Attahment__4-DRAFT_PROJECT_AREA_2_USACE_IGP_1.docx

Project Area 2: Installation Geospatial Platform (IGP) U.S. Army Corps of Engineers

STATEMENT OF WORK (SOW)

Infrastructure as a Service – IaaS

Cloud Professional Services

1 Dec 2024

DRAFT

Version 1.2

Table of Contents

1. Project Area 2 Title Installation Geospatial Platform Cloud Professional Services

2. Project Summary The Installation Geospatial Platform (IGP) seeks cloud professional services to operate, maintain, and develop an enterprise geospatial platform and services to support the DISDI program. The IGP is a department-wide system designed to provide secure, scalable installation geospatial information and services (IGI&S) to support the Office of the Secretary of Defense (OSD), Joint Staff, Combatant Commands, DoD Components, the IGI&S community, and the IGI&S Governance Group.

3. Background

3.1. Purpose

The IGP provides several core capabilities. First, it provides data visualization (mapping), cataloging, and exchange functions for IGI&S, as well as IGI&S governance support functions as required by DoDI 8130.01, DoDD 8000.01, and DoDI 8320.02. Second, it provides a scalable infrastructure and security platform for the web-based Explosives Safety Siting (webESS) module (in development) and may provide similar support for future modules that require IGI&S capabilities. Third, the IGP provides secure, scalable geospatial analysis capability, net-centric data discovery and sharing functionality, and provides authoritative location information of real property assets to other DoD business systems and programs.

3.2. Assumptions

· USACE/OSD will manage compute/storage requirements and funding through a separate Department of Defense (DoD) initiative.

· USACE will provide each contractor with a government laptop and Common Access Card (CAC) so it can access the GovCloud environment and CorpsNet/NIPRnet.

· The contractor will have necessary DoD IL4 cybersecurity and Information Technology (IT) certificates and training to service the environment.

· The contractor will have familiarity with DoD cybersecurity, cloud, and IT standards and requirements.

3.3. Current Environment

IGP is deployed within the AWS GovCloud environment. The platform currently maintains central Shared Services account focused on providing management services for the platform as well as two application-level accounts for the DISDI and ESS programs. Each application has both a Staging (Dev/Test) and Production (PROD) cloud environments utilizing separate AWS GovCloud accounts. The environment is tied to the Army Enterprise Cloud Data Center AESS as well as DISA Security Stack (VDSS) and Virtual Data Center Managed Services (VMS). DISA is also the cyber security service provider (CSSP), but IGP also maintains its own cybersecurity contract and has dedicated cybersecurity staff to support. IGP documents its risk management framework and security control plan using U.S. Army Create managed Confluence collaboration tools. IGP also utilizes Army Create managed Jira for its help desk and change management workflow. Jira tickets are used to track all change requests within the IGP cloud environment and each contractor will require access to Army Create to understand change management requirements.

IGP’s latest architecture diagrams is found in Appendix A.

· Servers and / or Virtual Instances

· Combination of primarily Elastic Cloud Compute (EC2) & Elastic Container Service (ECS) used for application hosting

· 14 EC2 instances across 3 production accounts

· 1 ECS cluster running in production ESS account

· CodePipeline used to manage deployments to ECS clusters from Elastic Container Registry (ECR)

· Most application services are not leveraging redundancy, mirroring or high availability

· Amazon Web Services

· Amazon API Gateway

· Amazon AppStream 2.0

· Amazon Aurora PostgreSQL

· Amazon Cloud Directory

· Amazon CloudWatch

· Amazon CloudWatch Logs

· Amazon Data Firehose

· Amazon Detective

· Amazon EC2 Auto Scaling

· Amazon EC2 Image Builder

· Amazon Elastic Block Store

· Amazon Elastic Compute Cloud (EC2)

· Amazon Elastic Container Registry (ECR)

· Amazon Elastic Container Service (ECS)

· Amazon Elastic File System (EFS)

· Amazon EventBridge

· Amazon FSx

· Amazon GuardDuty

· Amazon Inspector

· Amazon RDS (Oracle)

· Amazon RDS (Postgres)

· Amazon RDS (SQL Server)

· Amazon Redshift

· Amazon Route 53

· Amazon S3 Glacier

· Amazon Simple Email Service (SES)

· Amazon Simple Storage Service (S3)

· Amazon Virtual Private Cloud (VPC)

· Amazon WorkSpaces

· AWS Backup

· AWS Certificate Manager (ACM)

· AWS CloudFormation

· AWS CloudShell

· AWS CloudTrail

· AWS CodeBuild

· AWS CodeCommit

· AWS CodeDeploy

· AWS CodePipeline

· AWS Config

· AWS Cost and Usage Reports

· AWS Cost Explorer

· AWS Directory Service

· AWS Fargate

· AWS Firewall Manager

· AWS Identity and Access Management (IAM)

· AWS IAM Identity Center

· AWS Key Management Service (KMS)

· AWS Lambda

· AWS License Manager

· AWS Network Firewall

· AWS Organizations

· AWS Private Certificate Authority

· AWS PrivateLink

· AWS Secrets Manager

· AWS Server Migration Service (SMS)

· AWS Shield

· AWS Storage Gateway

· AWS Systems Manager

· AWS Transit Gateway

· AWS Trusted Advisor

· AWS Well-Architected Tool

· Elastic Load Balancing

· Network Load Balancer (NLB)

· VM Import/Export

· Custom Coding / Scripts

· ADFS Single Sign-On (SSO) for all systems, accounts

· All AWS Infrastructure As Code (IaC)

· AWS Continuous Integration (CI) / Continuous Deployment (CD) pipelines

· Storage Systems

· Primary storage mechanisms leveraged are:

· Elastic Block Storage (EBS)

· Simple Storage Service (S3)

· Snapshots used as backup and recovery mechanism for EC2 instances

· Networks

· Approximately 15 authorized users with elevated privilege access in the account.

· Application users are targeted on DoD-users accessing the application via NIPRnet

· System intra-connectivity managed via VPC peering

· Entire platform leverages NIPRnet IP address space

· Platform is peered with DISA BCAP, VMS, VDSS, CSSP services

· Application traffic flows from NIPRnet to DISA-hosted f5 application web application firewall through BCAP to IGP-hosted Juniper networking device then to application hosted services in ESS and DISDI accounts

· Access to compute services from each environment by the Cloud Engineering, ISSO and development teams primarily routed through linux bastion using ssh

· Server Operating Systems

· Windows 2019

· Oracle Linux 8

· Juniper OS

· Databases

· Database instances deployed using Amazon RDS (4 instances in total)

· Platforms include Oracle Enterprise Edition, PostgreSQL, SQL Server

· Middleware

· Ansible

· ESRI ArcGIS Enterprise

· Microsoft Office

· Rundeck

· Voyager Search

4. Professional Service Requirements

IGP requires reoccurring cloud professional services to implement and maintain cloud-based platform to facilitate operations and improve efficiency. These services should provide targeted guidance and technical expertise to help IGP manage its cloud-based infrastructure flexibly and cost-effectively on a continuous basis. A summary of required cloud services is listed below in alphabetical order.

Architecture and Design:

· Design scalable, reliable, and cost-effective cloud solutions.

· Create / maintain blueprints for cloud infrastructure, considering factors like security, performance, and high availability.

· Design cloud-native applications, selecting appropriate services (e.g., compute, storage, databases), and optimizing resource utilization.

· Adopt serverless computing and microservices architecture.

Backup and Restore Systems and Capability:

· Backup IGP systems and data daily.

· Maintain Recovery Time Objective (RTO) of 4 hours to 24 hours.

· Maintain Recovery Point Objective (RPO) of 4 hours to 24 hours.

· Retain backups per IGP Data Strategy and Record Survey Management requirements (up to 3-years).

· Automate backup schedules.

· Create and store volume snapshots.

· Test backup processes to ensure they are valid and system and data assets can be successfully restored.

· Simulate disaster scenarios to verify data recovery processes.

· Restore systems after major incidents (e.g., hardware failure, cyberattack).

· Monitor backup jobs for errors or failures.

· Notify IGP CCB of backup issues.

· Implement cloud-to-cloud backups, where necessary.

· Enable versioning and take snapshots of virtual machines and storage resources.

· Ensure backups adhere to data privacy and retention regulations.

Assessment and Strategy:

· Assess existing infrastructure, applications, and business processes.

· Document cloud strategy that aligns with IGP goals and objectives.

· Evaluate cloud adoption approaches.

· Identify cost-saving opportunities.

· Recommend the most suitable cloud-smart solutions.

Data Analytics and Data Services:

· Setup and maintain data lakes, data warehouses, and analytics platforms in the cloud.

· Design and implement solutions for processing, analyzing, and visualizing large datasets.

· Aid IGP in implementation and automation of data lifecycle policies to ensure data storage is optimized.

· Support module owners and developers with ensuring data can be delivered as a service.

Database Administration:

· Automate deployment of RDS and EC2-based (if required) database instances

· Work with the application teams to:

· Setup and configure databases on the IGP cloud platform.

· Support database performance and health monitoring.

· Setup alerts for performance issues, security breaches, and resource utilization.

· Implement backup and recovery plans.

· Schedule regular backups, test restoration procedures, and ensure data integrity.

· Management user access, authentication, and authorization.

· Enforce security policies, handle encryption, and protect sensitive data.

· Scale databases horizontally or vertically.

· Setup replication, failover, and load balancing to achieve high availability.

· Avoid overprovisioning and unnecessary expenses.

· Adhere to DoD regulations and Army policies.

· Maintain audit logs and track changes based upon program requirements

· Design and test disaster recovery strategies.

· Ensure data availability.

· Ensure data is encrypted during transit and storage.

DevSecOps and Continuous Integration/Continuous Deployment (CI/CD):

· Adopt and maintain agile DevSecOps practices within IGP cloud environment.

· Set up CI/CD pipelines, automate deployments, and improve collaboration between module partners and IGP teams.

· Standardize cloud migration process by utilizing Infrastructure as Code (IaC), defined pipeline processes, and common scripting.

· Work with IGP CCB, Cyber Security Team and application development teams to streamline IaC deployment process through environments (Staging-Production) Directory Services:

· Provide role-based access controls through identity and access mechanisms for rights and privileges to Cloud services.

· Support Common Access Card (CAC) authentication to the configuration interfaces of Cloud services.

· Create, modify, and delete user accounts, ensuring proper access permissions per DoD standards.

· Configure authentication methods for secure access.

· Define roles and permissions to control user access to resources.

· Enforce security policies, monitor access logs, and handle security incidents.

· Integrate external directories and services, where applicable.

· Manage user accounts as a lifecycle (onboarding, changes, offboarding).

FinOps:

· Optimize cloud spending.

· Analyze usage patterns, recommend cost-saving measures, and monitor resource utilization.

· Aid IGP to avoid overspending and achieve better cost predictability.

· Allocate cloud costs to specific projects, teams, or modules.

· Identify underutilized resources and right-size instances.

· Implement consistent tagging and labeling practices for cost tracking.

· Predict future spending based on historical data.

· Use automation tools to manage and enforce cost-saving policies.

· Provide clear reports on financial information to IGP CCB.

· Regularly review and refine FinOps practices.

Migration and Enhancement Services:

· Support migration of existing and new applications, data, and workloads from on-prem environments to the cloud.

· Enhance and modernize existing cloud-based solutions based on defined requirements.

· Plan, execute, and validate the migration process, while minimizing downtime and ensuring data integrity.

· Follow IGP cloud migration steps and business processes.

Networking:

· Ensure IL4 data and systems traffic flows through the DISA BCAP.

· Implement and manage network load balancing.

· Provide load balancer health checks, such as allowing non-responsive machines to be dropped from the load balancing group.

· Allow for dynamic IP addressing.

· Provide the option to create an isolated virtual private network.

Outreach and Communication:

· Host weekly Office Hours sessions where partners have an opportunity to ask questions about specific Jira tickets.

· Attend weekly IGP Technical meeting to collaborate with IGP CCB, application development teams, IGP Cybersecurity Team, and partners.

· Meet monthly with AWS Enterprise Support team.

· Participate in specific meeting with module stakeholders to review requirements, troubleshoot issues, and resolve concerns.

· Submit accomplishments to weekly IGP situation report.

· Submit monthly invoices and reference each Jira ticket worked.

· Participate in monthly IGP program synchronization and cloud optimization meeting.

· Collaborate with IGP CCB members of topics related to development, data, GIS, etc.

· Message to partners when patching occurs.

· Message to partners about system maintenance and outages.

· Manage and share infrastructure schedule.

· Report on available funding, funding balances, and forecasted fund exhaustion.

Security and Compliance:

· Secure cloud resources, data, and applications in partnership with IGP Cybersecurity Team and module partners. This includes identity and access management (IAM), encryption, network security, and compliance.

· Ensure all new resources are STIG compliant prior to release to partner (Operating System, Apache, IIS, etc.)

· Implement best practices and adhere to DoD regulations.

· Maintain IGP Authority to Operate and ensure CCRI score remains at or below the “minor concern” category.

· Aid in the timely remediation of identified vulnerabilities.

· Implement zero-trust architecture.

· Support implementation and management of Security Information and Event Management (SIEM) solution

· Deliver automated notifications to IGP for critical incident alerts, unplanned traffic spikes, outages, and patching.

· Comply with DoD continuous monitoring and risk management framework requirements.

· In partnership with IGP Cybersecurity Team, prepare Plan of Action & Milestones (POAM) documentation.

System Administration:

· Install and configure various components of the cloud system, including servers, networks, storage, and software. Ensure infrastructure is setup correctly and optimized for performance.

· Troubleshoot operational issues and provide technical support for all systems to address any problems that arise.

· Proactively monitor the capabilities and performance of the cloud systems.

· Analyze logs, evaluate system performance, and identify areas for improvement.

· Implement new technologies to enhance efficiency or ensure cybersecurity compliance.

· Configure security settings, manage user accounts, handle software upgrades.

· Document infrastructure, configurations, and processes for future reference.

· Upgrade operating systems and other cloud components.

· Perform regular patching of DEV/TEST, and PROD environments on an agreed upon schedule. Notify parties of patch schedule, completion, and any issues that occur. Ensure issues include root cause explanation.

Testing:

· Assess system performance under different conditions (e.g., load, stress, scalability).

· Validate application functionality.

· Check application compatibility across different resources (e.g., browsers, devices, and operating systems).

· Evaluate user experience and interface design.

· Ensure new changes do not break existing functionality.

· Verify accessibility features.

5. Other Requirements In addition to the cloud professional service requirements listed in Section 4, IGP also requires additional support with other cloud-related activities and resources.

5.1. Software License

The contractor will be responsible for procuring software licenses on behalf of the IGP program. The licenses will be owned by IGP.

ArcGIS Enterprise:

Voyager Search Server: 1 License

5.2. Scalable Resources

The contractor will provide the ability to increase/decrease resources, as needed, to support any periods of high/low usage. Scalable resources include but are not limited to:

· Bandwidth

· Servers (including modifications to instance count, instance type/size, and changes to vCPU/memory of ECS resources)

· Storage

· Database instances (changes to instance type/size, storage)

· Other

5.3. System Availability

The Contractor will maintain the IGP environment configuration to support the system availability of 99% or greater per month.

5.4. Help Desk Support

IGP utilizes Jira as its primary change management collaboration tool. All changes to the IGP environment require a Jira ticket. The contractor will be responsible for completing tickets per IGP’s standard ticket workflow and change management business process.

Tickets will be worked Monday – Friday (except federal holidays) from 0800 – 1700 ET. The contractor will ensure cloud engineering availability to complete tickets within the maximum times identified below:

· BLOCKER: 15 minutes to 2 hours.

· CRITICAL: 2 hours to 2 days.

· HIGH: 2 days – 5 days.

· MEDIUM: 5 days – 10 days.

· LOW: 10 days – 20 days.

6. Period of Performance 01 February 2025 – 31 January 2030 (TBD)

7. Points of Contact Contracting Officer (CO) Name: Carla Mosley Address:

Email: Carla_mosley@ibc.doi.gov Phone Number: 703-964-8853

Contracting Officer’s Representative (COR) Name: TBD at time of award

Appendix A A-1: IGP Shared Services Topology Diagram

A-2: IGP – DISDI Topology Diagram

A-3: IGP – ESS Topology Diagram

IGP IaaS Cloud Professional Services 7 image1.png image2.png image3.png