Data Center and Cloud Engineering Services_Draft PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR

DATA CENTER AND CLOUD ENGINEERING SERVICES

1. General Information and Scope of Work.

1.1 Agency: Department of Defense, Office of Inspector General

1.2 Background: The Department of Defense Office of the Inspector General (OIG) has a requirement for highly skilled engineering services to support OIG projects to implement, secure, and maintain data center and cloud solutions. This engineering support model will provide and establish the tools, processes, resources, and skillsets required to successfully plan, deploy, integrate, operate, secure, and support complex OIG data center, network, and cloud technology systems and platforms. The OIG is seeking highly skilled engineering services to develop requirements, identify requirements, implement solutions, and support the tools, technologies, networks, and processes that will ensure the ongoing success of OIG projects, operations, and execution of the OIG mission.

1.3 Scope of work: Provide the technical skillsets and functional activities required for execution of tasks outlined within this PWS. Data center and cloud engineering support services will cover a broad range of specialized engineering tasks and projects that will be prioritized by the government and executed based on immediate and future impact need and impact on operations. The contractor will work with the OIG Office of the Chief Information Officer (OCIO) Infrastructure Directorate and divisions to identify and prioritize the necessary projects, technologies, and processes that need to be implemented to ensure successful long-term data center operations.

The contractor will be responsible for improving and optimizing the OIG data center, cloud, and network environments whereby the necessary tools and processes are implemented that will ensure ongoing operational success in the management of the OIG enclave data center and cloud ecosystems.

These responsibilities will include the identification, implementation, operational support and optimization of all data center related technologies, networks, and processes.

Performance location:

4800 Mark Center Drive Alexandria, VA 22311

2. Requirement (Objectives).

2.1 (Objective 1) Data Center and Cloud Engineering: The contractor shall provide engineering support for all projects and activities required to ensure the successful engineering, implementation, and operations of NIPR and SIPR systems, applications, and networks in the OIG data center and cloud environments. These activities will require close coordination with OCIO directorates and divisions, server and application owners, the Defense Information Service Agency (DISA), and commercial/government cloud vendors to develop a comprehensive and successful data center and cloud implementation, operations, and optimization plans. Provide assessments, analyze the data center and cloud environment architectures, make recommendations, and implement solutions. The contractor will provide a highly skilled engineering support team for the implementation of capabilities to ensure the ongoing successful operation and management of the data center and cloud environments. The contractor will be responsible for the identification, design, implementation, operational support and optimization of all data center and cloud related technologies, networks, and processes. Responsibilities will also include, but are not limited to enterprise network engineering and operations, file share platform engineering, application migration and support, data center and cloud automation, implementation of network, server, and cloud monitoring tools, data center and cloud capacity management and cost tracking, asset and IP address management, deployment and support of physical/virtual infrastructure, server and application backup solutions, data center and cloud security solutions, disaster recovery (DR) engineering support, data center and cloud right sizing and optimization, processes and procedures development and implementation.

2.2 Supporting Tasks (Objective 1).

(Task 1) Engineering Support. The contractor shall provide highly skilled engineering support for all DoD OIG data center and cloud projects and activities required to ensure the successful operation and security of NIPR and SIPR systems in the OIG data center and cloud environments.

These activities include, but are not limited to network design and implementation, cloud design and implementation, system design and implementation, project planning, development of technical documentation and standard operation procedures (SOPs), deployment of automated discovery, mapping, and migration toolsets, server performance optimization and right-sizing, network and server monitoring, DR planning and implementation, backup and encryption solution deployment, and validation of operational systems. The contractor will assist with the identification of technical requirements, solution recommendations, and implementation of new solutions and capabilities software in accordance with DISA Security Technical Implementation Guides (STIGs) to ensure the ongoing successful operation and management of the data center and cloud environments.

(Task 2) Microsoft Azure and Microsoft 365 Engineering and Security. The contractor shall provide highly skilled and experienced cloud engineering and cloud security support for the OIG Microsoft Azure and Microsoft 365 (M365) DoD Impact Level 5 (IL5) cloud environments. The contractor will be responsible for establishing and securing the OIG Azure and M365 IL5 cloud tenant(s) and performing all subsequent migration activities. These activities include but are not limited to the project management, design, development, security, and implementation of a hybrid (ExpressRoute) connected, highly available, multi-region Microsoft Azure cloud environment. The contractor will perform the migrations of all systems, servers, applications, and users to the Azure and M365 cloud environments. The contractor shall manage and administer the Microsoft Azure and M365 cloud, including the provisioning, configuration, performance monitoring, policy governance and security of the tenant(s) and ensuring that all cloud infrastructure components meet proper performance and capacity standards. The contractor shall also create technical documentation and reference materials (SOPs, network diagrams, installation documentation, etc.)

for the Azure and M365 cloud environments to be used by operations personnel.

The contractor will provide cloud security subject matter expertise to implement and maintain the security of the Azure and M365 environments in compliance with the DoD IL5 tenant configuration guides and STIGs and shall be responsible for securing the cloud infrastructure and workloads by designing, implementing, and operationalizing capabilities. These security capabilities include but are not limited to the implementation of continuous security monitoring practices along with threat and vulnerability prevention, detection, and response capabilities on cloud assets utilizing cloud security tools such as Microsoft Sentinel, Purview, and Defender. The contractor will also manage security and access controls of the Microsoft Azure and M365 cloud environments and develop and implement policy driven data protection best practices to ensure OIG data is successfully protected and secure.

(Task 3) Network Subject Matter Expert (CCIE Level). The Contractor shall provide a Network Engineer Subject Matter Expert (SME) to support all OIG enclave, data center and cloud network architectures, engineering, and operations required to maintain secure and reliable enterprise network(s). The SME shall work with the Enterprise Architect and network engineers to develop a highly comprehensive and robust network design, engineering, implementation, security, and operational plan. Provide assessments and analyze the data center and cloud network environment architectures, make recommendations, and implement changes. Responsible for design, staging, configuration, implementation, security, and support for all network related equipment and technologies including, but not limited to routing and switching, virtual private networks (VPN), and 802.1x network access control solutions. The SME will have expertise with Azure and AWS cloud network technologies and equivalents such as Virtual Private Cloud (VPC), Virtual Network, NAT Gateways, VPN Gateways, Route53, DNS, Traffic Manager, Network Load Balancer, Application Gateway, Custom Route Tables, User Defined Routes, AWS Direct Connect and Azure ExpressRoute. Design and implement network architectures, equipment, and software in accordance with DISA security STIGs. Develop and maintain documentation which will include but is not limited to SOPs and System Architecture Guides and Diagrams adhering to organizational templates, policies, and standards. Responsible for troubleshooting and resolving any network related problems. Perform root cause analysis of critical outage and incidents, engineer permanent solutions, and coordinate implementation. Responsible for all operations and maintenance of network systems and ensuring minimal network service interruptions. The network SME must be a Cisco Certified Internetwork Expert (CCIE) or equivalent certification skill level with a specialization in Routing and Switching.

(Task 4) File Services Platform Subject Matter Expert (CTERA). The Contractor shall provide a highly skilled SME to provide engineering and operational support for the CTERA file services platform. The SME will have specialized expertise and experience with the design, staging, configuration, implementation, security, and operational support of the CTERA platform in the DoD environment in accordance with the CTERA Military Unique Deployment Guide. The SME will work with Infrastructure Engineering to develop a highly comprehensive and robust CTERA platform network design, engineering, implementation, security, and operational plan. Design and implement CTERA architectures, servers, appliances, virtual machines (VMs), and software components including but not limited to CTERA Portal, Master and Replication DBs, Object Storage Nodes, Catalog Nodes, Application Servers, Gateways, and Agents. Develop and maintain CTERA documentation which will include but is not limited to SOPs and System Architecture Guides and Diagrams adhering to organizational templates, policies, and standards. The contractor will be responsible for and must have extensive experience with performing complex CTERA file share and object storage migrations successfully without incident, downtime, or loss of data.

Responsible for the operational support, troubleshooting, and resolution of any CTERA related problems. Perform root cause analysis of critical CTERA outages and incidents. The contractor will be responsible for all operations and maintenance of all CTERA products and ensuring minimal network service interruptions. The contract vendor and SME must have a minimum two years of proven experience and success with the engineering, implementation, security, monitoring, and operations of an enterprise CTERA platform deployment in the DoD environment.

(Task 5) Server and Application Migration Support. The contractor shall support and perform server or application migrations in the data center and cloud environments as required. Migrations may include but are not limited to on-going data center and cloud application deployment and integration projects, server and application upgrades, or residual migrations from previous data center and cloud projects. The contractor shall work with the application owner(s) to plan, analyze, and execute server and application migration projects as requested to include: on premise, commercial/government cloud migrations, virtual and physical servers, directory services, file shares, email, Voice over Internet Protocol (VoIP), Video Telecommunications (VTC), and applications with DR capabilities including mission essential applications such as DCATS and

CRIMS. Utilization of automated and manual discovery tools may be required along with conducting interviews with stakeholders and SMEs to gather the information needed to perform the migration activities. The contractor shall track and manage server and application migrations to ensure mission success while minimizing risk of business impact and downtime resulting from migration activities.

(Task 6) Data Center and Cloud Optimization and Automation. The contractor shall routinely perform technical assessments of the current operational OIG data center and cloud environments, networks, technologies, tools, and processes to identify improvement opportunities. The assessments shall be used by the contractor to recommend, plan, and implement solutions that will improve the OIG data center and cloud operations through optimization and automation.

Optimization of current operational OIG networks, systems, and applications is necessary to ensure optimal performance is maintained while keeping data center and cloud resource costs to a minimum. Automation of data center and cloud activities and processes is necessary to ensure efficient and effective data center and cloud operations by simplifying repeatable processes, reducing human error, and reducing cost. Optimization and automation activities include, but are not limited to process improvement, network performance and utilization monitoring, server right-sizing, server performance and utilization monitoring, implementation of automated discovery and monitoring tools, automation of data center and cloud capacity management and cost tracking, service request processes, service management ticketing processes, server and virtual resource cost calculators, and DR failover testing.

(Task 7) Server Virtualization. The contractor shall support OIG system virtualization and the installation, configuration, deployment, and securing the DoD OIG VMware environments located at DISA and the Mark Center. The contractor will engineer, design, deploy, and support VMWare technologies such vSphere, ESX/i, and vCenter and ensure all virtualized environments are performing properly. The contractor will assess the current OIG server infrastructure and virtualization environments and work closely with OCIO to develop and document consistent internal policies and processes for tracking server and server resources, capacity changes, and performance monitoring. This will include recommending and implementing changes, performance forecasting, capacity evaluations, and condition appraisals of the physical infrastructure and virtual environment.

Develop technical designs and implement best practices accordance with to DoD virtualization policies and security technical implementation guides (STIGs).

(Task 8) Enterprise Monitoring. The contractor will be responsible for the implementation and modifications of the enterprise monitoring tools in the OIG data center and cloud environments, as well as the design and strategy of the monitoring infrastructure as a whole. Enterprise monitoring requirements include the ability to monitor OIG data center and cloud networks, servers, applications, and systems utilizing monitoring tools such as PRTG and Microsoft SCOM.

Functional monitoring capabilities shall include data center and cloud network, server, and application performance monitoring, automated alerts, notifications, and ticketing, admin and executive level dashboards, and custom monitors as necessary. The contractor shall ensure all relevant data center and cloud infrastructure and services are properly covered within the monitoring and alerting systems and configured to collect the metrics at the right frequency and ensure the data is readily available for effective alerting, reporting, and analysis. The contractor shall collaborate with cross-functional teams to understand complex application architectures in order to implement an effective top-down monitoring strategy, work with multiple teams and stakeholders to determine best monitoring approach of systems and applications, and provide support and resolution for complex monitoring issues.

2.3 General Deliverables: (not separately priced)

2.3.1 Engineering Support Requirements Plan. The Contractor shall provide an Engineering Support Requirements Plan supporting the engineering services and technical resource requirements for tasks identified in this document. The Engineering Support Requirements Plan shall capture and document the required technical tasks of the project and the alignment of resources and expertise to specific tasks to ensure the correct resources and skillsets are available throughout the project. The plan will include the following additional information:

• Staffing Plan

• Points of Contact

• General Operating Procedures for:

− Problem/Issue Resolution − Task Methodologies − Quality Control

2.3.2 Data Center and Cloud Operational Assessment. The contractor shall provide a Data Center and Cloud Operational Assessment that will capture and identify current operational strengths, weaknesses, threats, and opportunities (SWOT) for improvement. The primary purpose of the assessment is to identify and prioritize engineering tasks to ensure the continual improvement of IT operations and ability to support the OIG mission. The assessment will provide recommendations and guidance on how improvements can be made either through the implementation of new technologies, processes, resources, documentation, or other. The assessment shall be updated as new issues or improvement opportunities are identified throughout the contract period of performance.

2.3.4 Monthly Status Report (MSR): The contractor shall provide a Monthly Status Report (MSR) that briefly summarizes, by task, the management and technical work conducted during the month, as indicated below.

• Effort/status of all activities/requirements by task

• Deliverables submitted for the period by task

• All standards followed in support of the requirements

• Problems or issues

• Staffing (Planned/On Board) per Task

2.4 Post Award Orientation Conference.

A post-award orientation conference (PAOC) will be conducted to aid both Government and contractor personnel to achieve a clear and mutual understanding of all contract requirements, and to identify and resolve potential problems. The PAOC meeting agenda will include the following:

• Introduction of Personnel

• Overview of project tasks

• Discussion of Data Requirements

• Security requirements/issues/facility access procedures

• Invoice procedures

• Points of contact

• Quality Surveillance Process

• Any additional issues of concern

3 Constraints.

3.1 Security Requirements: This is a DOD work effort involving access to SECRET information or material. The Contractor shall be an active participate of the National Industrial Security Program (NISP). Visit Request Letters (VRL) are applicable to these efforts whenever contract performance occurs on a Department of Defense installation or within a Department of Defense controlled facility or activity.

3.1.1 Facility Security Clearance: The Contractor shall possess an active facility clearance of SECRET from the Defense Counterintelligence Security Agency (DCSA) at the time of its proposal and maintain the clearance throughout the contract period. Subcontractor(s) facility clearance levels must be commensurate with the level of classified material to be accessed during the contract term. While DoD OIG will initiate a DD 254 to the prime Contractor, the Contractor will create DD 254s for subcontractor(s) and DoD OIG will review the DD 254s prior to awarding to the subcontractor(s). DoD OIG Office of Security (OSEC) will review all DD 254s.

3.1.2 Personnel Security: This DOD work effort involves classified and unclassified material.

Personnel shall adhere to the Privacy Act, Title 5 of the U.S. code, Section 552a and applicable agency rules and regulations.

3.1.2.1 The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in this contract. Contractor personnel must possess at a minimum an interim Secret or final security clearance and interim or final IT-level eligibility when performance of contract starts. Only U.S. citizens may be assigned to these engagements. Therefore, Contractor personnel who currently hold dual citizenships and/or active foreign passports must report possession of a foreign passport to their Company security office and Facility Security Officer (FSO). Contractor personnel must report any use of a foreign passport to enter or exit the United States to the FSO. The FSO shall follow guidelines as set forth within the SECURITY EXECUTIVE AGENT DIRECTIVE 4 (SEAD 4).

(https://news.clearancejobs.com/2017/05/23/new-security-clearance-criteria-released-sead-4/)

3.1.2.2 Mandatory Training. All selected contractor personnel are required to complete the following mandatory annual trainings in order to comply with the DoD OIG contractor security policy: Cyber Awareness Challenge, Personally Identifiable Information, Anti-Terrorism Level 1, DoD Security Awareness, Preventing Violence in the Workplace and Counter Intelligence Reporting and Awareness training, Insider Threat Awareness, OPSEC Training, Unauthorized Disclosure of Classified Information, Introduction to Information Security, and Controlled Unclassified Information. The annual mandatory training in addition to other policies and procedures for the DoD OIG and Mark Center will be discussed during the mandatory face-to- face in-briefing, as well as the execution of the Classified Information Nondisclosure Agreement, SF 312.

3.1.2.3 Visit Authorization: The Contractor and/or subcontractor(s) are responsible for submitting a visit authorization letter via the Defense Information System for Security (DISS) to the DoD OIG OSEC after personnel have been approved to perform on the contract. The DoD SMO Code will be provided to the Company Facility Security Officer (FSO) upon request. The Contractor shall also prepare and submit site visit letters no less than fifteen (15) business days prior to the start date.

3.1.2.4 Building Access: All Common Access Cards (CAC) issued to contractor personnel are government property and must be returned either upon departure from the program or at the conclusion of the contract (whichever comes first) to:

Department of Defense Office of Inspector General ATTN: Industrial Security Program Manager 4800 Mark Center Drive, Suite 09B24 Alexandria, VA 22350-1500

Contractors whose CAC is lost or stolen must present documentation with immediate supervisor’s signature, to OSEC or CAC sponsor identifying that the CAC is missing and describing the circumstances under which the loss occurred. OSEC or CAC sponsor will provide an official memorandum for the badge office in order to receive a new CAC. The CAC contains personally identifiable information and must be treated as a controlled item.

The Contractor's staff must not share their CAC and passwords with any other staff member. The CAC must either be tucked away or removed when leaving a government facility. The COR will report any violation or suspected violation to the Contracting Officer and OSEC. Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from a previous engagement with another agency that CAC must be returned to that agency before issuance of a DoD OIG sponsored CAC.

3.1.2.5 Disclosure of Information: The contractor shall not release to anyone any unclassified information. Contractor personnel shall not divulge or release privacy data or information developed or obtained in the performance of this task order, until made public or specifically authorized by the Government. The Contractor shall not use, disclose, or reproduce third party companies’ propriety data, other than as authorized and required in performance of this task order. Personnel working on this project will be required to sign a non-disclosure agreement immediately upon their start on the project.

The Contractor’s procedures for protecting against unauthorized disclosure of information shall not require Department of Defense employees or members of the Armed Forces to relinquish control of their work product, whether classified or not, to the Contractor.

4 Government-Furnished Resources.

4.1 Contractor personnel performing duties will be provided Government furnished resources, to include workstations, printers and copy machines. In accordance with DoD policy, personally owned workstations, laptop computers, software, and printers, including computers connected via VPN, will not be connected to the Enterprise Network or allowed in the contractor workspace. This prohibition is a security requirement to protect the DoD OIG from the spread of malicious logic (viruses and Trojan horse programs) and to protect controlled, unclassified information (CUI) from being compromised.

4.2 The contractor shall acknowledge receipt of all furnished resources and manage a master list showing the disposition, version, and status of the items held. The contractor shall notify the COR of any discrepancies, concerns, or risks they identify related to the receipt, disposition, version, and status of the items held.

4.3 Government furnished Information (GFI) will be provided to the contractors. The contractor will have access to any technical information and databases deemed appropriate to facilitate their performance requirements. Contract personnel are required to follow DoD OIG Office of the Chief Information Officer defined processes, procedures, and practices.

4.4 Government furnished material (GFM) (e.g., office supplies) will be provided to contractor Personnel.

4.5 The contractor will coordinate and provide notifications for facilities maintenance and incidents with the COR.

4.6 Specific Government Furnished Items and Services include the following:

4.6.1 Services: The government will provide the contractor with Internet and Phone Connectivity while working in government furnished facilities.

4.6.2 Facilities: The government will provide the contractor sufficient workspaces within the following government furnished facilities.

4.6.3 Utilities: The government will provide the contractor all required utilities while working from government furnished facilities.

5 Contract Deliverables.

All deliverables associated with this contract shall be provided in Microsoft Office compatible electronic format, as well as any hard copy documents not included in the electronic files. All deliverables are subject to final COR approval. Unless otherwise indicated in this PWS, the COR will approve all deliverables within twenty (30) business days after submission by the Contractor, or provide comments showing additional information required. Unless otherwise indicated in this PWS, the Contractor shall resubmit the revised deliverable to the COR within ten (10) business days after receiving comments from the COR.

Electronic copies shall be delivered via e-mail attachment. The Contractor shall label each electronic delivery with the Contract Number and Project Title in the subject line of the e-mail transmittal.

All other deliverables are to be provided based on the agreed upon schedule under each objective/task.

TECHNICAL EXHIBIT 1

DELIVERABLES SCHEDULE

Milestone/ Deliverable Format

Number Copies

PWS

Reference

Planned Frequency

Engineering Support Requirements Plan

Electronic MS Word

2 Copies to

COR

2.2 TASK

1-8, PWS

2.3.1 Within 30 days After Kick

Off Meeting

Data Center and Cloud Operational

Assessment

Electronic MS Word

2 copies to

COR

2.2 Task

5, PWS

2.3.2 Within 90 days After Kick

Off Meeting

Monthly Status Report (MSR):

ELECTRONIC

MS WORD

2 copies to

COR

PWS 2.3.4

BY THE 5TH OF THE

MONTH FOR THE PRIOR

MONTH’S ACTIVITY.

6. Acronyms and Definitions. Alphabetical list of definitions of key words used or acronyms.

AQL Acceptable Quality Level CAC Common Access Card CIO Chief Information Officer CMDB Configuration Management Database COOP Continuity of Operations Plan CO or KO Contracting Officer COR Contracting Officer's Representative CRIMS Criminal Reporting Investigation Management System CUI Controlled Unclassified Information DCATS Defense Case Activity Tracking System DCIM Data Center Infrastructure Management DCSA Defense Counterintelligence and Security Agency DECC Defense Enterprise Computing Center DISA Defense Information Systems Agency (US DoD) DISS Defense Information System for Security DoD Department of Defense DOD OIG Department of Defense Office of the Inspector General DODIG Department of Defense Inspector General FSO Facility Security Officer GFI Government Furnished Information GFM Government Furnished Material IPAM IP Asset Management IPR In-Progress Review ITAM IT Asset Management MSR Monthly Status Report NIPR Net Non-Secure Internet Protocol Router Internet OSEC Office of Security PAOC Post Award Orientation Conference PWS Performance Work Statement QASP Quality Assurance Surveillance Plan SIPR Net Secure Internet Protocol Router Internet SME Subject Matter Expert VOIP Voice over Internet Provider VRL Visit Request Letters VTC Video Teleconferencing

7. Performance Requirement Summary (PRS).

7.1 PRS Table

Performance

Objective Performance Standard AQL Inspection Method

Engineering Support.

PWS 2.2

Task 1

PS1) Engineering Support Requirements Plan completed IAW OIG policies and procedures as required by the contract.

PS2) Deliverables will be provided IAW task requirements

(AQL 1) - Meet 100% of established project milestones.

(AQL 2) - 100 % of tasks will be completed by the required completion date and 10% of deliverables will be rejected no more than once.

Periodic Surveillance through observation, monthly Status Reports and Customer Satisfaction Reports

Network Subject Matter Expert (CCIE Level).

PWS 2.2

Task 2

PS1) Effort meets project milestones as applicable.

PS2) The Contractor shall provide uninterrupted service from a Network SME specialized in Routing & Switching.

milestones.

(AQL 2) - Acceptable deviation when the loss of resource is out of the control of contractor.

Other Contractor turnover does not result in a unfilled/vacant position for more than 1 workweek during each contract year.

monthly Status Reports and Customer Satisfaction Reports

Server and Application Migration Support.

Task 3 milestones.

Periodic Surveillance through observation and monthly Status Reports

Data Center Optimization and Automation.

Task 4

PS1) Data Center Operational Assessment completed IAW OIG policies and procedures as required by the contract.

PS2) Deliverables will be provided IAW task requirements.

milestones.

(AQL 2) - 100 % of tasks will be completed by the required completion date and 10% of deliverables will be rejected no more than once.

monthly Status Reports and Customer Satisfaction Reports

Configuration and Asset Management.

Task 5 milestones.

Periodic Surveillance through observation and monthly Status Reports

Server Virtualization.

Task 6 milestones.

through observation and monthly Status Reports

Enterprise Monitoring.

Task 7

(AQL 1) - Meet 100% of milestones.

through observation and monthly Status Reports

7.2 Quality Assurance Surveillance Plan (QASP)

The Government will utilize a QASP to monitor the contractor’s performance on the contract. The QASP is a living document and can change at any time during the life of the contract. As such, the Government reserves the right to unilaterally edit the QASP at the Government’s discretion.