Exhibit 1 SOW DIR-CPO-STS-609_MNS_Final.docx

DIR-CPO-STS-609

State of Texas

Department of Information Resources

Exhibit 1

Statement of Work (SOW)

Managed Network Services (MNS)

DIR-CPO-STS-609

Contract Change Log

CCR-000XXX

1 Background and Introduction

1.1. Introduction

The Texas Department of Information Resources (DIR) seeks a Successful Respondent to serve as the Shared Technology Services (STS) Managed Network Services (MNS) Service Component Provider (SCP). The Successful Respondent shall establish the Services for MNS within the STS program. DIR Customers may request specific services proposals that include the responsibilities defined in this Statement of Work.

This Statement of Work defines requirements Successful Respondent must meet to achieve the objectives of the procurement.

1.1.1. Eligible Customers and STS Program Restrictions

Eligible DIR Customers include state and local government entities, as provided by Section 2054.0525, Texas Government Code. All STS-enrolled DIR Customers are eligible to purchase services through MNS.

MNS is distinct from and complimentary to the Telecom Managed Services offered under DIR’s Texas Agency Network (“TEX-AN”) contracts. The TEX-AN Telecom Managed Services procurement model requires DIR Customers to develop a specific statement of work for managed services; whereas, the proposed STS Managed Network Services are predefined services within the STS program, as detailed in this Exhibit 1 (SOW).

For further clarity, this Statement of Work does not include telecommunications services or is part of the consolidated telecommunications system under Chapter 2170, Texas Government Code. DIR Customers will continue to procure telecom and voice platform services through the TEX-AN program. Those services may not be offered through this Statement of Work.

1.2. Services Scope Overview

The purpose of STS Managed Network Services is to provide a central point for DIR Customers to obtain highly automated and scalable solutions for advanced networking and monitoring capabilities.

DIR has designed its operating model to leverage an MSI which currently operates on an ITIL-based platform with specific tools and processes that all SCPs are expected to utilize.

Successful Respondent will be responsible for delivering Services in a manner that maximizes value for the DIR Customer by utilizing emerging technology coupled with best industry practices.

MNS offering categories available to DIR Customers include Network Services – Successful Respondent infrastructure (Successful Respondent-owned Hardware and Software), Network Services – Customer infrastructure (DIR Customer-owned Hardware and Software, and Additional Network Services).

1. Network Services – Successful Respondent infrastructure: Shall include all necessary Services, Hardware, Software and maintenance for successful delivery, inclusive of monitoring, management, Network Security, Disaster Recovery Planning, Disaster Recovery Testing, Disaster Recovery, and device patching and updates, Governance, Risk, and Compliance. Refer to Exhibit 2 (Financial Provisions and Pricing Requirements). The Network Services – Successful Respondent infrastructure includes:

a. Network Operations Center (NOC): Successful Respondent shall establish and perform 24x7x365 monitoring, event management, triage, and system restoration of DIR Customer Equipment and shall be included in all Network Services - Successful Respondent infrastructure and Network Services – Customer infrastructure. This service shall include all Hardware, Software, licensing, and maintenance required for delivery of the service.

b. Fully Managed VPN: Successful Respondent shall establish and perform monitoring and management of a DIR approved virtual private network solution enabling encrypted tunnel traffic to DIR Customer environments. This service shall include all Hardware, Software, licensing, and maintenance required for delivery of the service.

c. Fully Managed DDI: Successful Respondent shall establish and deliver a DIR approved DDI solution. The solution shall include Domain Name Service (DNS), Dynamic Host Configuration Protocol (DHCP), and Internet Protocol Address Management (IPAM). This service shall include all Hardware, Software, licensing, and maintenance required for delivery of the service.

Except for Third Party-hosted SaaS products or Successful Respondent hosted Fully Managed Services all Network Services – Successful Respondent infrastructure solution elements shall be hosted on DCS program infrastructure.

Network Services – Successful Respondent infrastructure

2. Network Services – Customer infrastructure: Shall provide operational services for DIR Customer owned Hardware and Software and shall include all necessary Services for successful delivery, as defined in the requirements outlined in Article 2, Managed Network Services, inclusive of NOC, monitoring, management, network Security, Disaster Recovery Planning, Disaster Recovery, and device patching and updates, Governance, Risk and Compliance. These services include:

a. LAN: Successful Respondent shall deliver LAN Services including 7x24 NOC, monitoring, management, performance and capacity management, triage, system restoration, incident resolution, problem resolution, change execution, system patching, refresh planning, and asset management.

b. WAN: Successful Respondent shall deliver WAN Services including 7x24 NOC, monitoring, management, performance and capacity management, triage, system restoration, incident resolution, problem resolution, change execution, system patching, refresh planning, and asset management.

c. Wireless: Successful Respondent shall deliver Wireless Services including 7x24 NOC, monitoring, management, performance and capacity management, triage, system restoration, incident resolution, problem resolution, change execution, system patching, refresh planning, and asset management.

d. Firewall: Successful Respondent shall deliver firewall Services including 7x24 NOC, monitoring, management, performance and capacity management, triage, system restoration, incident resolution, problem resolution, change execution, system patching, refresh planning, and asset management. Firewall services cannot be provided standalone. One of the following services must also be selected with Firewall: LAN, WAN, or managed Wireless.

e. Web Application Firewall (WAF): Successful Respondent shall deliver Web Application Firewall Services including 7x24 NOC, monitoring, management, performance and capacity management, triage, system restoration, incident resolution, problem resolution, change execution, system patching, refresh planning, and asset management. Web Application Firewall services cannot be provided standalone. One of the following services must also be selected with Web Application Firewall: LAN, WAN, or Wireless.

f. VPN: Successful Respondent shall deliver VPN Services including 7x24 NOC, monitoring, management, performance and capacity management, triage, system restoration, incident resolution, problem resolution, change execution, system patching, refresh planning, and asset management.

g. DDI: Successful Respondent shall deliver DDI Services including 7x24 NOC, monitoring, management, performance and capacity management, triage, system restoration, incident resolution, problem resolution, change execution, system patching, refresh planning, and asset management.

h. Staff Augmentation: Successful Respondent shall deliver Staff Augmentation Services upon DIR Customer request providing resources capable of meeting the expertise defined in Exhibit 2.1 Attachment 2.1 (Pricing and Volumes).

Network Services – Customer infrastructure

* Firewall & Web Application Firewall services cannot be provided standalone, one of the following services must be selected with Firewall & Web Application Firewall: LAN, WAN, or Wireless.

3. Additional Network Services: These services may be requested by DIR Customers at any time during the term of the Agreement. These services include:

a. Network assessments: DIR Customer initiated events requiring a review of the DIR Customer network environment that shall consist of currency, performance, utilization, Architecture design, infra mapping, compliance, and identification of misconfigurations.

b. Network Vulnerability scans: DIR Customer initiated event requiring Vulnerability scanning of DIR Customer network Equipment

c. Network incident response: DIR Customer initiated event requiring time sensitive network services expertise aligned to rate card Technical Field Services: Successful Respondent shall deliver technical field services for dispatch to DIR Customer locations for execution of DIR Customer requests and system restoration of managed Equipment as required.

Requirements for the service offerings above are detailed in Article 2, Managed Network Services in each respective section.

1.3. Service Objectives

Successful Respondent will provide industry leading managed network services to DIR Customers, while minimizing risk, enhancing security, and modernizing DIR Customer network systems.

Achieve desired outcomes, including:

a. Improve availability and reliability

b. Maintain continuity of operations

c. Improve access to network resources

d. Modernize network technologies

e. Provide for budget transparency

f. Management of program risk

Successful Respondent will provide comprehensive managed network services at an enterprise level that must integrate with other Service Providers to establish integrated services within the STS Program.

1.4. Document Overview

This Exhibit 1 (SOW) contains several subsequent sections, described below for reference purposes.

Document Overview

2 Managed Network Services

2.1 General Requirements

The following sub-sections and related attachments further describe the Services to be offered and supported under this SOW; and with which Successful Respondent shall comply. Each specific service environment will be defined at the time the Successful Respondent is engaged by a DIR Customer to propose or deliver Services. In the course of delivering the Services, Successful Respondent may bring specific tools to manage the environment, and all tooling shall be capable of supporting multi-tenancy.

2.1.1 Emerging Technologies

In addition to services directly provided to DIR Customers, Successful Respondent shall:

1. Collaborate with DIR, DIR Customer, the MSI, and other SCPs and utilize industry networking best practices to provide ongoing insight and alignment of emerging technologies consistent within DIR Customer and government requirements.

2. Align emerging networking technologies and capabilities within the Services model to ensure DIR Customers receive the value within the MNS program.

a. Ensure certain emerging technologies align with DIR’s and DIR Customer’s strategic objectives for using MNS to drive efficiencies, innovation, consistency, and price reductions.

b. Deliver any AI services consistent with the NIST Artificial Intelligence (AI) Risk Management Framework and DIR AI requirements.

3. Work with DIR Customers, MSI, and SCPs, to identify strategic problems to be used as use cases for improvement and services innovation.

4. Deliver all Services in alignment with the Agreement and data policy standards.

5. Implement emerging technology services capabilities and value into a set of best practices, tooling, and innovative delivery methods in coordination with DIR and DIR Customer.

6. Support DIR Customers by:

a. Contributing to other emerging technology initiatives within STS to provide consistency across the program.

b. Detailing usage of emerging technologies within demand and solution documentation.

2.1.2 Routine Maintenance, Patching, Updates, and Hot-Fixes

For all Services provided, Successful Respondent shall:

1. In consultation and agreement with DIR Customer, establish, publish, and follow a schedule and process for performing routine maintenance, patching, updates and hot-fixes.

2. Assess, develop, and recommend opportunities to reduce (or avoid) costs associated with support and operations.

3. Monitor Software and Hardware recommended or required configurations, patches, updates, hot-fixes and upgrades and the like for all elements that are utilized in the DIR Customer’s network environment:

a. Prior to any production deployment, ensure that such items are understood, follow guidance and requirements, and are tested in a non-production or laboratory environment prior to their introduction to the MNS program.

4. Provide appropriate Successful Respondent-related data for periodic DIR Customer analysis and review of resources deployed for preventive maintenance and planning preventive maintenance.

5. Monitor and analyze trends to identify potential issues and follow-up on recurring problems.

6. Maintain systems in accordance with DIR Customer strategies, principles, and standards relating to technical, data, and network standards as defined in this Exhibit 1 (SOW), or the SMM.

7. Provide timely responses to DIR, DIR Customer, and MSI requests for information and reports necessary to provide updates to business units and stakeholders.

8. Monitor operations for correctness and adherence to agreed quality, performance and availability criteria according to industry best practices or as set forth in the SMM.

9. Support production staff (DIR, DIR Customer and Successful Respondent) to create and adapt IT operational processes and procedures related to the in-scope environments.

10. Validate that all system Software, bios/microcode, updates, patches, and hot fixes are inventoried, cataloged, backed up, and available prior to any maintenance activity and following the successful deployment to the DIR Customer’s network environment.

2.1.3 Network Security

For Services provided on infrastructure, regardless of whether such infrastructure is provided by Customer or Successful Respondent, Successful Respondent shall:

1. Verify networking elements include required security defenses and monitoring elements defined in the SMM, or as otherwise agreed upon with DIR Customer, and that these service offerings are reporting to monitoring services as well as any Service Provider security monitoring functions.

2. Manage Security functions related to the network operating system(s), configuration items, Hardware, Software, appliances, and other elements that comprise the Services including administrative access and passwords and the related Security controls to maintain the integrity of the operating system as based on processes defined in the SMM.

3. Identify unauthorized access to the network and provide reporting to the DIR Customer.

4. Deliver network encryption services to the defined demarcation as required by DIR Customer.

5. Assist DIR Customer with implementing network Security policies and standards as defined in the SMM.

6. Take appropriate actions to block malicious or unwanted traffic that has been identified, and coordinate activities with DIR Customer.

7. Deliver Services in accordance with Information Security Management requirements found in Section 8.10.11, Information Security Management Requirements.

2.1.4 Policies, Procedures and Standards

1. The general policies, procedures, and standards with which Successful Respondent shall provide the Services are provided in the SMM. Additional requirements will be determined if Successful Respondent is engaged by a DIR Customer to propose or deliver Services.

2. Successful Respondent shall integrate into the STS program’s tools, procedures, and reporting such that DIR Customers will request resources through the Public Service Catalog. All onboarding and training will be done by Successful Respondent and the MSI.

3. Successful Respondent is required to adhere to Article 8, Cross-Functional Services regardless of whether equipment is provided by Successful Respondent or DIR Customer. Successful Respondent shall implement capabilities for forwarding events, alerts, and monitoring integration management information generated through the Services into the MSI CMDB, unless defined in the SMM or otherwise agreed upon with DIR. These capabilities include forwarders, agents, or aggregation points, all while maintaining existing alerting for DIR Customer operations.

2.1.5 Disaster Recovery Requirements

2.1.5.1 Network Services – Successful Respondent infrastructure Disaster Recovery Planning The MSI leads, manages, and oversees the Disaster Recovery Program (DR) within the Shared Technology Services program, including planning and testing activities. Successful Respondent retains responsibility for business continuity plans for Network Services - Successful Respondent infrastructure, recovery of Network Services -Successful Respondent infrastructure, and data associated with the Services. For clarity, the following services will require Disaster Recovery plans and Disaster Recovery testing.

1. Network Operations Center

2. Fully Managed VPN

3. Fully Managed DDI

Successful Respondent shall:

1. Architect, design, and manage DR Services to satisfy the overall needs of DIR and DIR Customers within the centralized Services, including support for automated failover and testing.

2. Support elements as required to operate and maintain the Services including all infrastructure and operational elements the Successful Respondent provides or is dependent upon to deliver the Service to DIR Customers and, as applicable, other SCPs.

3. While multiple RPO and RTO Disaster Recovery Classes exist within STS, Successful Respondent is expected to design and implement Network Services – Successful Respondent infrastructure to align to the disaster recovery class outlined in Table 4 below, in support of the business continuity plan(s).

Disaster Recovery Class

4. Develop and maintain processes and procedures to deliver Successful Respondent Services and tooling recovery capabilities.

5. Participate in program level planning in cooperation with the MSI.

6. Ensure valid backups exist for all Successful Respondent Services in support of the RTO and RPO.

7. Provide input into DIR’s specifications, design, and implementation of Disaster Recovery plans based upon the following principles:

a. Documentation of procedures to restore primary operations within the defined timeframes detailed in the SMM.

8. Upon request, participate in planning sessions, testing review sessions, and other meeting activities for in-scope elements.

9. Participate in DIR Disaster Recovery planning activities to ensure that respective roles, responsibilities, processes, and procedures of the parties are understood and documented.

2.1.5.2 Network Services – Successful Respondent infrastructure Disaster Recovery Testing The SCP will develop a DR test schedule annually that schedules DR tests periodically throughout the year. Upon request, Successful Respondent shall:

1. Establish, with the MSI, test objectives designed to verify the Services will be available within the agreed upon timeframes contained in a business continuity plan.

2. Follow MSI established schedule for testing the disaster recovery and business continuity plans relating to the Services at least annually, any testing and recovery providers, and relevant Third-Party service providers (including cloud Service Providers) in accordance with the SMM.

3. Continue to operate and manage the Services during periodic disaster recovery tests.

4. Execute an annual tabletop disaster recovery test on in-scope service elements.

2.1.5.3 Network Services – Successful Respondent infrastructure and Customer infrastructure Disaster Recovery Declaration

1. In the event of a Disaster declaration, provide the necessary personnel and compute resources to recover the Network Services – Successful Respondent infrastructure to the RTO/RPO designated in Section 2.1.5.1, Network Services – Successful Respondent infrastructure Disaster Recovery Planning.

2. In the event of a Disaster declaration for Network Services – Customer infrastructure, provide the necessary personnel to recover Network Services – Customer infrastructure as defined in Section 2.1.5.4, Network Services – Customer infrastructure Disaster Recovery Planning.

3. Upon recovery of the Services, validate with DIR and DIR Customers that the Services are functioning as designed.

2.1.5.4 Network Services – Customer infrastructure Disaster Recovery Planning The MSI leads, manages, and oversees the Disaster Recovery Program (DR) within the Shared Technology Services program, including planning and testing activities. Successful Respondent retains responsibility for business continuity plans for Network Services – Customer infrastructure. For clarity, the following services shall require Disaster Recovery plans.

1. LAN

2. WAN

3. Wireless

4. Firewall

5. Web Application Firewall

6. VPN

7. DDI

Successful Respondent shall:

1. Architect, design, and manage DR Services to satisfy the overall needs of DIR and DIR Customer within the Services.

2. Support elements as required to operate and maintain the Services including all infrastructure and operational elements the Successful Respondent provides or is dependent upon to deliver the Services to DIR Customers.

3. Deliver Services to ensure that any existing implemented DR methods to enable specified DR and business continuity for DIR Customer applications and systems are not diminished as a result of Successful Respondent efforts.

4. Design and implement Network Services – Customer Infrastructure Services to align to the DIR Customer DR class in support of the business continuity plan(s).

5. Develop and maintain processes and procedures to deliver Successful Respondent Services and network tooling recovery capabilities.

6. Participate in program level planning in cooperation with the DIR Customer and the MSI.

7. Configure and manage backups for all Successful Respondent Services in support of the RTO and RPO as defined by the DIR Customer.

8. Provide input into DIR Customer’s specifications, design, and implementation of Disaster Recovery plans based upon the following principles:

a. Documentation of procedures to restore primary operations within the defined timeframes and detailed in the DIR Customer DRP.

9. Participate in planning sessions and other meeting activities for in-scope elements.

10. Participate in DIR Disaster Recovery planning activities to ensure that respective roles, responsibilities, processes, and procedures of the parties are understood and documented.

2.1.6 Governance Risk and Compliance (GRC) Network Assessments The Successful Respondent shall make certain Governance Risk and Compliance (GRC) is integrated across DIR Customer offerings, the Successful Respondent shall, at a minimum:

1. Integrate with the MSI Risk Management program to ensure significant risks are reported to DIR Customer executive management and perform a comprehensive review of Security risks, treatment plans, and identify further remediating actions.

2.2 Network Services – Customer Infrastructure

2.2.1 LAN

Successful Respondent shall:

1. Configure, manage, and support DIR Customer multi-protocol LANs, including:

a. Manage all Layer 3 address spaces, (e.g., IP v4, IP v6) as well as any and all layer 2 addresses (e.g., ATM, MAC) used to transport the above traffic.

b. Manage Application-specific network addressing, transport, and protocol schemes (e.g., VLANs, VRFs, VLAN trunking, link aggregation, and 802.1x where applicable).

2. Use intelligent network devices, systems, and Software to monitor LANs remotely.

3. Deploy site switches, perform large and small configuration changes, and Security updates.

4. Validate that a consistent network device operating system version is deployed.

5. Provide wired systems support for DIR Customer wired LAN environment including switches, bridges, hubs, and all associated patch cabling and related ancillary network Equipment.

6. Support and update all documentation for the wired LAN environment, including as follows:

a. Develop physical and logical network diagrams for audit purposes.

b. Maintain Hardware lists for accurate asset management information regarding what Equipment is currently in or out of service and documenting what date each event occurs, in the MSI CMDB.

7. Provide trained staff to support the DIR Customer.

8. Verify that all DIR Customer procured LAN services deployed are aligned with DIR Customer architecture design standards.

9. Provide support services to DIR Customer as a part of the Services that shall include:

a. Installation, maintenance, and decommissioning of Equipment and Software to support DIR Customers’ business applications.

i. Specify required Hardware, Software, Security, and connectivity to support the solution.

ii. Work with third parties as required, including assisting with configuration and troubleshooting of third party provided Equipment and solutions.

b. Monitor all Equipment for configuration and Security compliance.

i. Implement all configuration and Security compliance standards for installed Equipment in accordance with DIR policies and industry best practices.

ii. Monitor and report all compliance status for internal and external notifications.

iii. Work with the DIR Customer to address and remediate any variance from the defined standards.

2.2.2 WAN

Successful Respondent shall:

1. Comply with DIR Customers’ requests to modify the connection method, parameters, etc. to conform to periodic changes in technology, networking, or Security standards.

2. Maintain WAN connectivity for approved Authorized Users for DIR Customers and provide connectivity and protection as required and in accordance with DIR and DIR Customers’ Security standards or as set forth in the SMM.

3. Deploy site routers, support large and small configuration changes, and Security updates.

4. Provide application visibility and recognition within each router that will support Security, patching, and prioritization decisions.

5. Deliver network on premise and cloud-based Security services (firewall, IDS/IPS, web filter) that support independent policy/rules for each virtual or logical network.

6. Employ appropriate encryption measures as required by DIR Customer, including Triple DES, IPSEC, AES, etc.

7. Manage the transport services profile that complies with applicable open system standards and specifications (e.g., IETF Standard Docs; ITU-T; IP/MPLS Forum recommendations; ANSI and IEEE).

8. Employ high availability and redundant solutions across all shared enterprise services, as required by DIR Customers.

9. Support IPv4/IPv6 Dual Stack, and multicast as required by DIR Customers.

10. Support, validate, and provide the availability of secure out-of-band access to the network routers, including:

a. Perform quarterly testing to make certain out-of-band access to the routers are working as expected.

b. Open an Incident and resolve out-of-band access issues identified via this process.

c. Monitor usage of out-of-band access and report on any suspicious activity to the DIR Customer.

d. Utilize out-of-band access only if necessary to perform the service objectives.

11. Validate consistent network device operating system versions are deployed to adhere to the Software currency requirements.

12. Provide and support dedicated, over the air (e.g., satellite and cellular) and broadband backup solutions as required by DIR Customers.

2.2.2.1 WAN Services - Intranet Services

In addition to the requirements in 2.2.2, Successful Respondent shall provide the following for Intranet Services:

1. Configure, install, test, and support WAN connectivity (both network transport and network Equipment) for DIR Customers.

2. Configure and manage transport, cross connects, demark extension, routing, network segmentation, and network class of service as required by DIR Customers.

a. Collect data on router WAN interfaces and provide tooling necessary for reporting as defined in Exhibit 1 Appendix A (Reports).

2.2.2.2 WAN Services – Internet Access Services

WAN Services – Internet Access Services are defined below, expressly excluding those services described in Section 1.1.1, Eligible Customers and STS Program Restrictions.

In addition to the requirements in Section 2.2.2, WAN Successful Respondent shall provide the following for Internet Access Services:

1. Configure, install, test, support, and maintain the network and network Equipment used to access the internet.

2. Configure, test, support, and maintain existing SD-WAN technologies as required by DIR Customers.

3. Provide network encryption services as required by DIR Customers.

4. Implement DIR Customer Security policies or utilize industry best practices.

5. Manage routes and filtering as necessary.

6. Collect utilization data on Internet WAN routers and provide tooling necessary for reporting as defined in Exhibit 1 Appendix A (Reports).

7. Configure, manage and support an internet service offering at DIR Customer office locations. The internet service offering will provide:

a. Local firewall services,

b. Network address translation,

c. Dynamic Host Configuration Protocol (DHCP) services,

d. LAN switch functionality,

e. On-board wi-fi capabilities,

f. Internet access through optional transport technologies including broadband and cellular, and

g. DDOS protection for all internet services.

2.2.2.3 WAN Acceleration

In addition to the requirements in Section 2.2.2, WAN , Successful Respondent shall provide the following for WAN Acceleration services:

1. Engineer, configure, tune, test, support, and maintain WAN Acceleration devices as required by DIR Customers.

2.2.3 Wireless

Successful Respondent shall:

1. Provide Wireless systems support for building, and office connectivity to DIR Customer LANs, including DIR Customer site survey, engineering, design, procurement, programming, burn-in, installation, preventive maintenance, and upgrades for access points, antennae, and where applicable, Wireless bridges.

2. Manage Wireless controllers.

3. Manage Security systems (e.g., authentication servers) associated with Wireless LAN Systems.

4. Adhere to IEEE and PCI-DSS standards as well as DIR technical and Security guidelines with regard to Wireless LANs.

5. Provide secure, encrypted connectivity for Authorized Users to network services (e.g., Internet access, network printers, etc.) using network authentication and authorization with technologies such as 802.1x, RADIUS, and Active Directory.

6. Work with DIR Customer to determine if a guest network environment is required to enhance the ability to isolate untrusted networks, by bringing guest traffic in through the Internet perimeter and its Security layers.

7. Provision, manage, and support public use, no-fee to public, “hotspots” for open access to the Internet in applicable locations approved by DIR Customer (e.g. common areas, conference rooms, etc.).

8. Segment Wireless devices (e.g., access points) as required by DIR Customer.

9. Monitor Wireless secure networks as required by DIR Customer for unauthorized access and report to DIR Customers.

10. Employ appropriate encryption measures in compliance with state policies and standards (e.g., WPA3).

11. Comply with all radio frequency regulations.

12. Manage a personal device wi-fi network that provides guests with internet access from their personal wi-fi devices from the DIR Customer requested sites.

a. Validate VLAN segmentation is maintained between guest wi-fi network and DIR Customer’s network

b. Manage and validate the availability of the Wireless access controller

13. Disconnect or remove WLAN Equipment and related Software and configurations to meet DIR Customers’ business and Application requirements.

2.2.4 Firewall

As described in Table 2, Firewall and Web Applicaton Firewall services can only be procured if the DIR Customer also purchases one of the following: LAN, WAN, or Wireless services.

Successful Respondent shall:

1. Administer, configure, customize, and test firewall rules that have been identified, by either DIR Customer or the Successful Respondent, as applicable for the firewall Security implementation, per DIR standards or as otherwise approved by DIR Customer.

2. Continuously tune configurations to maximize firewall capabilities and protections.

3. Review and manage to resolution firewall Security Alerts, Events, Incidents identified through DIR Customers or DIR Security Operations Services as assigned to the Respondent.

4. Implement a lifecycle management and recertification process for all firewall rulesets.

5. Upon discovery of anomalies or inconsistencies in firewall policies or rulesets, escalate to DIR Customer with recommendations on next steps and changes.

6. Resolve Incidents and complete Solution Requests as assigned.

7. Create custom firewall rule(s) for DIR Customers approval as required by Security threats, vulnerabilities, and industry best practices.

8. Analyze the implications of proposed firewall rule changes received from DIR Customers, recommend deployment or rule adjustments for approval.

9. If a new threat is discovered, by the DIR Customer, DIR SecOps, or MSS within the DIR Customer’s computing environment, write a rule for DIR Customer’s written approval to secure network infrastructure.

10. Monitor custom rule deployment and address any of the ad-hoc troubleshooting or maintenance requests in accordance with the established Service Levels.

11. Successful Respondent must be able to support stateless, stateful, and next generation firewalls.

12. Monitor for unauthorized access or cyberattacks and notify and coordinate response with DIR Customer, DIR SecOps SCP, or MSS SCP.

13. Participate in Security incident response to provide additional Security information needed to respond to or manage the incident until the threat is mitigated or resolved.

14. Utilize the complexity matrix in Table 5 below to size the Firewall Services:

Firewall Complexity Matrix

2.2.5 Web Application Firewalls (WAF)

As described in Table 2, Network Services – Customer infrastructure, Firewalls and Web Application Firewalls can only be procured if the DIR Customer also procures one of the following: LAN, WAN, or Wireless.

Successful Respondent shall:

1. Install WAF updates and make configuration changes that address known vulnerabilities or risks to the web Application Server in accordance with industry best practices, or as required to maintain compliance with DIR and DIR Customer Security requirements.

2. Administer, configure, customize, and test WAF rules that have been identified by either DIR Customer, or the Respondent as applicable for the WAF Security implementation, per DIR Security Standards as identified in the SMM.

3. Continuously tune configurations to maximize WAF capabilities and protections.

4. Review and manage to resolution WAF Security Alerts, Security Events, and Security Incidents identified through the DIR Customer or DIR Security Operations Services as assigned to the Respondent.

5. If a new threat is discovered within DIR Customers’ computing environment, write a rule for DIR Customer’s written approval to secure the protected web application.

6. Provide written documentation on WAF coverage, as required by the DIR Customer.

7. Respond to and confirm any suspected priority events and make recommendations on whether traffic is malicious or legitimate and whether mitigations should be put into effect.

8. Monitor for unauthorized access or cyberattacks.

9. Participate in Security incident response to provide additional Security information DIR Customer may need to respond to or manage the incident until the threat is mitigated or resolved.

10. Implement a lifecycle management and recertification process for all WAF rulesets, in accordance with DIR Customer.

11. Upon discovery of anomalies or inconsistencies in WAF policies or rulesets, escalate to DIR Customer with recommendations on next steps and changes.

12. Utilize the WAF complexity matrix in Table 6 below to size WAF services

WAF Complexity Matrix

2.2.6 VPN

Successful Respondent shall:

1. Provide monitoring and management of the DIR Customer site-to-site and remote access VPN solutions.

2. Make certain the VPN solution adheres to current DIR Customer Security standards as defined in the SMM or industry best Security practices.

3. Provide system documentation with details of the VPN solution and configuration at the time of VPN release and with each major update or upgrade of the VPN solution Software utilized by DIR Customers.

4. Provide end-user use and configuration installation instructions.

5. Monitor, manage and update VPN access gateway devices within the distributed infrastructure that facilitate VPN access to DIR Customer assets.

6. Configure all Hardware to utilize standard network communications and high availability fail-over functionality.

7. Provide support for required encryption technologies.

8. Support multiple authentication methods (username/password, digital certificates, tokens, adaptive) via authentication (e.g. RADIUS, LDAP, Active Directory) system.

9. Manage and report licensing based on DIR Customer licensing capacity and thresholds or future growth as needed.

10. Provide acquisition, registration, distribution, and revocation of any digital certificates needed for the VPN solution and accompanying systems.

11. Provide integration with DIR Customer defined SIEM, if available including potentially multi-homing of alerts for all DIR Customer identified alerts/alarms based on inappropriate access or usage of the VPN solution.

2.2.7 DDI

2.2.7.1 IP Address Management (IPAM)

Successful Respondent shall:

1. Provide monitoring and management of the DIR Customer IPAM solution.

2. Provide IP address management as required by DIR Customers.

3. Provide a central support model of management.

4. Manage subnets address ranges and overall IP addresses schema.

5. Provide address reporting and auditing as defined in Exhibit 1 Appendix A (Reports).

6. Provide new address request management services.

7. Assign new and existing addresses as required.

8. Resolve any address conflicts.

9. Maximize efficiency of IP address assignment and usage of internal IP address ranges (e.g. RFC 1918).

10. Document and maintain IP address range details in PCM, TPC, and any other public and DIR Customer data center environments.

11. Develop and administer policies that support consistency throughout the network.

12. Interface and integrate with other SCPs of network services (e.g. DNS and DHCP).

2.2.7.2 Domain Name System and Dynamic Host Configuration Protocol (DNS/DHCP) Successful Respondent shall:

1. Provide both internal and external DNS services as required by DIR Customers.

a. External DNS services shall support enhanced Security features to help protect and identify attacks such as DNS cache poisoning, DNS hijacking, reflection attacks, and amplification attacks.

b. External DNS services shall support all standard resource record types plus the non-standard alias resource record type.

2. Provide DHCP services as required by DIR Customers.

3. Provide a central support model of management.

4. Manage DNS and DHCP services.

5. Provide reporting and auditing as identified in Exhibit 1 Appendix A (Reports).

6. Provide new request management services.

7. Provide DHCP proactive capacity monitoring and management.

8. Administer policies that support consistency throughout the network.

2.2.8 Staff Augmentation

Successful Respondent shall provide Network Staff Augmentation to supplement DIR Customers responsibilities related to network management, as further described in this section. Successful Respondent shall:

1. Perform the type and scope of work as determined by the applicable DIR Customer and agreed between Successful Respondent and DIR Customer.

2. Provide Network Staff Augmentation resources to augment network services for DIR Customers.

3. Deliver the categories of work and price according to Exhibit 2 (Financial Provisions and Pricing Requirements).

4. Deliver Network Staff Augmentation resources for network services defined in the SMM and described in Section 1.1.1, Eligible Customers and STS Program Restrictions.

2.3 Network Services – Successful Respondent Infrastructure

2.3.1 Network Operations (NOC)

Successful Respondent shall:

1. Provide a DIR approved multi-tenant NOC solution suitable to remotely monitor and manage multiple DIR Customer networks where those DIR Customers may be using using different technologies and platforms.

2. Provide DIR Customers read only access to the console as requested.

3. Install, configure, and provide ongoing network operations of DIR Customer network Software, network Hardware, firmware, and monitoring…