Atch_J-1_PWS_-_GCDS_final.docx

PERFORMANCE WORK STATEMENT (PWS)

as of 30 May 2014

1. Contracting Officer’s Representative (CORs).

a. Primary COR.

Department of Defense Activity Address Code (DODAAC):

H98272

Chambersburg, PA 17201

b. Alternate COR.

Chambersburg, PA 17201

2. Task Order Title. Global Content Delivery Services (GCDS)

3. Background. Defense Information Systems Agency (DISA) Enterprise Services (ES) is a provider of information technology (IT) solutions for the Department of Defense (DOD). DISA requires processing, storage, communications, and content delivery services for a variety of its customer applications across DOD. The purpose of this PWS and resulting contract is to provide state-of-the-art global content delivery capacity to meet current and future DOD customer requirements across the Defense Information System Network (DISN) and any other networks utilized by DOD users.

DISA is required by DOD to enhance communications effectiveness through improved information interoperability. The Under Secretary for Defense for Acquisition, Technology and Logistics (OUSD (AT&L)) has articulated a vision for transforming the information environment in the DOD. The envisioned changes represent a fundamental paradigm shift from providing platform centric applications to platform independent, web-enabled, Net-Centric services that require the support of a ubiquitous network environment, that meet the requirements of the end users, and which are highly available, secure, and reliable. As a result of the shift to Net-Centric services, ES requires content delivery capabilities at DISA-owned and other DISA approved processing locations, based on new missions and workload requirements.

DISA is committed to maintaining secure information assurance (IA) and delivery of application data to geographically dispersed user communities. Inherent in the secure delivery is the capability to encrypt data transmissions, provide the ability for public key infrastructure (PKI) enablement of distributed applications and content to authenticate individuals requesting application access, prevent inadvertent disclosure of sensitive information, and assure access controls are appropriately executed. An additional tenet of IA is availability. The overlay network shall be fully capable of automatically detecting, without user intervention, when a content delivery location at the edge of the network (so forth referred to as “edge”) is not available and continue to provide service without the end user experiencing outage or delay.

DISA research conducted over the last 6 years determined that the distributed computing environment will meet mission content delivery requirements for global application availability and performance. This capability shall include the ability to provide various forms of content to users at the extreme edge of the DoD managed wide area networks (WANs) employed by war fighters world-wide on both classified and unclassified networks, including the Non-Classified Internet Protocol Router Network (NIPRNet), the Secret Internet Protocol Router Network (SIPRNet), the Joint Worldwide Intelligence Communication System (JWICS) and the International Security Assistance Force (ISAF) network (a Combined Enterprise Regional Information Exchange (CENTRIX) network), and the Internet. Other similar networks utilized by DOD users will be deployed over time. At a minimum the requirements detailed in this PWS shall include the ability to store and forward content in the form of web hypertext transfer protocol (HTTP ) and hypertext transfer protocol secure (HTTPS) objects of all types, distribute data and databases across the Federal and DOD networks, execute applications operating on locally available (cached) data and databases, and deliver streaming video to end user populations on disadvantaged networks throughout the world.

Content delivery shall also include cache capabilities and the acceleration of content which is HTTP or HTTPS, utilizing compression and front end optimization or similar techniques. The capability of streaming video and audio delivery is required at all edge locations world-wide. This capability shall allow for a single stream of video/audio to traverse the network unbroken into multiple user streams until it reaches the edge locations worldwide. Transcoding of the device type being used (Blackberry, Flash, etc) shall be made at the edge location in a single stream and format. Also, multiple occurrences (i.e. 3) shall be delivered across the network and have consistency in delivery to be put together at the edge to ensure a full stream without breaks is delivered to users. The capability to automatically detect bandwidth congestion in bandwidth disadvantaged networks is required and this shall not affect the stream of data.

DISA recognizes the importance of delivery of Domain Name Service (DNS) from remote edge locations to meet the availability of DNS service on both NIPRNet and SIPRNet and various other networks. The contractor shall, without human intervention, integrate and utilize existing DISA global DNS services. Source NATing shall be disabled on all GCDS related systems, components and equipment.

4. Objectives. The objective is to obtain reliable, responsive, and cost effective content delivery services that are dynamically scalable and utilize an on-demand service approach to support DISA and other DISA-approved locations in the continental United States (CONUS) and outside of the continental United States (OCONUS).

Service shall provide two to ten times an increase in performance upon achieving full operational capability (FOC) and a minimum of 50% bandwidth offload from the origin server.

The service provider shall procure, install, uninstall, transport, perform power up configuration, and provide all areas of hardware, technical personnel, software, data replication services, hardware/software upgrades, maintenance, replacement, and disposal. Additional procurements will include the provision of switches, servers, racks, RPDU’s, UPS devices, SAN or NAS devices, and monitoring/reporting software used to support the content delivery services at all locations worldwide. This includes Naval vessels or tactical locations. The service provider shall provide full Network Operations Command Center (NOCC) capability and support for all service offerings.

The acquisition of all IA- and IA-enabled GOTS IT products is limited to products that have been evaluated by the NSA or in accordance with NSA-approved processes. The acquisition of all IA- and IA-enabled COTS IT products is limited to products that have been evaluated or validated through one of the following sources - the International Common Criteria (CC) for Information Security Technology Evaluation Mutual Recognition Arrangement, the NIAP Evaluation and Validation Program, or the FIPS validation program. Robustness requirements, the mission, and customer needs will enable an experienced information systems security engineer to recommend a Protection Profile, a particular evaluated product or a security target with the appropriate assurance requirements for a product to be submitted for evaluation.

5. Scope. The Contractor will accredit, deliver, install, maintain and dispose GCDS capacity infrastructure in concert with the Government, at any of the current DISA ESD computing facilities or future DISA ESD computing facilities in the continental US (CONUS), outside CONUS (OCONUS) and other DISA or DISA approved locations worldwide. Service shall be integrated IAW DISA and DoD policies. The objective is for the Contractor to provide content delivery services using a “utility based contract concept”. This utility concept requires that the Contractor provide all assets and services needed for the content delivery service, with the exception of type I cryptographic devices, firewalls, and intrusion detection systems (IDS). These assets shall include, but are not limited to, hardware, software, software maintenance and licensing, design capabilities, logistical support, field maintenance, and engineering support. These services will also include, but are not limited to, installation, racking and stacking of equipment, cabling, powering of device, and configuration related to the deployment and sustainment of the provided GCDS service. The scope shall also include transitioning existing and new customer applications. Contractor shall provide customer outreach activities.

This initiative will support unclassified and classified networks including SCI level environments:

· Non-Classified Internet Protocol Router Network (NIPRNet)

· Secret Internet Protocol Router Network (SIPRNet)

· Joint Worldwide Intelligence Communication System (JWICS)Combined Enterprise Regional Information Exchange (CENTRIX)/International Security Assistance Force (ISAF)

· Similar type networks deployed over time

6.0 Performance Requirements

6.1 Task 1 – Global Content Delivery System Support

6.1.1 Subtask 1.1: Technical Requirements

The Contractor will accredit, deliver, install, maintain and dispose GCDS capacity infrastructure in concert with the Government, at any of the current DISA ESD computing facilities or future DISA ESD computing facilities in the continental US (CONUS), outside CONUS (OCONUS) and other DISA or DISA approved locations worldwide. Service shall be integrated IAW DISA and DoD policies. DoD requires all systems services to be IPv6 compatible.

6.1.2 Subtask 1.2: Supported Networks: This service shall support unclassified and classified networks including SCI level environments:

6.1.2.1 Non-Classified Internet Protocol Router Network (NIPRNet)

6.1.2.2 Secret Internet Protocol Router Network (SIPRNet)

6.1.2.3 Joint Worldwide Intelligence Communication System (JWICS)

6.1.2.4 Combined Enterprise Regional Information Exchange (CENTRIX)/ International Security Assistance Force (ISAF)

6.1.2.5 Similar type networks deployed over time

6.1.3 Subtask 1.3: Ancillary Components The contractor shall provide solutions that include all required ancillary components such as racks, cables, power cables, etc. See Attachment 2 for rack and power details.

Deliverable/s: Solutions that conform to rack and power details identified in Attachment 2.

6.1.3.1: All GCDS hardware deployed in austere environments (see section 9.1.3), to include tactical Edge, shall be solid state devices.

6.1.4 Subtask 1.4: Accredited Global Content Delivery Service

The contractor shall provide a fully DoD certified and accredited content delivery solution, which can be deployed globally, provide network storage and management of content, maximize bandwidth, deliver static, dynamic and streaming content, cache management, load balancing, and offer performance measurement /reporting capabilities. Contractor provided content delivery solution shall be managed and maintained by the contractor, and shall be subject to DOD certification and accreditation processes. Certification and accreditation must be achieved before the first order can be placed.

6.1.5 Subtask 1.5: Provide Security Accreditation

The contractor shall work with DISA to implement DOD security standards and Security Technical Implementation Guides (STIGs), scan systems, record results (currently employing VMS), and complete Plan of Action and Milestones (POA&Ms). The contractor shall also provide technical input, such as ports and protocols, to the DOD certification and accreditation package. Contractor shall provide support for the creation and deployment of security patches as dictated by IAVAs that are applicable to the software; this includes performing scanning, recording results (currently employing VMS) and running reports. The contractor shall provide support for yearly Security Testing and Evaluation audits by the DISA Field Security Operations (FSO) Staff.

6.1.5.1 Subtask 1.5.1: The GCDS deployed on the DISN in satisfaction of the service request must meet applicable DoD and DISA security regulations and standards. It is the responsibility of the service provider to maintain the systems in accordance with these and, using any system or systems specified by DISA, to properly document the system’s security posture and currency under existing IAVA program. Contractor shall comply with DoD patch management procedures (DoD currently uses WSUS and HBSS).

The contractor shall ensure that all contractor infrastructure, servers and workstations connected to the DISN and/or containing customer sensitive data are configured in compliance with the DISA STIG applicable for that operating system.

The contractor shall comply with the following DoD-approved architectures, programs, standards and guidelines:

DoD Instruction 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP), DoD Directive 8500.1, "Information Assurance (IA)," October 24, 2002 DoD Instruction 8500.2, "Information Assurance (IA) Implementation," February 6, 2003 DoD Instruction 8551.1, "Ports, Protocols, and Services Management (PPSM)," August13, 2004 DoD CSC-STD-002-85, "DOD Password Management Guideline," April 12, 1985 CJCSM 6510.01, "Defense-in-Depth: Information Assurance (IA) and Computer Network Defense (CND)", March 25, 2003 DoD CM-400-260-01, "Software Requirements Specification (SRS) for the Network Management (NM) Functional Area Of The Defense Information Infrastructure (DII)," July 8, 1997 DoD Directive Number 3020.26, Continuity of Operations (COOP) Policy and Planning, May 26, 1995 DoD Instruction Number 3020.39, Integrated Continuity Planning for Defense Intelligence, ASD (C3I), August 3, 2001 DoD Directive Number O-8530.1, Computer Network Defense (CND), January 8, 2001 Defense Information Systems Agency Instruction (DISAI) 630-230-19, "Security Requirements for Automated Information Systems (AIS)," August 1991, and Supplements 1 and 2, not dated . ASD (NII) Memo, "Internet Protocol Version 6" (IPv6), June 9, 2003 DoD Directive 8570.1 Information Assurance Training, Certification, and Workforce Management DoD 8570.1M, Information Assurance Workforce Improvement Program DoDM 8530.1-M CJCS Manual 6510.01, Defense-In-Depth, Information Assurance (IA) and Computer Network Defense (CDNDoD Security Technical Implementation Guides (STIGs)FSO Process Guides FSO Penetration SOP FSO Security Features User Guide (SFUG) FSO Security Review Methodology FSO Risk Assessment Guide National Security Agency (NSA) Security Guides Netcentric Enterprise Services (NCES) Framework Section 508 Accessibility Standards as appropriate DoD 5200.2-RM DOD Personnel Security Program DISAI 240-110-36, Personnel Security DoD 5220.22-M, National Industrial Security Program Operating Manual DoD 5220.22-R, Industrial Security Regulation Federal Information Processing Standards Publication (FIPS)140-2 Compliance NIST Special Publication 800-53 r4 Security and Privacy Controls for Federal Information Systems and Organizations, April 2013

6.1.6 Subtask 1.6: Rapid Deployment of GCDS for emergency responses – The contractor shall be able to rapidly deploy service to austere locations using innovative solutions such as a compact mobile node at the edge of the network. New edges shall be maintained by the contractor while the edge is deployed, and bring the edge down (decommission) at the direction of the government. This node must have the capability to function as any other node at the edge of the network and must be able to deliver content, stream video and audio and work to reduce the page size and optimize page render time. This deployable unit must be a maximum of 4U, which includes all necessary equipment to function independently. The unit must be all solid state with a box that is dust resistant and can withstand, without degradation, a max high temperature of 122F with a range of 15% to 90% humidity and a max low of 32F with a range of 15% to 90% humidity. GCDS shall be able to provide a deployable 4U Edge racked in a shock travel case. The edge must be up and running in a GCDS production environment at either a vender location or Chambersburg location as to meet a minimum of 24 hr notice for shipping to CONUS and OCONUS locations. This edge will be employed to support crisis and/or federal disasters.

6.1.7 Subtask 1.7: Electrical Power Configuration- The unit must be configured with a standard electrical plug fully compatible with the area of deployment (adapter if necessary) as well as an Ethernet connection. Neither of these plugs/wires can jeopardize the integrity of the case.

6.1.8 Subtask 1.8: Origin Load Balancing- GCDS shall provide the capability to load balance between multiple application origins and edge points for each application based on configurable network conditions to reduce perceived latency and optimize performance. The solution will align demand with resources and resources with demand to maximize throughput, minimize response time, combat “flash crowds”, and increase reliability. GCDS shall automatically direct traffic away from an origin should the origin not be reachable or have network problems which reduce the origin server from not being optimal to the delivery of traffic to the global edge locations.

6.1.8.1 Node load balancing: GCDS node servers must be able to load balance for DoD applications that require session stickiness.

6.1.9 Subtask 1.9: The contractor shall ensure the GCDS solution will interface, without capability loss or degradation, with Government firewalls (currently employing Juniper), IDS (currently using Sourcefires or Securify), and cryptography.

6.1.10 Subtask 1.10: The GCDS shall provide the capability to validate user credentials from a Common Access Card (CAC) , Smart Card or other authentication methods from the established edge locations based on DoD standards utilizing a revocation list created from an Online Certificate Status Protocol (OCSP) responder.

6.1.11 Subtask 1.11: GCDS SSL Delivery

GCDS delivers both static as well as dynamic content. To ensure dynamic content delivery, contractor shall provide the capability to perform SSL processing and certificate management at the scale required to handle encrypted SSL tunnels. Each GCDS edge location shall have the capability of independently passing and handling SSL applications. Within the scope of dynamic content, the contractor shall provide the capability to support logic for statements, conditionally assembling fragmented HTML content to enable separation of dynamic pages into cacheable and un-cacheable components, while improving application performance by minimizing the amount of content that needs to be retrieved from the origin server for that application.

6.1.11.1 Support Non-HTTP/S: Contractor shall provide support for Non-HTTP/S applications with highly dynamic data. Service shall accelerate delivery of TCP protocols such as virtual desktops/client server apps as well as interactive web conferencing, virtualized applications over Citrix ICA and Microsoft RDP protocols, and accommodate large files transferred through secure FTP or SSH to meet a minimum threshold of 30 seconds for files equal or exceeding 100MB. Capabilities shall employing real time route optimization to support the acceleration and delivery of dynamic content.

6.1.12 Subtask 1.12 Customer Portal: The contractor shall provide a customer portal for GCDS customers to control essential aspects of service delivery for their applications, provision simple services, obtain statistics of how the service is delivering applications, provide alerts when thresholds are exceeded, and information with logs which can easily be accessed and made into reports with information readily stored for one year. Customers shall be able to purge their own content in the cases of spillage and cache issues automatically from a purge button on the portal for that application owner. The customer application portal shall only display the content for that application owner, and shall be authenticated and validated in compliance with OSCP guidance. The portal shall also display to the user the capability to view areas of their application, Uniform Resource Locators (URLs), and the usage in Mb/month, MB/month, GB/month or Gb/month in a report format. All data from the portal shall be conformed to allow users to create reports from that data and produce them in a Portable Document Format (PDF) file, a raw data file and an Excel data file at a minimum.

6.1.12.1 Subtask 1.12.1 GCDS PM Dashboard: GCDS shall include a management dashboard that allows GCDS PMO to review the status of applications, run reports, gather statistics, and see a view.

6.1.13 Subtask 1.13- Adverse Network Detection: This service shall detect adverse network conditions immediately and demonstrate the ability to continuously and efficiently obtain and distribute applications and content to end users. The service shall provide a visual tool to provide the GISMC, TNCs, and others the capability to view network conditions and create reports for these conditions. This application shall be CAC enabled and communicate in real time.

This content shall be provided by the best performing source infrastructure relative to the end user (such as from a region in closest topological proximity to the end user) with the goal of providing optimal performance from the perspective of that user.

6.1.14 Subtask 1.14-GEO Location: The GCDS shall provide a global map application, which displays latitude, longitude, country, state and city for an IP address of an end user in real-time, automatically with attributes gained from network heuristics from the GCDS edges placed globally. This information shall be incorporated to allow for identification of an end users location in real-time.

6.1.15 Subtask 1.15 Cache Content: The contractor shall provide capability to cache all content browsed by end users, whether on GCDS or not. GCDS service shall automatically apply developed metadata for the end user. If the application requested by the end user does not have metadata established for the application requested by the end user, then the GCDS service shall determine the cacheable content in the application automatically and apply this cacheable content to the GCDS cache at that edge location. This capability is required to reduce transport costs across the DISN. GCDS shall act as a forward cache providing non-GCDS traffic (DoD sites not on GCDS or Internet sites), making intelligent decisions on caching the content at the edge location, the capability to fragment an application page into cacheable content as to allow for a statement or a section of metadata to be excluded from the cache, providing that cache content to others at that edge location, and storing that cache at that established edge location. The edge location cache must handle any cache from any content provider for example Internet, Facebook, YouTube, CNN, and FoxNews (examples).

6.1.15.1 Subtask 1.15.1Advanced Cache Controls: Provide the capabilities within GCDS to automatically modify an objects cache label (or cache key) to contain only URL components and request attributes that are appropriate for the defined content. Items within the content such as IP address, header or cookies shall be able to be automatically determined as the cache key as opposed to the URL. Contractor shall also provide for session management, with GCDS being capable of generating redirects acting on behalf of the application, following redirects on behalf of the end user or even the ability to tweak an HTTP header to accommodate unique configurations.

6.1.16 Subtask 1.16 Enterprise Recursive Service (ERS) Compatibility: The purpose of the ERS program is to provide centralized control of recursive DNS queries on the NIPRNET. To implement this control, each local recursive name server is configured to forward all queries from local end-users to a set of IP Anycast-enabled ERS servers. ERS functionally acts as a DNS proxy; it will recursively resolve the forwarded requests. With ERS in place, all external DNS queries can be controlled via policy as directed by the Cyber Command. Under this scheme, all authoritative name servers will see IP addresses of ERS rather than the more numerous and distributed local name servers. GCDS must be able to coexist with the ERS application and not adversely affect ERS’s functionality or allow ERS to adversely affect its functionality and mission to provide dramatic performance increases in availability, fault tolerance, and security for critical DoD web applications.

6.1.17 Subtask 1.17 PKI/CAC enabled applications for non-SharePoint sites: the solution must be able to recognize and take correct action for DoD certificates and non-DoD certificates, extract CAC info and forward to application for authorization for role based access.

6.1.18 Subtask 1.18 PKI/CAC enabled applications for SharePoint sites: the solution shall re-sign the certificate and send it forward to SharePoint environment for authentication and authorization.

6.1.19 Subtask 1.19: The solution shall provide established edge locations at the edge of the network the ability to solely validate with the applications source (origin) server (in various locations globally) before providing the application content to the end user or denying application content to the end user without a reach back to a central repository. Support HTTP basic authentication and form based login at the node located at the edge of the network. Upon denial from the origin application server, the node at the edge of the network will automatically provide a customized error page for that application indicating the denial to the end user.

6.1.20 Subtask 1.20 Global Network Operations Support 24 x 7: The NETOPS tool includes the following features:

· Active sensors distributed worldwide monitoring network performance

· Sensors setup to do tests such as pings, DNS lookup and downloads of an HTTP object

· Provides an aggregated view over any time period and at any rate which the end user requires for the tests to be run between any GCDS location and any IP routable assets on the NIPRNet and SIPRNet

· Early warning for network activity

· Provides alerts and situational awareness

· Provides a baseline and monitoring changes in baseline

· Provide alerts if differs from baseline for that reporting of a point to point test

· Passive sensors distributed worldwide monitoring intrusive activity

· While sitting in un-advertised IP space, the sensor will listen for any activity

· Records the IP address and port for which the intrusive activity is coming from

· That information is then relayed to the portal to be displayed

· One year worth of data for comparison would be stored for the portal

· This tool will be fully supported by the 24X7 NOCC

· Utilize passive tools which are compatible with intrusion detection devices which are utilized today as Sourcefire IDS’s.

· The contractor will perform one free relocation of a GCDS sensor location at the edge of the network per fiscal year

6.2 Task 2 GCDS Repository with Global Traffic Management (GTM):

The service shall meet the requirement for a global traffic management solution that provides both performance mapping and automatic testing of websites to ensure customer facing content has optimal responsiveness and availability to user requests. The solution shall provide global traffic management service in a fault tolerant system that makes intelligent routing decisions based on real-time server and WAN conditions. The service will help customers balance traffic between origin datacenters across the WAN.

The Contractor monitors Web site availability through widely-deployed points-of-presence to capture WAN traffic conditions relative to the customer’s datacenters. Based on these conditions, customer-specific policy rules are evaluated against real-time WAN traffic conditions.

The contractor will provide full NOCC capability and support for the global traffic management and repository services on NIPRNet and SIPRNet 24X7X365.

There are three service variants:

1. Failover The Failover feature monitors the primary website datacenter and can automatically direct requests to alternate locations when there is a failure at the primary site.

2. IP Intelligence Requests can be directed to datacenters based upon IP rules.

3. Performance

Requests can be directed through policy rules that feature percentage-based load balancing and load feedback. This allows for server specific load balancing within a datacenter.

6.2.1 Subtask 2.1 DNS Resolution: The service employed shall use resolution consistent with the Internet Protocol (IP) standard DNS or other technologies to direct users of the service to the best performing infrastructure that will provide content or execute an application for those remote users. The domain name resolution or other technology provided by the service shall be integrated into the technology of delivery to eliminate any incompatibilities, technology inconsistencies, or any other interoperability problems which could adversely impact a user if a region becomes unavailable mid-session. The service shall inherently provide the capability to determine which of the diverse infrastructures is appropriately loaded to service the users. Therefore, DISA accepts that the underlying algorithmic rationale for domain name resolution is assumed to be proprietary and possibly a trade secret or otherwise intellectual property of the contractor. The service shall also be aware of its own geographic and topological diversity to optimize routes between regional infrastructures to provide application level routing over the WAN, both to and from origin applications and to and from user bases. The service shall be able to utilize various storage infrastructures, both local and remote, to provide best value for rapid delivery of data to end users. The service shall be effectively self-aware relative to its infrastructure capabilities (meaning system outages, network latencies, diminished capacity or degraded performance of any type for the various dispersed nodes) to most effectively utilize those components, nodes, regions, etcetera to limit the negative impacts of any degradation. SIPRNet and NIPRNet and other classified/unclassified network connections shall be provided to the contractor facility not to exceed a DS-3line, if the Government requires this capability.

6.2.1.1 TCP Optimization: The contractor shall provide for Terminal Control Protocol (TCP) Optimization. The contractor shall support (through real-time network conditions and statistics) a complete understanding and knowledge of the GCDS overlay network and conditions of connections. The TCP optimization techniques shall be utilized including the ability to initiate more aggressive TCP compressions when appropriate and to reduce packet loss by enabling error correction at the edge.

6.2.2 Subtask 2.2 WAN Traffic: GCDS shall use multiple techniques effectively and concurrently to minimize the back-end WAN traffic distributing content across regions and to deliver applications and content to end users. The distribution of content across regions will be performed in a way or at a time when it shall have the minimal impact on network operations and available bandwidth. GCDS shall control all accesses to origin servers providing applications and content so that no users actually access the origin servers. Security built into the GCDS shall allow for an end user to only access the content delivery edge, and that the content delivery edge shall only access the origin. This protection is mandatory as it prohibits Distributed Denial of Service (DDOS) attacks by the attack concentrating on the content provider’s network and not the origin server. The content provider shall ensure that if a DDOS were to occur that immediate notification would be made to the TNCs, GISMC, etc for NetOPs reporting and the capability to isolate that traffic for the DDOS into one of more edges prohibiting the network from being affected by the DDOS as a whole.

6.2.2.1 Application Firewall: The contractor shall provide the capability of a layer 7 Application Firewall within the GCDS service to prevent malicious attacks to include cross site scripting, SQL injection and others, and shall have the capability to detect the signature of the attack and block the attack if it were to occur across the GCDS service.

6.2.2.2 Session Based Firewall: The contractor shall provide the capability to block users from edge locations for certain identified IP blocks, and the capability to provide edge IP addresses to application providers to allow for blocking all traffic at their location besides the CNAME’d application edges which are serving their traffic. With the GCDS application being CNAME’d over to the GCDS overlay network to prevent DDOS attacks as well as handling flash crowds and load balancing globally for the loads; the application origin server is only accessible from the GCDS edges globally, and end users accessing the application shall only access the GCDS edge locations The capability shall exist to allow certain applications to only accept data from certain edges globally. Provide the application owner the IP addresses of the edges so all unwanted traffic can be blocked at their origin, besides the GCDS edges which they have chosen to accept content from. Also, in reverse, GCDS shall have the capability of blocking certain users from certain global edge locations based on IP blocks of the end user location within DNS. This is a capability which is needed to block non-theater users from accessing edges which are within theater as well as other situations.

6.2.2.3 Cache Hierarchy: The contractor shall provide the capability to not only support the storage and optimal delivery of the application from the edge location, but also within the GCDS overlay network, edges shall be divided to support both parent and child edges, with parent edges having the capability of holding more cache information to support applications such as Facebook, (users information is available, however, data is not accessed often and usually by one or two users). GCDS shall have the capability as needed to store infrequent used data or data used by few users to be gradually moved from a child edge to a parent edge before being removed from the GCDS overlay network.

6.2.3 Subtask 2.3 GCDS Repository: The contractor shall provide integrated storage capability for large amounts of data (25TB-500TB) at various global existing locations (and future locations) that replicate globally between all units, two or three units, per the choice of the application owner and is integrated into the GCDS application.

6.2.4 Repository Performance: The contractor shall provided for a GCDS Repository that facilitates fast transfer of content to Contractor edge locations by replicating content to multiple locations and by selecting the optimal location from which to retrieve content. Replication brings content closer to the edge – this provides a significant improvement over content retrieval from a traditionally-deployed single-location customer origin deployment.

6.2.5 Repository Scalability: The contractor shall provide for a GCDS Repository that offers scalability as customer’s content needs growth and mirroring of content to multiple locations on the NIPRNet and SIPRNet.

6.2.6 Highly Available Repository: The contractor shall provide for Redundancy and fault tolerance are built into the GCDS Repository architecture – redundant server configurations with automatic failover, high availability repository hardware, content mirroring to multiple locations, and traffic management.

6.2.7 Intelligent Routing: The contractor shall provide for routing decisions that are based upon constant monitoring and analysis of network performance, congestion, and server load.

6.2.8 Data Mirroring: The contractor shall provide for uploaded content is that is replicated across multiple Repository centers in different locations. This ensures fault tolerance for both high performance and high reliability.

6.2.9 Failover: The contractor shall provide for failover to storage based conditions of origin server i.e. 500 level response (server not found can’t be reached), 400 level response (connection to server exists but content is unavailable. Based on user requirements GCDS could return apology page or error message. GTM used for mapping and load balancing based on performance, load, geography and can be used as a standalone failover solution.

6.3 Task 3 GCDS High Definition (HD) Video Streaming:

The contractor shall deliver HD video over HTTP/HTTPS, a one to many broadcast format. The solution must have the following capabilities:

1. Provides for live stream and video on demand.

1. Ability to encrypt video stream

1. Ability to step up or step down the size of the video stream according current bandwidth conditions.

1. Broadcast video with synchronized slide view and an ask-a-question feature where the presenter can view questions from attendees

1. Stream on-demand video by uploading pre-recorded video for future playback

1. Customizable player support Digital Video Recorder (DVR)

1. Access Control – via token security

1. Adaptive bit rate

6.3.1Subtask 3.1 Flash Streaming:

The contractor shall provide Flash streaming at a minimum with adaptive bit rate technology at the established edge locations with full DVR functionality and live streaming with streaming authentication capabilities using PKI authentication of CAC cards or Smart Cards.

6.4 Task 4 - Industry Standards: The contractor shall provide for implementation of components of the Information Technology Infrastructure Library (ITIL) will improve overall management of DISA’s storage infrastructure. Companies and Government agencies that have followed the methodologies of these models have improved their service and reliability of their processing infrastructure reducing their long-term costs. The following ITIL principles shall be incorporated in the contractor’s proposal:

1. Change Management,

1. Configuration Management,

1. Asset Management,

1. Release Management.

6.4.1 Subtask 4.1 - Change Management: An established process for handling change to the GCDS infrastructure on a continual basis shall be provided in the contractor’s proposal. Technologies will change, software will be revised, and hardware will be phased out by the manufacture. By having a process in place to handle these inevitable events, time and money can be saved. It will also be necessary to incorporate DISA customer requests for new or revised functionality.

6.4.2 Subtask 4.2 - Configuration Management: An established process for managing the infrastructure’s GCDS configuration shall be provided in the contractor’s proposal. The contractor shall provide monthly configuration/asset summary reports for configuration/asset validation by the Government.

6.4.3 Subtask 4.3 - Asset Management: An established process for handling asset returns and redeployment shall be provided in the contractor’s proposal.

6.4.4 Subtask 4.4 - Release Management: An established process for performing package releases to the infrastructure shall be provided in the contractor’s proposal. Release Management works to ensure strong Configuration Management and Change Management, and works alongside Asset Management to ensure that any assets are introduced into the infrastructure correctly and with the minimum of difficulty.

Deliverable/s: Methodology for ensuring established quality processes for change management, configuration management, asset management and release management that will integrate with DISA processes.

6.5 Task 5 Situational Awareness: Provide situational awareness 24x7x365 to various DOD entities such as Cyber Command (CYBERCOM), the Global NetOps Support Center (GNSC), the Theater Netops Centers (TNCs) and the Global Infrastructure Service Management Center.(GISMC). Situational awareness reporting shall provide information on how the service is performing in accordance with Network Operations (NetOps) reporting requirements. Reporting information will be derived from the DISA ESD performance monitoring tools to include, but not limited to, the Enterprise Systems Management (ESM) toolset.

6.5.1 Subtask 5.1- Performance Optimization: Provide solutions to optimize performance - Maintain and configure the Global Content Delivery environments to ensure that the service is optimized for flexibility and performance.

6.5.2 Subtask 5.2-Application Support: Provide solutions for application support - Maintain and configure the GCDS to ensure that it supports all application owners’ requirements including multiple large and/or complex portal style applications as well as interface with third party monitoring system for performance and availability.

6.5.3 Subtask 5.3-Real time monitoring: Provide solutions for a near real time tool to monitor the locations at the edge to Central Communications Centers (CCCs), TNC GISMC and all other sites the PMO designates as receiving the tool. This tool shall monitor performance being served from the edge with the capability of reaching back in logs to one year, total bandwidth being used across all edge locations in the service, the number of hits which are occurring across all the locations in the service as well as the number of hits per edge location.

6.6 Task 6 Standard Implementation Services:

The contractor shall provide for all standard GCDS capabilities and services identified in the performance work statement (PWS). For existing DISA customer applications, transition of applications to the GCDS platform shall support the following standard implementation services:

Standard Implementation Services are included as part of the GCDS, and allow the customer to integrate their site leveraging the following standard GCDS capabilities:

Extending the Infrastructure:

- Hyper Text Transfer Protocol (HTTP) Dynamic Site Delivery

- Secure Object Delivery (Secure Socket Layer Objects)

- Secure Content Delivery - Hyper Text Transfer Protocol Secure (HTTPs)

- Last Mile Accelerator (Compression)

- Streaming Delivery (Audio/Video)

- Dynamic End User Mapping

- Basic Cache Control (Prefetching, Standard TTLs, etc.)

- Capacity On-Demand

- Object delivery

- Domain Name Resolution (CNAME, A-Records etc.)- Control

- Monitoring

- Customer Reporting and Log Delivery

- Unique Customer/Application Identifier

- Alerts (Adjustable threshold settings, E-mail delivery, etc.)

- Customer Content Control Utilities (Purging, etc.)

- Standard Break/Fix Customer Care Support (24x7x365)

6.7 Task 7: IPv6 Compliance:

The contractor shall provide solutions that are Internet Protocol Version 6 (IPv6) capable. An IPv6 capable system or product is capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

Conformance to the DoD Information Technology Standards Repository (DISR) developed DoD IPv6 Standards Profile. Systems being developed, procured or acquired shall comply with the Global Information Global Architecture and DISR standard IPv6 Capable definition. An IPv6 Capable system shall meet the IPv6 base requirements defined in the latest “DoD IPv6 Standards Profile” available from the DISR.

Maintenance of interoperability with Internet Protocol Version 4 (IPv4). Systems developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities. Systems should implement IPv4/IPv6dualstack and should also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with.

6.8 Task 8 Mobile Device Support:

The contractor shall provide full support with mobile device capabilities, the solution shall determine the type of device at the established edge location the end user is interacting with worldwide, and deliver that mobile content in the appropriate format from the edge, GCDS shall have the capability to transcode from the edge and deliver appropriate formats from the edge for the end users device.

6.9 Task 9 Automated Capabilities: In support of cloud services, contractor shall provide the capability within GCDS to have automated capabilities to generate metadata on GCDS from Application Program Interfaces (API) that can link with Cloud environments within DISA

6.10 Task 10 Data DeDuplication Technologies:

DOD cloud services including Enterprise Email and the Enterprise SharePoint as well as others require the integration of data deduplication technologies (Riverbed or equivalent). The contractor shall provide a capability within their product to link into the deduplication technology to allow for the data deduplication technology to be delivered invisible to the end users globally and interface automatically with the GCDS edge locations globally.

6.11 Task 11 Transition Strategy:

6.11.1 Subtask 11.1- Implementation Transition Strategy: The implementation transition strategy will begin immediately upon award of the task order. The contractor shall provide a detailed non-disruptive strategy for transitioning the current edge locations provided in their proposal. The transition strategy shall provide for completing the transition of all edge locations to the proposed contractor’s solutions achieving full operating capability (FOC). Incentivization disincentivization will be provided based on timeline of completion as referenced in section 8.1 and 8.2. Full operating capability involves working with the incumbent contractor and the application owners to transition edges, metadata, etc. seamlessly. The contractor shall identify and respond to new customer requirements and prioritize implementation and shall utilize an automated URL migration tool if using such a tool would make URL migration more efficient than manual processes.

Transition phases will be approved by the GCDS PMO to manage customer expectations, bandwidth constraints.

Deliverable/s: Transition Plan showing the methodology for transitioning current GCDS capabilities to Contractor provided utility solution(s).

6.11.1.1 Subtask 11.1.1- New Customers: The contractor shall identify and respond to new customer requirements and prioritize implementation.

6.11.2 Subtask 11.2 Transition Exit Strategy: The transition exit strategy will begin at the end of the base task order. The Contractor shall conduct any necessary de-installation and removal of hardware items on this task order upon request by the Government both during and at the end of the task order, at no cost to the Government. Removal of all contractor equipment will be coordinated with the site Accountable Property Custodian (APC) or Property management group.

Deliverable/s: Transition Exit Strategy that details the draw down and transition for all capabilities as well as the impact to system requirements.

6.11.2.1 Task 12 Removal of Equipment:

The Contractor shall conduct any necessary de-installation and removal of hardware items on this task order upon request by the Government both during and at the end of the task order, at no cost to the Government. Removal of all contractor equipment will be coordinated with the site Accountable Property Custodian (APC) or Property management group.

Deliverable/s: De-installation and removal of hardware items on this task order upon request by the Government at no cost to the Government.

6.13 Task 13 Media Retention: All systems; components and/or writeable media being removed from the site (tapes, hard drives, mass storage devices, etc.) will be sanitized or may be retained by the government for destruction in accordance with DoD, DISA and ESD Security guidance. The contractor must be aware that the sanitation process is to prevent any compromise of classified and/or controlled unclassified data and may render the system components and/or writeable media unserviceable and/or completely destroyed. The Government will make the determination as to whether drives can be sanitized or destroyed.

Deliverable/s: De-installation and removal of media items on this task order upon request by the Government at no cost to the Government.

6.14 Task 14 Delivery and Installation:

The Contractor shall provide GCDS solution components that can be delivered, installed, and ready for use within 30 calendar days necessary to support task order requirements. The Contractor shall acquire, warehouse, install, uninstall, transport, provide the necessary hardware (including cabinets/racks), hardware maintenance, associated support software required for contractor solution to operate, and services to support the storage infrastructure associated with the task order. The contractor shall ensure that all GCDS Hardware/Software/solutions are STIG’d and configured in compliance with DoD and DISA Information Assurance directions and instructions which are further detailed in Section 12. Normal equipment installations should be accomplished during regular dayshift working hours (0600-1800 local time), Monday through Friday. Under certain conditions, the contractor may be required to perform an installation/update after normal duty hours during evenings and weekends. Although the Government will try to minimize this requirement, the Contractor must plan to work after hours, weekends, and or holidays for delivery and installation of new or updated orders.

6.14.1-All vendors are required to technically refresh a minimum of 1 time during the base 3 year period. The refresh can be at the start by providing new equipment when the award is made or any time before the expiration of the…