RFI No. 81 - UH WiFi.pdf
PDF 18 KB Posted
- Attached to
- Dorm Internet Services at Whiteman AFB
- Solicitation number
- FA462526Q1038
About this file
This is an informational document addressing cybersecurity, privacy, and contractual requirements for government-funded commercial Wi-Fi services in military dormitories.
The document identifies three common operational scenarios: commercial ISP provision (such as Boingo), base network office management, or hybrid arrangements where government funds the service but a commercial entity operates infrastructure. Requirements vary significantly based on the service model. Logging requirements typically include IP address assignments, connection times, authentication events, and network performance data, though deep content inspection is generally unnecessary unless contractually specified or legally required. Data retention periods are not standardized government-wide and are determined by service contract terms, company policy, applicable federal and state laws, and any DoD-specific requirements. Privacy expectations depend on network ownership—government-managed networks provide limited privacy with mandatory acceptable use policies, while commercial provider networks are governed by the provider's privacy policy and contract terms. Abuse handling procedures must address copyright complaints, malware activity, spam, harassment, illegal activity, and law enforcement requests. Cybersecurity incident reporting requirements apply primarily when providers operate under DoD contracts involving covered defense information, with obligations potentially including reporting timelines under DFARS regulations. Contract development should address audit logging, log protection and integrity, retention periods, incident response procedures, security monitoring, privacy notices, acceptable use policies, vulnerability management, security patching, law enforcement cooperation, cyber incident notification timelines, and data disposal procedures.
View the file
Other files
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
If the U.S. government is funding or providing commercial Wi-Fi for military dorm residents, there are often cybersecurity, privacy, and contractual requirements—but the exact requirements depend on who owns and operates the network.
There are generally three common scenarios:
1. Commercial ISP provides the service (such as Boingo or another contracted provider).
2. The installation or base network office manages the service.
3. A hybrid arrangement where the government pays but a commercial company operates the infrastructure.
The requirements differ significantly in each case.
Generally speaking:
• Logging: Most providers maintain network logs such as IP address assignments, connection times, authentication events, and network performance data. Deep inspection of content is generally not required unless specified by contract or necessary for security or legal reasons.
• Data retention: There is no single government-wide retention period for dorm internet. Retention is usually determined by:
o the service contract, o company policy, o applicable federal and state laws, o and any DoD-specific requirements if they apply.
• Privacy: If residents use a government-managed network, they should expect limited privacy and are typically presented with a banner or acceptable use policy. If it is a commercial provider, privacy is primarily governed by the provider’s privacy policy and contract.
• Abuse handling: Providers generally need procedures for responding to:
o copyright complaints (DMCA), o malware or botnet activity, o spam, o harassment or illegal activity, o law enforcement requests.
• Cybersecurity incident reporting: If the provider is operating under a DoD contract, the contract may require reporting certain cyber incidents involving covered defense information or contractor systems.
Requirements vary based on the contract and applicable regulations, such as those in the Defense Federal Acquisition Regulation Supplement (DFARS). If the network is purely commercial with no covered government information, normal commercial incident reporting requirements may apply instead.
If you’re asking from the perspective of developing or reviewing a contract for government-funded dorm internet, you would typically consider requirements in areas such as:
• Audit logging
• Log protection and integrity
• Log retention periods
• Incident response procedures
• Security monitoring
• Privacy notices
• Acceptable use policy
• Vulnerability management
• Security patching
• Law enforcement cooperation
• Cyber incident notification timelines
• Data disposal at the end of retention periods
Blank Page
File details come from the government source that posted it. Updated .