RFI Atch 5 - PRS Table_DRAFT.pdf

Performance Requirements Summary (PRS) Table

Performance Objective

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

Performance Obj #1 Provide an on-demand intermediate, digital, secure storage for test evidence and files from applications in the Lab (or in cloud) so testers can upload to test tool at later date

PWS

3.2

PRS# 1

Availability: 24x7x365

Incident Response: Work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, 30 minutes for Priority 1 incidents

Imaging, Security Updates, and Patching: 24hrs of client approval for critical, 72hrs for important, 30 days for moderate, 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

Restoration: Restore functionality of systems within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for priority 3 incidents, 4hrs for priority 1 incidents

• Availability: 99.9% of time

• Incident Response:

90% of the time for Priority 4 incidents;

90% of the time for Priority 3 incidents;

95% of the time for Priority 2 incidents;

95% of the time for Priority 1 incidents

• Imaging, Security Updates, and Patching:

99% of the time for critical, 99% of time for important, 95% of the time for moderate, low priority updates

Restoration: 90% of the time for Priority 4 incidents; 90% of the time for Priority 3 incidents; 95% of the time for Priority 2 incidents; 95% of the time for Priority 1 incidents

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates.

Performance Obj. #2 Provide network capability to allow users to connect to .com and .mil in the METIC and DDC and connect to Wi-Fi in

METIC

PWS

3.2

PRS #2

Availability: 24x7x365

Incident Response: Work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, 30 minutes for Priority 1 incidents

• Restoration: Restore functionality of systems within 10 business days

Priority 4 incidents;

90% of the time for Priority 3 incidents;

95% of the time for Priority 2 incidents;

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for priority 3 incidents, 4hrs for priority 1 incidents

• Restoration: 90% of the time for Priority 4 incidents; 90% of the time for Priority 3 incidents; 95% of the time for Priority 2 incidents; 95% of the time for Priority 1 incidents

Performance Obj. #3 Allow users easy and timely remote access to servers, storage, and networking resources through a Wide Area Network (WAN) or similar communication structure

PWS

3.3

PRS #3

Availability: 24x7x365

Incident Response: Work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, 30 minutes for Priority 1 incidents

• Time to provision: <=1 day

Priority 4 incidents;

90% of the time for Priority 3 incidents;

95% of the time for Priority 2 incidents;

• Time to provision:

95% of the time monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

Performance Obj. #4 Develop a “platform management suite” with standardized suite of tools (tools are standardized via governance process) to provide an avenue to product managed services

PWS

3.6

PRS #4

Availability: 24x7x365

Incident Response: Work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, 30 minutes for Priority 1 incidents

Restoration: Restore functionality of systems within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for priority 3 incidents, 4hrs for priority 1 incidents

AQL performance is achieved when:

• Availability: 100% of the time

Priority 4 incidents;

90% of the time for Priority 3 incidents;

95% of the time for Priority 2 incidents;

• Restoration: 90% of the time for Priority 4 incidents; 90% of the time for Priority 3 incidents; 95% of the time for Priority 2 incidents; 95% of the

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance time for Priority 1 incidents

Performance Obj. #5 Maintain the ATO for TI.mil pre-prod environments and the site accreditation for the METIC & DDC data centers

3.2

PRS #5

• ATO Compliance:

Maintain TI.mil, METIC, & DDC compliance with annual ATO re-certifications

• ATO compliance is achieved 100% of the time

Periodic Surveillance:

Compare required reports submitted against reports required for ATO re-certification

Performance Obj. #6 Develop, update, store, and maintain architecture documentation that describes the various “as a service” topology and services

3.1

PRS #6

Architecture Diagrams:

Updates completed within 30 days of changes implemented

• Architecture Updates:

Documentation updated monthly

• Architecture Updates achieved 90% of the monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates.

Performance Obj. #7 Manage chip/devices catalog, remote management, and monitoring/alerting tools

PRS #7

Catalog Accuracy: Catalog is accurate

• Catalog Updates: Orders for changes to catalogue received by noon should be updated same day

• Catalog Accuracy:

100% of the time

• Catalog Updates:

Performance Obj. #8 Partner with the PEO DHMS CM team to review and manage Change Requests submitted to the PEO

CCB

3.9

PRS #8

Change Request (CR) Process Time: CRs processed within 10 days of request

• Change Request Report:

CR process report provided every month

• CR Process Time:

90% of the time

• CR Report: 90% of the monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates.

Performance Obj. #9 Support DHA imaging, security updates, and patching on the infrastructure and laptops in METIC, DDC data centers, and in cloud

3.5

PRS #9

DHA Image Installation:

Laptops and Infrastructure in METIC, DDC, Cloud will have DHA image installed and maintained within 3 business days of receipt

• DHA Image Installation: 90% of the time

• Imaging, Security Updates, and Patching:

99% of the time for critical, 99% of the time for important, 95% of the time for

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

• Imaging, Security Updates, and Patching:

Installation of updated image, security updates, and patching will be within 24hrs of client approval for critical, 72hrs for important, 30 days for moderate, 60 days for low priority updates on laptops and infrastructure in METIC, DDC, and Cloud moderate, and 95% of the time for low priority updates

Performance Obj. #10 Provide support for specialized projects, including facilitating POCs for new tools/technologies.

Specialized projects include:

• Tech Refresh -replacement of hardware devices (laptops, medical devices)

• Major OS upgrades (desktops and servers)

PRS #10

DHA Image Installation:

Laptops and infrastructure in data centers and cloud environments will have DHA image installed and maintained within 3 business days of receipt

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

• Time to provision:

Within agreed target time

• DHA Image Installation: 90% of performance standard achieved 99% of the time for critical, 99% of the time for critical, 95% of the time for moderate, and 95% of the time for low priority updates

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

Performance Obj. #11 Verify, manage, and track physical security for designated data centers

3.3

PRS #11

• Facility Response: 5 minutes to respond to security issues and alarms in the facility

• Facility Response:

Vendor provides physical access logs, physical surveillance video, and documented issues as requested;

COR reviews and validates

Performance Obj. #12 PWS 3.5

PRS #12 • Effective License Position Reporting:

Random Sampling

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

Maintain and track desktop licensing for VDIs

• Effective License Position Reporting:

100% accurate

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging including calculations and supporting data; COR reviews and validates.

Performance Obj. #13 Provide a seamless self-service mechanism for scheduling events in the METIC and document/distribute SOP for stakeholders on the process

PRS #13

Event Request: schedule and deliver events in METIC and DDC within 48 hours of request (including weekend support)

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1 hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8 hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents

• Event Request: 90% of

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #14 Conduct Cyber Security Asset Scans

PWS

3.10;

3.1.8

PRS #14

• Frequency: Conduct

Cybersecurity Asset Scans XX per month

• Frequency: 95% of the

TBD

Performance Obj. #15 Maintain property book to track and receive all hardware and software

PWS

3.2

PRS #15

• Inventory Accuracy:

Inventory records should reflect actual stock

• Inventory Accuracy:

98% of the time

Manual spot check of physical inventory

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance assets in the METIC and the DDC monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and reviews and validates

Performance Obj. #16 Develop, manage, and support “serverless computing” by providing scalable containers to allow developers to rapidly deploy applications

Develop, manage, and support “serverless computing” by providing scalable containers to allow developers to rapidly deploy applications

PWS

3.8

PRS #16

Implementation Time:

implementation provision time within 5 hours for a low priority request, 3 hours for a medium priority request, and 1 hour for a high priority request

• Availability: 24x7x365 days a year

• Implementation Time:

monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #17 Support and manage requirement analysis for pre-production environments to host Kubernetes Platform for container services

PWS

3.8

PRS #17

Kubernetes Request Requirement Analysis:

completed <= 5 business days from request

• Kubernetes Request Requirement Analysis:

monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #18 Provide operational support and optimize DoD Network enclaves' (e.g., Med-COI, NIPERNET) network connection for Garrison and .mil for DHMS program capabilities such as OpMed

PRS #18

Implementation Time:

implement and/or optimize network connection within 12 weeks for low priority requests, 8 weeks for medium priority requests, and 4 weeks for high priority requests

Latency: < 100ms during the first year of contract performance, < 90ms during

• Implementation: 95% of the time

• Latency: 95% of the

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance the second year of contract performance, < 80ms thereafter

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1

Performance Obj. #19 Provide access to secret network/vault for DHMS and DoD health programs conducting high side testing using SIPRNET in secure facilities

PRS #19

Implementation Time:

implement and/or optimize network connection within 12 weeks for low priority requests, 8 weeks for medium priority requests, and 4 weeks for high priority requests

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for

• Implementation: 95%

• Network Availability:

99.9% of the time

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incident

• Restoration: 90% of the time for Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Performance Obj. #20 Provide an on-demand dashboard and/or reporting capability for software and hardware assets in on-prem and cloud

PRS #20

Inventory Accuracy:

inventory records should reflect actual stock for hardware

Effective License Position:

100% accurate

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1 hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business

98% of the time

• Effective License Position: 100% of the

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance days for Priority 3 incidents, 8 hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents

Performance Obj. #21 Provide automated capability to receive, track, and inventory equipment, devices, and test assets in the METIC and DDC

PRS #21

Inventory Accuracy:

inventory records should reflect actual stock with an accuracy of >=98%

Tracking Updates: updates to the tracking system should be reflected within 30 minutes of any status change

Availability: M-F, 0700-

1900 EST

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents

• Tracking Updates:

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Random Sampling:

Manual spot check of physical inventory

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #22 Conduct gap analysis to determine how to implement access to secret network/vault for DHMS and DoD health programs conducting

PWS

3.9

PRS #22

Implementation Time:

implement and/or optimize network connection within 12 weeks for low priority requests, 8 weeks for

• Implementation Time:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance high side testing using

SIPRNET

medium priority requests, and 4 weeks for high priority requests

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents

• Network Availability:

99.9% of the time

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #23 Provide .mil, .com, and Med-COI network access and connectivity to test enclaves and external connections

3.4

PRS Table #23 Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1 hr for Priority 2 incidents, and 30 minutes

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, Provide .mil, .com, and Med-COI network access and connectivity to test enclaves and external connections

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incident

• Imaging, Security Updates, and Patching:

performance standard achieved 99% of the time for critical, 99% of the time for critical, 95% of the time for moderate, and 95% of incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Performance Obj. #24 Develop and provide a centralized platform (via PaaS) to enable standardized DevSecOps framework, standardized processes, associated standardized tooling, and templatized CI/CD pipelines to automate development and testing in the cloud

PWS

3.6

PRS #24

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days

AQL performance is achieved when:

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, incidents, 90% of the time for Priority 3 incidents, 95% of the

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Performance Obj. #25 Develop and enable a self-service provisioning portal (via IaC) with standardized infrastructure offerings (i.e., servers, storage, and network resources) accessible via service catalog

PWS

3.4

PRS #25

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents

• Time to Provision: <1 day

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents,

• Imagine, Security

99% of the time for critical, 99% of the time for critical, 95% of the time for moderate, and 95% of incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

Performance Obj. #26 Provide a hybrid model for IaaS services by leveraging on-prem “private cloud” and “public cloud” services via automation (IaC)

3.4

PRS #26

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, 99% of the time for critical, 99% of the time for critical, 95% of the time for moderate, and 95% of incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

Performance Obj. #27 Monitor physical security of infrastructure in data center 24x7x365 in real-time using a building management system

PRS #27

• Log Access: Provide physical access logs and physical surveillance video within 1 week of request

• Log Access: 100% of the time

Random Sampling:

Vendor provides physical access logs and physical surveillance video upon request; COR reviews and validates

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

Performance Obj. #28 Provide locker for storage of securable supplies (iPhones, CACs, iPads, etc.) in the Labs

PRS #28

Locker Space: Locker space is available

• Storage Compliance:

locker space is compliant with access control restrictions of the facility

• Locker Space: 100%

• Storage Compliance:

Physcial inspection

Performance Obj. #29 Provide capability to remotely connect Virtual Desktop Infrastructure (VDI) to DHA network within the Lab to remove the need for AVHE and reduce latency

PRS #29

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, 99% of the time for critical, 99% of the time for important, 95% of the time for moderate, and 95% of incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

4 hours for Priority 1 incidents

Performance Obj. #30 Provide remote Virtual Desktop Infrastructure (VDI) for PMOs to test applications within the METIC (inlcuding FFGAL), connected to DoD network enclaves (e.g., MED-COI, NIPRNET, SIPRNET)

PRS #30

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incident

• Availability: 100% of

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, 99% of the time for critical, 99% of the time for important, 95% of the time for moderate, and 95% of the time for low priority updates

• Restoration: 90% of the time for Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #31 Provide and maintain network access to VDI, AVHE, NIPRNET, MedCOI, and external partner connections as

PWS

3.5

PRS #31

Latency: < 100ms

Availability: 24x7x365 days a year

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

PMOs would need B2B for partner test environments

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incident

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, 99% of the time for critical, 99% of the time for important, 95% of the time for moderate, and 95% of incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

Performance Obj. #32 Host, support, and provide ease of use automated managed software for any/all tools/technologies through an automated self-service portal

PWS

3.9

PRS #32

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents

• Time to Provision: <5 days

Priority 2 incidents, 99% of the time for critical, 99% of the time for important, 95% of the time for moderate, and 95% of incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #33 Perform ongoing optimization, improvement, upgrades, administration, and operation of networks and systems to support DCaaS, CaaS, DaaS, IaaS (e.g., VMWare resource pools, storage), PaaS, and SaaS capabilities

PRS #33

Latency: < 100ms during the first year of contract performance, < 90ms during the second year of contract performance, < 80ms thereafter

Availability: M-F, 0700-

1900 EST

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance incidents, and 30 minutes for Priority 1 incidents

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incident

99% of the time for critical, 99% of the time for important, 95% of the time for moderate, and 95% of incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Performance Obj. #34 Provide fully managed tools (standardized, packaged, license controlled, and automated tools) to allow stakeholders to conduct development, integration, testing, and other automated tasks

PRS #34

Latency: < 100ms during the first year of contract performance, < 90ms during the second year of contract performance, < 80ms thereafter

Availability: M-F, 0700-

1900 EST

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, 99% of the time for critical, 99% of the

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

Imaging, Security Updates, and Patching: Installation of updated image, security updates, and patching will be within 24 hours of client approval for critical, 72hrs for important, 30 days for moderate, and 60 days for low priority updates on laptops and infrastructure in data centers and cloud environments

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents time for important, 95% of the time for moderate, and 95% of incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Performance Obj. #35 Develop industry standard set of tools/technologies at the core of PaaS offering for version control, issue tracking, security tracking, and centralized log analysis

PRS #35

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents,

• Restoration:

performance standard achieved 90% of the time for Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents time for Priority 2 incidents, and 95% of the time for Priority 1 incidents

Performance Obj. #36 Enable self-service portal for DHMS customers to access and utilize SaaS Offerings via automated service catalog products (incl. any plug-ins)

3.7

PRS #36

Latency: < 100ms

Availability: 24x7x365 days a year

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2 incidents, and 30 minutes for Priority 1 incidents

Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents

Time to provision: within agreed target time

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, and 95% of

Random Sampling:

Monitor time it takes for a transaction to make a round trip from the DHMS network boundary to the vendor provided system and back to the DHMS network boundary

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #37 Provide METIC availability, including testing infrastructure facility space, equipment floor space, and office floor space, from 0700 - 1900 M-F EST in the District of Columbia, Maryland, and Virginia region with options to schedule overtime and for weekend and surge

PWS

Section

PRS #37

Operating Times: Data Center open 0700 - 1900, M-F EST, with weekend support provided on an ad hoc basis

• Operating Times: 95% of the time

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance support as required.

Includes what is currently hosted as well as the capability to be expanded for additional requirements. This includes infrastructure, physical medical devices, peripherals (printers, laptops, storage areas), and facilities provisioned for consumption as well as

METIC.

*This is under the assumption that the DDC will operate 24x7x365 with remote capability to METIC

Performance Obj. #38 Support data center facilities, including installation and maintenance of UPS power, cooling, and rack services, as required and approved

PWS

3.3

PRS #38

• Response Time: Respond within 24 hours of request

• 95% of the time Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #39 Provide data migration services for data hosted in various tools and infrastructure in METIC, DDC, TI.com, TI.mil, & cloud to the enterprise shared services tools (i.e., SDLC tool data)

PWS

3.9

PRS #39

Migration Time: Within agreed target time

• Migration Time: 95% monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates.

Performance Obj. #40 Develop and manage “utilization reports” for the below metrics:

1. % of available Compute utilized

2. % of available Memory utilized

3. % of available Storage utilized

4. % of available Network utilized

5. # active user accounts

PWS

3.1

PRS #40

• Reporting: provide monthly reports within 10 business days of the end of the month

• Reporting: 100% of the time

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance

6. # of METIC visit requests

7. METIC space utilization

8. # of licenses utilized for all software tools/technologies

9. # of software and hardware assets procured/provisioned

10. Cost usage reports in cloud

11. # of containers provisioned Performance Obj. #41 Establish security policies and procedures in accordance with DoD

RMF

PWS

3.10;

3.1.8

PRS #41

• RMF Documentation

Complete: submit documentation which meets DoD RMF requirements within 6 months of contract start;

update policies & procedures annually thereafter

• RMF Documentation Complete: 100% of

Compare DoD RMF requirements versus vendor developed security policies and procedures

Performance Obj. #42 Perform NIST RMF-based Cybersecurity activities on the TI and provide centralized cyber compliance reports at certain frequency, in compliance with SOC 2 Type 1 and Type 2 requirements

3.10;

3.1.8

PWS #42

RMF Compliance:

compliance with DoD RMF reporting requirements, or waiver granted

• SOC 2 Compliance: pass

3rd party audit

• RMF Compliance:

• SOC 2 Compliance:

Compare required reports submitted against reports required on a monthly and an annual basis

Performance Obj. #43 Provide conference rooms, audio-visual support, and office space for usage by PEO staff for engineering, test, and demonstration activities

PWS

3.2

PRS #43

Space Availability:

conference room/office space available during business hours

Internet: reliable high-speed internet access available

• Tech Support: technical support will be available within 15 minutes of request

• Space Availability:

99% of the time

• Internet: 99% of the

• Tech Support: 90% of

Physical inspection

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #44 Provide physical storage space for assets that are not in

PWS

3.2

PRS #44

Storage Space: storage space is available

• Storage Space: 100%

Physical inspection

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance static configuration in the Lab, including spares or equipment as it waits for DRMO

• Space Compliance:

storage space compliant with access control restrictions of the facility

• Space Compliance:

100% of the time

Performance Obj. #45 Provide IT and hardware configuration support for setting up and connecting equipment to the network in the Lab when needed

PWS

3.4

PRS #45

• Support Request:

respond within 2 hours of request

• Support Request: 95% of the time

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates

Performance Obj. #46 Provide Tier 1–4 Service Desk support for PEO DHMS customers

PWS

3.10;

3.10.9

PRS #46

T1 and T2 Availability:

24x7x365

• T3 and T4 Availability:

M-F, 0700-1900 EST

• T1 and T2: 95% of the

• T3 and T4: 95% of the monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and supporting data; COR reviews and validates.

Performance Obj. #47 Provide on-demand ability to ship equipment to/from the METIC Lab to external agencies supporting development or test activities via self-service ticketing process

PRS #47

Tracking Updates: Updates to the tracking system should be reflected within 30 minutes of any status change

Shipping Time: Items shipped within the continental United States must arrive within 7 business days of ticket request

Availability: M-F, 0700-

1900 EST

Incident Response: incident is routed to a supplier's queue and work begins within 5 business days for Priority 4 incidents, 1 business day for Priority 3 incidents, 1hr for Priority 2

• Tracking Updates:

• Shipping Time: 95%

Priority 4 incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2 incidents, incidents, 90% of the time for Priority 3 incidents, 95% of the time for Priority 2

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

PWS

Ref.

Performance Standards - Performance Requirements Summary

(PRS)

Acceptable Quality Level (AQL)

Method of Surveillance incidents, and 30 minutes for Priority 1 incidents

• Restoration: restore the functionality of systems, through addressing the root cause or implementing a workaround within 10 business days for Priority 4 incidents, 3 business days for Priority 3 incidents, 8hrs for Priority 2 incidents, and 4 hours for Priority 1 incidents incidents, and 95% of the time for Priority 1 incidents

Performance Obj. #48 Support PEO DHMS with research, identification, and procurement of SaaS candidates / tools

PWS

3.7

PRS #48

• Time to Provision:

Within agreed target time

• Time to Provision:

95% of the time

Random Sampling:

Vendor self-reports monthly metrics into centralized reporting dashboard by leveraging DHMS ITSM tool including calculations and

(The following listing provides various types of Surveillance as examples to select from and should not be included on the final document.

Random Sampling: Appropriate for frequently recurring tasks. Evaluate randomly selected samples of the lot to determine the acceptability of the entire lot.

Random Inspection Guide, Method of surveillance, Lot size, Sample size, Performance requirement, Sampling procedure, Inspection procedure.

100 Percent Inspection: Appropriate for tasks that occur infrequently. Inspect and evaluate performance each time task is performed.

Periodic Surveillance: Evaluation of samples selected on…