Atch_8_Historical_Workload_Data.pdf

Atch 8 – HISTORICAL WORKLOAD DATA

Examples of 26 NOS Surge Events:

Support of 561 NOS or 83 NOS Contingency:

In the summer of 2013, wildfires in Colorado triggered a transfer of the 561 NOS boundary devices to 26 NOS for approximately five (5) days. The base support agreement provides 24x7x365 support for the 26 NOS mission, which includes the support for operating, maintain and defending the boundary devices for the Air Force (AF) enclave. That effort includes support for 16 Non-secure Internet Protocol Routing (NIPR) network gateways, 15 Secure Internet Protocol Routing (SIPR) network control nodes and 2 Integrated Management Suite (IMS) network enclaves. In certain contingency situations, the 26 NOS may be required to provide support for operating, maintaining and defending the boundary devices for all base enclaves managed by either 561 NOS or 83 NOS for a period of time not expected to exceed 30 days. No contingency requiring simultaneous support for bases managed by both 561 NOS and 83 NOS is anticipated. Although the wildfire threat did not materialize, the 67 CW took advantage of the opportunity for training and transferred responsibility as part of an exercise.

Rapid Solution Deployment:

In order to respond to certain contingencies, the 26 NOS has to support rapid solution deployment to meet downward directed requirements dictated by the Department of Defense, Secretary of the Air Force, United States Cyber Command, Air Force Space Command, 24 Air Force, 67 Network Warfare Wing or a combination of those authorities. In the fall of 2012, the 26 NOS was directed by 24 AF to deploy Command and Control nodes at 15 locations on the SIPR network within a specific and condensed timeline. The level of effort required to perform the work required to accomplish that downward directed requirement in the specified timeline necessitated increased levels of effort in tasks such as configuring devices; verifying and validating configuration changes; coordinating scheduled interruptions of service; installing, configuring, testing, and validating devices; updating documentation and monitoring systems;

and related activities. The deployment and operationalizing of the 15 Command and Control Nodes on the SIPR Network required 26 NOS and contractor personnel to carry out the tasks associated with that effort.

Support for Dual Environments:

The base support agreement provides 24x7x365 support for the solutions operated, maintained and defended by 26 NOS on a routine basis. Typically this effort supports the existing AF NIPR Gateways (16) and the SIPR Command and Control (C2) Nodes (15) as well as 2 IMS enclaves.

As the AF approaches the implementation of an effort known as “SIPR Modernization”, it is anticipated that there may be a requirement for 26 NOS to temporarily support both the existing environments plus the new environment delivered by “SIPR Modernization”. This is due to the necessity of operating both the legacy environment and the new environment to be provided with “SIPR Modernization” or similar effort on NIPR.

ATCH 8 ‐ HISTORICAL WORKLOAD DATA

Para Number Statement Reports/Briefings/Records Recurrence (if applicable)

Annual Count

Description DID

3.1 Persistent Network Operations

3.1.1 Router Operations

3.1.1.1 The contractor shall provide support for router operations.

3.1.1.2 The contractor shall configure, secure, patch, update, upgrade, and monitor network devices.

A044 Router IOS Upgrade Implementation Plan As Requested N/A This plan includes description and purpose of upgrades, steps to minimize adverse impact to organization missions, steps to verify the IOS upgrade did not cause second or third order effects once accomplished, etc. It should be submitted one week before deployment.

3.1.1.3 The Contractor shall analyze and optimize network device performance, network traffic, and utilization.

A023 Network Device Performance Report A024 Network Traffic Utilization Report

Weekly 52 A023- This report should leverage 26 NOS tools to provide customized, actionable reports that show things like response time, availability, & uptime of routers, switches, & other SNMP-enabled devices. It should also report on the health of the device and provide recommendations and POA&Ms for replacements and upgrades.

A024 - This report should leverage 26 NOS tools to provide customized, actionable reports that show exactly how bandwidth is being utilized throughout the AFIN–specific reports on which user, application, source, destination, conversation, etc. is occupying bandwidth. It should also show top applications, protocols, hosts, etc. It should also list actions taken to optimize the traffic utilization and any upcoming plans to optimize traffic. It should also provide trends of traffic utilization and root cause analysis for abnormal traffic trends. Submit as part of Weekly Activity Report.

3.1.1.4 The contractor shall operate, manage, and defend the VOIP/VoSIP systems supported or used by 26 NOS.

3.1.2 System Administration

3.1.2.1 The contractor shall provide support for system administration.

3.1.2.2 The Contractor shall provide and ensure troubleshooting is available for all shifts.

3.1.2.3 The contractor shall provide system administration for Windows, Linux, Unix, Solaris servers and clients.

3.1.2.4 The Contractor shall provide administration, management, and maintenance for the 26 NOS virtual environments.

A009 Trends and Analysis Report A028 Monthly Storage Analysis Report

Weekly/Monthly 52 A009-Reports show resource usage over time for various levels of the virtualized environment. The reports show trends at the cluster, host server and virtual machine level. Shows the clusters, host servers, and virtual machines that consume the most or least resources (CPU, memory, storage) A029- Trend report should at minimum include consumption trends, remaining storage available, allocated usage data.

3.1.2.5 The Contractor shall provide administration, management, maintenance, and security for 26 NOS storage environment.

A009 Trends and Analysis Report A028 Monthly Storage Analysis Report

Weekly/Monthly 52 A009-Reports show resource usage over time for various levels of the SAN environment. The reports show consumption trends the most or least resources (CPU, memory, storage) A028- Trend report should at minimum include consumption trends, remaining storage available, allocated usage data

3.1.2.6 The Contractor shall provide and perform administration and management for 26 NOS backup and recovery systems.

A029 Weekly Backup/Restore Status Report A030 Monthly Off-Site Status Report

Weekly/Monthly 52/12 A029-Report should include at minimum status of the master server listing of backups run, media id, date backed up and type, classification and hostname. A030-Off-site backup should include a copy of of this report in offsite container with date delivered and POC who conducted delivery.

3.1.2.7 The Contractor shall provide and perform administration and management for System Applications.

A009 Trends and Analysis Report Weekly 52 A009-Reports show resource usage over time for various levels of the Application environment. The reports show consumption trends the most or least resources (CPU, memory, storage), outage trends.

3.1.2.8 The Contractor shall perform and provide administration and management for Web Application Programming.

A009 Trends and Analysis Report Weekly 52 A009-Reports show resource usage over time for various levels of the Web Application environment. The reports show resource (CPU, memory, outage) trends.

3.1.2.9 The Contractor shall provide and perform administration and management for System Administration Active Directory.

3.1.2.10 The Contractor shall perform vulnerability scanning, remediation, reporting, and patch management for systems managed by the 26

NOS.

A031 Weekly Vulnerability Status Reports Weekly 52 A summary of all open STIG findings identified per week and status of remediation.

3.1.2.11 The Contractor shall develop scripts and utilities for routine task automation and connection to software APIs.

3.1.2.12 The Contractor shall administer, coordinate, and manage Higher Headquarters orders like TCNOs, MTOs, and CTOs for ensuring AFNET and legacy systems are in compliance.

3.1.3 Quality Assurance

3.1.3.1 The Contractor shall administer QA Evaluations for 26 NOS work centers.

A009 Trends and Analysis Report A043Evaluation Executive Summary Report

Weekly/As Requested 4 As needed

A009 - A summary of all findings identified per quarter A043 - This is a high-level summary report that provides a detailed breakdown on all "Comply with Comment" and "Not In Compliance" deficiencies. This should include, as a minimum, the finding along with the deficiency code, trend analysis, root cause and recommended management actions.

3.1.3.2 The Contractor shall conduct Equipment Evaluations for 26 NOS work centers.

A009 Trends and Analysis Report A043 Evaluation Executive Summary Report

Weekly/As Requested 4 As needed

A009 - A summary of all findings identified per quarter.

A043 - This is a high-level summary report that provides a detailed breakdown on all "Comply with Comment" and "Not In Compliance" deficiencies. This should include, as a minimum, the finding along with the deficiency code, trend analysis, root cause and recommended management actions.

3.1.3.3 The Contractor shall conduct QA training for 26 NOS work centers.

3.1.3.4 The Contractor shall perform Technical Order Distribution Officer (TODO) responsibilities.

A048 TO Reconciliatoin Memo for Record Annual 1 This memo is a written record for the Commander's signature noting that the TO Library was reconciled IAW with AF policies.

3.1.3.5 The Contractor shall administer Self- Assessment Program (SAP) responsibilities for 26 NOS work centers.

A010 QA SAV Report Semi-Annual 2 Direct Unit program managers to run their self-assessment checklist and provide responses in MICT for tracking. Also, quality check a sampling of all reports. (30%)

3.1.4 Training

3.1.4.1 The Contractor shall provide support for training course development, facilitation and instruction.

A005 New Training Course Development Project Plan A006 Training Course Curriculum

As needed N/A A005 - Provides unit with development planning and scheduling for supplemental and upcoming training requirements.

A006 - Provides the unit with actual course curriculum product.

3.1.4.2 The Contractor shall verify and monitor 26 NOS personnel follow the required training plan for their position.

A001 Weekly Squadron Training Status Report A002 Monthly HHQ Training Status Report A003 Quarterly HHQ Training Status Report

Weekly/Monthly/ Quarterly

A001 - Provides unit with weekly Training Progress progress.

A002 - Provides unit with Monthly Training Progress.

A003 - Provides unit with Quarterly Training Progress

3.1.4.3 The Contractor shall facilitate creation and maintenance of training documentation for 26 NOS Work Centers.

A001 Weekly Squadron Training Status Report A002 Monthly HHQ Training Status Report A003 Quarterly HHQ Training Status Report

Weekly/Monthly/ Quarterly

A001 - Provides unit with weekly Training Progress progress.

A002 - Provides unit with Monthly Training Progress.

A003 - Provides unit with Quarterly Training Progress

3.1.4.4 The Contractor shall conduct Staff Assistance Visits (SAVs) on 26 NOS Work Centers.

A007 SAV Calendar A008 SAV Report

As Requested N/A A007 - Provides Scheduling of SAVs.

A008 - Provides details of work center training status per AF guidance.

3.1.4.5 The Contractor shall configure and maintain equipment (i.e. routers, servers, laptops) for the 26 NOS training lab.

A049 Monthly Equipment Status Report Monthly 12 Provides equipment status (Systems Patched and ready for Operations) reporting for training usage.

3.1.5 Infrastructure

3.1.5.1 The Contractor shall install, maintain, configure, and troubleshoot infrastructure devices for both the 26 NOS legacy and AFNet Increment 1 environments.

3.1.5.2 The Contractor shall maintain and monitor authentication applications for the 26 NOS legacy and AFNet Increment 1 environments.

3.1.5.3 The Contractor shall maintain and monitor environmental systems for the 26 NOS legacy and AFNet Increment 1 environments.

3.1.6 Change Management

3.1.6.1 The Contractor shall manage and administer the change management function at the 26 NOS.

A032 Asset Management Database Report A033 Interdependency Diagrams and Charts A034 Overdue Change Request Report

Weekly 52 A032 - Report shows hardware, warranty info, dates,locations, serial numbers, ADPE account association.

A033-Provide database input and information export detailing system, software, hostname, application, relationship to connecting devices and function A034- Change Request database export detailing at minimum, team, POC, summary, report date, last modified date and category

3.1.6.2 The Contractor shall develop Network Task Orders (NTOs), Maintenance Task Orders (MTOs), and Notice to Airmen (NOTAM) for AFNet.

A045 AF Notification Documents As Requested N/A A045- The documents should follow AFSPC/24 AF standard notification templates and should include at minimum originating authority, subject, expected mission impact, details of the notice, actions required and suspense.

3.1.6.3 The Contractor shall perform Integrated Maintenance Data System (IMDS) duties.

A025 Preventive Maintenance Inspection (PMI) Schedule

Weekly 52 A025-Local PMI Work Card guidance will be followed. IMDS Schedule will be followed and all information annotated in IMDS database.

3.1.6.4 The Contractor shall develop and maintain a baseline of all networks, systems, software, and software interfaces operated by the 26 NOS.

A026 AFNet Baseline A046 Software Inventory

Weekly/Monthly 52 A026 - Provide diagrams, database input and information export detailing system, software, hostname, application, relationship to connecting devices and function A046- Contractor shall provide a monthly report documenting all software due to expire within 6 months and all software licensed to the 26 NOS. Report should at minimum include POC information, number of licenses in use, license information and equipment associated with software.

3.1.6.5 The Contractor shall track all 26 NOS assets. A032 Asset Management Database Report A037 Monthly Warranty Report

Weekly/Monthly 52 A032 - Report shows hardware, warranty info, dates,locations, serial numbers, ADPE account association.

3.1.6.6 The Contractor shall act as the Change Management Program Office for managing, maintaining, and documenting for Change Management processes and Configuration Control Board (CCB) decisions.

A035 CAB Meeting Minutes A036 Database Deficiency Report

As Requested/Monthly 52 A036 Contractor shall submit meeting minutes in Memorandum format NLT 48hrs post CAM meeting.

A037 Submit monthly report of Change Management database outages, trouble tickets and issues associated with the change management database.

3.1.7 Records/Knowledge Management

3.1.7.1 The contractor shall administer and maintain knowledge management

3.1.7.2 The Contractor shall manage and maintain 26 NOS electronic information and records

3.1.7.3 The Contractor shall develop and implement a schedule management system (Microsoft Project preferred) and a common repository that consolidates all schedules into a master schedule.

A038 Schedule Management System A039 Weekly Records Management Status Report A040 AF Form 673 Routing Reports

Weekly 52 A038- Report should include at minimum project description, milestones, status and issues, POC A039- Weekly report detailing status of documents, team/POC, description A040- Track, distribute and maintain publication and form record set containing all documentation that shows coordination, comments resolutions and other actions, such as changes and rewrites, exemptions, waivers, suggestions.

3.2 Defensive GIG Operations

3.2.1 Network Security

3.2.1.1 The Contractor shall establish, operate, and maintain 26 NOS Network

Security Systems.

N/A When a technician provides support to network security systems any action that they take on the device should be properly documented in the Air Force approved ticketing software (Remedy)

3.2.1.2 The contractor shall analyze boundary device performance data and traffic utilization.

A023 Network Device Performance Report A024 Network Traffic Utilization Report

Weekly 52 A023- This report should leverage 26 NOS tools to provide customized, actionable reports that show things like response time, availability, & uptime of routers, switches, & other SNMP-enabled devices. It should also report on the health of the device and provide recommendations and POA&Ms for replacements and upgrades.

A024 - This report should leverage 26 NOS tools to provide customized, actionable reports that show exactly how bandwidth is being utilized throughout the AFIN–specific reports on which user, application, source, destination, conversation, etc. is occupying bandwidth. It should also show top applications, protocols, hosts, etc. It should also list actions taken to optimize the traffic utilization and any upcoming plans to optimize traffic. It should also provide trends of traffic utilization and root cause analysis for abnormal traffic trends. Submit as part of Weekly Activity Report.

3.2.2 Information Assurance

3.2.2.1 The Contractor shall provide support for the 26 NOS Information

Assurance (IA) program.

A042 IAVM Leadership Brief Monthly 12 This report provides monthly IA, Vulnerability Management, & Inspection prep status updates.

3.2.2.2 The Contractor shall complete the DoD Information Assurance

Certification and Accreditation Process (DIACAP)/DIA Risk Management Framework for the 26 NOS.

A012 Certification and Accreditation (C&A) Status Report A013 DIACAP/DIARMF Plan of Action and Milestones

Monthly 12 A012 Monthly eMASS C & A Control Review and update for all 26 NOS managed networks.

A013 Monthly review and status update of all Plan of Action and Milestones

3.2.2.3 The Contractor shall manage IA projects and resources for the 26

NOS.

Varies depending on the project

3.2.2.4 The Contractor shall perform vulnerability management duties for the

26 NOS.

A047 Plan of Action and Milestones (VMS & Other, not C&A related) Approval, Tracking, Reviews

Weekly/As Requested 12 Monthly POA&M review. Review and Approve/Disapprove POA&M on an "as needed" basis

3.3 AF Domain Management

3.3.1 Domain Name Services (DNS) and Simple Mail Transport Protocol

(SMTP) Operations

3.3.1.1 The Contractor shall operate, maintain, and defend appliances, servers, and systems for DNS and SMTP services.

A009 Trends and Analysis Report Weekly 52 Weekly system report detailing, deficiencies, outages, blocks implemented, increase or decrease in messaging traffic, and anomalies.

3.3.1.2 The Contractor shall provide and perform network address management for other applicable services and DNS.

3.4 Network Analysis and Troubleshooting

3.4.1 Enterprise Analysis: Analyzes and monitors circuit and protocol utilization to prevent circuit saturations and network outages. Performs deep packet analysis of all network components to troubleshoot and isolates network problems.

3.4.1.1 The Contractor shall provide conduct Circuit & Protocol Utilization and Deep Packet Analysis.

A014 Ad Hoc Reports A015 All Circuit Utilization Report

Weekly

3.4.2 Project Integration

3.4.2.1 The contractor shall provide project management, engineering and system analyst support to operate, manage and defend all AFNGWS, their SIPR equivalents, the SDP routers managed by the 26 NOS, the IMS networks and systems, and the underlying workstations, servers, storage networks, and systems of the 26 NOS at the primary location and AOL.

A016 PIG Project Plan A017 New Technologies Implementation Plan A019 PIG Weekly Status Report A041 Status Report

As Requested/Weekly A041 Provides weekly progress report on all active projects in government approved format) Monthly Trend Analysis and Historical Report (Develops and delivers trend analysis and historical reports monthly; Develops and delivers trend analysis and historical reports covering a six-month period by Government suspense date.)

3.4.2.2 The Contractor shall manage, maintain, and administer VoIP/VoSIP support for projects at 26 NOS and other supported AF bases.

A050 Report of current VoSIP users Monthly 12 This report shows VoIP equipment inventory and status on a quarterly basis. It provides a status of the overall health of the VoIP network, to include call manager and other network devices. There will also be ad hoc reports.

3.4.3 Enterprise Tools

The contractor shall leverage the capabilities of the 26 NOS Network Monitoring Tools to provide an effective, proactive security posture OR

A020 Tool Feature Training Plan A021 Product Upgrade Implementation Plan

The contractor shall provide support to foster persistent network operations and increased situational awareness to enhance the squadron's ability to defend the AFNET against internal and external threats.

3.4.3.2 The Contractor shall update existing tool set displays and dashboards, as needed, to meet the customer's requirements.

A020 Tool Feature Training Plan A022 Custom Solutions I-Plan

As Requested

3.4.3.1 As Requested