DRAFT SOW 9.12.2024.pdf

SECTION II - Statement of Requirements

Cybersecurity and Infrastructure Security Agency (CISA) National Risk Management Center (NRMC)

Telegeography Data Sets September 12, 2024

PURPOSE. To support agency-wide and interagency efforts to protect and conduct risk assessments of critical communications infrastructure.

SCOPE. CISA analysts will utilize the Transport Network Research Service and Data Center Database at CISA Headquarters, within the divisions, and at a regional level for a variety of different use cases. These may include, but are not limited to:

• Regional Characterizations to assess steady-state inventory of infrastructure in a study area

• Critical Infrastructure/Key Resource (CI/KR) Analyses to determine infrastructure that support key government, emergency response, or public events.

• Infrastructure of Concern (IOC) Lists that inform leadership decisions on protective measures to take and sites to monitor before a known risk, such as a hurricane.

• Risk Assessments that determine vulnerability measurements from known or unexpected threats

• Regional Resiliency Assessment Program (RRAP) support to identify a range of security and resilience issues that could have regionally or nationally significant consequences.

• Key Site Analyses that conduct in-depth assessments and dependency studies of a specific infrastructure facility

• Data to support Policy Decision-Making at the conglomerate or summary and trending level of data

Database Access:

• Transport Network Research Service o Provides data and analysis for long-haul networks and the undersea cable market. Including supply and demand, country profiles, carriers, pricing analysis and much more.

o Includes:

Detailed network and carrier profiles, spanning more than 400 carriers and 480 Subsea Cables Bandwidth supply and demand analysis by region and by route Key data and analysis on major content providers, including metrics on their international bandwidth growth.

Comprehensive wholesale bandwidth pricing trends Planned Subsea cables.

Cable ownership

• Data Center Database o A comprehensive online guide to global data center capacity, service providers, and pricing trends and sites around the world.

o Includes:

Interactive map depicting over 5,500 active data centers.

A treasure trove of search tools to help you pinpoint sites that meet your specific parameters. Filter by location, operator, networks connected, and IX.

Colocation pricing workbook, which includes 28 major metro areas and converts prices from local currencies into USD

Data Center site profiles, including operator contact details, megawatt capacity, floor space, and vital details about the site ecosystem

Analysis of global data center market trends compiled from 1,500 site surveys

PERIOD OF PERFORMANCE.

Base Year: September 21, 2024 – September 20, 2025 Option Year 1: September 21, 2025 – September 20, 2026 Option Year 2: September 21, 2026 – September 20, 2027

PLACE OF PERFORMANCE. Non-applicable

BACKGROUND The NRMC within CISA brings together government and industry to collaborate to reduce cyber and other systemic risks to national and economic security. The NRMC is a planning, analysis, and collaboration center. The NRMC analysis helps CISA prioritize its operational activities and maximize operational effectiveness through more efficient use of resources to support DHS leadership, operational components, and field personnel during crises, emerging threats, or incidents impacting the Nation’s infrastructure.

The NRMC leads the CISA effort for several large efforts to assess and protect infrastructure, to include communications infrastructure throughout the United States, its territories, and its interests throughout the world, to include Undersea Cable Infrastructure (UCI). The data made available through this agreement will enhance, inform, and support these efforts through detailed, asset-level accounting of communications infrastructure. The data will be used for detailed-level analysis as well as summarized for higher-level policy decision making purposes.

It will also be merged and incorporated into other products for comprehensive analysis products.

CISA regional offices, Geospatial Analysts, Regional Liaisons, Protective Security Advisors (PSAs) will also make use of the data for more detailed looks into facilities and assets than are currently possible. The data will allow for a more distributed workforce to share, access, and collaborate on infrastructure protection assessments more efficiently than in the past.

PERFORMANCE OBJECTIVES. The following measures will be considered to determine the usefulness of the data sets to CISA:

Access – The data and website(s) used to access the data should be available 24/7 and the website should be user-friendly and responsive.

Completeness – The data should be as complete and comprehensive as possible. When gaps are found, Telegeography should be responsive to feedback and work with CISA to ensure that findings are incorporated into future updates. Telegeography should inform of any incremental updates to the data and changes to the data schema.

Accuracy – Location and attribute data should be accurate so as not to cause misidentification of a facility. When gaps are found, Telegeography should be responsive to feedback and work with CISA to ensure that findings are incorporated into future updates.

Compatibility – Data should be easily accessible, in formats to be incorporated into analysis tools and products. This should include proper formatting, data types, and formats. Data should be exportable into compatible file formats.

OPERATING CONSTRAINTS.

No operating constraints. Telegeography Workstation is available through web and desktop application.

REFERENCES:

DHS Management Directive 140-01, “Information Technology System Security Program, Sensitive Systems”

1.DHS 4300A Policy Directive (Version 13.3, February 13, 2023).

. DHS National Security Systems Policy Directive 4300B, Version 10.1, November 21, 2018, for NSS Collateral (Unclassified, Secret or Top Secret Collateral).

. DHS Sensitive Compartmented Information (SCI) Systems 4300C Instruction Manual, Version 2.1, March 24, 2017, for TS SCI/C-LAN.

1. DHS and CISA ENTERPRISE ARCHITECTURE COMPLIANCE

All solutions and services shall meet DHS and CISA Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security Enterprise (HLS) Architecture (EA) requirements:

• All developed solutions and requirements shall be compliant with the HLS EA.

• All IT hardware and software shall be compliant with the HLS EA Technical

Reference Model (TRM) Standards and Products Profile.

• Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the CISA Chief Data Officer for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

• Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01 and CISA’s Enterprise Data Management Program Policy and all data-related artifacts will be developed and validated according to DHS and CISA data management architectural guidelines.

• Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components

(networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB

Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

2. DHS GEOSPATIAL INFORMATION SYSTEM TERMS AND CONDITIONS

All implementations including geospatial data, information, and services shall comply with the policies and requirements set forth in the DHS Geospatial Information Infrastructure (GII), including (but not limited to) the following:

- All data built to the GII, whether adopted or developed, shall be submitted to the government for review and insertion into the DHS Data Reference Model.

- All software built to the GII, whether adopted or developed, shall be submitted to the government for review and insertion into the DHS Technical Reference Model.

3. EPEAT AND ENERGY STAR LANGUAGE

“All hardware procured directly or in support of this action must meet applicable and appropriate Electronic Product Environmental Assessment Tool (EPEAT) and ENERGY Star standards.”

4. DHS CYBER-SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) TERMS & CONDITIONS

a. Definitions

i. End-of-Life (EOL): means that an ICT product has reached the final stage of the product life cycle in which that version of the ICT product will no longer be supported nor manufactured (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

ii. End-of-Support (EOS): means that an ICT product will no longer be supported (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

iii. information and communications technology (ICT): encompasses the capture, storage, retrieval, processing, display, representation, presentation, organization, management, security, transfer, and interchange of data and information; includes all categories of ubiquitous technology used for the gathering, storing, transmitting, retrieving, or processing of information (e.g., microelectronics, printed circuit boards, computing systems, software, signal processors, mobile telephony, satellite communications, and networks).

iv. Product: part of the equipment (hardware, software and materials) for which usability is to be specified or evaluated.

b. Original Equipment Manufacturer (OEM) End-use Information and Communications Technology (ICT) Product.

i. The contractor shall provide new equipment unless otherwise formally approved by the Government, in writing. The contractor shall provide only Original Manufacturer (OEM) end-use products to the Government. In the event that a shipped OEM product, or part or component of that product, fails, all replacements must be new OEM.

ii. The contractor may provide previously used OEM products only with written Government approval. Such parts shall be procured from their original source and shipped only from the manufacturer’s authorized shipment points.

c. List of Components in ICT Products

i. Contractors shall provide and maintain a list of components for each product used in performance of the contract, including through subcontracts or other arrangements. This list for each product shall provide the component manufacturer’s name, address, state, and/or domain of registration, and, where applicable, the Unique Entity Identifier (UEI) number, for all components comprising the ICT products.

ii. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

iii. The contractor shall notify the Government when a new contractor/subcontractor/service provider is introduced to the ICT provided on this contract, or when suppliers of components or products are changed. If a software component used in the performance of the contract is updated with a new build or release, the contractor must update the list provided in accordance with (i) above to reflect the new version of the software. This includes software builds to integrate an updated component or dependency.

iv. For software products, the contractor shall provide all OEM software updates, and patches to correct defects, for the life of the product [i.e., until the “End of Life” (EoL) or “End of Support” (EoS)]. Software updates and patches shall be made available to the government for all products procured under this Contract, and replaced when End of Support (EoS) is reached.

d. Supply-Chain Transport

i. The contractor shall use formal and accountable transit, storage, and delivery procedures (i.e., the possession of the end-use product to be delivered is always documented from initial shipping point to final destination, and every transfer of the product from one custodian to another is fully documented and accountable) for all information and communication technology (ICT) shipments to fulfill this contract.

ii. The contractor shall maintain all records pertaining to the transit, storage, and delivery of ICT deliverables under this contract through at least 6 months after acceptance and make available for inspection upon request of the Government.

iii. The contractor shall make use of tamper-proof or tamper-evident packaging for all shipments.

iv. The contractor shall provide a packing slip for each container or package with the information identifying the contract or order number, a description of the hardware/software.

v. The contractor shall provide a shipping notification to the intended government recipient; with a copy transmitted to the Contracting Officer, or other designated representative. This shipping notification shall be provided electronically and identify the contract or order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

e. Foreign Equities

The Contractor shall immediately notify the Contracting Officer and Contracting Officer’s Representative regarding any changes to corporate ownership or control from contract award through final delivery or the end of the period of performance.

5. Section 508 Requirements

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div

5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

6. THE HOMELAND SECURITY PRESIDENTIAL DIRECTIVE 12 (HSPD-12)

• The Homeland Security Presidential Directive 12 (HSPD-12) requires the use of the Personal Identity Verification (PIV) credentials as the common means of authentication for access to DHS facilities, networks, and information systems.

Personal Identity Verification (PIV) credentials shall be used as the primary means of logical authentication for DHS sensitive systems. The Contractor must https://uscode.house.gov/view.xhtml?req=(title:29%20section:794d%20edition:prelim)%20OR%20(granuleid:USC-prelim-title29-section794d)&f=treesort&edition=prelim&num=0&jumpTo=true https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 use his or her federal issued Personal Identity Verification (PIV) credentials to access DHS resources to include IT applications and physical facility.

• The DHS Security Office shall be notified of all terminations/resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer Representative (COR) all DHS issued Personal Identity Verification (PIV) credentials/identification cards and building passes that have either expired or have been collected from terminated employees. If a PIV credential/identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the PIV credential, pass or card number, name of individual to who it was issued and the last known location and disposition of the PIV credential, pass or card."

The above language in section 8 must be included to any SOW if any of the following conditions apply.

1. All service contracts (requirements with labor) – NA

2. Requirement to use Personal Identity Verification (PIV) credentials as the primary means of identification and authentication to Federal information systems and federally controlled facilities incorporated in this procurement.

3. Identity products and services acquired to further HSPD-12 and ICAM implementations compliant.