Attachment 1 - Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT

.gov Top Level Domain (TLD) Registry and DNS Services in support of:

Cybersecurity and Infrastructure Security Agency (CISA)

1.0 Background

The Cybersecurity and Infrastructure Security Agency (CISA) is the Nation’s risk advisor, working with partners to defend against today’s threats and collaborating to build more secure and resilient infrastructure for the future. In this role, CISA builds the nation’s capacity to defend against cyber attacks by providing cybersecurity tools, incident response capabilities, and assessment services to safeguard the Federal IT enterprise, state and local partners, and systems that support national critical functions.

The DOTGOV Act of 2020, appointed CISA as the policy and management authority for the .gov Top Level Domain (TLD). .gov domains (e.g., whitehouse.gov) are only available to bona fide U.S.-based government organizations and publicly controlled entities. Since they signal being official and trusted, .gov domains are actively used by each branch of the federal government, every state in the nation, hundreds of counties and cities, and many tribes and territories to serve the public on the internet. The .gov zone currently includes 7800 domains, and CISA anticipates consistent growth (+20% yearly) over the next few years. The retention rate for .gov, or the percentage of domain registrants who keep their registration year-to-year, is also high, at over 99%.

The .gov TLD is central to the availability and integrity of thousands of online services relied upon by millions of users, and the .gov is considered critical infrastructure for governments throughout the country.

2.0 Purpose

The purpose of this contract is to provide CISA with a registry and DNS services provider that can meet our need for highly available DNS services that enhance resilience and simplify security operations for .gov domain users. CISA makes .gov domains available at no cost to bona fide US-based government organizations, but it takes more than registering a domain to put it on the internet. It requires the name be hosted by a DNS nameserver that is authoritative for the domain.

At present, the .gov TLD does not offer authoritative DNS hosting. This means that even though a .gov domain is free, staff at government organizations must manage their own DNS servers or procure access to a DNS service in order to use their domain. This increases a financial and technical burden, which is felt most acutely in non-federal government organizations, disincentivizing a move to .gov.

Additionally, the absence of a central DNS hosting offering produces at least three negative security outcomes for CISA:

1. Wider attack surface: Registrants host their DNS with many different service providers, and these providers vary widely in the usability and security of their services. This vastly increases the attack surface of .gov-related infrastructure and government organizations.

2. Weak defaults: Individual management of authoritative DNS leads to suboptimal namespace-wide security. A central offering would allow CISA to automate sensitive portions of DNS security management, set DNS records that make it hard to successfully impersonate government in email by default, and offer new features that typically require coordination between various parties.

3. Lack of visibility: With a central DNS hosting service, CISA could better detect and prevent certain DNS ecosystem issues instead of reacting to them (see Emergency Directive 19-01). With DNS hosting for .gov domains spread across the internet, CISA also lacks direct insight into the subdomains and hostnames operating on a .gov domain.

This requires the agency to collate the names of online services that use .gov in piecemeal fashion, something that would largely be obtained natively through the offering of a central service.

DNS is a core internet service that is foundational to the security of the applications that sit on top of it. Expanding the .gov TLD to include authoritative DNS hosting allows CISA to minimize the attack surface for .gov and using organizations, ensure a strong security baseline to governments, and increase insight into potential security issues. It also makes .gov more attractive to governments since they can manage their organization’s namespace in one place.

CISA is concurrently developing a domain name registrar, separate from this contract, that will be the interface for administrators of .gov domains to interoperate with the registry provider’s services. The registrar will be a modern, user-centered, responsive web application that enables .gov registrants to manage their domain’s registration lifecycle, DNS settings, and additional supporting services that CISA may offer. It will also be CISA’s central administrative hub for .gov, supporting registrant/domain/account management and tracking technical performance indicators for the TLD. For both CISA and registrants, the registrar will help generate insights into the security of an organization’s internet-accessible systems.

3.0 Scope

The scope of this contract is to provide CISA with .gov TLD registry and DNS services to be utilized by .gov registrants. The service provider shall include managed nameservers for the .gov zone and authoritative DNS hosting for .gov domain names. The .gov TLD registry and DNS services are available to all bona fide U.S.-based government organizations and publicly controlled entities.

The service provider shall provide the Government with project management support, expert-level consultation services, and provide the core registry services needed to operate and secure the service.

4.0 Technical Requirements

The following subsections provide the performance objectives for the .gov TLD registry and DNS services.

https://cyber.dhs.gov/ed/19-01/ https://cyber.dhs.gov/ed/19-01/

4.1 Operate Secure and Resilient Authoritative Nameservers

The service provider shall operate secure and resilient authoritative nameservers to serve the .gov zone file in IPv4/v6, ensuring global, always-available DNS resolution with low latency (100% uptime and availability). The average query load is currently between 10 and 20 billion queries per month.

The performance objectives of authoritative nameservers service shall include the following:

a. Performantly respond to queries despite failures (e.g., hardware, software, networking), attacks (e.g., distributed denial of service), or accidents (e.g., vulnerabilities).

b. Maintain the .gov zone file, sourcing updates from the .gov registrar, via Extensible Provisioning Protocol or other means. After registry policies are met (e.g., a new domain is approved and nameservers are responsive with proper resource records; a domain is to be placed on serverHold for non-compliance determined by CISA), updates to the .gov zone must be near-real-time.

c. Perform DNS Security Extensions (DNSSEC) key management for the TLD.

d. Align with applicable Internet Engineering Task Force Request for Comments to ensure utility and interoperability.

e. In ICANN’s Base Registry Agreement (or successor document):

i. Align with the Specification 6, Registry Interoperability and Continuity Specifications, sections 1-3.

ii. Meet or exceed the service level requirements in Specification 10, Registry Performance Specifications for offered protocols.

4.2 Operate, Secure, and Offer Authoritative DNS Hosting for Registered .gov Domains

The service provider shall operate, secure, and offer authoritative DNS hosting for registered .gov domains and child zones in IPv4/v6, served from multiple networks and geographic locations to support 100% uptime and availability across the internet with low latency. Average query load will vary between types and sizes of government organizations. Some primary domains for major federal agencies see 5-20 billion queries per month.

The performance objectives of authoritative DNS hosting service shall include the following:

a. Operate stable, resilient authoritative nameserver infrastructure, in alignment with best current practices (e.g., https://www.iana.org/help/nameserver-requirements), benchmarked by automated means.

b. Enable management of DNS resources via well-documented API. CISA will use the provider’s DNS hosting APIs to expose a “zone template” to registrants through the .gov registrar (with values they can modify).

c. The provider must support an infrastructure-as-code approach (e.g., Terraform) to domain management.

d. The service must support common resource records (e.g., SOA, NS, A, CNAME, MX, TXT, PTR, DNAME), DNSSEC RRs (in alignment with performing key management for the TLD; e.g., DNSKEY, DS, NSEC3), useful/emerging RRs (e.g., CSYNC, CDS, https://www.icann.org/en/registry-agreements/base-agreement

CDNSKEY, TLSA, HTTPS) and quasi-record functionality (e.g., ALIAS) with tunable values (e.g., TTL).

e. Updates to the DNS hosting service (e.g., publication of new or updated resource records) must be near-real-time.

f. Use of the DNS hosting service will not be mandatory on registrants, and they may elect to manage their own DNS or use a third-party service. These registrants may elect to use the DNS hosting offering as secondary/tertiary authoritative service in order to increase resilience.

g. In addition to hosting .gov domains, DNS hosting must be available to non-.gov domains

– after approval by CISA in the .gov registrar – that government orgs manage in other registrars. (In time, CISA anticipates the ability to transfer non-.gov domain name into the .gov registrar directly.)

h. CISA seeks to offer new DNS features as they offer utility to our users or public users, like authoritative-to-recursive transit encryption.

i. In order to minimize the impact of a critical vulnerability across hosted zones, CISA is interested in DNS nameserver software diversity.

5.0 Tasks

The service provider shall provide all necessary support services to ensure the registry service is managed and supported effectively throughout the period of performance. The following subsections address required task areas:

• Task 1: Provide Project Management Support

• Task 2: Configure, Secure, and Operate the Service

• Task 3: Provide Expert-Level Consultation

5.1 Task 1 - Provide Project Management Support

The service provider shall provide project management services under this contract that support the successful implementation and operation of the registry and DNS services. The management services include the management and oversight of all activities performed by service provider personnel, including subcontractors, to satisfy the requirements of this contract.

The service provider shall notify the General Services Administration (GSA) Contracting Officer (CO) and CISA Contracting Officer’s Representative (COR) of any technical, financial, personnel, Organizational Conflict of Interest (OCI), or general managerial problems encountered throughout the period of performance

5.1.1 Subtask 1.1 – Conduct A Project Kick-Off Meeting

The service provider shall conduct a Kick-Off Meeting (Deliverable 01) following contract award. The meeting will provide an introduction between the service provider personnel and Government personnel. The meeting will provide the opportunity to discuss necessary technical and administrative activities associated with execution of the contract. Prior to the kickoff meeting, the service provider shall submit resumes for each key personnel, with each resume clearly mapping experience to the qualifications identified in Section 10.1 Key Personnel.

The Project Kick-Off Meeting Agenda shall include, at a minimum, the following topics/deliverables:

a. Introduction of team members:

1. Roles and responsibilities of service provider team

2. Lines of communication overview between the service provider and the

Government.

b. Summary of technical approach:

1. Overview of the Solution and its ability to meet technical requirements of 4.0.

2. Approach to satisfying requirements of Tasks 1-3.

3. Transition-In approach

4. Initial timeline to meet technical requirements of 4.0.

c. Contract Administration:

1. Reporting requirements

2. Security requirements

3. Sensitivity and protection of information.

4. Invoice Requirements

5. Additional administrative items including press/news releases.

5.1.2 Subtask 1.2 – Prepare A Monthly Status Report (MSR)

The service provider shall develop and provide an MSR (Deliverable 02). The MSR shall include the following:

a. Activities during the reporting period, by task (include ongoing activities, new activities, and activities completed, and progress to date on all above-mentioned activities). Each section shall start with a brief description of the task.

b. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

c. Government actions required.

d. Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

e. Cost incurred by CLIN.

f. Accumulated invoiced cost for each CLIN up to the previous month.

g. Projected cost of each CLIN for the current month.

h. Performance report or the Solution

i. Service ticket inflow, to include the total number of tickets received, types of issues, and how they were resolved.

5.1.3 Subtask 1.3 – Provide Financial Reporting

The service provider shall provide a Financial Report of cumulative expenditures monthly (Deliverable 03). The Financial Report shall include as a minimum the following:

a. Project monthly expenditures by CLIN starting with the current month through the end of the POP.

b. Funded levels by CLIN

c. Diagram reflecting funding and burn rate by month for each CLIN

d. Cumulative invoiced amounts for each CLIN up to the previous month.

5.1.4 Subtask 1.4 – Transition Out

The service provider shall provide transition-out support when required by the Government. The Transition-Out Plan shall facilitate the accomplishment of a seamless transition from the incumbent to incoming service provider/Government personnel at the expiration of the contract. The service provider shall deliver the initial Transition-Out Plan and updates to the plan six months before the end of any contract year (Deliverable 04).

The Government reserves the right to request revisions to the Transition-Out Plan if there are large changes to the service.

In the Transition-Out Plan, the service provider shall identify how it will coordinate with the incoming service provider and Government personnel to transfer knowledge regarding the following:

a. Points of Contact.

b. Location of technical and project management documentation.

c. Status of ongoing technical initiatives.

d. Appropriate service provider-to-service provider coordination to ensure a seamless transition.

e. Schedules and milestones.

f. Actions required of the Government.

g. Identification and transfer of Government owned data and assets.

The service provider shall also establish and maintain effective communication with the incoming service provider/Government personnel for the period of the transition via weekly status meetings or as often as necessary to ensure a seamless transition-out.

The service provider shall implement its Transition-Out Plan NLT six months prior to expiration of the contract.

5.2 Task 2 – Configure, Secure, and Operate the Service

The service provider shall initially configure and test the service to ensure it meets the technical requirements and objectives. The service provider shall ensure that the service is secured, receives a CISA ATO, and maintains that ATO throughout the period of performance of the contract. The service provider shall operate the service and ensure it is available 24x7.

5.2.1 Subtask 2.1 – Configure and Test Registry Services

The service provider shall configure the service to meet the technical requirements of Section

4.0. The service provider shall deliver technical documentation (Deliverable 05) that provides all key Government stakeholders with a common understanding of the service and its ability to accomplish the Government’s technical requirements and objectives. The technical documentation shall provide a testing approach for requirements that can be validated via testing demonstration.

The service provider shall execute approved testing demonstrations, when requested by the Government. In addition, the service provider shall provide as needed access (preferably via authenticated API) to Government stakeholders for further service verification and validation.

Testing activities will validate that the service is ready for operation.

The service provider shall ensure that any requirement not implemented as part of the initial operating service is iteratively added during execution of the contract. In addition, the service provider shall ensure that any developed enhancements for the commercially available service are also implemented on this service, following Government approval. Any updates to the service may necessitate updates to technical documentation.

5.2.2 Subtask 2.2 – Secure Registry Services

The registry is anticipated to be a FIPS 199 high impact system and a high value asset. The provider shall ensure their services are secured, receives an “authority to operate” (ATO) from the CISA CIO, and maintains that ATO throughout the period of performance. This will include a major role in the preparation of privacy/security documentation required by federal law or agency policy, and technical alignment with those requirements. It will include the preparation/maintenance of documents like a system security plan, contingency plan, incident response plan, privacy threshold analysis or impact assessment, rules of behavior.

CISA desires that the service provider obtains an ATO as soon as possible following contract award.

The service provider shall submit all necessary security authorization documentation to achieve an ATO. Activities to support this process include:

a. Providing all the required documentation for the security authorization process (e.g., system description, system architecture, security control, POA&Ms, etc.) (Deliverable 06). This includes the generation of additional security documentation to satisfy NIST 800-53 and DHS 4300A requirements.

b. Remediate all security findings and create Plans of Action and Milestones (POA&Ms) and/or waivers, as appropriate.

c. Ensure DHS and/or CISA security requirements are met including regular delivery of vulnerability scans, asset management activities, POA&Ms, and/or waiver remediation https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-09.pdf activities.

d. Support Security Test and Evaluation/Security Assessment activities by ensuring availability of the system personnel for interviews and artifact collections as required.

The service provider shall maintain the ATO (following receipt) during complete period of performance, including updating relevant security authorization documentation as needed.

5.2.2 Subtask 2.3 – Operate Registry Services

The service provider shall ensure there is a seamless transition of the services described in Section 4.1, which are currently being provided under another contract, with no service disruption or service degradation during and after transition. The transition may include the following, but only to the extent technically necessary to ensure an effective transition:

a. A shadow operation in which the registry services shall not be connected but shall otherwise be fully operational and shall receive all inputs received by the incumbent contractor.

b. A joint operation in which the registry services shall be being fully operational and shall function transparently.

The Government will review the readiness of and approve the cut-over timing for the registry services. Performance standards (8.0 Quality Assurance and Acceptable Criteria) must continually be met upon transition.

The service provider shall operate the service and provide core registry services including the following:

a. Providing all administrative and management responsibilities for the operational service.

b. Providing Tier 3 24x7 engineering support to CISA to remedy operational issues or incidents related to the registry or DNS hosting.

c. Manage registry and registration data directory services (Registration Data Access

Protocol, WHOIS), meeting or exceeding the service level requirements in ICANN’s Base Registry Agreement (or successor document), Specification 10, Registry Performance Specifications for offered protocols.

d. Track useful performance metrics and trends for the .gov zone and domains (e.g., query load) and make them available programmatically through operational reports (Deliverable 07).

5.3 Task 3 – Provide Expert-Level Consultation

The service provider shall provide expert-level consultation on the DNS ecosystem to assist CISA in ensuring the DNS service is useful and operated “transparently and in the spirit of public accessibility, privacy, and security” as required by the DOTGOV Act.

Activities for the expert-level consultation shall include:

https://www.icann.org/en/registry-agreements/base-agreement

a. Provide consulting support on the new .gov registrar, particularly in assisting CISA with the necessary access, documentation, guidance, etc., sufficient to securely integrate with the service provider’s registry and DNS solutions.

b. Provide strategic and tactical planning, advise on DNS best practices and opportunities, and collaborate to devise technical solutions to emerging challenges.

c. Assist in the development of roadmaps, plans, and technical briefing materials as needed (Deliverable 08).

d. Other expert-level consultation support where appropriate.

6.0 Constraints

CISA has identified the following operational constraints to this effort:

a. CISA is building a new .gov registrar to enable US-based government organizations to manage their domain’s registration lifecycle, DNS settings, and useful supporting services. Key functionality for the registrar will be enabled by integration with the service provider’s application programming interfaces (APIs).

b. Given its unique role, .gov requires a provider that is incorporated or legally organized under the laws of the United States whose core competency is DNS services.

c. CISA anticipates the services to be in scope of the service provider’s vulnerability disclosure policy (VDP) or our VDP, as required by Binding Operational Directive 20- 01.

7.0 Contract Deliverables

The following abbreviations are used in this schedule:

DEL: Deliverable

All references to days: Government Workdays

Deliverables are due the next Government workday if the due date falls on a holiday or weekend.

The service provider shall deliver the deliverables listed in the following table on the dates specified:

The contractor shall deliver all electronic versions by electronic mail (email) and removable electronic media, as well as placing in the Government’s designated repository. The following are the required electronic formats, whose versions must be compatible with the latest, commonly available version on the market.

a. Text Microsoft (MS) Word, PDF

b. Spreadsheets MS Excel

c. Briefings MS PowerPoint

d. Drawings MS Visio

e. Schedules MS Project

8.0 Quality Assurance and Acceptable Criteria

The Government has established and will maintain a Quality Assurance Surveillance Plan (QASP) for work accomplished under this contract. The QASP will be based under the following standards and acceptable quality levels (AQL)s:

DEL. # DELIVERABLE DUE DATE

01 Kick-Off Meeting Within 10 workdays of contract award

02 Monthly Status Reporting Within 10 workdays after beginning of month

03 Financial Reports Within 10 workdays after beginning of month

04 Transition Out Six months before the end of any contract year

05 Technical Documentation In accordance with approved schedule (as presented in MSR)

06 Security Authorization Documentation

Initial as soon as possible following award, updates as needed to maintain the ATO

07 Operational Reports Within 10 workdays after beginning of month

08 Ad Hoc Technical Materials As needed

Deliverable or Service

Performance Standard Acceptable Quality Level

Operate Secure and Resilient Authoritative Nameservers, Registry, and Registrations Directory Data Services for the TLD

SLA's identified in ICANN's Base Registry Agreement, Specification 6 (§1-3) and Specification 10

Meet or exceed SLA's for any offered protocol.

Operate Authoritative DNS Hosting for Registered .gov Domains

Operational availability 100% Availability

Operational Reports

Tailored operational reports are delivered on time and effectively tailored to address the stakeholder needs

100% of reports submitted on time, effectiveness of operational reports assessed in on-going manner with consistent feedback

24x7 engineering support to CISA to remedy operational issues or incidents related to the registry or DNS hosting

Tier 3 Engineering support point of contact is always available

Response time to CISA contact is no greater than 10 minutes

9.0 Period and Place of Performance

The period of performance for this contract is a 12-month base period followed by four, 12-month option periods.

The primary place of performance will be at the contractor’s site. The service shall be available to support US Government operations domestically and internationally.

10.0 Key Personnel

The following are the minimum personnel who shall be designated as “Key.”

All requirements of the contractor apply equally to any proposed additional Key Personnel.

a. Project Manager (PM)

The Government desires that Key Personnel be assigned for the duration of the contract. Key Personnel may be replaced or removed subject to Section 10.2, Key Personnel Substitution.

10.1 Project Manager

The service provider shall identify a PM to serve as the Government’s main point-of-contact and to provide overall leadership and guidance for all service provider personnel assigned to the contract. The PM shall ultimately be responsible for the quality and efficiency of the work performed under this contract. The PM shall have organizational authority to execute the requirements of the contract. The PM shall assign tasking to service provider personnel, supervise ongoing technical efforts, and manage overall performance to ensure the optimal use of assigned resources and subcontractors. This Key Person shall have the ultimate authority to assign resources and make decisions for the service provider’s organization in response to Government issues, concerns, or problems. The PM shall be readily available to respond to Government questions, concerns, and comments, as well as be proactive in alerting the Government to potential contractual and programmatic issues.

It is desirable that the PM possess the following qualifications:

a. Experience in completing, leading, or directing the work of others on projects similar to the size, scope, and complexity of the work and environment described in Section 4.

b. Managerial experience providing technical advice, organizing, planning, directing, and managing staff to ensure goals and objectives are achieved.

c. Experience with the management and supervision of teams comprised of technical multi-discipline employees and teaming partners/subcontractors.

d. Experience with risk management, issue resolution, problem solving, and customer service.

10.2 Key Personnel Substitution

The service provider shall not permanently replace any personnel designated as Key Personnel without the written concurrence of the CO. Prior to using other than designated key personnel, the service provider shall notify the CO and the COR. This notification shall be NLT ten calendar days in advance of any proposed substitution and shall include justification for the proposed substitution, resume, and labor category of proposed substitution in sufficient detail to permit evaluation of the impact on performance.

5.3 Task 3 – Provide Expert-Level Consultation