Clarification Questions and Answers.docx

QUESTIONS AND ANSWERS

Solicitation: 36C25526Q0202 for VPN Ethernet Services – Marion VA Amendment: 0001 Date: 03/27/2026

1. Is a separate ISP/carrier circuit required?

ANSWER: No traditional “ISP” circuit is allowed.

LEADS requires a transport circuit (Metro‑E, EVPL, L2, PTP) that connects directly to an Illinois Century Network (ICN) POP site. ICN is the only entity that provides LEADS access.

2. If required, who is responsible for ISP procurement (VA, contractor, or State)?

ANSWER: The VA procures the transport circuit from an approved telecom provider (e.g., Frontier, Clearwave, Wabash, Mediacom, etc.).

ICN service fees are paid separately to the State of Illinois.

3. Are there state‑mandated or pre‑approved carriers?

ANSWER: ICN is mandatory, but transport carriers are flexible.

Transport vendors must be approved by DoIT/LEADS to ensure they meet ICN POP requirements.

DoIT currently works with:

Frontier, Clearwave, Wabash, Mediacom, AT&T, Fidium, MCC, and others.

4. Where is the ISP building entrance/demarc located?

ANSWER: Building 37 room 131 SE corner.

The demarc is determined by the telecom transport provider.

For Frontier and others, this is typically the MDF.

5. Will new fiber need to be run from the ISP demarc to the MDF/IDF rack?

ANSWER: Possibly.

If the transport provider’s handoff is not already present in the MDF, new fiber/copper may be needed.

ICN will specify the required handoff type.

6. Who is responsible for internal fiber pathway installation and firestop compliance?

ANSWER: The VA (Facilities or contractor) is responsible for all internal pathway work inside the building, including code‑compliant firestop. A pathway should already exist.

7. Is physical air‑gap required, or is logical segmentation acceptable?

ANSWER: Logical segmentation is acceptable.

LEADS traffic traverses a dedicated transport path to ICN, eliminating internet exposure.

Segmentation inside the VA environment must follow CJIS and VA security requirements.

8. Please provide a network topology diagram identifying all demarcation points.

ANSWER: A textual description (diagram can be produced on request):

Transport Provider Network → ICN POP → ICN backbone → DoIT‑managed router inside VA → LEADS workstation VLAN.

9. Will this require a separate ATO?

ANSWER: No new system boundary is created.

The ICN/LEADS system is state‑owned; the VA only maintains its local environment.

An ISA/MOU with the State may be required, but not a new ATO.

10. Who is the Authorizing Official and system owner?

ANSWER: For the VA environment: the VA Police/System Owner.

For the ICN/LEADS network: State of Illinois / ISP LEADS Administration.

11. RACI Matrix

• ISP/transport procurement – VA (A/R), Transport Vendor (R), DoIT (C)

• Internal fiber runs – VA or VA contractor (A/R)

• Router/firewall ownership – ICN/DoIT owns the LEADS router; VA owns local security devices

• Endpoint management – VA Police, ISP LEADS (C)

• Encryption management – ICN/DoIT

• Logging & monitoring – VA (A/R) for local logs; DoIT monitors ICN router

• Incident response – VA for local boundary; ISP LEADS for LEADS‑related CJIS issues

• CJIS compliance – VA PD (A), ISP LEADS Administration (A/R for state component)

• Hardware lifecycle – VA (local), DoIT (ICN router)

• Change management – VA CAB for VA-side changes; DoIT approval for transport provider changes

12. Has coordination been completed with the Illinois State Police?

ANSWER: VA Police are currently utilizing LEADS. However, the VA Police must notify ISP LEADS of the transport vendor change and complete the required vendor forms.

13. Is CJIS Security Policy compliance mandatory?

ANSWER: Yes.

All vendors and personnel involved in LEADS connectivity must meet CJIS standards.

14. Who is the CJIS Systems Officer?

ANSWER: ISP LEADS Administration designates the CSO.

Contact is via LEADS Administration, not DoIT.

15. Are CJIS background checks required for contractor personnel?

ANSWER: Yes, for any technician with access to LEADS‑connected systems or the DoIT router environment.

16. Are FIPS 140‑2/140‑3 validated modules required?

ANSWER: Yes.

ICN/LEADS systems use CJIS‑compliant cryptographic mechanisms; agency systems must meet CJIS requirements.

17. Are endpoint hardening standards defined by the State?

ANSWER: Yes, LEADS requires compliance with CJIS endpoint hardening principles.

VA can apply DISA/NIST baselines for compliance.

18. What VPN architecture is required?

ANSWER: None.

LEADS connectivity does not use VPN.

It uses a private, statewide ICN network delivered through a DoIT router.

19. What encryption standard is required?

ANSWER: Encryption is enforced within the ICN/LEADS network, not by the VA.

ICN meets CJIS requirements.

20. Where does the VPN tunnel terminate?

ANSWER: Not applicable.

There is no tunnel; LEADS runs over ICN’s private network.

21. Who manages encryption keys and certificates?

ANSWER: ICN / DoIT manages encryption inside their network.

22. Is MFA required?

ANSWER: Yes, for LEADS application access and user authentication.

23. Is OS2 or OM4/OM5 required?

ANSWER: Depends on the transport provider’s handoff specifications.

ICN does not mandate fiber type inside the facility.

24. Distance from ISP demarc to rack?

ANSWER: Roughly, over 500 feet to the MDF. Should be determined via site survey.

25. Required optical interface (1G LX, 10G LR, etc.)?

ANSWER: Determined by the transport vendor and ICN router port specifications.

26. Connector type (LC/SC/APC/UPC)?

ANSWER: Determined by the transport provider handoff.

27. Are OTDR/certification reports required?

ANSWER: Yes, for any new fiber or copper runs.

28. Is redundant fiber path required?

ANSWER: Not required by DoIT/LEADS.

29. Can existing fiber plant be reused?

ANSWER: Yes, if compatible and certified.

30. Where will equipment be housed?

ANSWER: In the VA Police Dispatch office (Building 42, Room A102) and MDF, where the DoIT router and transport provider demarc exist.

31. Is rack space and UPS‑backed power available?

ANSWER: Yes.

32. Is badge‑controlled physical access required?

ANSWER: Yes, CJIS and LEADS require controlled access. It already exists.

33. Are escorts required for installation?

ANSWER: Yes, follow VA physical security and CJIS escort policies.

34. Is the LEADS desktop connected via copper or fiber?

ANSWER: Typically copper.

35. If copper, what specification?

ANSWER: Cat6 minimum.

36. If fiber, what type?

ANSWER: N/A.

37. Is the desktop on a dedicated network drop?

ANSWER: Yes, dedicated and segmented for LEADS.

38. Who provides and installs the drop?

ANSWER: VA or a VA‑authorized contractor.

39. Are certification test results required?

ANSWER: Yes, for compliance and troubleshooting.

40. Is MAC binding or 802.1X required?

ANSWER: 802.1X is recommended. CJIS requires strong device/user authentication.

41. Is NAC required?

ANSWER: Determined by the transport vendor and ICN router port specifications.

42. Who owns modem, router, firewall, optics, cabling?

ANSWER: Transport provider owns the transport CPE.

DoIT owns the ICN router.

VA owns internal cabling and firewalls (if any).

43. Who performs firmware updates?

ANSWER: DoIT for their router; transport provider for their CPE; VA for its equipment.

44. Are EOL/EOS devices prohibited?

ANSWER: Yes, for all components in the LEADS path.

45. Are certified technicians required?

ANSWER: For cabling — yes (BICSI).

For DoIT router — only DoIT personnel.

For LEADS systems — CJIS‑screened technicians.

46. Are network engineer certifications required?

ANSWER: Recommended but not mandated by the State.

47. Who provides IP space?

ANSWER: ICN/DoIT provides addressing for LEADS connectivity.

VA provides internal workstation LAN IPs.

48. Is BGP required?

ANSWER: No — routing on LEADS circuits is controlled by ICN.

49. Is NAT permitted?

ANSWER: Not applicable; LEADS does not traverse NAT or the public internet.

50. Are routing changes subject to VA CAB?

ANSWER: VA-side routing changes must go through VA CAB.

ICN routing is managed exclusively by DoIT.

51. Who monitors logs?

ANSWER: VA monitors local workstation and security logs.

DoIT monitors ICN/LEADS router and backbone.

52. Must logs integrate with VA SIEM?

ANSWER: Unknown.

53. Does incident response follow VA 6500 or State CJIS?

ANSWER: Inside VA boundary: VA 6500.

LEADS/CJI incidents: CJIS and ISP LEADS procedures.

54. Who has primary investigative authority?

ANSWER: VA for internal breaches;

ISP LEADS Administration for LEADS/CJI-related issues;

Coordination occurs between both.

55. Required bandwidth?

ANSWER: LEADS traffic is minimal; 10 Mbps or higher transport is sufficient.

Most providers deliver 100M or 1G handoffs.

56. SLA requirement?

ANSWER: Minimum 99.9% recommended.

ICN service levels apply beyond the transport handoff.

57. Is redundant ISP required?

ANSWER: Not required by LEADS/DoIT.

58. Is automatic failover required?

ANSWER: Not required.

59. Is 24×7 support required?

ANSWER: Not required, but recommended.

60. Which telecommunications carriers are currently approved to provide transport connectivity to the Illinois Century Network (ICN) for LEADS access?

Are AT&T and Verizon approved ICN transport providers for LEADS connectivity?

Is there a published or internal list of approved ICN transport vendors that can be shared?

ANSWER: We can work with just about any vendor.

The vendor must have a presence at one of our POP sites.

At this time, we currently work with Delta/Clearwave, Frontier (a Verizon company), Wabash communications (WIN) Futiva, and Mediacom in your local area. There are many more vendors across the state, but those vendors would more than likely partner with one of these for local access in the Marion, Il area.

We don’t have a direct link to Verizon at this time but again Verizon may work with one of the local vendors to bring the needed PTP service to our POP site.

We also have service that is brought into our Carbondale POP (regional host for the Marion/Carbondale area) by Windstream, Comcast, and ATT, Fidium/Consolidated.

So, there are many vendors to work with. We can assist in providing the necessary details for these vendors so you are getting the correct type of circuit that will work on our network.

61. Our question for this opportunity is Construction will be required to reach the hospital, and we need to know where the DMARC is located, where the fiber will terminate? It will help my engineers with determining the construction cost.

ANSWER: The fiber will terminate at Building 37, Room 131, SE corner.

62. Would you please provide the exact ICN POP location (facility name and address) where the carrier circuit must terminate for Marion VA LEADS connectivity. You mentioned Carbondale POP. I believe that's the town over about 20 miles.

ANSWER: There are many possibilities for our POP sites. Any of our current vendors are aware of our locations and are vetted for access. We would have to approve new vendors before allowing access to our facilities.

That being said, we will work with you to make a circuit with any vendor work if able.

We do have some standards so if you provide an offer we will review so we know that it will meet our standards.

The facility at SIU-Carbondale has restricted access to State of Illinois employees. Access is granted when we escort vendors in and out of our room.