CEG_Region_Four_PWS-_for_FBO.pdf

PERFORMANCE WORK STATEMENT

Commercial Ethernet Gateway (CEG) – Continental United States (CONUS) Region Four

15 October 2019

Table of Contents

1. Contracting Officer Representative (COR)

2. Contract or Task Order Title

3. Background

4. Objectives

5. Scope

6.0 Performance Requirements

6.1 Task 1 - Program Management:

6.1.1 Subtask 1 – Implementation Planning

6.1.2 Subtask 2 - Project Status and Reporting

6.2 - Task 2 - Network Service Capabilities

6.2.1 Subtask 1 - Commercial Enterprise Ethernet Gateways

6.2.2 Subtask 2 - DODIN Customer Access Services:

6.3 Task 3 – Network Service Management

6.4 Task 4 – Security - Reserved

6.5 Task 5 – Site Implementation Services (Optional)

6.5.1 Subtask 1 - Site Engineering Solution and Implementation Plan

7. Performance Standards

8. Incentives

9. Place of Performance

9.1 Alternate Place of Performance - Contingency Only

10. Period of Performance

11. Delivery Schedule

12. Security Requirements

12.1 Facility Security Clearance

12.2 Security Clearance and Information Technology (IT) Level

12.3 Visit Authorization Letters (VAL

12.4 Security Contacts

12.5 Information Security and other miscellaneous requirements

13. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished

Information (GFI)

14. Other Pertinent Information or Special Considerations

15. Section 508 Accessibility Standards

16. Attachments

Attachment A – CEG -DISN Node and Customer Access Site List

Attachment B _ CEG Design Document

Attachment C _ CEG Implementation Standards

PERFORMANCE WORK STATEMENT (PWS)

as of 15 October 2019

Contract Number: TBD

Task Order Number: TBD

Contractor Name: TBD

Tracking Number:

Follow-on to Previous Contract and

Task Order Number:

1. Contracting Officer Representative (COR).

a. Primary COR.

Name:

Organization:

Department of Defense Activity

Address Code (DODAAC):

Address:

Phone Number:

E-Mail Address:

b. Alternate COR (ACOR).

Name:

Organization:

Department of Defense Activity

Address Code (DODAAC):

Address:

Phone Number:

E-Mail Address:

2. Contract or Task Order Title. Commercial Ethernet Gateway (CEG) – Continental United States (CONUS)

Region Four- Virginia

3. Background.

In May 2016 the Department of Defense Chief Information Officer (DOD CIO) directed the DoD to migrate to

Ethernet-based services to reduce TELCOM costs. Since that time the Defense Information Systems Agency

(DISA) has been modernizing the DOD Information Network (DODIN) to facilitate Ethernet connections to that network and enable the replacement of legacy point-to-point Public Switched Telephone Network (PSTN), time division multiplexing (TDM)-based circuits.

4. Objectives.

The objectives of this contract are to:

1. Establish Commercial Ethernet Gateways (CEG) from the Commercial Service Provider’s (CSP) owned, leased and operated network(s) to the DODIN in accordance with the instructions shown in Attachments A and B for the CEG DISN Core Sites. CEGs should employ virtualization using virtual local area network

(VLAN) (802.1Q) between the DISN Joint Provider Edge Router (J-PE) and the Service Provider’s PE routers using, diverse, high bandwidth links. The CSP’s CEG design must meet the performance and availability requirements in the PWS.

2. For the Customer Access Sites shown in Attachment A, provision > 1Gb connections to the CSPs Ethernet

Network. Perform functional and performance testing to demonstrate compliance with PWS requirements.

3. If exercised as part of the Surge CLIN, provide additional Customer Access Sites in the region and discontinue or move service for Customer Access Sites.

5. Scope.

The Government requires commercially provided network solutions and services where the Contractor engineers, furnishes, installs, tests, maintains, and sustains the CEG and Access Site capabilities described in Attachment B to support both DoD and authorized non-DoD operations for the Region Four locations shown in Attachment A.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support may include both additional Task 2 Subtask 2 Customer Access Services not listed in Attachment A, as well as Site

Implementation Services described in optional Task 5. Surge support over the life of the contract will not exceed

20% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6.0 Performance Requirements.

6.1 Task 1 - Program Management:

6.1.1 Subtask 1 – Implementation Planning

The Contractor shall provide a Comprehensive Implementation Plan (CIP). The CIP shall include the following data:

1. Diagrams showing the technical architecture proposed at both the CEGs and the Access Sites. Diagrams should include tables showing the make and model number of all equipment that will be installed as well as operating system versions and its configuration for each device. If the contractor intends to use more than one configuration in the region, they should provide drawings and data for each configuration to be used.

Show how the equipment used on this contract meets the requirements outlined in the contractor’s Supply

Chain Risk Management (SCRM) Plan outlined in Paragraph 14.h.

2. Logical and physical diagrams showing where the equipment will be installed, what government provided resources will be required (e.g. electrical power connections, rack space, HVAC load, etc.) and how the equipment will be connected to the DoD customer premise equipment. If the contractor proposes to install

CEG equipment in their owned or leased facility, state and provide the address and a description of the facility including physical security information.

3. Regardless of whether the install location is on a contractor or government site, the contractor shall include the following information in the CIP for each site. Unless otherwise noted the data element is due in the

Final CIP, which is to be delivered not later than 30 days after contract award:

a. Contractor Name (include POC name and contact info)

b. Contractor Customer Circuit ID

c. Contractor CEG NNI (Trunk) ID

d. Planned Completion Date (see subparagraph 6.1.1.(7) below)

e. Contractor NOC/24/7 Trouble Reporting number (see subparagraph 6.1.1(8) below)

f. Customer Physical demark Address (provide in first CIP Update after install completion)

g. Rack/shelf/slot/port – for contractor equipment EVC connection to site (provide in first CIP

Update after install completion)

For each location, the government will provide the VLAN ID to the contractor after the contractor provides a-e above.

4. Contractor’s process to notify designated Government personnel of planned surveys, installation work, changes in site implementation, site concurrence and acceptance, contractor testing, and maintenance or repair. The contractor shall also describe its approach for resolving issues that surface at the site during contractor installation, testing, and/or maintenance activities.

5. CEG Test plan/procedures that demonstrate that the Contractor’s gateway meets the technical and performance requirements of this contract. Upon approval, this plan/procedure will be used at all gateways and test results provided to the government for review and approval prior to proceeding with Access Site installations.

6. Detailed and realistic schedule for implementation of the proposed CEG solution, including specific dates to survey, provision, install, activate, test, submit test results, and obtain Government acceptance.

Schedule shall meet the Acceptable Quality Level (AQL) for Gateway Delivery listed in Paragraph 7

Performance Standards.

7. Access Site Test Procedures that demonstrate that the access site solution proposed by the contractor meets the technical and performance requirements of this contract. This plan/procedure shall be used by the contractor at all customer access sites. Test results shall be provided to the government for all access site installations within 48 hours of the completion of the installation.

8. Detailed and realistic schedule for installation of the Access Sites on Attachment A. If the contractor requires multiple visits to survey, provision, install, activate, and test, the proposed dates and duration of these visits for each site should be clearly shown on the schedule. Schedule shall meet the AQL for

Ethernet Virtual Connection (EVC) Delivery listed in Paragraph 7 Performance Standards.

9. Contractor’s Operation and Maintenance Plan (O&M Plan), including Network Operations Center (NOC) facilities (primary and alternate), capabilities, diversity and redundancy that will be utilized to provide CEG and User Access services. The plan shall address continuity of operations (COOP), emergency/disaster response, coordination procedures (with DISN NOCs), escalation, and maintenance processes (planned and unplanned) for CEG and user access services.

The contractor shall notify the Government and obtain Government approval of any proposed changes to the CIP.

6.1.2 Subtask 2 - Project Status and Reporting

6.1.2.1 The Contractor shall conduct an initial In-Progress Review (IPR) within 10 business days after award to present its proposed CIP. The Contractor shall brief the detailed approach for performance, functional work relationships, programmatic and technical compliance, identification of critical path and key dependencies, and all risk elements and proposed mitigation. In addition, the Contractor shall provide a comprehensive briefing of the proposed implementation method, planned activities, and proposed schedule. The briefing shall also identify their existing capacity and capabilities in place to satisfy the requirements. Following the initial IPR, subsequent IPRs shall be conducted monthly until completion of the contract. Once CEGs are operational, the contractor shall provide the following data in the IPR:

Access Site installation status - CIP Schedule vs Actual o IPR shall identify any/all Site Implementation Services (Task 5) required to install a CEG or

Access Site.

o Once the Contracting Officer has authorized implementation services to proceed, the contractor shall provide status of implementation services until completed.

CEG Availability o Explain any CEG downtime

CEG Bandwidth Utilization o Provide details of periods where CEG utilization exceeds 80% for more than 5 minutes

Access Site Availability – include all downtime even for planned maintenance.

The IPR may be conducted virtually using the contractor’s collaboration tool.

DELIVERABLE: Comprehensive Implementation Plan Updates

DELIVERABLE: Implementation Schedule Updates

DELIVERABLE: Network Drawing Updates

DELIVERABLE: Test Plan Updates

DELIVERABLE: O&M Plan

DELIVERABLE: In-Progress Review (IPR) presentation

DELIVERABLE: Design Changes to CIP (if required and approved)

DELIVERABLE: Acceptance Testing Results

6.1.2.2 Monthly Progress Report (MPR).

The Contractor shall ensure a MPR is submitted that addresses adherence to the Contractor Master Schedule (CMS), expenditures, billings, progress, status, and any problems or issues encountered in the performance of this contract, in a format mutually agreed upon with the Government. The MPR shall describe tasks, progress and financial status, and identify problems, accomplishments and issues from the reporting period of the MPR. At a minimum, this data shall include:

- Description of activities and deliverables during the current month. The description shall include problem definitions and recommendations for program resolution. Particular attention shall be given to risk management activities.

- Trips, technical visits, and related results for the report period.

- The project schedule showing any proposed changes, the reasons for the changes, and the potential impacts on the program.

- Identification of key personnel and personnel reassignments including personnel added or removed from the contract and the subtasks and projects they will or did support.

- Self-assessment of performance with respect to the PWS AQLs

DELIVERABLE: Monthly Progress Report (MPR)

6.2 - Task 2 - Network Service Capabilities

DISA has a requirement for a robust, redundant, survivable, net-centric solution to meet the DOD’s current and future telecommunications requirements. This task requires the contractor to establish Commercial Ethernet

Gateways (CEG) at the gateway locations identified in Attachment A. The gateways shall comply with the design requirements contained in the DISA CEG Design Document (Attachment B). DISA’s requirement is to have an enterprise solution to efficiently aggregate Ethernet circuits from a CSP and to ultimately decommission the existing point-to-point TDM circuits. Virtualization using VLAN (802.1Q) between the DISN J-PE and the Service Provider

PE routers over a high bandwidth link is the desired CEG solution. The Government requires IP and Ethernet services that will provide more efficient customer and backbone transport access to the DODIN. Only E-line services are requested for this PWS.

As part of this contract, the Contractor shall install, test, and maintain network to network interfaces (NNI) between

DISN Core Sites in Attachment A, and its network. The Contractor’s network shall be capable of supporting the access interfaces and virtual service requirements defined in this PWS. Once CSP CEG infrastructure has been installed and tested to verify DISN connectivity and performance, the individual Customer Access Sites listed in

Attachment A will be provisioned under this contract using that tested and approved CSP CEG infrastructure. The contractor shall also provide Surge pricing to support new customer access requirements as well as any costs associated with termination of service at customer access sites during the PoP of this contract.

For all Task 2 subtasks, the government will ensure that the contractor has access to the site to install any required equipment and that government infrastructure (e.g. rackspace, HVAC, power, local fiber) is made available to support the installation and operation of the service. As stated in paragraph 6.1.1, the contractor should identify infrastructure requirements in the CIP prior to the start of any installation work.

6.2.1 Subtask 1 - Commercial Enterprise Ethernet Gateways

6.2.1.1 Commercial Ethernet Gateways (CEG): The Contractor shall provide, install, test, and maintain a CEG between the DISN Joint Provider Edge (J-PE) routers and the CSP’s facilities as described in Attachment B. The contractor’s CEGs shall connect to two or more of the DISN Core Sites locations listed in Attachment A for the

CEG Locations listed therein. Equipment can be hosted on the government site or in a contractors hosting facility.

Regardless of the equipment location, the connections shall be configured to meet all technical and performance requirements and specifications described in Attachment B.

The Contractor’s network and CEG solution shall:

1. Have the capability to rapidly respond to changes in DoD mission capacity demands

2. Enable a DISN on-ramp for Off-Campus customers to access DISN services via CSP’s Ethernet Services

3. Enable elimination of existing point-to-point lease services via the CSP’s Ethernet Services and CEG.

The contractor shall provide test reports for every installed CEG that demonstrate that all the CEG Technical requirements have been met. The contractor shall provide written test results to the COR that show that the CEG meets the technical and performance requirements specified herein. The following paragraphs provide additional

CEG requirements.

6.2.1.2 Ethernet Network to Network Interface (NNI) Services: The high capacity trunk between the DISN J-PE and the CSP PE is referred to as the Network-to-Network Interface (NNI). The Contractor shall provide, install, test, and maintain an NNI between the DISN J-PE router and the CSPs CEG interface. It is incumbent upon the contractor to ensure that their CEG design has sufficient capacity to support all of the access sites in the Region

(including Surge Sites if ordered). Thus, CSPs shall determine the number of gateways required and the size of the

NNIs necessary to support traffic in the region. NNIs shall meet the technical requirements listed in Attachment B.

DISA is not requiring contractors to have enough bandwidth to support 100% of the regional requirements in the event of a gateway failure. Contractor’s gateways should have at least 30% additional capacity to support new requirements, and to potentially be used to manually re-route some E-Lines affected by an alternate gateway failure.

Bidders should state the amount of additional bandwidth that will be available at each gateway in the proposal, and in the event of a gateway outage, the expected downtime to reroute traffic or effect gateway restoral.

6.2.1.3 NNI Operation: The Contractor shall operate these network interfaces at no additional cost to the

Government (no usage billing). The Contractor must meet the NNI Design requirements described in Attachment

B.

6.2.1.4 VLAN Assignments: The VLAN assignments on the NNI interface to the CSP are the same as they are for customer interfaces developed in Subtask 2. VLAN Assignments shall be in accordance with Attachment B and be provided by DISA.

6.2.1.5 Service Levels: Contractors shall demonstrate how their CEG design will support the gateway service levels requirement specified in Attachments A and B.

6.2.2 Subtask 2 - DODIN Customer Access Services:

The Contractor shall provide E-line services for DoD sites listed in Attachment A “CEG -DISN Node and Customer

Access Site List Region 4”. The contractor shall have the capability to meet the performance specifications in

Attachment B paragraph 2.5. Note that references to “Latency” mean Round-Trip Latency throughout this PWS.

As stated in Task 1 Subtask 1, the contractor shall provide test reports for all access sites that demonstrate that the technical and performance requirements of the PWS and Attachment B have been met. The contractor shall test every access site installed and provide the results at the IPR that show that the site meets the technical and performance requirements specified herein. The following paragraphs provide the technical description and requirements for Customer Access Service.

6.2.2.1 - Ethernet Network Access Interface (Layer 2 E-Line) – For this requirement, E-Line is defined as an Ethernet (optical or electrical) interface handoff between the Contractor and the customer's equipment at the defined demarcation point to enable the establishment of Layer 2 service over the Contractor’s network.

E-Line service shall be provided in accordance with the design requirements outlined in Attachment B.

6.2.2.2 CSP Owned Aggregation Device at Off Campus Lease Locations – There will be sites where two or more DoD activities currently have separate point to point circuits in place. These separate circuits must be aggregated onto separate Layer 2 E-Lines being provisioned by the CSP. In those instances, the CSP shall provide the aggregation device. Attachment B Paragraph 2.10 provides a description of the required capability. As part of the Site Implementation Planning process described in Task 1 Subtask 1 above, CSPs shall determine if a CSP provided aggregation device is required and include it in the proposed design provided as part of the CIP.

Unless otherwise specified, the requirements in Task 3 and 4 apply to both E-Line and to any CSP provided aggregation devices.

6.3 Task 3 – Network Service Management

The Contractor shall provide service management on the CEG and all installed access services. The CSP’s NOC shall have circuit visibility and the capability to resolve any service outage as needed to meet AQLs, and provide data to DISA as described in 6.3.2. DISA will work with the CSP to establish this data feed. At a minimum, the

CSP shall meet the following service management requirements:

6.3.1 The Contractor shall have the ability to perform continuous network monitoring/management and keep the

Government continuously informed of all activities that impact or have the potential to impact the DODIN or

DODIN service.

6.3.2 CSP Network management systems shall have the ability to interface with the DISA-Enterprise Operations

Center (EOC) network monitoring tools and, where prescribed by the Government, to provide near real time network situational awareness. DISA utilizes standards-based SNMP (v2c and v3) and Syslog feeds for situational awareness. DISA can also ingest an XML formatted WSDL via a standard web services interface or a JSON interface.

6.3.3 Report status and tracking data in near real time related to request fulfillment, trouble management, configuration management, and comparable processes to the DISA-EOC as described in Task 1 Subtask 1.

6.3.4 The Contractor shall ensure that Contractor or Government furnished equipment will not cause interference with or be degraded by the performance of co-located systems or other systems and equipment.

6.4 Task 4 – Security - Reserved

6.5 Task 5 – Site Implementation Services (Optional)

There will be instances where implementation services may be needed at a site in order for the CSP to be able to install its equipment and connect that equipment to the CSPs and/or the customer’s network. For example, there may be insufficient rack space, electrical power or HVAC to support the addition of the CSPs equipment. There may also be a need for low-voltage inside plant wiring to be accomplished. New sites that are ordered under the optional Surge CLIN may require these services however and in that event, the following requirements apply as do the site implementation requirements listed in Attachment C.

6.5.1 Subtask 1 - Site Engineering Solution and Implementation Plan

The contractor’s CIP developed under Task 1 will be revised/updated to include the on-site implementation and check-out tasks that the contractor will perform to complete the installation of the Access Site Service. This may include the following tasks/subtasks:

• Equipment/material shipment receipt and temporary storage at site

• Crew arrival

• In-briefing for site POC(s)

• Equipment/material shipment inventory

• Initial unpacking and set-up

• Initial functional equipment testing

• Authorized service interruptioncoordination

• Hardware/software installation

• Testing and turn-up of equipment

• Connections and splicing

• End-to-end system continuity and functional checks

• Preparation of testing documentation, including test and acceptance plans

• Completion of required implementation checklists

• Completion of property management documentation with site POC(s)

• Disposition of shipping materials, debris, and reusable items

• Exit briefing for site POC(s)

• Turn-over of implementation to operations

• Updating designs to include “as-built” information

• Updating DISA’s change management system to reflect “as-built” configuration

• Delivery of required documentation to the CORs

At a minimum the contractor shall provide a complete listing of all equipment installed as part of the site implementation effort. Upon approval of the revised CIP and authorization to proceed from the Contracting Officer, the contractor shall perform the implementation services and complete and test the access services.

For all Task 5 efforts, the government will ensure that the contractor has access to the site to install any required equipment and that government infrastructure (e.g. rackspace, HVAC, power, local fiber) is made available to support the installation and operation of the service. As stated in paragraph 6.1.1, the contractor should identify infrastructure requirements in the CIP prior to the start of any installation work.

7. Performance Standards. (Unless otherwise stated, all time is in Calendar Days)

Performance

Standard

Acceptable Quality Level

(AQL)

Methods of Calculation Method of

Surveillance

Task 1,2- Ethernet

Gateway Delivery -

Contractor establishes a gateway that connects their carrier

Ethernet network to the DISN and that fully complies with the DISA CEG

Design

Specification.

Target Level: Gateway installed and passes acceptance test not later than (NLT) 30 days after contract award (ACA). System meets all Attachment B, SCRM and IPv6 requirements

Minimum Acceptable: Gateway installed and passes acceptance test NLT 60 days ACA. System meets all Attachment B, SCRM and IPv6 requirements

Calculations

Delivery: # of Days between date contract is signed and date DISA receives acceptable test results (i.e.

results that show CEG meets 100% of design requirements).

CEG Design: Gateway Design complies with requirements outlined in Attachment B

SCRM: Components comply with requirements outlined in SCRM Plan

Ipv6: Components and implementation comply with NIST SP

500-267 and the corresponding declarations of conformance defined in the USGv6 Test Program.

100% Inspection

Task 1,2- Ethernet

Network/Gateway

O&M - Contractor

Gateway is reliable and available.

Complies with MEF

6.2

Target Level: Contractor

Network and Gateways must meet CEG Design Document

Para 2.3.1 (Objective MTU), 2.5.1, 2.5.2 and 2.5.3 Service

Category Assured #1

Minimum Acceptable:

Contractor Network and

Gateways must meet CEG

Design Document Para 2.3.1

(Threshold MTU), 2.5.1, 2.5.2 and 2.5.3 Service Category

Assured #1

Calculations:

Gateways will be continuously monitored by DISA Enterprise

Operations Center for packet loss, jitter and latency and outages/ downtime. Availability will be calculated on an annual basis i.e.

fractional hours of downtime in 12-month period/8760

Continuous monitoring of deliverable services.

Task 1,2- Ethernet

Virtual Connection

(EVC) Delivery – circuits are installed and operational as quickly as possible.

Target Level: 75% of all circuits ordered are installed and fully operational NLT 120 Days

ACA.

Minimum Acceptable: No more than 10% of circuits ordered take longer than 180 days ACA to become operational. All circuits listed in Attachment A installed

NLT 365 days ACA

Calculations

Number of circuits ordered

Number of circuits in-effected in <

120 days ACA

Number of circuits in-effected in

>120 days ACA

Number of circuits in-effected in

>180 days ACA

100% Inspection

Performance

Standard

Acceptable Quality Level

(AQL)

Methods of Calculation Method of

Surveillance

Task 2 -EVC

Service Levels

Target Level:

EVC must meet performance requirements specified in CEG

Design Document Para 2.3.1

(Objective MTU), 2.5.1, 2.5.2, and 2.5.3 for the Service

Category specified for that EVC in PWS Attachment A.

Minimum Acceptable

EVC must meet CEG Design

Document Para 2.3.1 (Threshold

MTU), 2.5.1, 2.5.2 and 2.5.3

Service Category Assured #2

Calculations:

Each EVC will be continuously monitored by DISA Enterprise

Operations Center for packet loss, jitter and latency and outages/downtime.

Availability will be calculated on an annual basis i.e. hours of downtime in

12-month period/8760

Continuous monitoring of deliverable services.

Task 1- SCRM – components used by contractor meet

DISA SCRM

requirements

Target Level: Contractor submits fully acceptable SCRM

Plan NLT 30 days after contract award. Contractor fully complies with SCRM throughout life of contract

Minimum Acceptable:

Contractor submits fully acceptable SCRM Plan NLT 90 days after contract award.

Contractor fully complies with

SCRM throughout life of contract

Calculations:

Days between Contract Award Date and date SCRM Plan approved by

DISA. DISA will subtract its review days from the total calculation.

100% Inspection

8. Incentives.

Both positive and negative performance will be documented in past performance reports/database, Contractor

Performance Assessment Reporting System (CPARS), as appropriate and will be taken into consideration for follow-on work.

9. Place of Performance.

The primary Place of Performance for the work under this task order will be determined by task. Report writing will be performed at Contractor-provided facilities.

Implementation will be conducted in various locations within the U.S. and its territories including but not limited to the sites listed in Attachment A. Surge sites may include additional sites which will be located within the region.

9.1 Alternate Place of Performance - Contingency Only

Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance.

The period of performance for this requirement shall be ONE year with NINE one-year option periods. As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions.

11. Delivery Schedule. (Unless otherwise stated, all time is in Calendar Days)

PWS

Task No.

Deliverable Title Format Due Date

Distribution/

Copies

Frequency and

Remarks

6.1.1 Comprehensive

Implementation

Plan Updates

Contractor-Determined format utilizing

Microsoft Office products

Initial shall be delivered with the proposal and presented at IPR.

Final - 30 days ACA with revisions provided at the subsequent IPR as changes are made

Standard

Distribution

Monthly

6.1.1 Acceptance Test

Results

Contractor-Determined format utilizing

Microsoft Office products

Within 2 business days of installation completion

Standard

Distribution

As required

6.1.2 Implementation

Schedule Updates

Contractor-Determined format utilizing

Microsoft Office products

Initial – 20 business days ACA.

Subsequent- within 2 business days after change in schedule is known

Standard

Distribution

As required

6.1.2.1 Network Drawing

Updates

Contractor-Determined format utilizing

Microsoft Office products

Initial – 20 Business days ACA.

Subsequent- as changes are made – provide at next IPR

Standard

Distribution

Updates provided no more than 20 business days ACA and submitted at IPR.

Contractor must submit any proposed changes for

Government review prior to updating

6.1.2.1 Test Plan Updates Contractor-Determined

format utilizing

Microsoft Office products

Initial – 20 Business days ACA.

Subsequent- as changes are made – provide at next IPR

Standard

Distribution

Updates provided no more than 20 business days ACA and submitted at IPR.

Contractor must submit any proposed changes for

Government review prior to updating

6.1.2.1 Operations and

Maintenance

(O&M) Plan

Contractor-Determined format utilizing

Microsoft Office products

Initial – 20 Business days ACA.

Subsequent- as changes are made – provide at next IPR

Standard

Distribution

Updates provided

NLT first IPR after update is made.

6.1.2.1 In-Progress Review

(IPR) presentation

Contractor-Determined format utilizing

Microsoft Office products

First report due 10 days following award.

Standard

Distribution

Monthly

6.1.2.1 Design Changes to

CIP (if required and approved)

Contractor-Determined format utilizing

Microsoft Office products

5 business days after change is approved

Standard

Distribution

As required

6.1.2.2 Monthly Progress

Report

Contractor-Determined format utilizing

Microsoft Office products

First report due 30 days following award.

Standard

Distribution

Monthly

PWS

Task No.

Deliverable Title Format Due Date

Distribution/

Copies

Frequency and

Remarks

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the COR/ACOR. Paper copies shall be provided to the Government upon request.

12. Security Requirements. This section shall be considered a supplement to Block 13 of the Government provided DD Form 254, Contract Classification Specification. The following security requirements shall apply to this effort.

References:

a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of User Responsibilities –

Basic User

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-4 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating Change

02 May 2016

12.1 Facility Security Clearance. Some of the work to be performed under this contract/order is classified up to the Secret level. Therefore the contractor must agree to obtain a Secret Facility Clearance from the Defense Security

Service Facility Clearance Branch post-award. The requirements of paragraph 12.2 shall be met once the contractor is granted their facility security clearance.

12.2 Security Clearance and Information Technology (IT) Level. All personnel performing on or supporting a

DISA contract/order in any way will be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance and interim or final IT-level eligibility delineated in the table below when performance starts.

PWS Task /

Subtask

Clearance

Level

IT Level

Access

Level of Classified

Access Justification for Access to Classified

6.1 Secret IT-II Secret Contract is for equipment installation and maintenance services on equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for the performance of the contract. Cleared personnel are required to perform this service because visual or aural access to classified information cannot be precluded by escorting personnel. Any classification guidance will be provided by the using activity.

Access required for the information needed to perform the work. Access is needed to review classified information and to communicate with secure IT systems (SIPRNet, WWOLS.).

12.2.1 All personnel requiring Secret or IT-II access under this contract/order shall undergo a favorably adjudicated

Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or

Access National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigations will be initiated by submitting a Tier 3R investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

12.3 Visit Authorization Letters (VAL). Visit requests shall be processed and verified through the Joint Personnel

Adjudication System (JPAS) to SMO DKABAA10. (Include other JPAS SMO codes as applicable. A complete list of DISA JPAS SMO codes can be found at https://disa.deps.mil/ORG/MP6/mp61/industrialsecurity/Shared%20Documents/Forms/AllItems.aspx) JPAS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number and

ADP/IT-Access level of the contract/order in the Additional Information section. Contractors that do not have access to JPAS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in PWS/SOW Section 1.0.

If JPAS is not available, the VAL must contain the following information on company letterhead:

Company name, address, telephone number, facility security clearance

CAGE CODE

Contract/Order Number

Name, SSN, date and place of birth, and citizenship of the employee intending to visit

Certification of personnel security clearance and any special access authorizations required for the visit

(type of investigation & date, adjudication date & agency, and IT access level)

Name of COR/Alt COR

Dates or period the VAL is to be valid

12.4 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-1235 or via mail at:

Defense Information Systems Agency Defense Information Systems Agency

ATTN: MP61, Industrial Security ATTN: MP62, Personnel Security

Command Building Command Building

6910 Cooper Ave. 6910 Cooper Ave.

Fort Meade, MD 20755-7088 Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Bryant Hamlor 301-225-8117

Defense Information Systems Agency

ATTN: MPS61, Industrial Security

Command Building

6910 Cooper Ave.

Fort Meade, MD 20755-7088

12.5 Information Security and other miscellaneous requirements.

12.5.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the government facility.

12.5.2 Contractor employees shall be required to comply with all Government security regulations and requirements.

Initial and periodic safety and security training and briefings will be provided by Government security personnel.

Failure to comply with Government security regulations and requirements shall require the company to provide the

Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

https://disa.deps.mil/ORG/MP6/mp61/industrialsecurity/Shared%20Documents/Forms/AllItems.aspx

12.5.3. Contractor employees with an incident report in JPAS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

12.5.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

12.5.5 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

12.5.6 Contractor personnel will generate or handle documents that contain For Official Use Only information at the contractor and government facility. Contractor shall have access to generate and handle classified material only at the location(s) listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 3, Vol. 4, Information Security, DoDM 5400.07, Freedom of

Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19.

12.5.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

13. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-

Furnished Information (GFI).

There is no GFP/GFI being provided for this contract. The Government will furnish reasonable GFI determined to be necessary in order for the contractor to accomplish this requirement. The contractor shall be responsible for the proper handling, safeguarding and return of all GFI.

14. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work. N/A

b. Identification of Potential Conflicts of Interest (COI.) N/A

c. Identification of Non-Disclosure Requirements. N/A

d. Packaging, Packing and Shipping Instructions. N/A

e. Inspection and Acceptance Criteria. FOC shall be achieved for the work contained herein and is defined complete and satisfactory delivery of this required service, in accordance with all of the conditions of this PWS and associated contract. FOC is achieved when all tasks of this PWS are completed and the Government approves the contractor’s test results.

f. Property Accountability. N/A

g. Supply Chain Risk Management (SCRM). In accordance with provision DFARS 252.239-7017 Notice of

Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission

Critical Functions to Achieve Trusted Systems and Networks, Section 806 of the FY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures, the

Contractor shall submit a SCRM plan as part of the technical proposal. The SCRM Plan shall be no longer than 20 pages. SCRM Plans may be reviewed by the PMO for completeness and sufficiency. The Contractor must incorporate and/or address corrections and feedback from the PMO within thirty (30) calendar days. The

Contractor shall implement the finalized SCRM Plan upon approval and provide updates when necessary. In accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 and

Committee on National Security Systems Instruction (CNSSI) 1253 Appendix D, the SCRM plan shall address the following security controls, as applicable to your contract:

Control

Number

HW SW Srvc

SA-12 Supply Chain Protection x x x

SA-12(1) Supply Chain Protection / Acquisition Strategies / Tools / Methods x x x*

SA-12(2) Supply Chain Protection / Supplier Reviews x x x*

SA-12(5) Supply Chain Protection / Limitation of Harm x x x*

SA-12 (7) Supply Chain Protection Assessments Prior to Selection / Acceptance/ Update x x x*

SA-12 (8) Supply Chain Protection / Use of All-Source Intelligence x x x*

SA-12 (9) Supply Chain Protection / Operations Security x x x

SA-12 (10) Supply Chain Protection / Validate as Genuine and Not Altered x x x*

SA-12 (11) Supply Chain Protection / Penetration Testing / Analysis of Elements, Processes, and Actors x x x

SA-12 (12) Supply Chain Protection / Inter-Organizational System Components x x x

SA-12 (13) Supply Chain Protection / Critical Information System Components x x x*

SA-12 (14) Supply Chain Protection / Identity and Traceability x x x*

SA-12 (15) Supply Chain Protection / Process to Address Weaknesses or Deficiencies x x x

IR-4 (10) Incident Handling / Supply Chain Coordination x x x*

IR-6 (3) Supply Chain Protection / Incident Reporting / Coordination With Supply

Chain x x x*

SA-11 Developer Security Testing and Evaluation x x x*

SA-14 Criticality Analysis x x x*

SA-15 Development Process, Standards, and Tools x x x*

SI-7 Software, Firmware, and Information Integrity x x x*

CM-4 Security Impact x x x*

PM-16 Threat Awareness Program x x x

*Not required if there will be no procurement of hardware, firmware, or software systems.

DELIVERABLE: Supply Chain Risk Management (SCRM) Plan

h. Supply Chain Risk Management Plan Update: The contractor shall provide an updated SCRM Plan to the COR and ACOR within five (5) business days whenever there is a change that affects one or more security controls as described in the Committee on National Security Systems Instructions (CNSSI) 1253 Appendix D

(companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)).

At a minimum, the following events will require a SCRM Update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and ICT supply chain compromises.

DELIVERABLE: Supply Chain Risk Management (SCRM) Plan Update

Contractor employees may be required to take periodic mandatory training courses provided through the agency, such as records management training and other training required by statute, regulation, DoD, or DISA policy.

(Note if there are specific courses you will require from your contractors, insert those here.) No other training of contractor personnel shall be provided by the Government unless authorized by the Contracting Officer.

15. Section 508 Accessibility Standards. The following Section 508 Accessibility Standard(s) (Technical

Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards

1194.21 - Software Applications and Operating Systems

1194.22 - Web Based Intranet and Internet Information and Applications

1194.23 - Telecommunications Products

1194.24 - Video and Multimedia Products

1194.25 - Self-Contained, Closed Products

1194.26 - Desktop and Portable Computers

1194.41 - Information, Documentation and Support

The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the

Offerors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance.

This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

Functional Performance Criteria

1194.31 - Functional Performance Criteria

16. Attachments

Attachment A – CEG -DISN Node and Customer Access Site List Region 4

Please request a copy of this site list from the Contract Specialist and/or Contracting Officer.

Attachment B _ CEG Design Document

Att B Region 1 fbov3.docx

Attachment C _ CEG Implementation Standards

Attachment C _ CEG

Implementation Standards.docx

Unclassified 8 October 2019 Version 2.0

Commercial Ethernet Gateways (CEG) Design Document

Version 2.0

10 August 2019

Version 1.8.2

Revision HistoryDefense Information Systems Agency

IEA/IE5

6910 Cooper Ave

Ft Meade, MD

Version Number

Date

Description of changes

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.8.1

1.8.2

2.0

21 Sept 2018

27 Sept 2018

1 Oct 2018

1 Oct 2018

2 Oct 2018

5 Feb 2019

26 Apr 2019

20 Jun 2019

18 Jul 2019

25 Jul 2019

10 Aug 2019

8 Oct 2019

Original Draft

Changed the Threshold MTU of NNI from 4472 to 4400. Added section on E-Line Redundancy. Clarified access to JRSS for E-line and Layer-3 VPN. Also pointed out that customers connecting directly to CSP for Layer-3 VPN may have option of using TDM interfaces. Made many minor editorial changes

Made many editorial changes and clarifications

Updated document show classification as Unclassified. Spelled out any undefined Acronyms and provided missing definitions. Crossed out some VLAN numbers from VLAN tables so document can released in RFI. Removed all encryptor vendor names.

Made many editorial changes

Section 2.1: section added that not all CSPs can be expected to support both E-Lines and Layer-3 VPN on same NNI; therefore separate NNIs for E-Lines and Layer-3 VPN is acceptable for this design.

Section 2.1.1: clarified that Customers submit CAPs.

Section 2.1.2: clarified that J-PE does strict route filter ingress on J-PE and that J-PE drops any default routes received from CSP.

Section 2.4: Customers are responsible for deploying Unclass Converged CE routers (Not the CSP)

Figure 2-6: Clarified who owns/manages encryptors

Added section 2-10 which clarifies CSP owned aggregation devices at off-campus locations

Section 2.3.1 change objective MTU from 9100 to 9000.

Section 2.5. Throughout section clarified language that ‘frame’ applies to E-line service and ‘packet’ applies to Layer-3 VPN service

Section 2.5.2: Further clarification that Round-trip delay shall be less than or equal to 10 milliseconds per 350 miles measured as the great circle distance between the “A” and “Z” locations.

Section 2.5.4 added which states that for E-Line service, the CSP will pass all Ether Types unchanged, end-to-end.

Section 2.5.5 added that states the vendor must test the circuit for 24 hours IAW ITU-T.Y.1564 (02/2016) Ethernet Service Activation Test Methodology

Section 2.5.3: Frame loss for Assured #2: (Silver) changed to .05%

Updated performance requirements into tables

Removed FOUO markings

Introduction: Clarified that only E-lines are required in Phase I contracts

Introduction: Defined the term EVC

Section 2.10: Added sentence on min circuit size and aggregation.

NOTE: This is version is also referred to as Att B Region 1 fbov3

1 Introduction 5

2 Design Details 6

2.1 E-Lines and Layer-3 VPN peerings: 6

2.1.1 E-Lines over NNI from CSP (These are just tail circuits separated by VLANs) 7

2.1.2 MPLS Layer-3 VPN Peering over NNI to CSP: 7

2.2 VLAN Assignments: 8

2.3 Maximum Transmission Unit (MTU) 9

2.3.1 MTU for Trunk NNI with CSP 9

2.3.2 MTU for Customer Circuits (Individual VLANs) 9

2.4 Converged CE Router using CSP service to access DISN 9

2.5 Performance Specifications for CSP 10

2.5.1 Performance of the NNI 10

2.5.2 End-to-End Latency (Delay) Specification 10

2.5.3 End-to-End Frame/Packet loss, Availability, and Jitter 10

2.5.4 Ether Types 11

2.5.5 Testing Duration 11

2.6 Interface Specifications for CSP 11

2.6.1 Interface Specification for NNI Trunk 11

2.6.2 Interface Specification for customer connection to CSP 11

2.7 Security 11

2.7.1 Control and Data Plane Security 11

2.7.2 Ethernet Layer-2 Type-3 Encryption (Optional for CEG locations) 12

2.8 Quality of Service 12

2.9 Redundancy for MPLS Layer-3 VPN and E-Line 12

2.9.1 Gateway Redundancy for MPLS Layer-3 VPNs 13

2.9.2 Achieving Redundancy with (2) Separate E-Lines 13

2.10 CSP owned Aggregation Device at Off-Campus Lease Locations 14

Introduction

The world is quickly transitioning away from Time Division Multiplexing (TDM) technologies and migrating to Ethernet. The DoD CIO office directed the entire DoD to optimize communications to Ethernet based services to reduce TELCOM costs. See DoD CIO memo (subject: circuit optimization, dtd 5 May 2016) for details. At the same time, point-to-point commercial leases are typically taking us 6-9 months to procure. This is unacceptable.

DISA urgently needs an enterprise solution to efficiently aggregate Ethernet…