Attachment 1 - PCSSP Sources Sought.docx

Requirements Document

1.0 Performance Requirements.

1.1 Task 1 - Operating Chipset Architecture/Operating Systems.

1.1.1 Subtask 1.1 - Technical Requirements and Architecture.

The hardware/chipset and the operating systems software required to deliver processor capability for DISA:

1.1.1.1 IBM System p (AIX)

1.1.1.2 Provisioning Management Infrastructure. The Contractor will provide a management infrastructure solution that includes provisioning capabilities, hardware diagnostics, hardware monitoring, event logging, image repositories or additional back office processes required to reside in a DISA environment to support the Contractor’s technical solution. The Contractor-provided infrastructure will be managed and maintained by the Contractor, and will be subject to Risk Management Framework (RMF) accreditation processes as well as relevant DISA STIG and security policies. RMF accreditation must be accomplished before the first order can be placed under this contract.

1.1.1.2.1 Contractor management and maintenance is not required for System P provisioning management infrastructure.

1.1.2 Subtask 1.2 – OS Requirements. For each Operating System, the Contractor will provide the most current version of that operating system. In addition, the Contractor’s solution will support the two previous versions. unless otherwise agreed to by DISA. The Government defines the most current version as N and the two proceeding versions as minus two (-2). Therefore N-2 is used to describe an OS current version and two major releases back (supportable by the OEM). An example being for the RHEL (Red Hat) 7, RHEL 6, and RHEL 5. Interim “dot” releases (i.e. RHEL 6.1) do not count as a major version.

1.1.3 Subtask 1.3 – Original Equipment Manufacturer (OEM) Technical Support. The Contractor will provide a methodology/process for the Government to access OEM technical support for the operating systems being utilized. Maximum use of OEM commercial documentation will be used (e.g., operator instructions, maintenance manuals, trainer publications) to support the Contractor’s solution.

1.1.3.1 Provide high availability options for OS (clustering) at the local site for tying hardware together as required.

1.1.4 Subtask 1.4 – Image. Provide an image of the DISA operating environment. The image will not run on the capacity services hardware. The image will be for customers in the IT development stage prior to transitioning their projects to DISA. The image is intended to reduce transition issues for customers. This image should include not only the operating system software, but also any other software tools that the Contractor supplies with the bundled capacity provided on the DISA capacity services hardware. The intent is to allow DISA customers the opportunity to develop applications on an image that will "match" their production image when they move from their test environment to the DISA production environment. The Government will not require any support from the Contractor after initial delivery of the image.

1.1.5 Subtask 1.5 – Additional Hardware Components. The Government may require the installation of generic add on devices or peripherals to the Contractor-provided hardware. These additional components are special use requirements that do not fit into a standard service offering (for example: Crypto card, fax card, etc.). The Government would provide the components for these special use cases and the vendor’s only obligation would be to provide installation of these components.

1.1.6 Subtask 1.6 – Virtual Environments. Virtualization for Unix environments will be accomplished using native virtual capabilities for AIX. For native virtual capabilities, the Contractor will provide comparable native virtualization management tools and infrastructure for management and Government provisioning of virtual operating environments.

1.1.6.1 All operating environments whether physical (rack mount or blade) or virtual must be able to provide connectivity for a minimum of 4 network ports supporting Ethernet traffic, and two separate ports for fiber storage connectivity. Two network ports are utilized for production traffic, one network port is utilized for out of band (OOB) network connections, and one port is required for enterprise backup network (EBN) connectivity. Due to this requirement the four communications network ports must be distributed across 4 separate physical communication switches. Ports for fiber storage connectivity must be distributed across a minimum of 2 Host Bus Adapter (HBA) ports. Fiber channels should support both 8 and 16 Gbps capabilities. All communications switch equipment must be able to support the use of VLANs, as well as any other standard technologies and protocols. The proposed solution should also integrate into existing processing infrastructure with minimal disruption or reconfiguration of network infrastructure.

1.1.7 Subtask 1.7 - Software. For all software provided in the Contractor solution, including operating system software, as well as, any other software required for the Contractor solution to operate, the Contractor is responsible to ensure they have documentation that confirms software licenses and annual/current support/maintenance levels. In the event of an audit, the Contractor will be required to defend any audit discrepancy found against all software products that the Contractor has acquired in support of this contract.

1.2. Task 2 - Performance/Availability Personnel will have access to Secret Classified Information through SIPRNet Where required under this contract, the Contractor will maintain Performance/Availability standards on all hardware, operating system software, as well as, any other software required for the Contractor’s solution to operate. The Contractor will provide engineering and maintenance support personnel with the appropriate clearance for DISA’s classified and unclassified environments. SIPR access is required for all personnel that will be supporting current and future customer workloads that reside on the SECRET/SIPR network.

1.2.1 Subtask 2.1 - Processor capacity shall deliver 99.95% availability per orderable system with options to deliver up to 99.999 % availability per orderable system. The definitions and performance measurement are identified below.

Performance Measure 1: Operating Platform Availability 99.95%

1. Explanation: The percentage of time each system is available for productive use.

1. Measurement: (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time server is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions )*100=“Service Level Attained”. Total available hours = 24x number of calendar days in reporting month for each orderable system.

Measurement Exception: DISA or customer initiated downtime, Vendor Preventative maintenance (not break fix or hardware/software repair) that is properly coordinated through the Authorized Service Activity (ASA)/Authorized Service Interruption (ASI) process with DISA and the customer, and environmental failures not attributed to the vendor.

1. Availability Objective: 24x number of calendar days in reporting month minus Measurement Exception (see definition above).

1. Standard: Satisfactory = 99.95%

1. Contractor Responsibility: Maintain operating platform, operating system software), and related operating equipment in operating condition at a level to meet 99.95%.

Performance Measure 2: Operating Platform Availability 99.999%

1. Explanation: The percentage of time each system is available for productive use.

Measurement: 2A (summary): (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time server is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions)*100=“Service Level Attained”. Total available hours = 24xnumber of calendar days in reporting month averaged over all five nine’s orderable systems.

Measurement 2B(per system): (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time server is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions)*100=“Service Level Attained”. Total available hours = 24x number of calendar days in reporting month for each five nine’s orderable system.

Measurement Exception: DISA or customer initiated downtime, Vendor Preventative maintenance (not break fix or hardware/software repair) that is properly coordinated through the Authorized Service Activity (ASA)/Authorized Service Interruption (ASI) process with DISA and the customer, and environmental failures not attributed to the vendor.

1. Availability Objective: 24x number of calendar days in reporting month minus Measurement Exceptions (see definition above).

1. Standard: Satisfactory = 99.999%

1. Contractor Responsibility: Maintain operating platform, operating system software (and related operating equipment in operating condition at a level to meet 99.999%.

1.2.2 Subtask 2.2 - Provide 24x7x365 problem escalation/resolution support for hardware, operating system software, as well as, any other software required for the Contractor solution to operate, and service management infrastructure.

At a minimum, the Contractor shall provide a help desk process, and provide POCs, phone numbers, and escalation chart. The Contractor shall support management level escalation procedures to address any issues that may arise and that may impact operation of the provided services.

1.2.3 Subtask 2.3 - Provide ability to validate and view HW features and components installed.

1.2.4 Subtask 2.4 - Provide central management capability and reporting to include hardware utilization, and error diagnostics of installed hardware components.

1.2.5 Subtask 2.5 - Maintenance. The Contractor shall perform all Preventative Maintenance actions as required by the OEM, including Predictive and Remedial Maintenance, on all equipment delivered as a part of this contract. The contractor must schedule and perform maintenance with no disruption to production operating environment. Day to day operations management of the hardware does not require Contractor intervention. Software components are capable of remote management and compatible with current DISA dedicated management network. All maintenance requirements are included in the “utility” pricing.

1.2.5.2 Maintenance Repair and Response Time. Provide processing capacity that delivers 99.95% availability per orderable system with options to deliver up to 99.999 % availability per orderable system. Response and repair times for CONUS will be 2 hour response/4 hour repair, unless otherwise agreed to by DISA. The time for responses will begin when the Contractor is notified and will end when the Contractor makes contact with DISA. The time for repairs will be measured beginning when the Contractor is notified and will end when the repair is completed and the equipment is available for use in its original state prior to the outage. Contractor response times do not change the requirements, but represent requirements to repair components which might be causing a degraded state. The Contractor shall address solution failures of redundant components which might not impact system availability but do create performance issues or introduce single points of failure in systems.

Provide 24x7x365 problem escalation/resolution support for hardware, operating system software, and capacity management. The Contractor will provide a multi-level solution for response time after being notified by the Government, to commence remedial maintenance for hardware, operating system software as well as, any other software required for the Contractor solution to operate. Each orderable system will be identified to a level of response based on Government need. All maintenance requirements are included in the “utility” pricing.

1.2.5.3 Predictive Maintenance. The Contractor shall monitor equipment/component performance using diagnostics defined in paragraph 6.2.1 for the purpose of identifying whether equipment is operating in accordance with established specifications. This includes hardware, operating system software, as well as, any other software required for the Contractor’s solution to operate. Upon determining equipment/component is about to fail or is operating outside OEM specifications, the Contractor shall initiate action to effect repair even though no call for remedial maintenance has been initiated by DISA.

1.2.5.3.1 The Contractor shall call the Global Service Desk (GSD) to inform them they are coming in for predictive maintenance and request a Form 7 be generated and coordinated with the physical site. Upon arrival at the physical site, the Contractor’s technician shall report to the site Installation team in order to comply with reporting requirements – see paragraph 13.8, ADPE Maintenance Records/DISA Form 7.

1.2.5.4 Remedial Maintenance. Calls will be initiated by the GSD to the Contractor’s toll free help desk service. The Contractor shall respond and repair, or when necessary, obtain required OEM support, in accordance with this specification. The Contractor shall complete remedial maintenance and maintain the processor capacity availability per orderable system IAW paragraph 6.2.5.2. Upon arrival on site, the Contractor’s technician shall report to the site Installations team in order to comply with reporting requirements. This includes hardware, operating system software, as well as, any other software required for the Contractor’s solution to operate.

1.2.5.5 Preventative Maintenance. Preventative Maintenance shall be scheduled with the system administrator, local site support, and the Contractor. If deemed necessary by the system administrator, the preventative maintenance action could require coordination with the customer base of the affected system. In this scenario, the system administrator will take required actions to schedule an Authorized Service Activity/Authorized Service Interruption and coordinate the date and time with the affected customers and vendor. This includes hardware, operating system software, as well as, any other software required for the Contractor’s solution to operate. The Contractor shall submit in writing its preventive maintenance schedule for equipment to the Contracting Officer (KO) within 90 days after contract award. Submission of the schedule shall be in accordance with the Contractor’s format. The preventive maintenance schedule may be modified at no cost by mutual agreement of both parties. The Contractor’s proposed schedule shall not be less than that recommended by the OEM.

1.2.5.5.1 The Contractor shall commence preventative maintenance IAW the approved preventative maintenance schedule within 90 days after award for all maintenance equipment. Preventative maintenance shall be scheduled outside the prime system operating hours.

1.2.5.5.2 If during the course of preventative maintenance, an equipment malfunction is identified, the Contractor shall report the malfunction to the system administrator. The malfunction shall be corrected as a Remedial Maintenance Service (see paragraph 6.2.5.4) and comply with and maintain the processor capacity availability per orderable system IAW paragraph 6.2.5.2 processor capacity availability.

1.2.5.6 Remote Diagnostics. Permanent recorded system errors must be immediately reported to remote service center(s). This includes hardware, operating system software, as well as, any other software required for the Contractor solution to operate. The Contractor shall provide written confirmation that reports and remote diagnostics support for applicable equipment exist within 30 calendar days after contract performance start.

1.2.5.6.1 Verbal contact between the local maintenance technician and an off-site support technician is not acceptable for remote diagnostics. There shall be a diagnostic system usable by the remote technician.

1.2.5.6.2 The dial-in feature for remote access to equipment can be used, but ONLY with C2 Cell authorization. The feature must be capable of disabling and set up to provide the C2 Cell the ability to enable the feature upon request from the Contractor.

1.2.6 Subtask 2.6 – Delivery, Installation and Deinstallation. The Contractor shall provide processor hardware necessary to support contract requirements. The Contractor will acquire, install, deinstall, transport, provide the necessary hardware (including cabinets/racks), hardware maintenance, operating systems software, as well as any other software required for the Contractor’s solution to operate, and services to support the processor infrastructure associated with the contract. The Contractor will in some cases be required to install hardware in DISA and/or Mission Partner owned racks. DISA will ensure those rack meet the documented rack requirements set forth in Appendix Four. DISA will determine the need for additional processor equipment.

1.2.6.1 Subtask 2.6.1 Delivery of equipment must occur within 30 calendar days of the acceptance of the call order by the Contractor.

1.2.6.2 Subtask 2.6.2 Deinstallation of equipment must occur within 30 calendar days of the acceptance of the return call order by the Contractor.

1.2.6.3 Subtask 2.6.3– Equipment Report. Once an order has been placed, and before delivery, the Contractor will send a report containing equipment information to include serial numbers, worldwide names, MAC addresses, etc. to the Installation mail group (disa.meade.se.list.lob-data-center-sel42-all@mail.mil). This enables the Government to prepare for equipment receipt. The Contractor shall provide the report 7-10 working days prior to equipment delivery.

1.2.6.4 Subtask 2.6.4 – Normal equipment delivery/installations/uninstalls. Unless otherwise mutually agreed to, normal equipment installations should be accomplished during normal business hours, 0600-1800 local time, Monday through Friday.

1.2.6.5 Subtask 2.6.5 – Under certain conditions, the Contractor may be required to perform delivery/installation/upgrades/uninstalls outside of normal business hours during evenings and weekends. Although the Government will try to minimize this requirement, the contractor must plan to work after hours, weekends, and or holidays for delivery/installation/upgrade/uninstalls of new or updated orders. All installation requirements should be included in the “utility” pricing.

1.2.6.5.1 Under certain conditions, the Contractor may be required to be available on “stand by” after hours, weekends, and/or holidays. All “stand by” hours will be included in the technical assistance and consulting support pricing. “Stand by” means having a field engineer available on-site as requested by the Government.

1.3 Task 3 - Capacity.

1.3.1 Subtask 3.1 - Provide processing capacity that is scalable to adjust to increases and decreases in required workload. This includes but is not limited to, CPU,memory utilization, network interfaces (i.e. network interface cards (NIC), etc.). Provide processing capacity that does not adversely impact existing production workload.

The Contractor shall provide a process for increasing/decreasing capacity for CPU, memory, network interfaces, (i.e. network interface cards (NIC), etc.), sysplex within a tier. The Contractor shall provide a process to collaborate with the Government to modify hardware provided within tier(s) as technology advances, chipset performance improves, or other new hardware-based technologies are introduced, without impact to the awarded SLIN price.

1.3.2 Subtask 3.2 - Provide provisioning servers to support the infrastructure at no cost. These servers must be provided by the Contractor in order to image hardware with the current agreed upon images (reference PWS 6.1.4). Provisioning cannot be accomplished via the Wide Area Network (WAN). Solution should include automation capabilities to provide efficiencies in provisioning and automation to streamline recurring vendor and Government tasks. Automation capabilities may be utilized by both the Contractor and the Government in sustainment of provisioned infrastructure.

1.3.3 Subtask 3.3 - Provide processing capacity that is priced on a utility (as used) basis and tier size as defined in Appendix One.

1.3.4 Subtask 3.4 - Provide processing capacity for unclassified and SECRET workloads. This must be separate hardware infrastructure including channels and networks, not sharing components as instructed by DISA Security Technical Implementation Guides (STIGs) https://cyber.mil/stigs/ . This requirement does not have any impact on the security clearance provisions of the solicitation.

1.3.5 Subtask 3.5 - Provide processing capacity that is moveable. If this requires the movement of equipment the first move of each piece of equipment shall be at no cost to Government. Movement is defined as the transfer of equipment within the same DISA site. There will be a “Relocation Services” SLIN to support relocation of equipment to another DISA site. Once and item of hardware has been moved one time, any subsequent moves are billable via a call order.

1.3.6 Subtask 3.6 - Capacity requirements can be cancelled at any time at no additional cost to the Government

1.4 Task 4 - Integration/Interfaces. All equipment provided must work with the existing DISA infrastructure and network. Refer to Appendix Four.

1.4.1 Subtask 4.1 – The Contractor shall provide training/familiarization to DISA System Administrators for provided infrastructure; all training requirements should be included in the utility price. The Contractor’s training plan shall provide all or a combination of the following elements: OEM documentation guides, Computer Based Training (CBT) manuals, training hours and in-person/virtual classroom training at Government and/or Contractor facilities. Technical/training support will be recurring as new hardware is introduced to the processing environment. Technical/training support will be provided as part of the total managed service. To minimize risk, a Contractor-facilitated plan for training Government personnel on new technologies will be required.

1.4.2 Subtask 4.2 – The Contractor shall provide infrastructure that does not disrupt, conflict, or interfere with DISA's specified Enterprise Systems Management (ESM) architecture. The ESM environment is identified in Appendix Two.

1.4.3 Subtask 4.3 – The Contractor shall ensure all infrastructure components provided are capable of being managed remotely via a dedicated DISA management network.

1.4.4 Subtask 4.4 – The Contractor shall ensure all infrastructure components provided are capable of being backed-up via a dedicated backup network. Infrastructure components provided must be compatible with and operate seamlessly with DISA’s network and storage infrastructure.

1.4.5 Subtask 4.5 – The Contractor shall ensure all infrastructure components provided are coordinated with and agreed to by DISA before introduction into the processing environment.

1.4.6 Subtask 4.6 – The Contractor shall ensure all components are IPv6 capable. Criteria to be considered IPv6 capable are; conformant with the IPv6 standards profile contained in the National Institute of Standards and Technology (NIST) USG IPv6 guidance, NIST SP 800-119, Guidelines for the Secure Deployment of IPv6; maintaining interoperability in heterogeneous environments and with IPv4; commitment to up-grade as the IPv6 standard evolves; and availability of IPv6 technical support.

1.5 Task 5 – Release Management. The Contractor will work closely with the Government to test and field OS releases and upgrade packages. The Government develops standard documentation on version levels in line with change and configuration management programs. The Contractor will package the initial and upgrade OS releases. Initial OS releases are only deployed by the Contractor on capacity hardware; however, the initial OS release must be tested, coordinated, and documented with the Government to ensure all images are enterprise compatible. The Contractor manages the OS software repository. This repository will be available to the Government to execute OS upgrades.

1.5.1 Subtask 5.1 – Package OS.

1.5.1.1 Government will lead the operational acceptance testing with Contractor support. The Contractor shall provide release of new OS's and upgrade packaging for all upgrades. Server OS software is owned and licensed by the Contractor, with the Government having right to use through the capacity services contract.

1.5.1.2 Upon receipt of an image from the Contractor, the Government will install, test and validate image for adherence to standards, perform integration testing, provide release documentation or image corrections necessary for seamless integration into the DISA infrastructure. Items to be validated by the Government include introduction of new hardware, patches, or firmware versions to the enterprise; new or upgraded software; and tool integration and functionality such as ESM agents, Blade Logic, HBSS, Veritas, driver compatibility, IAVA compatibility and level, and STIGing to the current DISA level.

1.5.2 Subtask 5.2 - Manage the OS repository, and server. The Contractor shall manage an OS software repository. The repository will be used as a central repository for approved OS version baselines. The Government must be able to pull and install the OS upgrade package for testing on capacity hardware in use under this contract, and will return validated OS packages for support of general provisioning and upgrade processes.

1.5.2.1 Image Repository not required for System P

1.6 Task 6 - Installation/Configuration. The Contractor shall install, deinstall, provide power-up configuration within 30 days of acceptance of the call order by the Contractor.

1.7 Task 7 - Security. The Contractor shall comply with all applicable security directives, including the DoD Directive 8500.1, "Information Assurance (IA)"; DoD Instruction 8500.1, "Cybersecurity"; DoD Directive 8570.1, Information Assurance Training, Certification, and Workforce Management; DoD Manual 8570.01-M, Information Assurance Workforce Improvement Program; the Assistant Secretary of Defense Memorandum, Subject: Disposition of Unclassified DoD Computer Hard Drives, dated June 4, 2001; DISA Security Technical Implementation Guides (STIGs).

1.7.1 Subtask 7.1 – Contractor personnel supporting Information Assurance (IA) functions in Chapters 3, 4 10 and 11 (DoD 8570.01 M Information Assurance Workforce Improvement Program) shall obtain the appropriate DoD-approved IA baseline certification prior to beginning performance. Contractors have up to 6 months to obtain the rest of the qualifications for their position outlined in AP3.T1. Additional training on local or system procedures may be provided by the DoD organization receiving services. Certification reporting will occur bi-annually.

The contractor shall provide a solution for reporting certifications and certification status of all Contractor personnel performing Information Assurance functions as described in DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall provide a solution for ensuring certifications are in compliance with the manual and are identified, documented, and tracked.

6.7.2 Subtask 7.2 – All provided hardware and software solutions shall be in compliance with DISA Security Technical Implementation Guides (STIGs). Management solution and infrastructure provided must be compatible with government provided token authentication. (i.e.: CAC-enabled)

1.8 Task 8 – Facilities - Racks. The Contractors must follow the stated standard power and rack details as identified in Appendix Four.

1.8.1 Subtask 8.1 - Provide solution that complies with standard rack and power specifications as detailed in Appendix Four.

1.8.1.1 The Contractor shall allow the Government the flexibility to modify rack configurations as necessary to install cooling scheme, this allows for cooling infrastructure modeled per site dynamics by the Government.

1.8.1.2 The Contractor shall include ancillary equipment such as MPDUs, grommets, blanking panels.

1.8.1.3 Each rack shall be supplied with two (2) each three phase “modular power distribution units” (MPDU’s) that mount vertically into the rear access/cabling spaces of the rack and provide a SNMP interface or MODBUS external port capability.

1.8.1.4 Grounding capability must be provided.

1.8.1.5 Each server/enclosure/cabinet must include some form of Cable Management that allows for the server/enclosure/cabinet to slide on the rails without binding or causing interference to airflow.

1.8.1.6 The Contractor will include any manufacturer/vendor equipment required to meet their own mounting and/or warranty standards.

1.8.2 Subtask 8.2 - Provide solution for high density cooling configurations. Additional “high density” cooling technologies may be proposed. The Contractor should consider all technologies, and include those which are deemed most cost effective and efficient. Rack height dimensions will be permitted to exceed maximum height specified if the high density rack cooling solution is attached to the rack and fits within the applicable data center dimensions.

1.8.2.1 The Contractor must allow the Government the flexibility to modify rack configurations as necessary to install cooling scheme, this allows for cooling infrastructure required per site dynamics by the Government.

1.8.2.2 The Contractor must include ancillary equipment such as MPDUs, grommets, blanking panels.

1.8.2.3 Each rack shall be supplied with two (2) each three phase “modular power distribution units” (MPDU’s) that mount vertically into the rear access/cabling spaces of the rack and provide a SNMP interface or MODBUS external port capability.

1.8.2.4 Grounding capability must be provided.

1.9 Task 9 - DISA “Green” Initiatives. IAW U.S. Department of Defense's (DoD) mission to reduce energy costs, decrease reliance on foreign oil, ensure energy security, and achieve sustainability goals, the Contractor will support DISA "green" initiatives for contractor provided hardware. To facilitate a partnership between contractor and DISA Infrastructure planning, the Contractor shall submit plans, reports, and/or metrics delineating how their hardware supports green initiatives.

1.10 Task 10 - Technology Refresh Program.

Technology Refresh Program is designed to replace aging and out of date processors hardware in order to minimize obsolescence in advance of loss of service or hardware failure. DISA estimates that if a call order for capacity has been in production for 5 years, the Government may decide to refresh the capacity. The Tech Refresh Program will replace the oldest processor equipment as required, but generally processor hardware will have a 5 year service life. The Government can decide to refresh hardware based on functions and technology updates, at any point in time during the first five years. Although not typical, the Government does require the flexibility when the need arises. Likewise, special mission requirements mission partner constraints, as well as technical or cost efficiencies and advantages on keeping hardware for longer than the economic life may be encountered during the life of the contract. Joint discussions with vendor and DISA will be executed to determine feasibility and impacts to mission partner, as well as lifecycle management for both DISA and the vendor. These discussions may occur during regular contract reviews and the Government will make the final decision for potential extension of use beyond stated economic life. Without a viable Tech Refresh Program, DISA will be at risk due to the fact that the processors equipment cannot be serviced beyond its lifecycle. The Contractor shall provide technical refreshes to hardware without additional cost to the Government.

1.11 Task 11 – Service Transition and Exit Strategy Government Program Management Offices. Technical Assistance and Consulting Support is a specified requirement needed by DISA and does not include predictive, remedial, or preventative maintenance for hardware, software, racks, or release management.

1.16.1 Ensure contractor personnel are trained and certified. The contractor will be responsible for funding any training and certification testing as well as any certification maintenance requirements. In addition, the contractor will ensure the appropriate Operating System, Operating Environment, or Virtual Environment and Information Assurance Security certifications are met and maintained, in accordance with Government guidance (DoD 8570.01-M Information Assurance Workforce Improvement Program, see para 6.7.1, Subtask 7.1).

1.17 Task 17 - Ordering/Payment Process.

1.17.1 Subtask 17.1 - Ordering. All services will be placed via a call order process. A call order will be initiated by the Government through authorized call order personnel. . Processor capacity requirements can be ordered in the base period and all option years. Pricing for services in the Option Years shall include full capacity service as outlined in PWS section 5.3.

1.17.1.1 The Contractor must provide an ordering process to effectively manage the introduction or termination of technology, as well as changes to current and existing capacity offerings.

1.17.1.2 The Contractor must provide standard operating procedures to support the system including but not limited to the following: management of new or first time orders, returns, back orders, special orders, processing invoices, processing refunds, credits and exchanges, managing both deliveries and lost deliveries, billing processes, complying with quality assurance reviews and effectively balancing/managing inventories with orders.

1.17.1.3 On a regular basis the Government may have a requirement for new/revised IT products which shall require a fast turn-around time. Consequently, the Contractor must be able to respond to initial request within 5 business days to begin technical discussions related to the Government requirement for new/revised IT products.

1.17.1.4 The vendor has eight (8) business hours (Eastern Standard Time) to validate a call order for accuracy. Once the vendor validates a call order for accuracy, the hardware should be delivered within 30 days. Call orders received on Friday, requires validation by the following business day.

1.17.1.5 Each SLIN represents one orderable item. A SLIN may be ordered and a SLIN may be cancelled. Each SLIN is independent and not included in a bundle.

1.17.1.6 SLIN pricing will be based upon the month the order is placed. Order pricing will be based upon the monthly rates contained in the associated chipset pricing model beginning with the month the order is to take effect (ex: A new delivery order initiated in month 18 of the contract period of performance, will be priced utilizing monthly rates for month 18 and forward as proposed in the pricing model).

1.17.1.7 As part of their call order process, the Contractor may be required to accept open API (.xml) data from DISA.

1.17.2 Subtask 17.2 - Call Order Management System. The Contractor will create a secure and/or CAC-enabled, web-based, call order management system. If the system runs within a DISA facility, the system must be CAC- authenticated and must adhere to DISA security guidelines. If the system runs outside of a DISA facility, the system must be secure and authenticate users to ensure a secure system. This system will be utilized to create and place call orders (including cancellations and amendments), document, and update order status, and track financial data associated with the call order.

1.17.2.1 The Contractor call order management system will manage excess hardware, and software licenses. Excess hardware and software will be defined as any hardware and/or software that have received a 'cancelation' request via the call order process. This equipment will be marked in the call order management system appropriately to include cancelation date and date removed from DISA location.

1.17.2.2 The Contractor call order management system will include the ability to cancel existing equipment/workload and facilitate the removal capacity services gear from the DISA site within 30 days.

1.17.2.3 Format will include information defined in sample call order template (Appendix Five). After contract award, the Contractor will collaborate with DISA to finalize format and information required.

1.17.2.4 The call order management system must be able to handle the complete order process to include, but not limited to the following: ordering, new service, ordering additional capacity within a tier, ordering a new tier, order validations, invoicing, billing, returns, financial tracking, and Contractor asset management, throughout the life of the contract.

1.17.2.5 The call order management system must track equipment moves to include the equipment moved, date/s of move/s, which site equipment moved from and which site equipment moved to.

1.17.2.6 The call order management system will contain no more than two decimal places in the financial data.

1.17.3 Subtask 17.3 - Acceptance. The acceptance of equipment by the Government will start the billing cycle for this service. The Contractor will work with DISA to develop an acceptance process to smoothly transition equipment into the DISA production environment. The official acceptance validation process will be provided by the Government after the contract award.

1.17.4 Deactivation. Billing will stop based on the date of deactivation of the equipment and official cancellation of the original call order, not removal of the equipment from the DISA site.

1.18 Task 18 Moving. Movement is defined as the transfer of equipment within the same DISA site. There will be a “Relocation Services” SLIN to support this requirement.

1.18.1 Free Move: The relocation SLIN may be used to move hardware when requested by the Government. Free moves are defined as relocations within the DISA approved location that the hardware resides. The call order will be modified using the relocation services SLIN at zero cost to the Government.

1.18.2 Cost Reimbursable Move: The relocation SLIN may be used for a cost reimbursable move when requested by the Government. Cost reimbursable moves are defined as relocations within or between DISA approved locations. A call order will be generated using the relocation services SLIN and will be billed on a cost reimbursable basis. The Contractor must provide actual invoice for reimbursement. Reimbursement based on DISA PM approved quote detailing specific move requirements and cost estimate. This will be a direct cost reimbursement for shipping costs and must be supported with a receipt from the shipper.

1.19 Task 19 Risk of Loss. The Contractor shall be liable for loss of or damage to the hardware and software furnished by the Contractor under this service contract. This liability shall not apply when the loss or damage is caused by the negligence of officers, agents, or employees of the Government acting within the scope of their authority.

1.20.1 Subtask 20.1 SCRM Plan:

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations in-cluding the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of theFY2011 NDAA Requirements for Information Relat-ing to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.

The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract.

Control Number

*Not required if there will be no procurement of hardware, firmware, or software systems.

1.20.2 Subtask 20.2 - Supply Chain Risk Management Plan Update: SUPPLY CHAIN RISK MANAGEMENT PLAN UPDATE: The contractor shall provide an updated SCRM Plan to the COR and Program Manager within five (5) business days whenever there is a change that affects one or more security controls as described in the Committee on National Security Systems Instructions (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)). At a minimum, the following events will require a SCRM Update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and Information and Communications Technology (ICT) supply chain compromises.

1.21 Task 21 Technical Expert Status Accreditation /Analytical Support Status Accreditation (TESA/ASSA) Certification

1.21.1 Subtask 21.1- The vendor shall obtain TESA/ASSA accreditation to comply with German labor laws. TESA/ASSA accreditation needs to be initiated by the vendor within 30 days of award.