N2ITSM_Network_O M_PWS_DRAFT_v5_4_Feb_16.doc

NORAD and USNORTHCOM Information Technology

Service Management (N2ITSM) Peterson Air Force Base, CO

NETWORK OPERATIONS & MAINTENANCE

Performance Work Statement Current as of: 4 February 2016

DRAFT

Table of Contents 1 General

1.1 Description of Services

1.2 Background Information

1.3 Scope of Work

1.4 Estimated N-NC IT Environment and Level of Effort

1.5 Alteration of Services

1.6 Definitions of Responsibilities

1.7 Place of Performance

1.8 Hours of Operation

2 Tasks and Services Descriptions

2.1 task 1: Service Operations and Stability

2.2 task 2: Service Transition and Support

2.3 task 3: Service Optimization

2.4 task 4: Continuous Service Improvement 3 Service Summary

4 Furnished Items and Services

4.1 Government Furnished Items and Responsibilities

4.2 Contractor Furnished Items and Responsibilites

5 Specifics

5.1 Applicable Directives

5.2 Changes

5.3 Key Personnel

5.4 Special Qualifications

5.5 Information Assurance

5.6 Certification Updates

5.7 Other Direct Costs

5.8 Information and Documentation Requests

5.9 Contingency and Exercises

5.10 Process Requirements

5.11 Security Requirements

5.12 Contractor’s Quality Control

5.13 Quality Assurance

5.14 Recognized Holidays

5.15 Contracting Officer Representative

5.16 Primary Point of Contact

5.17 Contractor Personnel

6 Deliverables

7 Attachments/Appendix Listing general A. The work to be performed in accordance with (IAW) this Performance Work Statement (PWS) is in support of North American Aerospace Defense Command (NORAD) and United States Northern Command (USNORTHCOM).

B. Unless otherwise stated, work shall be in accordance with this PWS and the Base Indefinite Delivery/Indefinite Quantity (IDIQ) PWS.

1.1 DESCRIPTION OF SERVICES

1.1.1 The contractor shall provide non-personal services to manage, operate, sustain, and provide logistical and general support for the Information Technology (IT) Services, as identified in the Basic IDIQ Service Catalog attachment.

1.1.2 The contractor shall deliver all tasks identified in this task order in accordance with the specific tasks in this Performance Work Statement as well as adhering to the Basic IDIQ PWS.

1.1.3 The contractor shall provide professional, administrative, technical and management support for the N-NC Cyberspace Operations Directorate (N-NC/J6) to support the enterprise information technology (IT) services provided by the N-NC/J6 in support of NORAD and USNORTHCOM (N-NC) missions. The IT services, as identified in the Basic IDIQ Service Catalog, are ultimately responsible for day-to-day operational effectiveness of the NORAD and USNORTHCOM C4S architecture.

1.2 BACKGROUND INFORMATION

1.2.1 N-NC conducts theater security cooperation and supports counterdrug activities in order to promote democracy and stability in the NORAD and USNORTHCOM Area of Responsibility (AOR). The Command responds unilaterally or multilaterally to crises that threaten regional stability, security, or national interests. It also continuously prepares for future hemispheric challenges.

1.3 SCOPE OF WORK

1.3.1 To provide Network Operation and Maintenance services. The contractor shall provide non-personal services to manage, operate, sustain and provide logistical and general support for the IT services and service assets. To include: Information Transport, Network Distribution, Computing Services, Application Services, Technical Management, and Information Assurance (IA)/Cybersecurity service categories in accordance with the Basic IDIQ Service Catalog Responsible, Accountable, Consulted and Informed (RACI) matrices for each service. For the Combatant Command (COCOM) Mission Service category, provide Service Desk functions and Service Operations responsibilities, in addition to the Technical Management for the supporting services such as Information Transport and Network Distribution that COCOM Mission Services have dependencies.

1.3.2 The contractor shall provide all levels of maintenance and support. Contracted services include ITIL processes and functions supporting IT Service Strategy Support, Service Design, Service Transition, Service Operations, and Continual Service Improvement. Specific functions include Service Desk, IT Operations, Technical Management, and Applications Management. Contract task include: IT operations and maintenance, IT projects, IT design, testing and validation, component installation, service asset/component diagnostics/troubleshooting, service asset/component repair/replacement, enterprise network management, hardware and software handling/accountability, technical refresh/lifecycle replacement, network administration, systems administration, storage administration, enterprise network and security operations, telecommunications, configuration control and management, enterprise modeling and simulation, visual information/video teleconferencing, IA/cybersecurity, service desk, user training, exercise, contingencies, and support for national special security events (NSSE); and provide IT procurement for break-fix and for individual task orders.

1.3.3 The contractor shall recommend and identify changes to IT services, identify upgrades and service changes to improve the utility and warranty of IT Services in an effort to reduce total cost of ownership and increase efficiencies (proposed changes shall be approved through the N-NC Change Management process). However, changes to services in the Basic IDIQ Service Catalog that maintains the utility and warranty of that service is considered in scope of this contract as normal sustainment, and the contractor shall recommend implementation IAW industry best practices without imposing additional labor cost upon the Government. Changes in the technological environment may include application upgrades covered under software assurance agreements, technical modernization of service assets, and replacing service assets that are nearing end of life; establish, maintain, and administer an integrated Knowledge Management System (KMS), portal-based, for collection, control, publishing, and delivery of all program/PWS documents, and make the KMS available and accessible to the Government.

1.3.4 The Government retains the right to bring in external support to perform independent auditing, technical compliance, architectural services, and analysis functions on the existing enterprise, to review any contractor provided products, and implement new or significant changed service requirements.

1.4 ESTIMATED N-NC IT ENVIRONMENT AND LEVEL OF EFFORT

1.4.1 USERS

The current number of active end user computing devices range between 6,500 and 6,800 depending on status of Battle Staff operations. The contractor shall be expected to support approximately 2,500 users in the N-NC Headquarters, Peterson AFB proximity, and Cheyenne Mountain Air Force Station (CMAFS) locations, approximately 50 users geographically located at ODC Mexico, U.S. Embassy, Mexico City, Mexico, to include the Information Analysis Center (IAC) in the U.S. Embassy Mexico, approximately 10 users in ODC Bahamas, and approximately 25 users in the Washington Office. The remaining users shall be supported by the contractor through the Enterprise Tier Support Requirements defined in Table 3. Users are designated priority levels to ensure service requests and incidents are responded to and resolved in a prioritized manner. Definitions and response requirements for all four categories are outlined in Paragraph 1.6 Definition of Responsibilities. N-NC has experienced an average 2-3% growth per year over the past three (3) years in IT service assets.

1.4.2

SERVICES

The contractor shall provide the services in the Basic IDIQ Service Catalog and supporting services, infrastructure, transport, and access. The Basic IDIQ Service Catalog, Attachment 1, identifies the following service categories that the contract has roles and responsibilities for:

A. Information Transport (Primarily DISA provided services)

B. Network Distribution

C. Computing Services

D. Applications Services

E. Technical Management Services

F. Cybersecurity Services

G. Directorate Services (Services that have directorate ownership and require N2ITSM support)

H. COCOM Mission Services (Services that have dependency to N2ITSM contractor operated services)

1.4.3 DATA CENTERS & INFRASTRUCTURE

1.4.3.1 N-NC operates data centers within Building 2, the N-NC Command Center (N2C2) complex and within the CMAFS facility. The contractor shall provide IT access management, asset accountability, and operations for each of these facilities:

A. N-NC Headquarters, Building 2

B. NORAD and USNORTHCOM Command Center (N2C2) Complex, Building 2

C. Network Control Center (NCC) Room, CMAFS

1.4.3.2 The N-NC and CMAFS infrastructure hardware assets for network access, campus, distribution, and TLA stacks are in the transition of being replaced from a Cisco original equipment manufacturer based environment to a Cisco Juniper Network mixed original equipment manufacturer base environment. The transition will begin in March 2016 with an expected mixed Cisco Juniper environment thru calendar year 2016. The transition is being performed by a third-party contractor. The contractor shall be responsible for both Cisco and Juniper network certified and experienced staff to perform the Transition and Support and Operations and Stability tasks and Tier 1/2/3 Technical Management IAW this PWS.

1.4.3.3 The scope of the N-NC Infrastructure is primarily contained in the N-NC Headquarters, N-NC Operations Centers, and Cheyenne Mountain Air Force Stations (CMAFS). The tables below provide an approximate magnitude for these locations that the contractor will be responsible for operations and maintenance. Table 1 includes both the N-NC Headquarters and CMAFS infrastructure. Table 2 includes the infrastructure that supports N-NC Operations such as the command center and battle cells.

IT Infrastructure Magnitude

Workstations

CENTRIXS MX

20 Workstations

Transport

40GB backbone

40GB backbone

2 Firewalls

14 Routers/Switches

2 Major Boundaries 2 Firewalls

5 Routers/Switches 2 Firewalls

18 Routers/Switches

2 Major Boundaries

Data Centers (x3)

Table 1 – N-NC Infrastructure Magnitude

Operations Center IT Magnitude

Center 1

Center 2

ENCORE

7 Servers, 1 NAS, 2 Routers/Switches

Systems

Table 2 – N-NC Operations Center Infrastructure Magnitude

1.4.4 INFORMATION TECHNOLOGY SERVICE MANAGEMENT (ITSM) CAPABILITIES & TOOLS

The Government will provide available ITSM software and tools as listed in the Technical Library, Appendix D. The contractor shall assume that the ITSM capabilities and tools required to meet contractual requirements and execute this PWS may not be fully configured and optimized.

1.4.5 PROCESSES AVERAGE WORKLOADS

A. Service Desk: 1,500-2,000 calls per month.

B. Incident Management: 1,500-2,000 user incidents per month.

C. Requests Fulfillment: 800-1,000 standard and non-standard IT requests per month.

D. Change Management: 100-150 requests for change (RFC) for operations and maintenance changes per month.

E. Project Management: 2-4 projects per Project Leads/Operations Manager. Workload is based lined on full time equivalent (FTE).

F. Service Portfolio: Three (3) Service Packages for new IT requirements per month, ten (10) Non Standard Analysis Reports per month.

G. Service Design: 2-3 Service Design Packages per month for service improvements and technology upgrades/lifecycle replacement.

H. Service Improvement: Five Service Improvement Packages per quarter for services that do not meet service performance requirements.

I. Standard Requests

(1) Installing new application on the virtual infrastructure that supports less than 20 users that is not in the N-NC Software Catalog; 10-15 application installs per year

(2) Providing access to a non N-NC hosted web site or portal; 10-15 web sites per year

(3) Additions to existing N-NC services that do not cause a 5% increase in service capacity, like the number of users and/or number or connections/drops.

(4) Office moves or new installs of ten (10) or less personnel to include all workstations, peripheral devices, and network drops; 10-12 office moves or new installs per year estimating up to 100 users per year.

(5) Changes to proprietary or third-party Government Off-the-Shelf (GOT) or Commercial Off-the-Shelf (COT) software/application that are dependent on N-NC services to release or deploy successfully.

(6) All equipment installation necessary for standard desktop and automation configurations.

J. Lifecycle Replacement

(1) Workstations/Laptops hardware lifecycle replacement; 1,000-1,500 per year

(2) Infrastructure Server Blades, Routers, Access Switches; 25-35 per year

(3) Upgrade Operating System on all servers before EOL, achieve a five (5) year lifecycle replacement for all servers (physical and virtual)

(4) Upgrade Operating System on all workstations/laptops/tablets/mobile devices before EOL; achieve a five (5) year lifecycle replacement for all devices.

K. Network and Infrastructure: Estimate up to 200 network drop installs, 50 cable TV installs (or removals) and related drops, 200 network drop moves/relocations annually.

1.5 ALTERATION OF SERVICES

Over the life of the contract, the Government could execute the transition of services, processes, and/or functions from N-NC to other DoD Service Providers. The contractor shall support efforts with the staffing proposed in this contract to assist in the Service Design and Transition of services that are in the Basic IDIQ Service Catalog.

1.6 DEFINITION OF RESPONSIBILITIES

The contractor shall provide support for all levels of maintenance. The contractor shall provide support for the N-NC Enterprise Tier Support as defined in Table 3 for on-site, dispatched, and off-site maintenance. These maintenance levels apply to all services in the Basic Service Catalog and those extended to subordinates, regions, and sectors.

1.6.1 IT OPERATION SUPPORT LEVELS

1.6.1.1 Enterprise Maintenance Levels

A. First-Point Resolution (Tier 1): Performs first look trouble-shooting, including cables, configuration, and customer errors, escalation of Incidents, problems, and service requests to DoD Enterprise Service Providers or other Third-Party Providers. Third-Party provides could include commercial service providers, vendors, and original equipment manufacturers (OEM).

B. Second-Level Support Group (Tier 2): First point of escalation for problems beyond the scope of the Tier 1 technicians. Would include global server configuration settings, security policy, network infrastructure, and application configurations.

C. Third-Level Support Group (Tier 3): Final level of escalation for issues beyond the scope of the Tier 2 personnel, including interactions between systems, global network changes, upgrades to newer versions of hardware/software, and third party contracts. Tier 3 support may, but not necessarily, require an underpinning contracts so that Tier 3 personnel can coordinate fixes with the vendor and or OEM. The contractor shall provide Tier 3 trained and certified staff to support the core infrastructure and systems that N-NC operates for all networks.

1.6.1.2 ITSM Prioritization Levels. The following ITSM Prioritization levels are established to support N-NC Enterprise Operations, Users, and Services.

A. Priority 1A

(1) Priority 1A designation is reserved for Battle Staff Center seats. The seats are associated with the elements identified in the N-NC Publication 1-01 Battle Staff Standard Operating Procedure (BSOP). The primary location for the P1A seats is the N2C2 but the priority designation applies to any location occupied by Battle Staff personnel. Deployed elements in support of N-NC missions. The contractor shall support the Alternate Command Center (ACC) in CMAFS during contingency operations.

(2) Service outages escalated and service requests submitted by the 721st Communications Squadron Operations that are identified as “Critical” supporting the N-NC IT Operations and services located in Cheyenne Mountain Air Force Station (CMAFS) facility.

B. Priority 1

(1) Users: General Officers (GO), Flag Officers (FO), Senior Executives Service (SES), Office of Defense Coordination/Chiefs, Directors and Element Commander users.

(2) Services. Mission Critical communications equipment or systems whose failure prevents mission accomplishment. Mission Critical and Essential services as identified in the Basic Service Catalog, Attachment 2.

(3) All users located at subordinate commands, regions, sectors, and service components that have N-NC services extended to those organizations and if the incident isolates and/or degrades service. Service outages deemed critical by the appropriate Government Service Owner.

(4) Service outages escalated and service requests submitted by the 721st Communications Squadron Operations that are identified as “High” supporting the N-NC IT Operations and services located in Cheyenne Mountain Air Force Station (CMAFS) facility.

C. Priority 2

(1) Users. Support staff for GO/FO/SES (Priority 1) users; per the N-NC Chief of Staff’s Staff Directory and All command special staff directors.

(2) Services. Mission Essential communications equipment or systems whose failure prevent mission accomplishment but does not impact Priority 1A and 1 users.

(3) Service outages escalated and service requests submitted by the 721st Communications Squadron Operations that are identified as “Medium/Low” supporting the N-NC IT Operations and services located in Cheyenne Mountain Air Force Station (CMAFS) facility.

D. Priority 3

(1) Users. All other N-NC users using N-NC IT Services.

(2) Services. Any request for assistance from a subordinate commands, regions, sectors, and service component service provider that have N-NC services extended to those organizations.

1.6.2 IT SITE SUPPORT LEVELS

The following support levels apply to locations listed in Table 3.

A. On-site: Adequate IT support staffing primary location is listed Table 3 below.

B. Off-site: Remote support only will be provided to these locations listed in Table 3 below. If on-site support is required, travel costs will be incurred and reimbursable by the Government in accordance with Joint Federal Travel Regulation (JFTR).

C. Dispatch: While IT support is not housed/co-located at these locations, if required, IT support staff shall be required to travel on-site to the impacted locations in accordance with JFTR. The contractor shall be dispatched IAW local guidance and policy.

N-NC Headquarters

X

X

X

X

X

X

Joint Cyber Center (JCC)

Peterson AFB Support Buildings

SCONORTH (Hangar 104 & Hangar 140)

Bldg. 920 (N-NC/J2)

Bldg. 1470/71 (N-NC, DISA)

GO/FO Housing (Approximately 10 Houses)

Colorado Springs Locations

Western CONUS Regional Support Center

X

X

Leidos Facility (N-NC/J7)

X

X

J6 IT Warehouse (N2ITSM Contractor Location)

X

Cheyenne Mountain Air Force Station

NORAD Regions and Sectors

X

X

Canadian Region (CANR), Winnipeg CA

X

X

Canadian Air Defense Sector (CADS) North Bay, CA

X

X

Western Area Defense Sector (WADS), JB Lewis-McCord, WA

X

Eastern Area Defense Sector (EADS), Rome, NY

X

USNORTHCOM Subordinates

Joint Forces Headquarter National Capital Region (JFHQ-NCR)

X

Alaska Command (ALCOM)

X

Joint Task Force - Civil Support (JTF-CS)

X

Joint Task Force - North (JTF-North)

X

Army North (ARNORTH)

X

X

X

Air Force North (AFNORTH)

X

X

X

US Forces Fleet Command (NAVNORTH)

X

X

X

X

Office of Defense Bahamas, Embassy of the U.S. Nassau, Bahamas

X

Deployed Sites (Per Mission Requirements; Exercise/Contingency)

X

X

Table 3 - N-NC Enterprise Tier Support Requirements

1.7 PLACE OF PERFORMANCE

1.7.1 PRIMARY ON-SITE

The primary location for contract performance is N-NC Headquarters, located in Building 2, Peterson AFB, CMAFS, and Colorado Springs, Colorado area. The allotment of Government-provided contractor on-site workspace at the primary on site location is not-to exceed 56 seats with 24/7 access as noted in Table 4. The contractor shall support all locations served by the N-NC IT Enterprise identified in Table 3 of this PWS.

Table 4 - Contractor Seating Allotment at N-NC Headquarters, located in Building 2

1.7.2 GEOGRAPHICAL LOCATION ON-SITE SUPPORT

The geographically separated locations identified in Table 3 require on-site support at those locations. The allotment of Government provided contractor on site workspace is not to exceed 3 seats with 24/7 access support at ODC Mexico. The allotment of Government provided contractor on site workspace is not to exceed 1 seat with 24/7 access at the Washington Office. There is no government provided on site workspaces at ODC Bahamas, however access is provided to support 6 dispatched on site visits per year to perform O&M maintenance support.

1.7.3 CONTRACTOR OFF-SITE

Due to on-site seating limitations the contractor shall also work outside of N-NC Headquarters, Building 2 to the maximum extent possible. The Government, upon approval, may provide at the contractor’s off-site facility limited Non-secure Internet Protocol Router (NIPR) workstations and printers, if needed. The contractor shall be responsible for network transport and infrastructure to N-NC Headquarters, Building 2 for NIPR access.

1.8 HOURS OF OPERATION

1.5.1 The contractor’s core operating hours are 7:30 am to 4:30 pm, Monday thru Friday, except Federal holidays (see para 5.14 below) or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. In addition, the contractor shall provide support and response to incidences per the services priorities (paragraph 1.6.1.2) and respective response times (Incident Management and Service Request) to include:

A. Provide telephone service support 24/7/365 B. Provide 24/7/365 support for all services IAW ITSM priorities established in this PWS C. Provide 24/7 support during exercises and contingencies D. Service Desk operating hours are from 6:00 am to 6:00pm, Monday thru Friday

2.

TASKS AND SERVICES DESCRIPTION

The Contractor shall provide on-site IT Service Management for the specified tasks and sub-tasks. The N2ITSM Performance Work Statement shall be the core responsibilities for all IT Service Management support to ODC Mexico and its customers, users, systems, and services. The specific tasks and sub-tasks are identified to scope the responsibilities and performance required for the on-site staff with the expectation that the N2ITSM Network Operations and Maintenance (O&M) PWS will provide on-site contractor reach-back for those ITSM tasks and sub-tasks performed in this PWS and the N2ITSM O&M PWS. All Tasks and Subtasks should be integrated into the N2ITSM IDIQ Performance Work Statement requirements for the require Process Models. All Task and Subtask metrics should be reported separately for this task, but included in the overall Critical Success Factors.

2.1

TASK 1: SERVICE OPERATIONS AND STABILITY

2.1.1

SUB-TASK 1: SERVICE DESK

The Service Desk is the primary point of contact for users experiencing a service disruption or requesting a service and/or a service change. The goal of the Service Desk is to provide incident management and request fulfillment. The Service Desk resumes normal service to the user in accordance with priority level response times and documents and facilitates service requests.

2.1.1.1 REQUIREMENTS-The contractor shall:

A. Provide a Service Desk function that will support the users specified in Paragraph 1.4.1. During contingency and exercise operations, the Service Desk will be staffed 24/7 to meet the user demand.

B. Provide, integrate, and manage Service Desk functions to meet Government specified outputs, Operational Metrics (OM), Key Performance Indicators (KPI), and Critical Success Factors (CSF) identified below. The COR will review and validate reports and documents provided by the contractor and provide feedback.

C. Maintain the Service Desk as the primary point of contact for all incoming calls, walk-ins, and emails. The contractor shall provide a customer focused interface between the users to enable the efficient use of IT services, assisting in the restoral of normal services, in addition to assisting users against potential service interruptions.

D. The Contractor shall provide Common Access Card (CAC) unlock and Personal Identification Number (PIN) reset capability for NORAD and USNORTHCOM Personnel through the Service Desk and the N2C2 On-Site technical support.

E. Ensure all Service Desk requests that are identified as standard requests are immediately processed based on approved request models and nonstandard requests are logged and routed for contractor analysis.

F. Provide accurate status updates and feedback to the Contracting Officer Representative (COR) or designated Government Representative on all incidents, service and change requests submitted to the Service Desk on a weekly basis, until resolved, fulfilled, or officially declined by the Government. Develop and utilize a method to track that status updates are being delivered and provide weekly reports of notification history to the COR or designated Government Representative.

G. Utilize an incident, request, and call management system to log, categorize, and escalate incident records as well as record workarounds, maintain a known error database, and document final resolution within required timelines. Expose a customer facing view of the database to allow all N-NC customers (to include subordinates, regions, and sectors) to check on the status of requests in real-time. Maintain CAC PIN reset capability during normal service desk hours.

2.1.1.2 OUTPUTS: (Service Output Specifications, See Attachment 3) A. Monthly Service Desk Call Report 2.1.1.3 OPERATIONAL METRICS: (Monthly) A. Total Number Of Incidents Recorded By Service Desk B. Average Call Waiting Time (Seconds) C. Number Of Calls Abandoned after 60 Seconds D. Total Number Of First Contact Resolutions (i.e. walk-ins, phone calls) Tickets, within 15 minutes E. Total Number Of Calls Received

2.1.1.4 KEY PERFORMANCE INDICATORS: (Monthly)

A. Call Abandon Rate [Metric: C/E]

(1) Superior Service Threshold: 3%

(2) Service Warning: 5% B. Call Waiting Rate [Metric: B]

(1) Superior Service Threshold: (60 seconds)

(2) Service Warning: (120 seconds) C. First Contact Resolution Rate [Metric: D/A]

(1) Superior Service Threshold: 70%

(2) Service Warning: 55%

2.1.1.5 CRITICAL SUCCESS FACTORS:

A. Maintain Quality IT Services B. Improve User Satisfaction C. Effective Communications with Users 2.1.2

SUB-TASK 2: INCIDENT MANAGEMENT:

Incident management covers every occurrence that disrupts or might disrupt a network, system, capability, or security service. This includes incidents reported by customers to the Service Desk as well as those reported by subordinate, deployed, or alternate command sites, and automated systems. The goal of Incident Management is to restore normal service operation to meet user priority levels and minimize the adverse effect on operations, thus ensuring that the best possible levels of service quality and availability are maintained.

2.1.2.1 REQUIREMENTS-The contractor shall:

A. Provide, integrate, and manage Incident Management to meet Government specified outputs, OMs, KPIs, and CSFs identified below. The COR will review and validate reports and documents provided by the contractor and provide feedback.

B. Apply the following ITSM Prioritization Levels to incident management. By exception, the IT Service Management Division Chief can elevate the priority of an operations element, staff section, and/or mission essential personnel for a temporary period of time to meet an urgent or critical command need and if there is a significant impact to meet the mission. Similarly, the Director/Deputy Director of Command and Control Systems can also determine that the incident does not impair the operational mission of the user at the priority listed and can downgrade the priority to ensure unnecessary focus is not diverting efforts from issues with more operational necessity.

(1) Priority 1A

i. Priority 1A designation is reserved for Battle Staff Center seats. The seats are associated with the elements identified in the N-NC Publication 1-01 Battle Staff Standard Operating Procedure (BSOP). The primary location for the P1A seats is the N2C2 but the priority designation applies to any location occupied by Battle Staff personnel. Deployed elements in support of for N-NC missions (e.g. Homeland Defense, Civil Support, and NSSEs.

ii. Restoral of service within two (2) hours of outage notification and respond within 30 minutes

(2) Priority 1

i. Users: GO/FO/SES/Director/Element Commander users. Service restoration shall be contingent upon a required time coordinated with the executive staff or requested by the IT Service Management Division Chief.

ii. Services: Mission communications equipment or systems whose failure prevents mission accomplishment Mission Critical and Essential services as identified in the Basic IDIQ Service Catalog. Priority 1 applies to all N-NC services extended to subordinate commands, regions, sectors, and service components which isolates and/or degrades services. Service outages deemed critical by the appropriate Government Service Owner.

iii. All require restoral of like service capability within four (4) hours.

(3) Priority 2

i. Users: Support staff for GO/FO/SES (Priority 1) users; per the N-NC Chief of Staff’s Staff Directory and All command special staff directors.

ii. All require restoral of like service capability within 12 business hours.

(4) Priority 3

i. Users: All other N-NC users using N-NC IT Services.

ii. Manage, configure, install, troubleshoot, maintain and upgrade Government-approved incident management systems. Make the incident management system available for Government access, use, and review at all times.

iii. Respond and resolve all incidents for N-NC users. Priority 3 user incidents shall be resolved within 60 business hours. To minimize the incident aging, ninety percent (90%) of Priority 3 user problems shall be resolved 60 business hours, and one-hundred percent (100%) of Priority 3 user problems shall be resolved within 80 business hours (i.e. this requires all Priority 3 tickets to be resolved in ten (10) business days). All user incidents not resolved within 80 business hours shall be reported in the Daily Service Desk Report.

iv. Contact end-user on any anticipated service level breaches based on end-user priority.

v. All open incidents, after the 60 days phase-in period, will be reported to the COR within ten (10) business days. Incident open dates will be reset to contract start date and resolved IAW the ITSM prioritization schema.

vi. Report all major incidents defined by either a service outage or degradation affecting ten (10) or more users or a Core Service outage within 30 minutes to the Government Service Owner for Network Operations.

2.1.2.1 OUTPUTS: (See Attachment 3 Service Output Specifications) A. Monthly Incident Management Report B. Monthly Service Level Agreement (SLA)/ Operational Level Agreement (OLA) Breach Reports C. Monthly Major Incident Report D. Incident Models (Required within one (1) hour after closure of Major Incident

2.1.2.2 OPERATIONAL METRICS: (Monthly)

A. Total Number Of Incidents (All incidents resolved) B. Number Of Incidents Resolved Within Priority Levels C. Number Of Incidents Reopened Within Ten (10) Working Days

D. Incidents Caused By Customer (e.g., Port Blocked Denial of Service, Password Lock Out)

E. Number Of Closed Incidents without Customer/User Agreement

F. Number of Priority 3 Incidents Resolved within 60 Business Hours

G. Number of Priority 3 Incidents Resolved

H. Average Time to Incident Resolution for Priority 1A User

I. Average Time to Incident Resolution for Priority 1 User

J. Average Time to Incident Resolution for Priority 2 User

K. Average Time to Incident Resolution for Priority 3 User

2.1.2.3 KEY PERFORMANCE INDICATORS:

A. Incident Resolution Rate [Metric: (B/A)]

(1) Superior Service Threshold: 95%

(2) Service Warning: 90%

B. Customer Incident Impact Rate [Metric: (D/A)]

(1) Superior Service Threshold: 4.5%

(2) Service Warning: 7.5%

C. Incident Reopen Rate [Metric: (C/A)]

(1) Superior Service Threshold: 4.5%

(2) Service Warning: 7.5%

D. Customer Dissatisfaction Rate [Metric: (E/A)]

(1) Superior Service Threshold: 5%

(2) Service Warning: 10%

E. Incident Resolution (Avg) for Priority 1A Users [Metric: H]

(1) Superior Service Threshold: One (1) hour (Average)

(2) Service Warning: Two (2) hours (Average)

F. Incident Resolution (Avg) for Priority 1 Users [Metric: I]

(1) Superior Service Threshold: Two (2) hours (Average)

(2) Service Warning: Four (4) hours (Average)

G. Incident Resolution (Avg) for Priority 2 Users [Metric: J]

(1) Superior Service Threshold: Eight (8) business hours (Average)

(2) Service Warning: 12 business hours (Average)

H. Incident Resolution (Avg) for Priority 3 Users [Metric: K]

(1) Superior Service Threshold: 36 business hours (Average)

(2) Service Warning: 60 business hours (Average)

I. Priority 3 Incident Aging [Metric: F/A]

(1) Superior Service Threshold: 90%

(2) Service Warning: 80%

2.1.2.4 CRITICAL SUCCESS FACTORS:

A. Provide Effective and Efficient IT Service Management

B. Maintain Quality IT Services

C. Improve Mission/Business Productivity with IT Services

D. Improve User Satisfaction

2.1.3 SUB-TASK 3: REQUEST FULFILLMENT

Request Fulfillment is the process that incorporates all aspects of fulfilling a customer’s approved IT request. IT requests can be either for hardware or software equipment, devices, application, etc. that are offered in the Service Catalog. User requests can be requests for information, advice, a standard change, or access to a service in the Service Catalog. It should include self-service for identifying available services, capture the service request, approval, tracking, provisioning, delivery and delivery confirmation. The goals of the Request Fulfillment process are:

A. To offer users a channel through which they can request and receive services; to this effect an agreed approval and qualification process must exist B. To provide users and customers with information about the availability of service and the procedures for obtaining these services C. To assist with general information, complaints, or comments

2.1.3.1 REQUIREMENTS-The contractor shall:

A. Provide, integrate, and manage Request Fulfillment to meet Government specified outputs, OMs, KPIs, and CSFs identified below. The Government will review and validate reports and documents provided by the contractor and provide feedback.

B. Apply the following ITSM Priority Levels to request fulfillment.

(1) Priority 1A requests will be fulfilled in three (3) business days

(2) Priority 1 user requests will be fulfilled within five (5) business days

(3) Priority 2 user requests will be fulfilled within ten (10) business days

(4) Priority 3 user requests will be fulfilled within 14 business days

(5) All Priority 1A, 1, and 2 service requests exceeding the specified fulfillment days will be reported daily.

C. By exception, the Director of Command and Control Systems, can elevate the priority of an operations element, staff section, and/or mission essential personnel for a temporary period of time to meet an urgent or critical command need and if there is a significant impact to meet the mission.

D. Manage, configure, install, troubleshoot, maintain and upgrade Government-approved service request management systems. Make the service request management system available for Government access, use, and review at all times.

E. Respond and resolve all service requests for N-NC users and customers. Estimated average 1,500 service requests per month, both standard and non-standard.

F. Report all open service requests within 70 calendar days after contract start date.

G. After 90 calendar days of contract start, produce quarterly standard request model according to volume, recommended changes and updates. This report shall be provided to the designated Government representative.

H. Produce a Request Model for each IT Service. A Request Model should include, at a minimum, approval authority, provisioning steps, associated costs, funding approval steps, service assets, the Core Service Package (See Service Catalog), and any associated Service Level Packages for any differentiated offerings. Each Request Model will be approved by the Change Advisory Board prior to it becoming a standard change.

2.1.3.2 OUTPUTS: (See Attachment 3 Service Output Specifications) A. Monthly and Quarterly Request Fulfillment Report B. Monthly Request Model for each IT Service

2.1.3.3 OPERATIONAL METRICS: (Monthly)

A. Average Time to Fulfill Requests for Priority 1A User

B. Average Time to Fulfill Requests for Priority 1 User

C. Average Time to Fulfill Requests for Priority 2 User

D. Average Time to Fulfill Requests for Priority 3 User

E. Number Of Request Fulfillment Complaints

F. Total Number of Requests

G. Number Of Requests Reopened

2.1.3.4 KEY PERFORMANCE INDICATORS:

A. Request Fulfillment Rate for Priority 1A Users [Metric: A]

(1) Superior Service Threshold: Two (2) business days (Average)

(2) Service Warning: Three (3) business days (Average)

B. Request Fulfillment Rate for Priority 1 Users [Metric: B]

(1) Superior Service Threshold: Three (3) business days (Average)

(2) Service Warning: Five (5) business days (Average)

C. Request Fulfillment Rate for Priority 2 Users [Metric: C]

(1) Superior Service Threshold: Seven (7) business days (Average)

(2) Service Warning: Ten (10) business days (Average) D. Request Fulfillment Rate for Priority 3 Users [Metric: D]

(1) Superior Service Threshold: Ten (10) business days (Average)

(2) Service Warning: 14 business days (Average)

E. Request Fulfillment Satisfaction Rate [Metric: 1-(E/F)]

(1) Superior Service Threshold: 95%

(2) Service Warning: 90%

F. Service Request Reopen Rate [Metric: G/F]

(1) Superior Service Threshold: 3.0%

(2) Service Warning: 5.0%

2.1.3.5 CRITICAL SUCCESS FACTORS:

A. Deliver Accurate and Timely IT Services

B. Maintain Quality IT Service

C. Improve User Satisfaction

2.1.4 SUB-TASK 4: ACCESS MANAGEMENT:

A. Access Management consists of the processes and procedures responsible for allowing users to make use of IT services, systems, applications, data, or other IT assets. Access Management helps to protect the Confidentiality, Integrity and Availability of assets by ensuring that only authorized users are able to access or modify the assets.

B. The goal of Access Management is to ensure internal and external users have the appropriate level of access to a service, but differs from Availability Management in that it does not guarantee that access is always available at the agreed times.

C. Access Management applies to all N-NC managed systems and encompasses such systems without regard as to operating system or whether the access control is integrated into Active Directory Services.

2.1.4.1 The contractor shall ensure key access management personnel have the requisite education, expertise and/or experience to execute tasks. Commercial certification requirements for cybersecurity, IAW DoD 8570.01-M, IA Workforce Improvement Program, have previously been referenced in this document. While certifications are mandatory, they are often insufficient and cannot be a substitute for experience and expertise managing an effective access management and identity management program. Contractor’s key personnel should have an understanding of applicable directives and programs and be able to integrate access and identity initiatives in the most effective and efficient manner possible.

A. DoD Approved 8570 Baseline Certifications are maintained at the following link. (Information below retrieved from this site as of 17 Mar 2015.) http://iase.disa.mil/iawip/Pages/iabaseline.aspx B. As an extension of Appendix 3 to DoD 8570.01-M, the following certifications have been approved as IA baseline certifications for the IA Workforce. Personnel performing IA functions must obtain one of the certifications required for their position category or specialty and level. Refer to Appendix 3 of DoD 8570.01-M for further implementation guidance. For example, an individual in an Information Assurance Technical (IAT) Level II position could obtain any one of the four certifications listed in the IAT Level II cell. Higher level IAT and Information Assurance Manager (IAM) certifications satisfy lower level requirements. Certifications listed in Level II or III cells can be used to qualify for Level I. However, Level I certifications cannot be used for Level II or III unless the certification is also listed in the Level II or III cell. For example, the A+ or Network+ certification qualify only for Technical Level I and cannot be used for Technical Level II positions.

A+ CE

Network+ CE

SSCP

CCNA Security

GSEC

Security+ CE

SSCP

CCNA Security

CISA

GCIH

CISSP (or Associate)

GCED

CASP

CAP

GSLC

Security+ CE

CAP

GLSC

CISM

CASP

CISSP (or Associate)

GSLC

CISM

CISSP (or Associate)

CISSP (or Associate)

CASP

CSSLP

CISSP (or Associate)

CASP

CSSLP

CISSP - ISSEP

CISSP - ISSAP

GCIA

CEH

GCIH

SSCP

CEH

GCIH

CSIH

CEH

GCFA

CISA

GSNA

CEH

CISSP – ISSMP

CISM

Table 5 - DoD Approved Baseline Certification C. The above table provides a list of DoD approved IA baseline certifications aligned to each category and level of the IA Workforce. Personnel performing IA functions must obtain one of the certifications required for their position, category/specialty and level to fulfill the IA baseline certification requirement. Most IA levels within a category or specialty have more than one approved certification and a certification may apply to more than one level.

2.1.4.2 The System Security Certified Practitioner (SSCP) certification qualifies for both Technical Level I and Technical Level II. If the individual holding this certification moved from an IAT Level I to an IAT Level II position, he or she would not have to take a new certification. Higher level Computer Network Defense Service Providers (CND-SP) and Information Assurance System Architect and Engineer (IASAE) certifications do not satisfy lower level requirements.

(IA Certification)

(within six (6) months) Yes

(IA Certification)

(within six (6) months) Yes

(IA Certification)

(within six (6) months) Yes

(CND Certification)

(within six (6) months)

(for initial position)

(except CND-SPM)

(except CND-SPM)

(as required by certification) Yes

(as required by certification) Yes

(as required by certification) Yes

(as required by certification)

(as required by certification) Yes

(as required by certification) Yes

(as required by certification) Yes

(as required by certification)

(except CND-SPM)

CND-A: at least two (2) CND-IR: at least five (5) CND-AU: at least two (2)

Table 6 - IA Workforce Qualifications

2.1.4.3 REQUIREMENTS-The contractor shall:

A. Provide, integrate, and manage Access Management to meet Government specified outputs, OMs, KPIs, and CSFs identified below. The Government will review and validate reports and documents provided by the contractor and provide feedback.

B. Maintain documentation of all “Normal” user accounts. Required documents are Department of Defense (DD) Form 2875-System Authorization Access Request (SAAR), Basic User Agreement, and Inactive Account Exemption Request form.

C. Maintain documentation of all “Privileged/Elevated” accounts that are approved by the Government for services and service assets in the N-NC Service. Prior to requesting a privileged/elevated account, user must have a current basic user account with documents on file. Required documents are DD Form 2875-SAAR with a valid requirement, Privileged User Agreement, and DoD 8570.01-M specific certifications (must have required certifications prior to being hired on to the contract). The Government retains the right to review, approve, disapprove, all personnel with privileged and elevated accounts.

D. Conform to DoD 8570.01-M IT security and system specific certification requirements for granting elevated access privileges. Ensure that all personnel with elevated access are commercially certified on each service asset they have elevated access to relative to their labor category. For service assets without a formal certification program course completion of relevant training is sufficient. Personnel must also obtain the required DoD 8570.01-M IT security certification corresponding to the labor category. Maintain a personnel database with all required certification information and make the database available to the Government.

E. Ensure that access rights are disabled when account is inactive for more than 30 days (this includes personnel who have Inactive Account Exemption Request on file), upon notification of death, resignation, dismissal, role change, and transfer or travel where different regional access applies (system, network and physical).

F. Ensure that accounts are deleted upon receipt of a Deprovision Network Access Request (DNAR), inactivity of over 45 days without an approved Inactive Account Exemption Request on file, or by the direction of the Government service owner or Information Assurance Officer/Information Assurance Manager.

G. Change administrator passwords and service accounts on all N-NC Enterprise computer and network communications systems IAW DoD and N-NC password policies. Document service account passwords and detailed procedures involved in changing the passwords for each service in a physical password book. Maintain a physical copy at both Peterson AFB and CMAFS.

H. Coordinate with Telephone Control Officers on a monthly basis to ensure users of smart phones, cell phones, and other wireless devices are still active and assigned to the command to ensure wireless accounts are not continued after a user is terminated, transferred, and/or released from the command.

I. Maintain documentation of all users with elevated rights including system, network and storage administrators, specific rights delegated to and/or roles held by each user and service account.

J. Maintain and manage elevated privileges. Users with elevated privileges will have a valid requirement for such and meet all required certification and training prior to being granted any elevated privileges. The Government retains the right to review, approve, disapprove, and audit contractor personnel with elevated access and privileges.

K. Maintain a master list of passwords in a secure location. Access to the secure location shall be provided to the Government.

L. Provide PKI/Token…