Atch 1_PWS_NetOps SB.doc

NETCENTS-2 SOLUTIONS

Network Operations (NetOps) and Infrastructure Small Business Performance Work Statement (PWS)

NETCENTS-2

PERFORMANCE WORK STATEMENT (PWS)

NETWORK OPERATIONS (NetOps) AND INFRASTRUCTURE SOLUTIONS

1. NETCENTS-2 INTRODUCTION

1.1 Organization

HQ ESC/HIK-- Directorate of Acquisition

1.1.1 Identification

HQ ESC/HIJK

ATTN: Randi E. Williams 501 East Moore Drive, Bldg 884, Room 1400 MAFB-Gunter Annex, AL 36114

1.2 NETCENTS-2 Goal

The goal of the overall NETCENTS-2 program is to support missions that require voice, data, and video communications, information services, solutions, and products to deliver the right information, in the right format, to the right place, at the right time – efficient in peace, effective in war, and ensuring success across the spectrum of operations. NETCENTS-2 supports the IT lifecycle to include legacy operational and sustainment activities, re-engineering of legacy capabilities into target architectures and environments, and future service-oriented capabilities. NETCENTS-2 is an enabler to meet Air Force IT transformation goals to allow for innovation with the ability to more rapidly provision and field capabilities. NETCENTS-2 enables the ability to segregate aspects of full system lifecycles into more granular components that can be composed into integrated capabilities for the warfighter. Furthermore, NETCENTS-2 enables different solution providers to participate over the course of the program lifecycle. For example, the solution providers for development may be different from those that accomplish deployment, operation, and support.

1.3 NETCENTS-2 Scope

The NETCENTS-2 ID/IQ contracts will provide a wide range of IT Network-centric and Telephony products, services and solutions covering the full spectrum of netcentric operations and missions, including existing legacy infrastructure, networks, systems and operations as well as emerging requirements based on the AF Chief Information Officer’s (CIO’s) SOA construct. The contracts will provide Network-Centric Information Technology, Networking, and Security, Voice, Video and Data Communications, system solutions and services to satisfy the Combat Support (CS), Command and Control (C2), and Intelligence Reconnaissance and Surveillance (ISR) Air Force and Department of Defense (DoD) requirements worldwide. These contracts will provide users the capabilities to find, access, collaborate, fuse, display, manage, and store information on the Department of Defense (DoD) Global Information Grid (GIG). AF sites may include commercial-off-the-shelf (COTS) National Security Systems (NSS), intelligence data handling equipment, C2 equipment, Local Area Networks (LAN), Wide Area Networks (WAN), secure and non-secure video, voice and data systems, and/or mission equipment. The equipment processes information of varying security classifications and may include sites that are Sensitive Compartmented Information Facilities (SCIFs).

All effort supported under this contract shall be provided in accordance with Department of Defense, United States Air Force, or DOD Intelligence Information Systems (DoDIIS), and National Security Agency standards as applicable to the task order. Efforts under this contract will support industry best practices when not proscribed by aforementioned standards.

1.4 NETCENTS-2 Acquisition Strategy

NETCENTS-2 consists of various related IDIQ contracts in an effort to meet the above-stated goals. There are functions where performance on one task order may limit, because of dependencies or type of activity (e.g., support to the Government), work on other task orders. Total solutions will potentially be composed of combinations of subsets of the contract. NETCENTS-2 comprises the following suite of contracts:

1. Netcentric Products – COTS products to support the network

2. NetOps and Infrastructure Solutions – Solutions to support network operations, core enterprise services, and infrastructure development and operations (includes legacy Telephony)

3. Application Services - Services to sustain, migrate, integrate, re-engineer, and expose Mission Applications for secure access by authorized users, by establishing web and netcentric services, to include help desk, testing and operational support, in legacy and netcentric enterprise environments

4. Enterprise Integration and Service Management (A&AS) - Enterprise level integration/portfolio management activities

5. IT Professional Support and Engineering Services Advisory and Assistance Services (A&AS)

The NETCENTS-2 contracts enable the delivery of products, services and solutions that adhere to the AF Enterprise Architecture (AF EA) and complement each other as depicted in Figure 1.

Figure 1. Relationship of Contract Areas

1.5 Air Force IT Challenge

Currently, the Air Force has multiple, disparate and sub-optimized collections of computing and communications resources. Each set of resources is managed independently, resulting in costly and inefficient redundancy. Different networks, multiple computing centers, and stove-pipe systems all make it difficult for end users to access consistent and relevant information in a timely manner, allocate resources to respond to demand, and consequently make timely and informed decisions.

1.6 NETCENTS-2 Solution

NETCENTS-2 is a vehicle enabling the IT lifecycle to include legacy operational and sustainment activities, migration of legacy systems, and future service-oriented capabilities. NETCENTS-2 provides a streamlined, enterprise-supported contract vehicle that enables the consolidation of many existing base-level contracts for Operations and Maintenance (O&M) activities. In addition, NETCENTS-2 supports the re-engineering and modernization of legacy systems through the rapid, incremental delivery of solutions, enabling improved day-to-day operations and warfighting mission execution. NETCENTS-2 provides a contract vehicle for the acquisition of the components, such as infrastructure, services, resources and activities, required to implement service-oriented capabilities.

To support the re-engineering of legacy systems and future service-oriented capabilities, the AF has created a set of information sharing business rules called the Singularly-Managed Infrastructure (SMI) and Enterprise Level Security (ELS) (SMI-ELS). SMI-ELS is not a technical solution or specific product, instead it guides a business model informed by governance and architecture that affects all aspects of a Doctrine, Organization, Training, Materiel, Leadership and education, Personnel and Facilities (DOTMLPF) solution for the effective implementation of a secure Net-Centric Data Strategy (NCDS). SMI-ELS gives form to processes such as architecture and acquisition; technical solutions such as networks, vocabulary-based web services, applications, data repositories, and computing infrastructures; and force transformation, to drive Air Force systems and users into higher degrees of information and knowledge-based operations.

The NETCENTS-2 scope of work directly supports SMI-ELS objectives, as follows:

1. SMI: The Singularly Managed Infrastructure will place AF core service computing and communications resources under a single enterprise-wide management construct. This does not mean consolidating resources into a single physical location for management purposes. Many high-end computing platforms, like those used to run simulations, may have internal management constructs as their resources are not shared across the enterprise. However, any interaction between these localized collections and any other computing resources will fall under the SMI construct. Likewise, not all communications (i.e., Military Strategic Tactical Relay (MILSTAR) satellites) may be individually managed under the SMI concept, but the overall capability delivered by these resources will adhere to SMI concepts. The SMI will operate over existing physical locations, with some adaptation of those physical locations based on business case analyses, to manage all computing resources from the enterprise perspective. Existing data centers, such as the MAJCOM Computing Centers, will be integrated into the SMI and the management of the resources within those Centers will be subject to the SMI processes and procedures.

2. ELS: The Enterprise Level Security will enable authorized users to locate, access, and utilize information from authoritative sources regardless of the location of the data as long as information security guidelines stipulated are met.

NETCENTS-2 also provides the contract vehicle to support the development of vocabulary-based web services, content delivery and presentation services, and new mission applications that operate in netcentric enterprise environments and exploit SOA infrastructures.

This contract provides the services management support required by SMI-ELS. Service Management (SM) ensures that: (1) agreed upon services are delivered when and where they are supposed to be delivered and (2) services operate as agreed upon. Using NETCENTS-2 contract vehicles, portfolio managers implement SM with a focus on risk mitigation and policies that require built-in closed-loop governance mechanisms.

1.7 Governance

The services and solutions delivered under NETCENTS-2 in support of Air Force operations will be subject to the oversight of an Air Force enterprise level governance structure and set of processes. The governance processes will employ systems engineering fundamentals, ensure adherence to the Air Force Enterprise Architecture, and be implemented along with the normal reviews in the acquisition process. The governance structure has three tiers, strategic, operational, and tactical, where policy will be set at the strategic level, reviews for compliance and technical rigor will be done at the operational level, and contract mechanics will be handled at the tactical level. Further explanation of the governance structure is explained in the User’s Guide.

2. CONTRACT PURPOSE

The purpose of this contract is to provide Network Operations (NetOps), Infrastructure, and Service Oriented Architecture (SOA) implementation and transformation services and solutions to the United States AF (USAF) and Department of Defense (DoD) agencies at locations inside the contiguous United States (CONUS), outside the contiguous United States (OCONUS) and in war zone areas. The services and solutions provided will address the development, acquisition, integration, test, deployment, and sustainment of Air Force (AF) infrastructure and network operations, production, research and development, and Command, Control, Communications, Computers (C4) and, Intelligence, Surveillance, Reconnaissance (ISR) mission capabilities. The proposed solutions shall be in compliance with existing DoD, USAF, and Intelligence Community (IC) standardization and interoperability policies. Technology refreshment and system evolution within this contract will track proven, accepted, and available leading edge technology within industry.

This contract supports the Global Information Grid (GIG) architecture, Defense Information Infrastructure (DII), IC Information Sharing environments, and AF and Defense Communications Systems infrastructure for computer and telecommunications network mission areas. Solutions and services provided under this contract will help the DoD and IC achieve information superiority as called for in Joint Vision 2020 and will promote adherence to the Systems Engineering Process (SEP) as specified in the DoD 5000-series.

2.1 Contract Goal

The goal of this contract is to provide a full range of innovative, reasonably priced, world-class information technology services and solutions to support the full spectrum of netcentric operations and missions. It will help our warfighters be efficient in peace and effective in war while providing them the right information in the right format to the right place at the right time. NETCENTS-2 will support USAF, DoD, and other Federal Agency customers that work in transitory, static, and deployed locations throughout the world. The netcentric services and solutions provided will combine with joint and interagency assets and capabilities from land, sea, air, space, and cyberspace components, as well as coalition and allied capabilities, to create an interoperable force capability.

2.2 Contract Scope

This contract will provide a wide range of services and solutions covering existing legacy infrastructure, networks, systems and operations as well as emerging requirements. and guidance provided by the IC Information sharing Executive (ISE) and AF Chief Information Officer’s (CIO) . The contracts will provide Network-Centric Information Technology, Networking, and Security, Voice, Video and Data Communications, system solutions and services to satisfy the Combat Support (CS), Command and Control (C2), and Intelligence Reconnaissance and Surveillance (ISR) Air Force and Department of Defense (DoD) requirements worldwide. This NetOps contract will provide users the capabilities to find, access, collaborate, fuse, display, manage, and store information on the Department of Defense (DoD) Global Information Grid (GIG) and IC Information sharing environment as applicable. Other services include, but are not limited to, wireless devices/capabilities, Personal Digital Assistants (PDAs) to include Blackberries and information intensive data applications (e.g. video-teleconferencing, imagery, modeling, simulation, streaming video, web-enabled weapon systems and applications, information management, Everything over IP (EoIP), and Voice over IP (VoIP). This contract will support the transformation of AF global-level command and control and administration of Information Technology (IT) resources from base-level Network Control Centers (NCC), MAJCOM Coordination Centers (MCCC), MAJCOM Network Operations Security Centers (NOSC), and Network Operations Divisions (NOD) and Network Security Divisions (NSD) to regionally consolidated Area Processing Capabilities (APC), Enterprise Service Units (ESU), Integrated NOSCs (I-NOSC) and Enterprise Service Desks (ESD).

Through this contract vehicle, customers can acquire network infrastructure system solutions, operations, and maintenance, as well as systems management, configuration management, and NetOps Core IT services (e.g., e-mail, storage, and directory services). System solutions shall follow disciplined System Engineering Processes and shall include, but not be limited to: establishment of the SOA Singularly Managed Infrastructure with Enterprise Level Security (SMI-ELS), including Metadata Environments (MDEs), Enclaves, Federation and Enterprise Management of the AF Architecture; Network Operations including GIG Web Content Management, GIG Enterprise Management (GEM) and GIG Network Defense (GND); and Network Infrastructure Messaging and Site Preparation and Installation services. This contract will provide NetOps services and solutions support to establish, operate, and maintain the network and SOA infrastructure required to provide netcentric capabilities and traditional network operations.

2.3 Netcentric Strategies, Standards, and the Use of This Contract by Other Agencies and Departments

Specific standards, guidance, and applicable documents within this contract are written with the intent of accomplishing Air Force netcentric strategies. These strategies will evolve over time and, when appropriate, the AF will revise and replace standards accordingly. The contractor shall conform to Air Force strategies and visions and adhere to associated standards. Other agencies and departments are encouraged to use this contract for the same purpose and may specify and substitute other standards, guidance, and applicable documents within their task orders that are appropriate to provide solutions tailored to meet their netcentric strategies. AF functional communities may be required by law or other National guidance to meet non-AF standards and guidance; in these cases the mandated standards and guidance will be identified in individual task orders.

The Air Force reserves the right to restrict use of this contract and to disallow DoD and other Federal Agencies from using this contract.

3. REQUIREMENTS

The contractor shall provide a wide range of services and solutions that support existing legacy infrastructure, networks, systems, and operations, as well as evolving the infrastructure, networks, systems and operations to comply with the AF enterprise architecture.

3.1 SMI-ELS Infrastructure Implementation and Operation

3.1.1 Singularly Managed Infrastructure (SMI)

The contractor shall provide services and solutions to realize a SMI that brings together at the middleware layer disparate networks and communications capabilities into a consistent AF enterprise-wide IT capability. The SMI shall support all AF mission requirements, and share data through federation with other infrastructure environments across the DoD, Federal agencies, and Joint and Coalition environments. The contractor shall provide the capabilities for Core Enterprise Services (CES), transport layers, metadata environments, enclaves, Communities of Interest (COIs), and federation that make an SMI possible.

3.1.1.1 Core Enterprise Services (CES)

The contractor shall provide services and solutions that provide infrastructure capabilities to execute and manage content delivery services that deliver information to the warfighter and operational end user. CES will include but not be limited to storage management, messaging, transaction management, workflow management, search and discovery, directory services and service execution through an application server capability for control and management of multiple services. CES will provide monitoring for Quality of Service (QoS), and governance of configuration and contract management to ensure a stable environment. The contractor shall ensure these solutions exploit the DoD CES when and wherever possible, and deliver AF-specific CES as required to augment the DoD CES to fulfill the AF mission.

Notes: Information Assurance (IA)-related services, while part of Core Enterprise Services, are listed separately in the Enterprise Level Security section. Transport layer capabilities are covered in the Network Operations section and deliver the physical infrastructure upon which middleware and services operate, including physical plants and network operations capabilities.

3.1.1.2 Enclaves

The contractor shall provide services and solutions to identify a logical partitioning of the network and its information assets into capabilities-based enclaves. In the SMI-ELS Concept Document, enclaves are defined as virtual collections of hardware, software (including services), networks, and users that share common features, such as: authentication, authorization, trust, account directories, and policies. The contractor shall provide services and solutions to enable the establishment of trust relationships and inter-enclave credentialing through which enclaves can interoperate and control the direction and nature of information exchanges, allowing the execution of multi-enclave service threads. The contractor shall provide services and solutions to facilitate migration of legacy enclave environments to enclaves compliant with the SMI-ELS Concept Document.

3.1.1.3 Federation

The contractor shall provide services and solutions that facilitate federation—a set of minimal agreements between enclave layer components which enable interaction between enclaves to take place transparently. The contractor shall provide federation capabilities within single domains and across multiple domains. Where applicable, the contractor shall provide federation capabilities across other domains within the DoD and IC to share mission critical information. The contractor shall establish federated naming and authentication between enclaves to enable discovery across them in accordance with applicable guidance, policy and direction. Contractor services and solutions shall adhere to core specifications, standards, and technologies, such as PKI, SAML, JMS, and WS-*, etc.

3.1.1.4 Metadata Environments

Metadata environments include the generation, consumption, and management of metadata to enable the operational user to discover authoritative and aggregated data and support automated mediation where appropriate. The contractor shall provide services and solutions that help generate and manage metadata and Metadata Environments (MDEs). The contractor shall maximize the use of COTS products when and where appropriate. Metadata are characteristics or attributes of information assets, describing the type of information asset, its structure or syntax, and its content or semantics, plus a wide range of other attributes that assist users in finding, managing, and consuming information contained in assets. The contractor shall develop and sustain a metadata environment to be used in the discovery of information by end users and other services, the management of information assets for storage, retention, and records management, and security authorization and access control. All metadata shall be created in accordance with the DoD Discovery Metadata Specification (DDMS) as appropriate. The contractor shall develop MDEs in accordance with the DoD Enterprise Architecture Data Reference Model or IC Architecture Reference Model as appropriate. The contractor shall develop a federated query capability to enable end users to discover and exploit mission services to gain mission essential information. Federated queries shall access MDEs within Enclaves to determine where information resides and how to access it. The MDE is characterized by the components and services it provides.

3.1.1.4.1 Metadata Components

The MDE comprises the following components: Metadata Registry, Metadata Catalog and Service Registry.

3.1.1.4.1.1 Metadata Registry

The contractor shall develop and support a Metadata Registry (MDR) to hold metadata definitions for the various types of metadata in a persistent store that is accessible during runtime operations. The contractor shall develop the capability for the MDE to use metadata from the MDR to tag instances of information assets with metadata values to support discovery, life cycle management, storage management, and categorization of the individual information assets. The contractor shall develop and support the capability for the MDR to track releasable information about individual artifacts and components of those artifacts where applicable. The metadata registry shall store COI vocabularies, and other metadata artifacts, describing the concepts and terminology required for information exchange within a COI. The vocabularies will be used by ADS’s to format exposed information assets, and by the semantic discovery capability to allow users to find information assets and the services that deliver those assets. The contractor shall make it possible for vocabularies and other metadata artifacts registered in the AF MDE to become available through the DoD Metadata Registry or IC Metadata Registry using federation. The contractor shall manage metadata that enables users to discover and consume information provided by mission capabilities implemented as services.

3.1.1.4.1.2 Metadata Catalog

The contractor shall develop and support Metadata Catalogs that include metadata to describe individual information assets and that link those assets to the content delivery service that provides the asset to the end user. The metadata shall include the format of the information asset as delivered by the service, expressed as an XML schema, PDF, or other Government approved format and adhering to the vocabulary prescribed by the COI that governs that information asset. Metadata shall also include the tags necessary to support the Department of Defense Discovery Metadata Specification (DDMS).

3.1.1.4.1.3 Service Registry

The contractor shall leverage existing service registry and provide support for a Service Registry where all services are registered and stores information about implemented services, service interfaces, and the ports and bindings involved. The Service Registry shall also track the identities and credentials of services within the enterprise information assurance infrastructure. The Service Registry shall support the invocation of services to deliver information assets once selected by an end user or another requesting service. Metadata Catalog entries shall point to services registered in the Service Registry, where the SOA infrastructure will be able to invoke the service to deliver the information asset to the requestor. The Service Registry shall enable the information stored in it to be federated with other DoD or IC service registries.

3.1.1.4.2 Metadata Environment Services

MDE services include the following: MDE Infrastructure Services, MDE Lifecycle Management, Discovery Services, and MDE Federation.

3.1.1.4.2.1 MDE Infrastructure Services

The contractor shall provide infrastructure services to support MDEs. These services and solutions include, but are not limited to, information assurance, messaging, application hosting, storage management, and other core enterprise services. The contractor shall provide standard repository management services and solutions to support authorized administrative personnel in the creation, update, retrieval, and deletion of items within the MDE.

3.1.1.4.2.2 Metadata Lifecycle Management

Metadata Lifecycle Management includes the following services: Metacards and Asset

Registration, Automated Metadata Population Services (AMPS), Versioning and Indexing.

3.1.1.4.2.2.1 Metacards and Asset Registration

The contractor shall provide services and solutions that support the manual or automatic population of metacards for registered assets in a structure that is compliant with DDMS or IC standards most current version and is in correlation with one or more COI vocabularies. The contractor shall provide services and solutions that support registering infrastructure services as assets, including, but not limited to, the following:

1. Services developed to support COI business processes (e.g., content exposure, aggregation and presentation).

2. Service interfaces based on one or more XML schemata, or other Government approved format.

3. Vocabulary artifacts that describe COI domain knowledge. This includes, but is not limited to, Web Ontology Language (OWL) representations of knowledge, and XML Schema Definition (XSD) representations of message types.

4. Information assets that are instances of authoritative content. This includes, but is not limited to, unstructured text documents, images, blob fields in databases and any other assets that qualify as requiring accountability of their content.

3.1.1.4.2.2.2 Automated Metadata Population Service (AMPS)

The contractor shall develop and support an Automated Metadata Population Service (AMPS) to automatically create the metadata for an information asset or service. AMPS shall automatically create metacards for registration in the Metadata Catalog. Users shall be able to invoke AMPS during registration of their assets to create metacards. AMPS shall be available as a service that can be invoked automatically during creation of an asset or in large scale metadata creation. AMPS shall be capable of tagging information assets defined by XML schemas as payloads coming from content delivery services so that services can be registered in the MDE and invoked upon discovery by an end user.

3.1.1.4.2.2.3 Versioning

The Contractor shall provide tools and services that will deliver version control of all metadata artifacts. These services will include but not be limited to capabilities that maintain different versions of the metadata artifacts such as metacards, ontologies, and indexes; manage and control deprecation of artifacts such as COI vocabularies; provide publication to consumers of versioning activities; ensure the application of the correct versions of the artifacts to other metadata services such as discovery, indexing, and automated metadata generation; and maintain histories and activity logs of metadata artifact versioning activities.

3.1.1.4.2.2.4 Indexing

The Contractor shall provide tools and services that will deliver indexing capabilities to support discovery and management of information assets. These services will include but not be limited to the indexing of metacards using keywords, concepts, and other indexing schemes; the application of the ontologies generated from COI vocabularies to the indexing of artifacts; the generation of the indexes either from metadata artifacts such as XSDs and WSDLs or directly from information assets in other formats such as documents, emails, or presentations. The services will also include capabilities that will maintain the indexes as metadata artifacts subject to the same constraints for versioning that are applied to the metadata artifacts to which the index references.

3.1.1.4.2.3 Semantic Discovery Services

The contractor shall provide services and solutions that support a semantic discovery capability that is based on vocabularies constructed by COIs. Semantic discovery users will be able to discover information based on their own preferred vocabulary, and automatically navigate across other users’ vocabularies to find information relevant to each query. The semantic discovery capability will support both users seeking mission critical information as well as developers responsible for implementing new information capabilities for those users. The semantic discovery capability will pass DDMS metacard contents, rather than asset content, directly to consumers with delivery service invocation instructions which will be activated by consumers as required. The semantic discovery capability will federate with other DoD and IC Components and their information assets through the Joint DoD/DNI Federated Search Specification.

3.1.1.4.2.4 Federation of MDEs

The contractor shall provide services and solutions that support the federation of MDEs. Federation of MDEs will direct discovery queries to the right enclaves and, using the IA infrastructure, access information, and services across enclaves. The federation of MDEs will include the capability for MDEs to broadcast information requests and queries across all enclaves, if direct requests are not possible. The federation of MDEs will support the mutual exchange of metadata to share reference data and support roll-up of summary metadata for the purposes of discovery and metadata management.

3.1.2 Enterprise Level Security (ELS)

3.1.2.1 Information Assurance Architecture

The contractor shall provide services and solutions to realize an information assurance architecture that permeates all components and operations. The contractor shall deliver information architecture services that conform to the Air Force Enterprise Architecture along with adherence to DoD and federal standards for information assurance, using role-based, policy-based or attribute-based controls, and managing trusted relationships between network enclaves. The contractor shall support the conformance with the 2-way authentication and end to end security stipulated by SMI-ELS and the AF Information Assurance Enterprise Architecture.

The contractor shall provide services and solutions in support of an information assurance architecture that delivers but is not limited to the following five categories of security services: confidentiality, integrity, availability, authenticity and non-repudiation. The contractor shall provide services and solutions to exploit the information assurance architecture to protect information consumed and generated by mission services. The contractor shall provide the capability of delivering these services at a level commensurate with the information assets being protected.

The contractor shall provide infrastructure capabilities that enable SOA solutions to implement IA in accordance with WS assurance standards. WS standards will be defined at the task order level, but the expected ones are:

WS-Security

WS-SecureConversation

WS-SecurityPolicy

WS-Trust

XML Signature

XML Encryption

XML Key Management (XKMS) The contractor shall provide information assurance architecture, services, and solutions as stipulated by IC standards or other US, Allied, and Parner standards as specified in TO.

3.1.2.1.1 Confidentiality

The contractor shall provide confidentiality security services that prevent unauthorized disclosure of data, both while stored and during transit.

3.1.2.1.2 Integrity

The contractor shall provide integrity security services that prevent unauthorized modification of data, both while stored and in transit, and detection and notification of unauthorized modification of data.

3.1.2.1.3 Availability

The contractor shall provide availability services that ensure timely, reliable access to data and information services for authorized users.

3.1.2.1.4 Authenticity

The contractor shall provide authenticity services that ensure the identity of a subject or resource is the one claimed. The contractor shall ensure that authenticity applies to entities such as users, processes, systems, and information.

3.1.2.1.5 Non-Repudiation

The contractor shall provide non-repudiation services that ensure actions within the AF, DoD or IC SOA service invocations, information queries, etc., are attributable to the entity that invokes them.

3.1.2.2 Information Assurance Services

The contractor shall provide services and solutions to implement and conduct IA operations such as, but not limited to, identity management, identity authentication, threat analyses and certification and accreditation.

The contractor shall ensure that all the requirements meet the DoD Information Assurance Certification and Accreditation Process (DIACAP) and DoDI 8500.2, Intelligence Community directive (ICD) 503, or the most current standards and guidance that are applicable. This includes Certification and Accreditation (C&A) activities. The contractor shall provide applications services that are in compliance with and support DoD, USAF, or IC Public Key Infrastructure (PKI) policies as applicable. The contractor shall support activities to make applications PK-enabled (PKE) in order to achieve standardized, PKI-supported capabilities for digital signatures, encryption, identification and authentication. The contractor shall assist in defining user and registration requirements to Local Registration Authorities (LRAs). The contractor shall provide solutions that meet confidentiality, data integrity, authentication, and non-repudiation requirements. Contractor solutions shall comply with National Institute for Standards and Technologies (NIST) and Federal Information Processing Standards (FIPS) and applicable IC standards.

As specified by the Task Order, the contractor shall provide Commercial-Off-The-Shelf (COTS) IA and IA-enabled products IAW AFI 33-200, Information Assurance or other specified guidance. These products must be National Security Telecommunications and Information Systems Security Policy Number 11 (NSTISSP-11) compliant, requiring them to be validated by accredited labs under the National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme or National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) Cryptographic Module Validation Program (CMVP) or IC standards as applicable.

3.1.2.2.1 Identity Management

The contractor shall provide services and solutions to accomplish identity management to enable users and applications to discover one another and utilize services provided by entities using methods such as the negotiated collaborative approach. The contractor shall also provide capabilities to selectively monitor interactions and manage all active identities to include user, services, machines, and services identity based on PKI.

The contractor shall provide services and solutions to accomplish life-cycle entity identity management from user creation to user revocation, as depicted in Figure 2. Entities are defined as both human and non-human users possessing accounts within the enterprise. The contractor shall support user creation (identity confirmation, credentialing, enrollment), user management (provisioning across single or multiple systems and services, automated provisioning workflow, and self service), user access (identification, authentication, and authorization), and user revocation (de-provisioning and disablement). The contractor shall enable the de-provisioning process through automated account disablements and token revocation. The contractor shall provide access controls with rights, roles and privileges. The contractor shall provide the capability for all accounts to comply with Federal Information Protection Standard (FIPS) 196, or other specified standard in TO, by using approved methods of authentication such as, but not limited to, the following:

Public Key Infrastructure (PKI) based authentication.

One-Time Password Tokens.

Biometrics with PIN or password.

Figure 2: Enterprise Entity Lifecycle

3.1.2.2.2 Threat Analysis

The contractor shall conduct comprehensive threat analyses for Network Defense of the SOA information assurance architecture in support of GIG Network Defense.

3.1.2.2.3 Certification and Accreditation

The contractor shall provide services and solutions to help address the risks associated with AF network convergence into an interoperable enterprise and accomplish the certification and accreditation (C&A) of the AF SOA infrastructure. The contractor shall follow the DoD Information Assurance Certification and Accreditation Process (DIACAP) or ICD 503 to accomplish the infrastructure C&A as applicable. In order to satisfy DoD system security documentation requirements, the contractor shall register the SOA infrastructure in the Enterprise Information Technology Data Repository (EITDR), and complete the Security, Interoperability, Supportability, Sustainability and Usability (SISSU) checklist, as described in the IT LEAN Reengineering and SISSU Guidebook, v5.0, 4 April 2007. The contractor shall accredit the SOA infrastructure so that it can be leveraged by individual mission services. TOs for classified network support will identify when alternative registries and C&A guidance is applicable.

3.1.2.3 Enabling Security Capabilities

The contractor shall provide the following enabling capabilities to facilitate Warfighter access to critical mission capabilities:

1. Ensure all interactions between people, machines, and services are verified using security policy

2. Conduct confirmed 2-way authentication using DOD-PK I and Federal Bridge credentials or applicable IC PKI and bridge

3. Authorize access to data based on groups and roles

4. Monitor and log all activities to provide for both real time assessment and historical analysis

5. Use automated tools to analyze and detect anomalous behavior using real time/logged information to preclude and prevent internal attacks on Air Force information and computing resources

6. Delegate roles and groups based on policy

7. Mediate graduated access to data for various types of users

8. Enable efficient cross-domain information sharing across networks operating at different classification levels (e.g., SIPRNET, NIPRNET, and JWICS)

9. Operate, maintain, and configure point to point, VPN, and bulk encryption for network and longhaul circuits

10. Provide encryption to the base campus SIPRNet connectivity.

11. Provide SCI network security capabilities as specified in TOs.

3.1.3 Enterprise Service Management

The contractor shall provide services and solutions to accomplish SMI-ELS service level management. The contractor shall provide operation and maintenance of the SMI-ELS infrastructure including, but not limited to, network monitoring, load balancing, information archival and backup, disaster recovery, Continuity of Operations (COOP), and enterprise support desk (ESD). The ESD shall support users encountering issues in accessing mission capabilities.

The contractor shall provide lifecycle management of services for both requestors of services and service providers. The contractor shall establish processes to inform users of the availability of new version of services.

The contractor shall provide enterprise service management to SCI networks as specified in TOs.

3.1.4 SMI-ELS Architecture Documentation

The contractor shall document the Singularly Managed Infrastructure with Enterprise Level Security (SMI-ELS) within the AF Enterprise Architecture (EA). The contractor shall document the Metadata Environment in the DoD EA Data Reference Model (DRM). The contractor shall document the standards and protocols that the AF will enforce in the DoD EA Technical Reference Model (TRM). The contractor shall develop DoD Architecture Framework (DoDAF) products or products adhering to other architecture guidelines as specified in task orders. The contractor shall support process improvement events, such as AFSO21, to address SMI-ELS processes and issues. The contractor shall document AFSO21 products and engineered processes in the Process Reference Model (PRM) and DoD EA System Reference Model (SRM).

The contractor shall develop, document, and register SCI architectures and artifacts per TO directions. The contractor shall document engineering processes and process improvement activities and artifacts per TO directions for SCI systems and networks

3.2 Network Services and Solutions

The contractor shall provide services and solutions that enable Network Operations and Network Infrastructure capabilities. Networks as defined in this section are for Data, Voice and Video.

3.2.1 Network Operations

The contractor shall provide services and solutions that enable Network Operations (NetOps) to operate and defend the Global Information Grid (GIG) to ensure information superiority. GIG network operations refers to land, air, and space networks across multiple levels of security. The contractor shall provide capabilities that support the essential tasks, Situational Awareness (SA), and Command and Control (C2) that comprise the operational framework that comprise NetOps. The contractor shall support the following essential NetOps tasks: GIG Enterprise Management (GEM), GIG Network Defense (GND), and GIG Web Content Management.

The contractor shall provide services and solutions that help the Government attain the following desired effects in its management of the Global Information Grid (GIG):

1. Assured System and Network Availability that ensures uninterrupted availability and protection of system and network resources. This includes providing for graceful degradation, self-healing, fail-over, diversity, and elimination of critical failure points.

2. Assured Information Protection of information in storage, at rest, while it is passing over networks, including from the time it is stored and catalogued until it is distributed to users, operators, and decision makers.

3. Assured Information Delivery of information to users, operators, and decision makers in a timely manner.

3.2.1.1 GIG Enterprise Management (GEM)

The contractor shall provide services and solutions that enable Enterprise Management. This shall include traditional systems and network management (Fault Management, Configuration Management, Accounting Management, Performance Management, and Security Management), as well as information and infrastructure protection. It shall also encompass the GIG’s information technology (IT) services management and consist of the many elements and processes needed to communicate across the full spectrum of the GIG, including the following:

1. Enterprise Services Management

2. Systems Management

3. Network Management

4. Satellite Communications Management

5. Electromagnetic Spectrum Management

3.2.1.1.1 Enterprise Messaging and Directory Services

The contractor shall provide services and solutions that enable directory services, e-mail and organizational messaging in accordance with Enterprise Architecture..

3.2.1.1.2 Enterprise Application Services and Service Management The contractor shall provide services and solutions that enable service management and the management of enterprise application services, including, but not limited to, the following:

1. Monitoring and measuring application and service health and performance

2. Reporting and visualizing key application and service QoS metrics

3. Monitoring and enforcing service level agreement (SLA) compliance

4. Managing application and service lifecycles

5. Provisioning applications and services

6. Logging and auditing application and service activities

7. Anticipating application and service problems and sending alert notifications

8. Pinpointing the root cause of application or service problems and allocating resources to correct the problems

9. Automating failover and load balancing

10. Mediation services transforming service messages and performing content based routing

11. Correlating enterprise service messages for business transaction tracking

3.2.1.1.3 Enterprise Information Management

The contractor shall provide services and solutions that enable information management services, including, but not limited to, the following:

1. Collaboration Services

2. Continuity of Operations

3. Disaster Recovery

4. Data Storage

5. Storage Area Network

6. Network Attached Storage

7. Back-Up/Archive

8. Records Management

3.2.1.2 GIG Network Defense (GND)

The contractor shall provide services and solutions that enable GIG Network Defense, including, but not limited to, the following:

Information Assurance (IA) – Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This shall include, but not be limited to, providing for restoration of information systems by incorporating protection, detection, and reaction capabilities. IA services shall include, but not be limited to:

a. Assured Information Sharing and Management

b. Access Control

c. Cross-Domain Security

d. Information Environment Protection

e. Certification and Accreditation

f. Risk Analysis

g. IA Awareness

h. Auditing

i. Emanations Security (EMSEC) /TEMPEST for TS or SCI environments

j. Communication Security (COMSEC)

k. Operation Security (OPSEC)

l. Information Protection

m. Authentication

n. Resource Protection

o. Federated Identity Management

p. Virtual Private Networking

q. Network Protection

r. Filtering

s. Intrusion Detection and Prevention

t. Cryptographic Services

u. Key and Certificate Services

v. Insider Threat Protection

w. Anomalous behavior detection

x. Time Compliance Network Order (TCN))

y. Computer Incident Response Team (CIRT)

z. Air Force Computer Emergency Response Team (AFCERT)

aa. Telecommunications Monitoring and Assessment Program (TMAP)

1. Computer Network Defense (CND) – Defensive measures to protect, monitor, analyze, detect, and respond to unauthorized activity with DoD information systems and computer networks and defend information, computer, and networks from disruption, denial, degradation, or destruction. This shall include, but not be limited to, the employment of IA capabilities in response to CND alert or threat information and the capability to predict, analysis and defend against new attack vectors..

2. Computer Network Defense Response Actions (CND RA) – Deliberate, authorized defensive measures or activities that protect and defend DoD computer systems and networks under attack or targeted for attack by adversary computer systems/networks. The contractor shall also rapidly and accurately implement JTF-GNO and NetOps directed Information Operations Condition (INFOCON) changes and provide Command and control on the progress and completion.

3. Defense Critical Infrastructure Protection (CIP) – Actions taken to prevent, remediate, or mitigate the risks resulting from critical infrastructure vulnerabilities. Actions shall include, but not be limited to, changes in tactics, techniques, or procedures; adding redundancy; selection of another asset; isolation or hardening; guarding; etc.

3.2.1.3 GIG Web Content Management

The contractor shall provide services and solutions to develop and administer web sites that enable Web Content Management and help ensure information is available to users on the GIG to accomplish their mission. Capabilities shall include, but not be limited to, those that enable the following core services areas:

1. Web Content Discovery – The ability to quickly search for information throughout the GIG. The contractor shall provide the capability for operational staffs to search across multiple sources from one place using a web crawler and web browser, vice making several attempts. Once products are located, the Content Delivery service shall permit users to pull in needed products.

2. Web Content Delivery – Delivery of requested information to GIG users. The contractor shall provide the capability for timely delivery of items across multiple, heterogeneous communication systems with delivery and read receipt notifications, providing assured delivery of information products.

3. Content Storage – The contractor shall provide and support physical and virtual places to host data on the network throughout the GIG with varying degrees of persistence.

The contractor shall provide services and solutions that provide Network Operations Centers with capabilities such as, but not limited to, the following:

1. The ability to optimize the flow and location of information over the GIG by positioning and repositioning data and services to optimum locations on the GIG in relation to the information producers, information consumers, and the mission requirements.

2. The ability to ensure that the GIG is optimally delivering the information required by GIG users in accordance with information delivery priorities.

3. The visibility of information flowing across the GIG and of those systems used to store, catalog, discover, and…