DOT COE - Section C - Infrastructure Services 20080812.doc

Dept of Transportation Common Operating Environment—Infrastructure Services

DRAFT

Common Operating Environment Infrastructure Services Dept of Transportation Date July 30, 2008

Table of Contents

11.0 Infrastructure Management Overview and Objectives

11.1 Services Overview

11.2 Service Objectives

22.0 Service Environment

22.1 Scope of Services and Infrastructure to be Supported

22.1.1 Hardware and Software

22.1.2 Service Locations and Hours of Operation

22.1.3 Personnel

22.1.4 Policies, Procedures and Standards

32.1.5 Agreements and Licenses

32.1.6 Work‑In‑Progress/Transition

32.1.7 Future initiatives

32.2 Baseline Information

53.0 Infrastructure Service Requirements

53.1 Cross-Functional Roles & Responsibilities

53.2 Responsibilities

53.2.1 General Responsibilities

63.2.2 Design/Engineering

63.2.3 Asset Acquisition and Infrastructure Provisioning

73.2.4 File and Print Server Services

83.2.5 Backup and Storage Services

93.2.6 Infrastructure Support and Operational Services

113.2.7 Security Operations

133.2.8 Remote Access Services and Internet Connectivity

143.2.9 Documentation

143.2.10 Firewall Management

153.2.11 Security Intrusion Detection Services

163.2.12 Security Vulnerability & Penetration Services

163.2.13 Security Incident & Audit Management Services

173.3 Exclusions

173.4 Service Specific Milestones

174.0 Service Management

174.1 Objectives

174.2 Definitions

174.3 Service Level Objectives (SLOs)

244.4 Reports

255.0 Referenced SOW Appendices and SOW Schedules

List of Tables

3Table 1.

Enterprise Baseline Projections

Table 2.

Server Size Definitions Table 3.

Data Network Baseline Projections Table 4.

General Roles and Responsibilities Table 5.

Engineering/Development Roles and Responsibilities Table 6.

Asset Acquisition and Network Service Provisioning Roles and Responsibilities Table 7.

File and Print Server Roles and Responsibilities Table 8.

Backup and Storage Roles and Responsibilities Table 9.

Operational Roles and Responsibilities Table 10.

Security Operations Roles and Responsibilities Table 11.

Remote Access and Internet Roles and Responsibilities Table 12.

Documentation Roles and Responsibilities Table 13.

Firewall Services Roles and Responsibilities Table 14.

Security Intrusion Detection Services Roles and Responsibilities Table 15.

Security Penetration Services Roles and Responsibilities Table 16.

Security Incident & Audit Management Roles and Responsibilities Table 17.

Server Availability – Service Level Objectives Table 18.

Server Response Times – Service Level Objectives Table 19.

Network Availability - Service Level Objectives Table 20.

Network Performance - Service Level Objectives Table 21.

Network Administration Services -Service Level Objectives Table 22.

Security Intrusion Detection SLRs - Service Level Objectives Table 23.

Security Vulnerability & Penetration Services - Service Level Objectives Table 24.

Capacity Planning Services - Service Level Objectives Table 25.

Network Service Reports

1.0 Infrastructure Management Overview and Objectives

1.1 Services Overview

Infrastructure Management services are the services and activities, as detailed in the following SOW, required to provision and support DOT’s data and network environment as described in section 2.0 below. Infrastructure support is primarily the support of DOT’s current infrastructure, including hardware and operating system software configuration management and change management.

Provider responsibilities include, but are not limited to, the provisioning, management, administration and troubleshooting of the following Data Network services:

· Midrange Servers (e.g. Email, Web, Blackberry, etc)

· File and Print Servers

· Network Infrastructure (firewalls, routers, switches, circuits, etc)

· Wide‑area Network (WAN)

· Virtual Private Network (VPN)

· Security

Services include but are not limited to server administration; server performance monitoring and reporting; backups and restores; management of DNS; management of hardware and software refresh; server management and support in the production and development environments; hardware and operating systems management and maintenance; server security operation (including anti-virus); patch and operating system upgrade and management.

In addition to the services described in this SOW the Service Provider is responsible for providing the services described in Schedule CF – Cross Functional Services SOW

1.2 Service Objectives

The following are the key high-level Service objectives DOT expects to achieve through the outsourced services and this Statement of Work (SOW):

· Provide a reliable, scalable and secure infrastructure network to DOT at the HQ and Field locations

· Achieve process maturity within the DOT HQ as a Common Operating Environment (COE) and extend the COE to field locations

· Operate efficiently and effectively by running on a consolidated network infrastructure and by simplifying network management, procurement and budgeting

· Minimize administrative effort by engaging the outsourcer to provide this management function

· Maintain compliance with industry standards and government regulations (e.g., Section 508, FISMA, ITIL, etc.)

· Assurance of access to trusted Networks

· Acquire Services that can leverage operational scale and best practices to achieve optimum price performance

2.0 Service Environment

2.1 Scope of Services and Infrastructure to be Supported

Infrastructure is intended to cover requirements for network services, including premise equipment and software, non-plant cabling, and the data circuits providing the physical and logical interconnectivity (both wired and wireless) between multiple computing devices.

The following sub-sections and related SOW Appendices describe and scope the network environment to be supported and complied with. Service Environment Appendices are to be maintained and reviewed with DOT by Provider and made available to DOT on a quarterly basis.

2.1.1 Hardware and Software

a. A listing and description of all supported network hardware is provided in Attachment C.1 – Infrastructure and Network Hardware. The Service Provider shall provide the resources, tools, and processes necessary to fulfill the obligations of the contract and to support the DOT COE Infrastructure environment and security requirements.

b. A listing and description of the supported network software and utilities is provided in Attachment C.2 – Infrastructure and Network Software. The government shall license the software under its enterprise licensing agreements. The Service Provider shall provide the resources, tools, and processes necessary to fulfill the obligations of the contract and to support the DOT COE Infrastructure environment and security requirements.

c. A listing of supported network circuits is provided in Attachment C.3 - Network Circuits.

d. A network topology diagram describing the supported network components is provided in Attachment C.4 - Network Topology.

2.1.2 Service Locations and Hours of Operation

e. A description and location of all DOT facility and office locations requiring network services is provided in Attachment C.5 - DOT Service Locations.

f. Hours of Operation are 24 x 7 x 365 for core infrastructure (e.g. Networks, Tier 2 support, email, security, etc). Hours for staff support (e.g. Database Management, activities within storage management) will be determined by location and activity and subject to local time.

2.1.3 Personnel

g. Provider will be responsible for staffing skilled and appropriately certified Data Network Management staff to meet the Service Level Objectives (SLOs) set forth in this SOW.

2.1.4 Policies, Procedures and Standards

h. A description of the DOT policies, procedures and standards with which Infrastructure Services will comply is provided in Attachment C.6 – Policies, Procedures and Standards.

2.1.5 Agreements and Licenses

i. A list of infrastructure related agreements and licenses to be supported are provided in Attachment C.7 – Agreements and Licenses.

2.1.6 Work‑In‑Progress/Transition

In-progress Infrastructure and Network related initiatives that are included in the scope of this document and are the responsibility of Provider to complete within the time frames specified are listed in Attachment C.8 – Work in Progress.

2.1.7 Future initiatives

Other Network related initiatives considered but not in process are included in Attachment C.9 - Future Initiatives. [Example: IPV6 planning and readiness, IPV6 Compliance and upgrades]

2.2 Baseline Information

DOT’s projected network usage is presented below. These business requirements represent DOT’s most realistic projection of the service requirements for Day 1 assumption of responsibility based on a combination of past trends and current anticipated overall business direction over the term of the contract.

These metrics, along with other data which may be pertinent for sizing the solution, are reflected in Schedule B – Contract Line Item Pricing.

Table 1. Enterprise Baseline Projections

Unix Servers

Windows Servers

Other Servers

Blackberry Servers

Email Servers

File and Print Servers

Storage Networks

Unix DASD (GB)

NT/WIN 2000 DASD (GB)

NAS/SAN (GB)

Midrange Tapes

Optical Storage

Table 2. Server Size Definitions

Table 3. Data Network Baseline Projections

Load Balancers

Small Router

Medium Router

Large Router

Layer 2 / 3 Switches

DSCs/CSUs

Firewalls

Modems

Frame Relay

Dedicated Internet Circuits

Point-to-Point Circuits

ISDN

Dial-up WD Modem Pool

VPN

IMACs per device/per year (average for total devices)

3.0 Infrastructure Service Requirements

3.1 Cross-Functional Roles & Responsibilities

In addition to the services, activities, and roles and responsibilities described in Schedule CF - Cross Functional Services SOW, Provider is responsible for the following Data Network Management services, activities and roles and responsibilities.

3.2 Responsibilities

The following tables identify roles and responsibilities associated with this SOW including the network components listed above. An “X” is placed in the column under the party that will be responsible for performing the task. Provider responsibilities are indicated in the column labeled “Provider.”

3.2.1 General Responsibilities

Table 4. General Roles and Responsibilities

1. Identify relevant policies, Standards, Technology and Architecture; and provide guidance on implementation

X

11. Review and approve changes to requirements based on changes in WAN/LAN/VPN/Firewall services

X

12. Review and approve services and standards for all services

X

14. Approve capacity planning thresholds

X

16. Financial Responsibility for Hardware Assets (Platforms and Storage)

X

17. Financial Responsibility for Software Licenses (OS, Storage, Exchange)

X

3.2.2 Design/Engineering

The following identifies the activities, roles and responsibilities associated with Infrastructure Engineering/Development services that are specific to this schedule. Additional activities include:

Table 5. Engineering/Development Roles and Responsibilities

4. Approve Infrastructure design engineering, security testing and integration procedures

X

6. Review and approve network design, engineering and security plans and schedules

X

7. Approve the scheduling of all changes to the network environment

X

3.2.3 Asset Acquisition and Infrastructure Provisioning

Provider will manage Asset Acquisition and Infrastructure Services Provisioning associated with acquiring Infrastructure, network equipment, and circuits. The following table identifies the underlying roles and responsibilities associated with Asset Acquisition and Network Services Provisioning activities.

Table 6. Asset Acquisition and Network Service Provisioning Roles and Responsibilities

3. Financial responsibility for WAN Circuits

X

10. Approve server and network provisioning requirements and policies

X

17. Financial responsibility for Assets (including spares, except where charges are the fault of the service provider)

X

3.2.4 File and Print Server Services

File and Print Server Services are the activities associated with the provisioning and day to day management of the installed Infrastructure Server environment (i.e., file/print servers) and their corresponding support services

Table 7. File and Print Server Roles and Responsibilities

3. Approve distributed server strategy, policies, architecture, standards and requirements

X

5. Review and advise on Network and Server architectural decisions

X

3.2.5 Backup and Storage Services

Backup and Storage Services are the activities associated with the provisioning, capacity management, and day to day operations of the installed storage and data environment (e.g., direct access storage devices (DASD), redundant array of independent disks (RAID), storage area Network (SAN), Network-attached storage (NAS), tape and optical), and their corresponding support services

Table 8. Backup and Storage Roles and Responsibilities

6. Participate in Capacity Planning and perform tuning as required

X

7. Approve Capacity Plans

X

3.2.6 Infrastructure Support and Operational Services

Operations provides for the management and maintenance of the DOT Headquarters and field locations using industry standards and DOT tailored processes to maintain network availability and to ensure security accreditation; maintenance of network HW/SW configurations (CM); management of equipment (AM); Broadband virtual networks using multi-protocol label switching; and integrity of firewalls, routers, and switches. The provider will conduct periodic audits and status reporting; be responsible for installation, changes, moves, disposition of surplus equipment, cabling and disconnection services; and problem resolution.

Operations shall provide Wide Area Network (WAN) Services (including the provisioning, monitoring, and management of networks) that interconnect two or more separate facilities that span a geographic area larger than a campus or metropolitan area. Transmission facilities include, but are not limited to, point to point circuits, Frame Relay, dedicated Internet connections, broadband (DSL/Cable Modem) Internet connections, ISDN, multiple VPNs, and dial up connections. The Service Provider shall work with public carriers and other circuit providers on behalf of DOT to ensure delivery of WAN services and provide support of any network services related work required by designated carriers, to support the DOT network, is considered within the scope of services.

Operations shall also provide Local Area Network (LAN) Services (including the provisioning and monitoring and management of networks) that are usually confined to a single facility or portion of a facility. LAN components include Dynamic Host Control Protocol (DHCP)/Domain Name Server (DNS) and Wireless LANs supporting all network traffic originating from desktop devices, local file and print servers, application servers, database servers, peripherals, firewalls/routers, other network devices and other user premise devices.

This service ends at, but does not include, the network card in the desktop device.

Table 9. Operational Roles and Responsibilities

5. Approve escalation and notification process

X

9. Approval of monitoring parameters

X

15. Provide DOT with access to asset / license database

26. Financial responsibility for facility cabling

X

29. Approve capacity planning and resource projections

X

3.2.7 Security Operations

Security Operations Services shall provide a full spectrum of integrated security services for monitoring Infrastructure and network activity throughout the DOT environment. This center will draw upon the most current tools and processes essential for supporting governmental security requirements, policies/standards, and regulatory mandates. The service provider will assume operational responsibility for the deployment of Government-furnished security software and integrate within its Security Operations Center.

Table 10. Security Operations Roles and Responsibilities

1. Provide Security Policies and Updates to Regulations

X

2. Provide dedicated security event analysts to manage sensors and to monitor, review, and analyze reported security events and determine security incidents that would be reported to the government’s Security Incident Manager, helpdesk, or other personnel. They will include (but not be limited to) the following:

· Execution of countermeasures derived from intrusion detection system (IDS) monitoring and Extrusion Detection

· Audit-log analysis tools in support of real-time monitoring of operations

· Data collection in support of forensic analysis and incident handling procedures

· Access to all locally and remotely accessible devices in support of DOT mission-critical operations

· Close coordination with DOT incident response and emergency response centers

· A security portal system accessible via DOT Intranet See Exclusions for CSMC monitoring responsibilities

X

3. Establish an online Security Awareness Training Program for the general user community and a separate program for other IT personnel on specialized security matters. This program will utilize the DOT intranet and develop Web pages for the purposes of promoting safe IT practices and Security Awareness Training of emerging threats

X

3.2.8 Remote Access Services and Internet Connectivity

Remote Access Services are the activities required to provide a secure path for authorized DOT users to gain access to the DOT network, business applications, email, calendaring functions, and data files while away from the office. Remote access is available regardless of location as long as the user has a basic Internet connection (not included in this service). Secure Remote Access (SRA) provides web-based remote access from any computer with Internet access, regardless of whether the computer is government-issued and regardless of the computer’s operating system.

Internet Connectivity includes the connection extending from the local telephone exchange to the remote user and includes all telecommunications and sustainable secure remote access. The purpose is to provide fully integrated digital services to a variety of users (e.g., teleworkers) requiring connectivity into the DOT system. Connectivity services include the operation and maintenance of the routers, firewalls, gateways, etc., that are used to provide connectivity to the Internet. Services also provide for routine collection of circuit loading data and use it to identify any existing problems on these connections and to identify trends in circuit consumption and forecast changes in the bandwidth of these circuits.

Table 11. Remote Access and Internet Roles and Responsibilities

1. Define Remote Access policies and procedures

X

2. Define authorization requirements for End-Users, roles, objects, etc., and approve Change requests

X

4. Review and approve Remote Access procedures

X

3.2.9 Documentation

The following are required document types that are specific to this Schedule.

j. Architectural specifications for Network and systems (for example, router configurations, firewall policies, routing diagrams/IP addressing tables, hardware/software listings, etc.)

k. Detailed circuit location information (e.g. circuit ID including LEC access ID, location, speed)

l. Detailed documentation showing all firewall policy, group, object, etc. information

m. “As-built” documentation for all infrastructure devices (including firewalls) that are deployed in development, test, QA, production or other technical environments

The following table identifies the roles and responsibilities associated with Documentation activities that are specific to this Schedule.

Table 12. Documentation Roles and Responsibilities

2. Approve Recommend documentation requirements

X

3.2.10 Firewall Management

Provider shall provide Firewall Management Service including firewall engineering and management and access control list engineering and management in compliance with DOT’s policies and standards. The following table identifies roles and responsibilities associated with the Firewall Management services.

Table 13. Firewall Services Roles and Responsibilities

2. Develop DOT specific firewall polices and requirements

X

3. Set firewall rules and conduct periodic audits for compliance

X

4. Approve firewall polices

X

8. Review and approve firewall security designs

X

9. Review and approve firewall ACL policies

X

11. Review and approve recommendations for improved security

X

12. Provide Access Control Lists (ACL)

X

3.2.11 Security Intrusion Detection Services

Provider shall provide both NIDS (Network-based Intrusion Detection Service) and HIDS (Host-based Intrusion Detection Service). The following table identifies the roles and responsibilities associated with the Intrusion Detection services.

Table 14. Security Intrusion Detection Services Roles and Responsibilities

2. Approve policies and standards for intrusion detection

X

4. Approve signature deployment process and authorize signatures

X

8. Review and approve recommendations for improved security

X

3.2.12 Security Vulnerability & Penetration Services

Provider shall test the susceptibility of DOT’s network hosts to a specific attack or suite of attacks targeting all DOT Internet address space as well as all DOT Intranet address space using automated and custom methods. The following table identifies the roles and responsibilities associated with the Security Penetration services.

Table 15. Security Penetration Services Roles and Responsibilities

2. Approve policies for security vulnerability & penetration testing

X

5. Source Selection and financial responsibility for IV&V

X

8. Review and approve recommendations for improved security

X

3.2.13 Security Incident & Audit Management Services

The following table identifies the roles and responsibilities associated with Security Incident Management services.

Table 16. Security Incident & Audit Management Roles and Responsibilities

2. Approve policies for security incident management

X

6. Establish security audit policies

X

3.3 Exclusions

The following items are specifically excluded from this statement of work:

a. CSMC Responsibilities (need statement of definition and activities)

3.4 Service Specific Milestones

Milestones specific to the deployment of Network services are listed in the following:

TBD

4.0 Service Management

4.1 Objectives

A key objective of this outsourcing agreement is to attain service-level requirements (SLRs). Service Level Agreements (SLAs) and Project-specific SLAs are specified with fee reductions where business is impacted through failure to meet significant mission critical systems or services, or project milestones or objectives. SLRs are detailed in the following sections and SLAs are detailed in Schedule C - Quality Plan and Fee Reductions / Balanced Scorecard.

Provider shall provide written reports to DOT regarding Provider’s compliance with the SLRs specified in this SOW Schedule.

4.2 Definitions

Attachment A – Definitions provides a list of terms that apply to this SOW and following SLRs.

4.3 Service Level Objectives (SLOs)

The following minimum service levels are required at the end of the Transition Period. Provider must consistently meet or exceed the following SLRs. SLRs associated with fee reductions are detailed in Schedule C - Quality Plan and Fee Reductions / Balanced Scorecard. All times shall mean local times.

Table 17. Server Availability – Service Level Objectives

System Availability Service-Level Objectives

Target SLO Performance %

Where Unavailability is defined as:

(( Outage Duration × 100%) ( (Schedule Time – Planned Outage)

Table 18. Server Response Times – Service Level Objectives

Application Platform Online Response Time SLOs

Target SLO Performance %

95% of transactions complete (1.0 seconds

100% of transactions complete (3.0 seconds 99.499%

95% of transactions complete (1.5 seconds

100% of transactions complete (2.0 seconds 99.499%

95% of transactions complete (1.5 seconds

100% of transactions complete (3.0 seconds 99.499%

95% of transactions complete (1.5 seconds

100% of transactions complete (3.0 seconds 99.499%

Intranet/Extranet, Blackberry, Web Systems

95% of transactions complete 2.5 sec

99.9% of transactions complete 3.5 sec 99.909%

Internet Web Service

80% of transactions complete 30 sec

99.9% of transactions complete 2 min 99.909%

Email Services

95% of transactions complete (1.5 seconds

100% of transactions complete (3.0 seconds 99.909%

Table 19. Network Availability - Service Level Objectives

All performance criteria are to be measured on a per circuit and component basis– criteria is not to be aggregated and averaged for all circuits and network components.

Network Availability SLOs

Where Unavailability is defined as:

(( Outage Duration x 100%) ( (Schedule Time – Planned Outage)

Table 20. Network Performance - Service Level Objectives

All performance criteria are to be measured on a per circuit and component basis– criteria is not to be aggregated and averaged for all circuits and network components. Maximum packet size is 128 bytes.

Network Performance SLOs

(data loss ≤ 0.05%)

Where:

t1 is the time when a packet leaves the ingress premise, and t2 is the times when the packet arrives at the egress premise

Where: “PDR” = Packets delivered/ packets sent.

Where: J1 is for two consecutive packets i and i+1 and, Ti = time 1st byte of packet is received by the source port (ingress time)

Ti+1 = time 1st byte of packet i+1 is received by the source port (ingress time)

Ti’ = time 1st byte of packet is received by the destination port (egress time)

Ti+1’ = time 1st byte of packet i+1 is received by the destination port (egress time) and

(T = Ti+1 - Ti (( is the time interval between packets at ingress

(T = Ti+1’ - Ti’ (( is the time interval between packets at egress

Table 21. Network Administration Services -Service Level Objectives

Network Administration Services SLOs

0700–1800

<4 hours

98.00%

0700–1800 <24 hours

98.00%

Decreases of installed capacity within 6 months 95.00%

0700–2000 immediately 99.00%

Firewall Management

Implementation of firewall changes related to changing, adding/deleting firewall rules.

Standard Requests: within normal change control parameters after submission by DOT 99.00%

Table 22. Security Intrusion Detection SLRs - Service Level Objectives

Security Intrusion Detection SLRs

Table 23. Security Vulnerability & Penetration Services - Service Level Objectives

Security Vulnerability & Penetration Services SLOs

Mon–Fri, 1700–0700

Sat-Sun, 0000-2400 99.90%

100% zero defects to target devices with release or updates 99.90% within schedule

100% within 8 hours of schedule close

100% zero defects

Table 24. Capacity Planning Services - Service Level Objectives

System Administration SLOs

Target SLO Performance %

Interim reports on rapidly developing events and trends identification 99.0%

4.4 Reports

The Provider will provide written reports to DOT regarding Provider’s compliance with the SLRs specified in this Section and other Network activity reports. Reports are required per the following:

Table 25. Network Service Reports

TBD

5.0 Referenced SOW Appendices and SOW Schedules