Tanium, OCSP, SolarWinds, Splunk, SCCM, VMWare, WSUS

STAR (RHEL on Physical)

Chemical Biological Radiological (CBR) System Division

(CSD) Exterior Modeling System

Sentry

Chemical Biological Radiological (CBR) System Division

(CSD)Environmental Monitoring

LIDAR

Chemical Biological Radiological (CBR) System Division

(CSD) Exterior Modeling System

Laboratory Information Management System (LIMS)

Chemical Biological Radiological (CBR) System Division

(CSD) Laboratory Information Management System

(LIMS)

Privileged Management Program (PMP) (Access

Management Portal, VMS) EPSD -Identity Control and Access Management System

AMAG

Access Control and Intrusion Detection System (ACIDS).

A component of the Electronic Security System located at

Mark Center, Defense Health Headquarters, and Raven

Rock Mountain Complex (RRMC).

CCURE 9000

Access Control and Intrusion Detection System (ACIDS).

A component of the Electronic Security System located at

Mark Center, Defense Health Headquarters, and Raven

Rock Mountain Complex (RRMC).

Bosch Video Management System (BVMS) CCTV System supporting the Video Surveillance Program

Activu Pentagon and Mark Center video Wall Display system

Under Vehicle Inspection System (UVIS)

A threat deterrent component of the Electronic Security

System located at Mark Center, Defense Health

Headquarters, and Raven Rock Mountain Complex

(RRMC).

Mobile License Plate Recognition (LPR)

Parking Enforcement component of the Electronic Security

System located at Mark Center, Defense Health

Headquarters, and Raven Rock Mountain Complex

(RRMC)

Physical Security Information Management (PSIM)

System

Multi-system (i.e. AMAG, CCURE, BVMS, SENTRY) common operating picture (COP).

License Plate Reader (LPR)

A threat deterrent component of the Electronic Security

System located at Mark Center, Defense Health

Headquarters, and Raven Rock Mountain Complex

(RRMC)

TABLE 2: PFPA INFRASTRUCTURE SYSTEM COMPONENTS (CONTINUED)

LSB IT Environment Short Description

Virginia Criminal Investigative Network (VCIN Virginia State Police statewide data communications network

Mark Center Active Vehicle Barrier System Physical Security Barrier Control System

Active Client Smart Card middleware, allows easily use of smart cards for desktop and productivity applications

Static Vehicle Screening System (SVSS) A threat deterrent component of the Electronic Security

System located at Mark Center, Defense Health

Headquarters, and Raven Rock Mountain Complex

(RRMC).

PFPA MISSION SYSTEMS INCIDENT RESPONSE POSTURE

PFPA uses multiple missions systems and technologies to perform it force protection mission. PFPA has defined these Mission systems and application which are significant to the efficient response of any type of Security, Law Enforcement and Life Safety situation. In the event these systems are inoperable, or degraded the contractor shall triage these incidents in accordance with the following Incident Response

Posture.

PFPA MISSION CRITICAL APPLICATIONS/SYSTEMS

A system whose operational effectiveness and suitability are critical to successful completion of the force protection mission. If this system fails, the mission likely will not be completed. These applications are required to be highly available and resilient. They must have a disaster recovery and a continuity of operations plan. Lives are at stake.

Mission Critical Support Response Posture: Subject Matter Expert (SME) support for all aspects of

JSP-provided infrastructure available 24/7/365. Tickets generated for Mission Critical Applications should be URGENT - CRITICAL IMPACT tickets and acknowledged within ten minutes of being opened. Critical tickets shall be resolved within 2 hours.

• Mission Critical Systems/Applications:

• AMAG 7 - Physical Security System

• Exterior Modeling System (EMS) - STAR (RHEL on Physical)

• E911

• Computer Emergency Notification System (CENS)

• C-CURE 9000 - Physical Security System by Software House

• Bosch Video Management System (BVMS) - Bosch CCTV system

PFPA MISSION ESSENTIAL APPLICATIONS/SYSTEMS

A system whose operational effectiveness and suitability are essential to successful completion of the force protection mission. If this system fails, the mission will be impacted but does not signify mission failure. These applications are not considered basic and required to be available for mission accomplishment. They must have a disaster recovery and a continuity of operations plan.

Mission Essential Applications: Support Response Posture: SME available 24/7/365. Tickets for

Mission Essential Applications should be HIGH - SIGNIFICANT IMPACT and acknowledged within 10 minutes. High Impact tickets shall be resolved within 8 hours.

• Mission Essential Systems/Applications

• ACTIVU - CAC Authentication (OCSP)

• Physical Security Information Management (PSIM)

• Privilege Management Program (PMP)

• SENTRY/ Pentagon Shield - CBRNE Environmental Monitoring

• Computer Aided Dispatch (CAD)

• PIMI (MS Access - SQL Server)

• Records Management System (RMS)

MISSION SUPPORT APPLICATIONS

A system whose operational effectiveness and suitability support the successful completion of the force protection mission. If this system fails, the mission will be impacted but does not signify mission failure.

Mission Support Applications: Support Response Posture: SME during business hours. Tickets for

Mission Support Applications should be NORMAL - MINOR IMPACT and acknowledged within 10 minutes. Normal impact tickets should be resolved within 24 hours

• Mission Support Systems/Applications (This list is not all inclusive)

• Joint Automated Booking (JABS)

• VCIN

• ADORE

• LIDAR

• VMware - vCenter Software

• Human Resources Management System

• WEBEOC

• Static Vehicle Screening System (SVSS)

TABLE 3: SPECIAL KNOWLEDGE AND EXPERIENCE

This is an approximate listing of knowledge and experience needed to perform the requirements listed in the Performance Work Statement. This list includes monitoring, management, and administrative tool critical to the operations and maintenance to the LSB Systems architecture.

Microsoft desktop/server operating systems;

Server Administration

Business and Disaster Recovery Planning

Remote Access Technologies

Satellite Communications

Storage Area Networking

Virtual Storage Platform

Enterprise Patching Solutions

Microsoft System Center Configuration Manager

Active Directory

Network Node Manager

VCenter/vCloud

Network Monitoring Tools (e.g. Solarwinds)

Cisco and Juniper network device administration

Various brands of server hardware (e.g. HPE, Dell, etc.)

BMC Remedy

Redhat Linux

Configuration Management and Change Control;

Microsoft Server

Microsoft SharePoint

Microsoft Azure Government

Amazon Web Services

Microsoft SQL Administration

Veeam Availability Suite

Splunk

Host Based Security System (HBSS)

Assured Compliance Assessment Solution (ACAS)

TABLE 4: LSB ENGINEERING PROJECTS

The following table is a list of projects that has been assigned to Projects and Architectural Engineering. The Priority 1

Projects are actively being worked and the expectation is that these are the projects that will continue to be worked upon

Task Order award. The Priority 2 projects are supporting type where JPP is coordinating with other government agencies to provide the transport for our stakeholder’s project. The Priority 3 project is completing an analysis and making a recommendation to LCR the LSB network.

PRIORITY

PROJECT

TITLE

PROJECT

DESCRIPTION

CURRENT

STATUS

EXPECTATION

NTP Servers

Upgrade

Upgrade current NTP servers from Code

Division Multiple Access

(CDMA) to utilize GPS provide long term and stable time source on the

PFPA LSB.

Research and analysis conducted.

Solution has been identified.

The expected results is a redundant time source on the

LSB network.

OCSP Load

Balancer

Eliminate the current round robin DNS load balancing configuration and Engineer and implement a true load balancer solution.

Load balancing is current achieved by using round robin

DNS

Upon completion, the expectation will be a more efficient load balancing solution.

Shield Domain

Consolidation

Consolidate the Shield

Domain into the LSB

Domain

The Shield Domain is currently a child domain of the LSB

Domain

Upon completion there will only a single domain on the LSB network

Platform as a

Service (PaaS)

LCR

Execute the LCR of the

PaaS based on previous analysis and Bill of

Materials

Analysis is in progress

The expectation is to execute the proposed LCR analysis and

BOM of the LSB network.

TABLE 5: DISA/JSP IT HOSTED ENVIRONMENT

The following is an approximate list of applications/systems hosted on the DISA/JSP network.

DISA/JSP IT HOSTED ENVIRONMENT SHORT DESCRIPTION

Visitor Management System Web-based Visitor Registration System

WebEOC Collaborative Emergency Management System

Human Resource Management System (HRMS) Personnel Management System

ADORE Training System

Computer Aided Design (CAD) Law Enforcement Event/Incident Recording and Reporting

System

Records Management System (RMS) Law Enforcement Event/Incident Recording and Reporting

System

Computer Emergency Notification System (CENS) Mass Enterprise Notification System

KRONOS Telestaff Public Safety Automated Scheduling Solution

PFPA Parking Application Parking Enforcement