Attachment 1_CSCIII.pdf

ATTACHMENT 1

1.0 Performance Requirements

1.1 Task 1 – Capacity Offerings.

1.1.1 Subtask 1.1 Communication Capacity. New communication capacity shall be provided as an ‘on-demand’ service capable of readily adjusting to changes in requirements, including both increases and decreases. The Government will determine the need for additional capacity and/or communication equipment. The Contractor shall provide flexible, highly scalable, solutions that are non-disruptive. Examples are provided in Appendix 1 as a sampling of the current hardware deployed within the DISA environment.

1.1.2 Subtask 1.2 Primary Offerings. Appendix 5 lists categories of services required for the Primary Offerings corresponding to SLINs and the minimum features for each category.

1.1.2.1 General Requirements.

1.1.2.1.1 Power. All provided physical solutions must support redundant power. Redundant power supplies internal to the chassis is the preferred method of achieving redundant power. However, a vendor-supplied, rack-mounted Automatic Transfer Switch (ATS) included in the base solution is acceptable for solutions which are not capable of internal redundancy. The Remote-managed mPDUs in Appendix 5 Section 0001G are exempt from this requirement.

1.1.2.1.2 Installation Accessories. All provided physical Primary Offerings must include all required accessories for installation, to include rack-mount kits and power cables, as part of the base solution.

1.1.2.1.3 Remote Diagnostics. The Government requires that all CSC solutions be supported by remote diagnostics, administration, and tools that communicate over the DISA management network. All CSC communications devices will be configured to send all management traffic via a dedicated management interface or Virtual Local Area Network (VLAN) capable of isolating management traffic to the management network. System errors will be immediately reported to remote tools servers and service center(s). The contractor shall provide written confirmation that capacity devices delivered can be supported by remote diagnostics within 7 calendar days after start of performance.

1.1.2.2 Solution Minimum Requirements. The minimum requirements in Appendix 5 must be met by the proposed solutions. Any solution that can meet the device requirements and complement the existing infrastructure would be considered a suitable fit.

Example Products. Appendix 5 contains example products to demonstrate the type of device for each category. The example products listed in Appendix 5 are examples only and are not intended to represent products that will meet specifications as it is the responsibility of the contractor to validate that product specifications to meet the Government’s requirement.

1.1.3 Subtask 1.3 Emerging Tech Offerings. Due to ever-changing communications requirements to meet the needs of DISA and its Mission Partners, the Government may request new solutions be made available on contract. The purpose of the Emerging Tech Offerings is to provide the flexibility needed to meet new short-notice requirements to keep pace with industry and service requirements.

1.1.3.1 Usage. The Emerging Tech Offerings shall be used for time-sensitive requirements. Once made available on contract, Alternate Offerings are subject to all applicable contract requirements for capacity, including but not limited to support, installation, and renewals.

1.1.3.2 Pricing. Emerging Tech Offerings will utilize “utility pricing” and shall be priced using the same methodology as Primary Offerings based on the costs at the time the Emerging Tech Offering is made available on contract. The Emerging Tech Offerings will be made available utilizing the appropriate Emerging Tech SLIN available in each category.

1.1.3.3 Minimum Requirements. The Emerging Tech Offering solutions must meet the requirements presented for the specific project.

1.1.4 Subtask 1.4 Capacity Support. The contractor shall include OEM support with all capacity offerings. For all capacity delivered, the contractor will have an OEM agreement in place to ensure uninterrupted delivery and quality of service to the Government. Copies of these agreements will be provided to the Government within 30 days of contract award.

1.1.4.1 Service Tiers. The Contractor will provide the following tiers of OEM service and response for each solution as applicable:

Level I (Gold) service: Contractor must provide 24x7x365 premium OEM phone support with Same Business Day Return Merchandise Authorization (RMA) service for physical hardware. Contractor must be on site within two (2) hours of delivery of replacement hardware or at the start of a Government coordinated maintenance window to perform remedial maintenance. On site labor support waivable by the Government.

Level II (Silver) service: Contractor must provide 24x7x365 premium OEM phone support with Next Business Day RMA service for physical hardware. Contractor must be on site within four (4) hours of delivery of replacement hardware or at the start of a Government coordinated maintenance window to perform remedial maintenance. On site labor support waivable by the Government.

Virtual solutions which do not include any hardware are exempt from the RMA requirement.

Level III (Bronze) service: Contractor must provide 8x5 OEM phone support with Next Business Day RMA service for physical hardware. Contractor must be on site within four (4) hours of delivery of replacement hardware or at the start of a Government coordinated maintenance window to perform remedial maintenance. On site labor support waivable by the Government. Virtual solutions which do not include any hardware are exempt from the RMA requirement.

1.1.4.2 Remedial Maintenance. If needed, as determined by site personnel, calls will be initiated by the Government to the contractor’s toll-free help desk service. Contractor shall respond and make the necessary repairs in accordance with the timelines identified in the contract and specified by the service tier level selected by the Government.

1.1.5 Subtask 1.5 Life Cycle Management. For all capacity offerings, the contractor shall track the life cycle of all solutions, to include published end of sale, end of software maintenance, end of vulnerability support, and end of support dates. Once an offered solution is no longer available for sale, the contractor shall coordinate a replacement solution with the Government. The replacement solution will be made available on contract at the same price as the replaced solution and utilize the same SLIN. The Government retains final approval for all replacement solutions.

1.1.6 Subtask 1.6 Structure. Capacity offerings shall be offered as both physical and virtual solutions as structured in PWS Appendix 5. Physical and Virtual capacity offerings will use SLINs from the b-table in the corresponding category and subcategory. Capacity offerings will use the following structure:

Category Number – Description

000 - Physical Capacity

0001 - General Appliances o 0001A - Enterprise WAN Acceleration Appliances and Licenses o 0001B - Data Center Console Server o 0001C - Data Center Circuit to IP Converter Appliance o 0001D - Enterprise Network Policy Compliance Appliance and Licenses o 0001E - Mobility Controller Appliance o 0001F - Enterprise Time Server Appliance, Licenses, and Accessories o 0001G - Remote-managed mPDU o 0001Z - Physical Emerging Tech - General

0002 - Firewalls o 0002A - Layer 7 Firewall o 0002B - Network Stateful Firewall, Licenses, and Modules o 0002C - Boundary Firewall, Licenses, Modules, and Management Systems o 0002D - Data Center Premise Firewall Device and Modules o 0002Z - Physical Emerging Tech – Firewalls 0003 - Load Balancers o 0003A - Application Delivery Controller Appliances, Licenses, and Modules o 0003B - Modular Data Center Load Balancer o 0003C - Enterprise Load Balancer and Modules o 0003Z - Physical Emerging Tech - Load Balancers

0004 - Security o 0004A - Intrusion Detection Systems o 0004B - Intrusion Detection System Management Appliance o 0004C - Intrusion Detection System Transceivers o 0004D - Next Generation Security Gateway o 0004E - Accounting, Authentication, and Authorization (AAA) Appliance o 0004F - Two Factor Authentication Management o 0004Z - Physical Emerging Tech - Security

0005 - Routers o 0005A - Data Center Edge Router o 0005B - Premise Router, Licenses, and Modules o 0005Z - Physical Emerging Tech – Routers

0006 - Non-SDN Switches o 0006A - Campus LAN Switch o 0006B - Campus LAN Switch Transceivers o 0006C - Non-SDN Fabric Spine Switch o 0006D - Non-SDN Fabric Leaf Switch o 0006E - Non-SDN Fabric Flexible Extender Appliance o 0006F - Non-SDN Fabric Switch Transceivers o 0006Z - Physical Emerging Tech - Switches

0007 - Software Defined Networking (SDN) o 0007A - SDN Controllers o 0007B - SDN Fabric Spine Switches o 0007C - SDN Fabric Leaf Switches o 0007D - SDN Fabric Flexible Extender Appliance o 0007E - SDN Transceivers o 0007Z - Physical Emerging Tech - SDN

0008 - Domain Name System (DNS) o 0008A - Enterprise DNS Appliances o 0008B - Enterprise DNS Management o 0008C - Enterprise DNS Reporting and Collection o 0008D - Enterprise DNS Transceivers o 0008Z - Physical Emerging Tech - DNS

0009 - Network Packet Capture (NPC) o 0009A - Traffic Matrix Switching Node, Modules, and Licenses o 0009B - Traffic Matrix Management Appliance o 0009C - Traffic Matrix Modular Taps o 0009D - Traffic Matrix Transceivers o 0009E - Network Monitoring Switches o 0009F - Network Monitoring Aggregation Appliance o 0009G - Network Monitoring Analysis Appliances o 0009H - Network Monitoring Fiber Taps o 0009I - Network Monitoring Copper Taps o 0009J - Network Monitoring Transceivers o 0009Z - Physical Emerging Tech - NPC

0010 - Email o 0010A - Enterprise Email Protection System o 0010Z - Physical Emerging Tech - Email

0011 - Virtualization Platforms o 0011A - Branch Network Virtualization Platform o 0011B - Data Center Network Virtualization Platform o 0011Z - Physical Emerging Tech - Virtualization Platforms

0012 - Voice over IP (VoIP) Equipment o 0012A - VOIP Call Manager (Appliance) o 0012B - VOIP Voicemail (License/Module) o 0012C - VOIP Automatic Call Distribution System o 0012Z - Physical Emerging Tech - VoIP

100 - Virtual Capacity

1001 - General Virtual Appliances o 1001A - Enterprise WAN Acceleration Virtual Appliances and Licenses o 1001Z - Virtual Emerging Tech - General

1002 - Virtual Firewalls o 1002A - Layer 7 Virtual Firewall o 1002B - Network Stateful Virtual Firewall o 1002C - Boundary Virtual Firewall o 1002Z - Virtual Emerging Tech - Firewalls

1003 - Virtual Load Balancers o 1003A - Data Center Load Balancer Virtual o 1003B - Enterprise Application Delivery Controller Virtual Appliances and Modules o 1003C - Containerized Load Balancer o 1003Z - Virtual Emerging Tech - Load Balancers

1004 - Virtual Security o 1004A - Intrusion Detection System Virtual Appliances o 1004B - Intrusion Detection System Management Virtual Appliances o 1004C - Account, Authentication, and Authorization Virtual Appliances o 1004D - Two Factor Authentication Management Virtual o 1004Z - Virtual Emerging Tech - Security

1005 - Virtual Routers o 1005A - Virtual Data Center Router and Licenses o 1005B - Virtual Edge SD-WAN Router o 1005Z - Virtual Emerging Tech - Routers

1006 - Virtual Switches o 1006Z - Virtual Emerging Tech - Switches

1007 - Virtual SDN o 1007A - SDN Centralized Controller Virtual o 1007Z - Virtual Emerging Tech - SDN

1008 - Virtual DNS o 1008A - Virtual Enterprise DNS Appliances o 1008B - Virtual Enterprise DNS Management o 1008C - Virtual Enterprise DNS Reporting Collectors o 1008Z - Virtual Emerging Tech - DNS

1009 - Virtual NPC o 1009A - Virtual Traffic Matrix for Private Cloud o 1009B - Virtual Traffic Matrix for Commercial Cloud (Gov Cloud Environments) o 1009C - Virtual Traffic Matrix Management Appliance o 1009Z - Virtual Emerging Tech - NPC

1010 - Virtual Email o 1010A - Virtual Email Security Appliance o 1010B - Virtual Email Security Management Appliance o 1010C - Virtual Enterprise Email Protection System Appliance o 1010Z - Virtual Emerging Tech - Email

1011 - Virtual Network Management o 1011A - Virtual Network Virtualization Platform Management o 1011B - Virtual Network And Security Analytics Solution o 1011Z - Virtual Emerging Tech - Network Management 1012 - Cloud and Automation o 1012A - Automation Platform - Virtual o 1012B - Secret Manager - Virtual o 1012C - System Management Software - Virtual o 1012D - Hybrid Cloud Container Platform - Virtual o 1012E - Distributed Event Store and Stream-Processing Platform o 1012F - Distributed Time-Series Data Store o 1012G - Centralized Analytics Platform o 1012Z - Virtual Emerging Tech - Cloud and Automation

1013 - Certificates o 1013A - Commercial Certificates - Standard o 1013B - Commercial Certificates - Wildcard o 1013Z - Virtual Emerging Tech – Certificates

1.1.7 Subtask 1.7 Integration with Existing DISA Network and Migration Services.

1.1.7.1 The contractor must ensure the proposed solutions will integrate with the existing DISA solutions of the same type (e.g., the proposed DNS/IPAM solution must integrate with the existing DNS/IPAM solution, and the proposed switching solution must integrate with the existing switching solution).

1.1.7.2 A list of proposed makes and models must be submitted by the contractor.

1.1.7.3 The contractor must ensure all infrastructure components provided are compatible with and operate seamlessly with DISA’s communications, processor, and storage infrastructure.

1.1.7.4 The contractor must ensure all changes to infrastructure component makes and models are tested and coordinated with and concurred by DISA before introduction into the communications environment. After testing, coordination, and concurrence for a make and model change, the contractor must provide an updated list of the makes and models.

1.1.7.5 The contractor must provide migration services to ensure that syntax from DISA’s current communications environment is transferable to the vendor provided solution. All migration services, including tools required to perform the services, must be included in the “utility” pricing. The contractor will provide in their proposal their migration services strategy including techniques, tools, and methods. Any tools or hardware needed for the migration services must be provided, installed, and initially configured by the contractor; however, any software tools to be installed on Government issued workstations required for the migration services must be provided by the contractor and then approved and installed on Government issued workstations by the Government.

1.1.8 Subtask 1.8 Removal of Equipment. The contractor shall conduct any necessary de-installation and removal of hardware items on this contract upon request by the Government both during and at the end of the contract. Removal of all contractor equipment will be coordinated with the site Accountable Property Custodian (APC) or Property management group. Removal will be at no cost to the Government.

1.2 Task 2 – Non-Capacity Offerings.

1.2.1 Subtask 2.1 Technical Assistance.

1.2.1.1 Technical Consultant. Technical consulting may be required on as needed basis to provide flexibility to modify services to meet the needs of DISA and its customers. The Contractor will be responsible for providing technical support and/or leadership in the creation and delivery of technology solutions designed to meet the Government’s business needs. All technical consulting requirements must be documented in a statement of work to be submitted with the technical assistance call order. Technical Consultant support is a specified requirement needed by DISA and does not include predictive or remedial maintenance for hardware, software, or release management.

Technical Consultants will be available on firm fixed price (FFP) hourly basis.

1.2.1.1.1 The Contractor is authorized to invoice only for hours authorized by call order.

1.2.1.1.2 The support will be divided into five levels depending upon the level of support required as described in Appendix 4, Technical Assistance and Consulting Support. The labor categories will also be used for performing services that will require a FFP effort with a detailed agreement with DISA on the scope of work.

1.2.1.2 OEM Professional Services. OEM Professional Services will be used to obtain engineering and/or deployment support from manufacturers as needed by the Government. All OEM Professional services requirements must be documented in a statement of work to be submitted with the technical assistance call order. The Contractor shall be responsible for establishing the service and agreements with the manufacturer. OEM Professional Services will be available via an hourly rate established at the time of procurement. The contractor is authorized to invoice only for hours authorized by call order.

1.2.1.3 Training and Certification. Contractors required to support this contract will comply with 8140 requirements as detailed in 6.3.5.

1.2.1.4 Travel. The Contractor shall be required to travel to support this contract to include but not limited to the primary places of performance identified in Section 9. Additionally, travel to other facilities both CONUS and OCONUS will be required. TO related travel costs, i.e., relocation and temporary duty (TDY) to include travel, lodging and meals are reimbursable in accordance with FAR 31.205-46. No Contractor travel shall be conducted to support the requirements of this PWS without advance, written approval from the Contracting Officer Representative (COR) on a Travel Authorization Request (TAR).

The Contractor shall provide trip reports to the COR and KO via electronic mail no later than five (5) business days after the completion of the trip. Travel for Government meetings will be at the Contractor’s expense. (See Section 6.6 Task 6.)

1.2.2 Subtask 2.2 Infrastructure Components.

1.2.2.1 Cables. The Contractor shall deliver the physical cables as a supply item, not a service, when ordered by the Government. Supply item requirements will be ordered through a one-time charge call order. As such these cables will be allocated/owned/retained by the Government. All cabling must conform to existing DISA cabling standards.

All cabling must be certified. See Appendix 7 for Cabling Specifications.

1.2.2.2 Racks and Rack Accessories. The Contractor shall deliver racks and associated components in support of this contract as supply items, not a service when requested by the Government. Supply item requirements will be acquired through a one-time charge call order. As such these cabinets, racks and associated components will be allocated/owned/retained by the Government. Most cabinets will be in the data center, but some will be in small communications closets where a two-post solution is necessary. Wall mountable enclosures must also be available.

Refer to Appendix 2 – Facilities Rack and Appendix 3 – Facilities Power Details. All cabinets and racks shall support configurable options allowing for optimized storage of hardware. Examples of common configurable options are listed below but not limited to:

Horizontal and vertical cable management Interface to overhead cable tray conveyance Under floor conveyance Front to back air flow Side to side air flow Shelves Mounting hardware Jumpers Patch panels

1.2.3 Subtask 2.3 Relocation.

1.2.3.1 Relocation defined. Relocation refers to movement and is defined as the transfer of equipment within the same DISA site. There will be “Relocation Services” CLIN/SLIN to support this requirement. Relocation must be accomplished within 10 calendar days of hardware turn-over and notification to the Contractor.

1.2.3.2 Free Move. The relocation CLIN/SLIN may be used for the one-time free move when requested by the Government. Free moves are defined as relocations within a single DISA approved location (CONUS & OCONUS) and can be used one time per item ordered. The call order will be modified using the relocation services CLIN/SLIN at zero cost to the Government.

1.2.3.3 Cost Reimbursable Move. The relocation CLIN/SLIN may be used for a cost reimbursable move when requested by the Government. Cost reimbursable moves are defined as relocations within and between DISA approved locations (CONUS & OCONUS). The equipment being relocated may be Contractor owned, DISA owned, or customer owned. Delivery must be accomplished within 10 calendar days of hardware turn-over to the Contractor and must include appropriate packaging of equipment to prevent damage in shipment. A call order will be generated using the relocation services CLIN/SLIN and will be billed on a cost reimbursable basis. The Contractor must provide actual invoice for reimbursement. Reimbursement will be based on DISA PM approved quote detailing specific move requirements. This will be a direct cost reimbursement for shipping costs and must be supported with a receipt from the shipper.

1.2.4 Subtask 2.4 Structure. Non-Capacity offerings will use SLINs from the b-table in the corresponding category and subcategory. Non-Capacity offerings will use the following structure:

Category Number – Description

200 - Non-Capacity

2001 - Technical Assistance o 2001A - Technology Consultant o 2001B - OEM Professional Services o 2001C - Travel

2002 - Restitution o 2002A - Property Loss by Government o 2002B - Early Return of Non-Reusable Items

2003 - Relocation o 2003A - Relocation Services

2004 - Infrastructure Components o 2004A - Rack/Cabinets o 2004B - Rack Accessories o 2004C - Cables o 2004D - Conveyance o 2004E - Disposable Technology

1.3 Task 3 – Program and Project Management.

1.3.1 Subtask 3.1 PMO (Program Management Office). The contractor must establish and maintain a Program Management Office to be the single point of contact for the Government to communicate with the contractor on all matters related to the operation and execution of the contract. In the proposal, the contractor will provide a description of the organization of the PMO. They will define processes related to providing service and support and address relevant functions including how to request capacity, report capacity failures, request technical assistance and relocation services, request supply items such as cables and racks, resolve monthly invoice questions, report installed inventory, escalate emergency issues and other related items. The contractor will describe any methods they will utilize to provide continuous, responsive action when needed, including backups for PMO functions, experience and certifications possessed by the PMO members, how security requirements for labor will be met, contract administration including scope and modification discussions, if they arise, and subcontractor management.

1.3.2 Subtask 3.2 Technical Assistance Center (TAC). Standard commercial communications technical support, such as call center support and firmware updates, must be provided at no additional charge to the Government. The call center must be manned by United States Citizens with the ability to hold the required clearance level. (Secret IT- 1 for system access and Secret IT-2 for all other CSC support). The contractor will provide a multi-level solution for response after being notified by the Government, to commence remedial maintenance for hardware and any software required for the contractor solution to operate. Each orderable system will be identified to a level of response based on Government need. All maintenance requirements are included in the “utility” pricing. The contractor shall provide a 24x7/365 problem escalation/resolution support services including POCs, phone numbers and escalation chart.

1.3.3 Engineering Support. To provide the best value for both DISA and the contractor, the contractor shall provide specialized engineering support to evaluate existing infrastructure solutions to properly engineer future technology.

1.3.3.1 Experience.

1.3.3.1.1 The engineering support will have extensive knowledge of the existing DISA environment and will be authorized to make changes to the DECC communications infrastructure (DCI) if they are following documented DCI change policies.

1.3.3.1.2 Engineering support will consist of at least one network systems architect fully versed in industry design standards for architectures including on-prem data center and campus networks, cloud, and hybrid cloud.

1.3.3.1.3 Remaining engineering support FTEs will be senior level network engineers with design experience.

1.3.3.2 Locality. The majority of engineering support provided must be provided as on-site (collocated with a DISA facility) for access to classified environments. Telework for on-site personnel will follow published DISA guidance.

Remaining FTEs for Engineering support may be remote or on-site at the contractor’s discretion to bolster engineering support for unclassified environments.

1.3.3.3 Sizing. The number of FTEs provided for engineering support is at the discretion of the contractor. The contractor may scale the number of FTEs as needed to perform the associated tasks as detailed in PWS Section 6.3.3.

1.3.3.4 New Technology. Engineering support will recommend new solutions as technology and requirements change and will assist DISA with testing new solutions as well as documenting engineering design guides that will aid implementation of new technologies. The Government retains final decision authority on all design change recommendations.

1.3.3.5 Mission Partner Engineering Support. Engineering support will provide consult as needed to aid in developing solutions for Mission Partner requirements as requested by the Government. Government communications engineers assigned to Mission Partner projects will engage engineering support as needed to verify solutions proposed to meet Mission Partner projects.

1.3.3.6 Technology Failure. The contractor will be required to perform on-site root cause analysis. To perform this role, this position must be proficient in technical writing, troubleshooting, and DISA organization structure.

1.3.3.7 Capacity Planning. To facilitate cost effectiveness and capabilities of the provided solutions, the contractor will monitor the solutions in use for underutilized and overutilized assets. The contractor will provide a monthly capacity report detailing under- and over-utilized assets, assets nearing performance thresholds, and summary recommendations for downgrades and upgrades to be considered by the Government. The Government has final decision authority for courses of action regarding the contractor’s recommendations.

1.3.4 Subtask 3.4 Tech Refresh Support. For large-scale tech refresh projects that cannot be accomplished with existing personnel, the contractor shall provide FTEs at no cost to the Government to facilitate transitioning from old technology to new technology when requested by the Government.

1.3.4.1 The Government will coordinate with the contractor Program Manager to determine scope and number of FTEs required for the project.

1.3.4.2 Requirements and tasks for the FTEs will be tracked in a Statement of Work attached to a no-cost Technical Assistance call order.

1.3.4.3 Duration of the Tech Refresh Support will not exceed the duration of the project.

1.3.4.4 Examples of large-scale projects which may justify Tech Refresh Support include, but is not limited to, tech refresh from existing architecture to the solutions provided by the contractor under this contract and solution changes that affect a large quantity of devices at all sites.

1.3.5 Subtask 3.5 Training and Certification. IAW DoD 8570.01-M, Information Assurance Workforce Improvement Program, Contractor personnel supporting Information Assurance (IA) functions, outlined in Chapters 3, 4, 10 and 11, shall obtain the appropriate DoD-approved IA baseline certification prior to beginning performance.

The Contractor personnel shall have six months to obtain the remaining qualifications for their position as outlined in DOD 8570.01-M, Table AP3.T1. The Contractor must be responsible for funding all training and certification testing, and all certification maintenance requirements deemed a requirement by the Government.

1.3.6 Subtask 3.6 Capacity Training. The Contractor will provide in-depth detailed technical training for all provided solutions (to include, but not limited to, any proposed (see 6.1) and/or new devices and capacities) at no additional cost. Formal contractor provided or equivalent quality training shall be provided for all new device types. Training will be used for engineering and operations teams to become proficient in design and operating of new devices. The contractor shall provide a plan showing how they will provide training to employees prior to capacity being deployed for the first time. Additional training required by the Government must be available.

1.3.7 Subtask 3.7 Testing/Lab Equipment. The contractor shall provide the ability for the Government to test newly released communications equipment in a lab setting for a 3 – 6-month timeframe as requested by the Government.

The Government may or may not decide to utilize this equipment in a production setting based on test results from the lab environment using a DISA PLA.

1.4 Task 4 - Ordering.

1.4.1 Subtask 4.1 Call Order Management System (COMS). The contractor shall deliver a secure and/or Common Access Card (CAC)-enabled web-based, call order management system capable of creating, amending, canceling, tracking, and accepting all call orders. This call order management system will be available within 30 calendar days after award. This system will be utilized by DISA to create and place call orders (including cancelations and amendments), document, and update order status, and track financial data associated with the call order. The COMS must meet the following requirements.

1.4.1.1 Hosting/Security Requirements. If the system runs within a DISA facility, the system must be CAC-authenticated and must follow DISA STIGs. If the system runs within a DISA facility, the system will be subjected to Department of Defense Risk Management Framework (RMF) accreditation processes as well as relevant DISA STIG and security policies. If the system runs outside of a DISA facility, the system must be secure and authenticate users to ensure a secure system.

1.4.1.2 Functionality Requirements. The COMS must be able to handle the complete order process to include, but not limited to the following: ordering, order validations, invoicing, billing, returns, financial tracking, and Contractor asset management, throughout the life of the contract. This system will include fields for tracking orders, assigning DISA internal tracking numbers, and call order status.

1.4.1.2.1 The COMS must track equipment moves to include the equipment moved, date(s) of move(s), which site equipment is moved from, and which site the equipment is moved to.

1.4.1.2.2 The COMS will include the ability to cancel existing equipment/workload and remove capacity services gear from the DISA site.

1.4.1.2.3 The COMS will manage excess hardware, and software licenses. Excess hardware and software will be defined as any hardware and/or software that have received a ‘cancelation’ request via the call order process. This equipment will be marked in the call order management system appropriately to include cancelation date and date removed from DISA location.

1.4.1.2.4 The COMS must be able to track excess hardware and software for re-utilization.

1.4.1.2.5 The COMS will contain no more than two decimal places in the financial data.

1.4.1.2.6 The COMS will have functionality for all pricing changes to include incentives section 8.0.

1.4.1.2.7 The COMS will distinguish call order types as follows:

Quote: Will be used to generate quotes for projects.

Capacity: Will be used to place orders for Capacity SLINs.

Non-capacity: Will be used to place orders for Non-Capacity SLINs.

Technical Assistance: Will be used for Technical Assistance and Travel SLINs.

1.4.1.3 Call Order Field/Column Requirements. At a minimum, call orders will contain the following information with the ability to add additional columns as required. The contractor may also add additional fields/columns as required.

System-generated call order tracking fields/columns shall include:

Call order number Amendment number Call Order creation date First estimated billable date Call order line-item fields/columns:

Line-Item Number CLIN/SLIN with description Quantity Total SLIN Cost Discount Extended Unit Cost Total Cost Cost Type: Implementation (one-time cost), Recurring (monthly cost)

User-entered/editable call order tracking fields/columns shall include:

Call order type Environment Designation. NIPR/SIPR/Other Application/Mission Partner Requestor Technical POC Project Type Project Name Project Number Implementation Resource Pool Recurring Resource Pool Implementation BAN Recurring BAN DISA Project Code MIPR/FCR number Spend Plan ID Site Staging Site Acceptance Date (contractor entered) Completion Date (contractor entered) Call order line-item fields/columns:

Line-Item Number Network Type: Prod, OOB Quantity Add Quantity Remove

1.4.1.4 Export/Reporting Requirements. The COMS shall be capable of providing reports, with the ability to be exported in either Excel or Adobe .PDF format. To include the following: all call orders and their status/metrics, equipment (capacity and maintenance) listed by serial number and invoicing.

1.4.1.4.1 The COMS must generate quotes that will be used to provide pricing for projects.

1.4.1.4.2 The COMS must provide inventory reporting to include call order number, project name and number, line-item number, Resource Pools and BANs, SLIN, hardware makes and models, serial number, and physical location, and costs.

1.4.1.4.3 The COMS will support exporting all call order types in either Excel or Adobe PDF format. Call Order export types must include the following:

Full exports with costs and without costs that include call order line items, call order Bill of Materials (BOM), installation information, and serial numbers.

Project Pricing export which includes call order line items with costs and cost types and call order BOM.

1.4.2 Subtask 4.2 Call Order Process. All services will be obtained via a call order process. A call order will be initiated by the Government through authorized call order personnel. No call orders shall be accepted by the Contractor to exceed the authorized funding on the delivery order for each line item. The Government can place new orders in the base period of five years and in all exercised option years.

1.4.2.1 Quotes will not utilize an approval process. Capacity, Non-Capacity, and Technical Assistance call orders will flow through an approval process consisting of the following phases and approvals:

1.4.2.1.1 Draft: May be approved by Government project managers, Government engineers, or Government contract Program Management.

1.4.2.1.2 Project Management: May be approved by Government project managers or Government contract Program Management.

1.4.2.1.3 Cost Containment: May be approved by Government contract Program Management or Government Budget personnel.

1.4.2.1.4 LOG: May be approved by contract COR/ACOR.

1.4.2.1.5 Vendor Review: May be approved by contractor personnel.

1.4.2.1.6 Engineering Validation: May be approved by contractor or Government project managers and engineers.

1.4.2.1.7 LOG Validation: May be approved by contract COR/ACOR. After LOG Validation approval, the call order shall be considered Government Approved.

1.4.2.2 Post-Approval Status will be updated by the contractor and will consist of the following phases:

Technical Assistance Orders:

Personnel Selection Pending Pending On-boarding Execution Complete Capacity and Non-Capacity Orders:

Order Pending Shipment Pending Shipped Delivered Installed

1.4.2.3 The Contractor must provide an ordering process to effectively manage the introduction or termination of technology, as well as changes to current and existing capacity offerings.

1.4.2.4 The Contractor must provide standard operating procedures to support the system including but not limited to the following: management of new or first-time orders, returns, back orders, special orders, processing invoices, processing refunds, credits, and exchanges, managing both deliveries and lost deliveries, billing processes, complying with quality assurance reviews and effectively balancing/managing inventories with orders.

1.4.2.5 On a regular basis the Government may have a requirement for new/revised Information Technology (IT) products which shall require the Contractor to respond in a turn-around time sufficiently fast to meet Government mission requirements. The Contractor must be able to expeditiously respond to requests to accomplish any changes and must be able to specify a response time relevant to accomplishing any Government requested change to a product line.

1.4.2.6 The Contractor has one (1) business day to validate a call order for accuracy. Once the Contractor validates a call order for accuracy, the hardware should be delivered within 30 calendar days for CONUS and 45 calendar days for OCONUS. Call orders received on Friday, requires validation by the following business day.

1.4.3 Subtask 4.3 Delivery, Installation and Acceptance.

1.4.3.1 Delivery. Equipment shall be properly packaged to prevent damage and marked to allow CSC identification (ID) at the docks to include manufacturer and call order number, contract and delivery order number, and site point of contact. Site point of contact will be contacted to coordinate installation activities. The Government reserves the right to consider an alternative delivery schedule.

1.4.3.2 Installation. The Contractor is responsible for installing the ordered capacity. Installation tasks include rack placement, power on and check for operational status. Routine installations should be performed between 0600-1800 Local Time at the requested location. Installations services between 1800-0600 Local Time will be required at the discretion of the Government. The Contractor shall install, power up, and confirm operational status of communications capacity.

1.4.3.2.1 Power-up Configuration. The Contractor shall complete power-up configuration as detailed by the Government. The Government shall perform final configuration as required.

1.4.3.3 Government acceptance. The written acceptance of new capacity by the Government starts the billing cycle for this service. The Government requires the ability to place orders for new technology throughout the Period of Performance (PoP) for this contract. The Contractor shall work with DISA to develop an acceptance testing methodology and smoothly transition the new (unless approved by the Government) equipment into the DISA production environment.

1.5 Task 5 - Billing Cycle, Invoicing and Payment Process.

1.5.1 Subtask 5.1 Billing Cycle. The Contractor shall employ a monthly billing cycle with 28/29/30/31 calendar days per month. The billing service period will be from the start of the month to the end of the month. If the POP starts in the middle of a month, billing for that month will result in two separate billing cycles.

1.5.1.1 Ordering. Each CLIN/SLIN represents one orderable item. A CLIN/SLIN may be ordered at the price listed in the B-table at any time during the period of performance. Each CLIN/SLIN can be ordered independently and is not included in a bundle.

1.5.1.2 Cancellation. All CLIN/SLINs can be cancelled at any time. Cancellations shall be at no cost to the Government unless restitution is defined in PWS Section 6.2.4.

1.5.1.3 Deactivation. Billing will stop based on the date of deactivation of the equipment and official cancellation of the original call order, not removal of the equipment from the DISA site.

1.5.2 Subtask 5.2 Invoicing. The Contractor shall create a draft invoice and submit it to the designated DISA COR who reviews/corrects, as necessary. Submission of the monthly invoice for the prior month’s activity should be completed no later than the fifth of the following month.

1.5.2.1 The invoice shall be available in a spreadsheet format at the call order SLIN level that can be filtered and sorted.

1.5.2.2 The Contractor shall create invoices directly from call order data provided by DISA in its “contract call order,” augmented by the “Acceptance” and “Deactivation” date.

1.5.2.3 Invoice amounts will not contain more than two (2) decimal places.

1.5.2.4 The order processing system should be queried to display a draft invoice based on:

Orders that remained in service the entire month with no changes Orders placed in service during the month; and Orders implemented during the month that reduced or canceled services.

1.5.3 Subtask 5.3 Payment Process. After the COR concurs with the draft invoice, the Contractor will submit the invoice via the DoD Wide Area Workflow (WAWF) System. The invoice will be constructed to DISA specification and supporting details will be appended in the form of a spreadsheet file that can be easily manipulated to provide a variety of different sorts and views of the underlying data.

1.6 Task 6 – Service Transition and Exit Strategy.

1.6.1 Incoming Strategy Plan. The Contractor shall create a transition strategy plan for assuming responsibility of the contract upon award. The transition strategy plan must identify and encompass all tasks to be performed by the incoming Contractor. The strategy should include a list of any questions or information requested of the Government.

It will lay out dates for future status meetings and program reviews. It will include details about the call order system being provided and schedule for training of Government staff.

1.6.2 Execution. The Contractor will work with the Government PMO to execute the transition tasks.

Exit Strategy. The Contractor shall create a detailed exit strategy for the end of the contract. The exit strategy shall assist the Government in the transition of services from this contract to any follow-on Contractor. The Contractor must agree to coordinate service transition with any follow-on Contractor to prevent service disruption during the transition.

The Contractor shall be responsible for the removal of all Contractor owned equipment related to this contract at the end of the contract at no cost to the Government. The Contractor shall provide an exit strategy based on these criteria.

However, an alternative plan may be provided by the Government, and will be evaluated by the Contractor for mutual agreement.

1.7 Task 7 - Technical Expert Status Accreditation /Analytical Support Status Accreditation (TESA/ASSA) Certification.

1.7.1 Subtask 7.1 Accreditation. The Contractor must obtain TESA/ASSA accreditation to comply with German labor laws.

1.7.1.1 The Contractor must submit completed TESA/ASSA documentation to the COR including contract notification form, job descriptions, employee TESA/ASSA applications, employee resumes, and employee employment contracts.

1.7.1.2 After review and approval, the COR will submit all TESA/ASSA documents to DoD Contractor Personnel Office (DOCPER) for approval as per the most current guidance.

DOCPER information and resources can be obtained at https://www.europeafrica.army.mil/contractor/ TESA/ASSA accreditation will be initiated by the Contractor within 30 calendar days after the date of contract award.

1.8 Task 8 - Supply Chain Risk Management Plan (SCRM).

1.8.1 Subtask 8.1 SCRM Plan: This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including Defense Federal Acquisition Supplement (DFARS) DFARS 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DODI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), Section 806 of the FY2011 NDAA Requirements for Information Relating to Supply Chain Risk and internal DISA SCRM processes and procedures.

1.8.1.1 SCRM plan defined. This requirement is in accordance with provision DFARS 252.239-7017 Notice of Supply Chain Risk, clause DFARS 252.239-7018 Supply Chain Risk, DODI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), and DISA Instruction 240-110-44.

1.8.1.2 SCRM Plan Submission. The contractor shall submit a SCRM plan no later than 10 business days after contract award that describes how the contractor will mitigate Supply Chain Risk using the security controls outlined below (further described in Committee on National Security Systems Instruction (CNSSI) 1253, Appendix D and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-35), as applicable to the contract.

Control Number

HW SW Srvc

SA-12 Supply Chain Protection x x x SA-12(1) Supply Chain Protection / Acquisition Strategies / Tools /

Methods x x x*

SA-12(2) Supply Chain Protection / Supplier Reviews x x x* SA-12(5) Supply Chain Protection / Limitation of Harm x x x* SA-12 (7) Supply Chain Protection Assessments Prior to Selection /

Acceptance/ Update x x x*

SA-12 (8) Supply Chain Protection / Use of All-Source Intelligence x x x* SA-12 (9) Supply Chain Protection / Operations Security x x x SA-12 (10) Supply Chain Protection / Validate as Genuine and Not

Altered x x x*

SA-12 (11) Supply Chain Protection / Penetration Testing / Analysis of Elements, Processes, and Actors x x x

SA-12 (12) Supply Chain Protection / Inter-Organizational System Components x x x

SA-12 (13) Supply Chain Protection / Critical Information System Components x x x*

SA-12 (14) Supply Chain Protection / Identity and Traceability x x x* SA-12 (15) Supply Chain Protection / Process to Address Weaknesses or

Deficiencies x x x

IR-4 (10) Incident Handling / Supply Chain Coordination x x x* IR-6 (3) Supply Chain Protection / Incident Reporting / Coordination with Supply Chain x x x*

SA-11 Developer Security Testing and Evaluation x x x* SA-14 Criticality Analysis x x x* SA-15 Development Process, Standards, and Tools x x x* SI-7 Software, Firmware, and Information Integrity x x x* CM-4 Security Impact x x x* PM-16 Threat Awareness Program x x x

* Not required if there will be no procurement of hardware, firmware, or software systems.

1.8.2 Supply Chain Risk Management Plan Update: The contractor shall provide an updated SCRM Plan to the COR and, Program Manager within five (5) business days whenever there is a change that affects one or more security controls as described in the CNSSI 1253 Appendix D (companion publication to NIST SP). At a minimum, the following events will require a SCRM update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and Information and Communication Technologies (ICT) supply chain compromises.

1.9 Task 9 - Availability and Performance.

1.9.1 Subtask 9.1 Availability. Communications capacity shall deliver 99.99% availability per orderable system with ability to deliver up to 99.999% availability per orderable system. The definitions and performance measurement are identified below.

Performance Measure 1: Communications Equipment Availability 99.95%

Explanation: The percentage of time each system is available for productive use.

Availability Objective: 24x number of calendar days in reporting month minus Measurement

Exception (see definition below).

Standard: Satisfactory = 99.99% Contractor Escalation Solution: Provide contractor solution.

Contractor Responsibility: Maintain communications equipment availability and related operating equipment in operating condition at a level to meet or exceed 99.95%.

Measurement: (Total available hours for number of calendar days in reporting month –

Measurement Exceptions – Time communications equipment is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions) *100= “Service Level Attained”. Total available hours = 24x number of calendar days in reporting month for each orderable system.

Measurement Exception: Measurement Exception: DISA or customer-initiated downtime, contractor Preventative maintenance (not break fix or hardware/software repair) that is appropriately coordinated through the Authorized Service Activity (ASA)/Authorized Service Interruption (ASI) process with DISA and the customer, and environmental failures not attributed to the contractor.

Performance Measure 2: Communications Equipment Availability for High Availability Systems 99.999%

Explanation: The percentage of time each system is available for productive use.

Availability Objective: 24x number of calendar days in reporting month minus Measurement

Exceptions (see definition below).

Standard: Satisfactory = 99.999% Contractor Escalation Solution: Provide contractor solution.

Contractor Responsibility: Maintain communications equipment and related operating equipment in operating condition at a level to meet or exceed 99.999%.

Measurement: 2A (summary): (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time communications equipment is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions) *100= “Service Level Attained”. Total available hours = 24xnumber of calendar days in reporting month averaged over all five nine’s orderable systems.

Measurement 2B (per system): (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time communications equipment is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions) *100= “Service Level Attained”. Total available hours = 24x number of calendar days in reporting month for each five nine’s orderable system.

Measurement Exception: Measurement Exception: DISA or…