HC102816R0012_Amend_0004.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to:

A. Provide the completed Q&A Round 2 document (see second tab on the attached MS Excel w orkbook).

B. Provide the follow ing revised documents: Cost Model Workbook; PWS; PWS Appendices 5-1 and 5-2; QASP; Section L; and Section M.

C. Extend the RFP response date from Oct 4, 2016 9:00 am Central, to Oct 11, 2016 9:00 am Central.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 2

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 20-Sep-2016

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HC1028-16-R-0012

X 9B. DATED (SEE ITEM 11)

02-Aug-2016

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

20-Sep-2016

CODE

DISA/DITCO-SCOTT-PL83

2300 EAST DRIVE

SCOTT AFB IL 62225-5406

HC1028 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HC1028-16-R-0012

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The required response date/time has changed from 04-Oct-2016 09:00 AM to 11-Oct-2016 09:00 AM.

(End of Summary of Changes)

RFP No. HC1028-16-R-0012

Section J, Attachment C-1, Appendix 5-2 Revised, Amendment 0004

Virtual Appliance Design Specification

1. Virtual Appliances:

1.1 Data Center Forward Proxy Virtual Appliances, Licenses and Modules

Example Products

Data Center Forward Proxy (Virtual Appliance)

Bluecoat Secure Web Gateway (SWG) VA-100, no license

Data Center Forward Proxy License, 25 user (License)

Bluecoat virtual appliance 25 user license

Data Center Forward Proxy License, 50 user (License)

Bluecoat virtual appliance 50 user license

Data Center Forward Proxy License, 100 user (License)

Bluecoat virtual appliance 100 user licenses

Data Center Forward Proxy License, 500 user (License)

Bluecoat virtual appliance 500 user license

Data Center Forward Proxy License, 1000 user (License)

Bluecoat virtual appliance 1000 user license

Data Center Forward Proxy License, 2500 user (License)

Bluecoat virtual appliance 2500 user license

The following minimum features must be met:

· Supports VMWare ESXI

· Supports availability in various sizes to support different user levels are each site

· Must support administrative users across different geographic locations

· Must provide a mechanism for failing traffic over from one site to another

· Supports comprehensive protection and control over web traffic

· Supports content caching

· Supports strong user authentication

· Supports the ability to automatically re-route end user requests to other sites based on a proxy file that can be referenced on the client machine

· Supports web filter licensing

· Supports web filtering (restriction of URL filtering by category as well as domain and ip address)

· Supports the routing of multiple communications protocols, including IPv4 and IPv6

1.2 Data Center SSL VPN Virtual Appliances

Example Products

Data Center SSL VPN Virtual Appliance (Virtual)

Juniper SA Pulse Gateway 4610, primary and backup system, no licenses

Data Center SSL VPN Virtual Appliance User License 2.5k (License)

Juniper SA Virtual Appliance User License 2.5k

Data Center SSL VPN Virtual Appliance User License 5k (License)

Juniper SA Virtual Appliance User License 5k

Data Center SSL VPN Virtual Appliance User License 10k (License)

Juniper SA Virtual Appliance User License 10k

Data Center SSL VPN Virtual Appliance User License 20k (License)

Juniper SA Virtual Appliance User License 20k

Data Center SSL VPN Virtual Appliance User License 25k (License)

Juniper SA Virtual Appliance User License 25k

The following minimum features must be met:

· Supports additional user licenses

· Supports both full and split tunneling capabilities

· Supports the ability to control route tables on client workstations

· Supports dynamic licensing in order to accommodate user connections across multiple sites

· Supports CAC authentication

· Can be configurable across multiple geographic locations to support site failover Supports flexible and secure remote connectivity for data center employees

· Supports host checking functionality on remote machines and validate various security capabilities (antivirus, firewall, etc.) before connecting users

· Supports the ability for authenticated users to be restricted access to specific resources based on their credentials

· Supports the ability to authenticate users utilizing methods such as LDAP and username/password

· Supports the routing of multiple communications protocols, including IPv4 and IPv6

· Devices should be available in a tiered model; small, medium, large

· Requirements for small:

· Minimum device support of 1,000 concurrent remote access VPN users

· Requirements for medium:

· Minimum device support of 20,000 concurrent remote access VPN users

· Requirements for large:

· Minimum device support of 40,000 concurrent remove access VPN users

1.3 Enterprise Accounting, Authentication, and Authorization Virtual Appliances, Licenses, and Modules

Example Products

Enterprise Accounting, Authentication, and Authorization System Virtual Appliance (Virtual)

Cisco Secure Access Control System, no license

Enterprise Accounting, Authentication, and Authorization System Virtual Appliance License, Base (License)

Cisco Secure Access Control System Base License, 500 devices or fewer, required for each virtual appliance

Enterprise Accounting, Authentication, and Authorization System Virtual Appliance License, Large Deployment (License)

Cisco Secure Access Control System Large Deployment Feature License, unlimited devices supported, only required for primary appliance

Enterprise Accounting, Authentication, and Authorization System Token Virtual Appliance (Virtual)

RSA Authentication Manager Virtual Appliance

Enterprise Accounting, Authentication, and Authorization System Token Virtual Appliance License (License)

RSA Authentication Manager Virtual Appliance License

The following minimum features must be met:

· Authentication servers should be capable of supporting authentication for up to 5,000 devices

· Supports 802.1x

· Must support the ability to replicate configurations from a centralized authoritative server

· Supports centralized validation of users attempting to gain access to network devices across the enterprise

· Supports detailed accounting and flexible administrative control over authentication and authorization processes

· Supports devices from multiple Offerors

· Supports NAC

· Supports the ability to provide scalability across geographic locations

· Supports TrustSec

· Supports two factor authentication via an external server, but may not be required for every deployment

· Two factor authentication must be a capability, but may not be required for every deployment

· Two factor authentication must provide support for both hardware and software tokens

· Two factor authentication license must support the number of users and tokens in DISA

1.4 Enterprise Application Delivery Controller Virtual Appliances and Modules

Example Products

Enterprise Application Delivery Controller Appliance Small (Virtual)

Netscaler VPX 8000

Enterprise Application Delivery Controller Appliance Medium (Virtual)

Netscaler VPX 10G, Netscaler VPX 15G

Enterprise Application Delivery Controller Appliance Large (Virtual)

Netscaler VPX 25G

Enterprise Application Delivery Optimization Appliance (Virtual)

Netscaler SD-WAN VPX

The following minimum features must be met:

· Supports decrypting SSL session to reduce load on application servers

· Varying methods of persistence supported

· Supports layer 4 – layer 7 load balancing to application servers to provide redundancy and scalability to hosted systems

· Supports multiple persistence methods including cookies, source IP address, and SSL Session ID, Reverse DNS look-up and only answer back to traffic sourcing from a .mil address

· Supports the routing of multiple communications protocols, including IPv4 and IPv6

· Requirements for small:

· Up to 8 Gbps System Throughput

· Requirements for medium:

· Up to 15 Gbps System Throughput

· Over 15 Gbps System Throughput

1.5 Enterprise Deep Packet Inspection Virtual Appliances and Associated Devices

Example Products

Enterprise Virtual Packet Inspection Monitoring Tap (Virtual)

Gigamon GigaVUE-VM Visibility Fabric node

Netscout nGenius Virtual Agent

Riverbed SteelCentral NetShark Virtual Edition

Ixia Phantom vTap

Enterprise Virtual Packet Inspection Monitoring Tap License, 10 Taps (License)

Gigamon GigaVUE-VM 10 Pack Bundle SW License Extension

Enterprise Virtual Packet Inspection Monitoring Tap License, 50 Taps (License)

Gigamon GigaVUE-VM 50 Pack Bundle SW License Extension

Enterprise Virtual Packet Inspection Monitoring Tap License, 100 Taps (License)

Gigamon GigaVUE-VM 100 Pack Bundle SW License Extension

Enterprise Virtual Packet Inspection Monitoring Tap License, 250 Taps (License)

Gigamon GigaVUE-VM 250 Pack Bundle SW License Extension

Enterprise Virtual Packet Inspection Monitoring Tap License, 1000 Taps (License)

Gigamon GigaVUE-VM 1000 Pack Bundle SW License Extension

Enterprise Virtual Packet Inspection Monitoring Tap Management (Virtual)

Gigamon GigaVUE-FM Fabric Manager

The following minimum features must be met:

· Supports scalability to allow maximum monitoring of virtualized production traffic in the enterprise

· Supports the ability to avoid oversubscription when transferring data

· Supports the ability to map ports from source to destination for performance and security monitoring purposes

· Supports the ability to meet data center requirements

· Virtual taps should be able to forward to existing monitoring infrastructure

· Management software should allow for configuration and deployment of chosen virtual taps

1.6 Enterprise DNS Virtual Appliances and Modules

Example Products

Enterprise DNS Manager Virtual Small (Virtual Chassis)

Bluecat Virtual Address Manager, PV-3000, 30 BC or MS DNS/DHCP Servers Supported (Virtual Appl), Infoblox TE2210/2220

Enterprise DNS Manager Virtual Medium (Virtual Chassis)

Bluecat Address Manager, PV-6000, Unlimited BC or MS DNS/DHCP Servers Supported, Infoblox TE2210/2220

Enterprise DNS Appliance Virtual Medium (Virtual Chassis)

Bluecat Virtual DNS & DHCP, S60-V, up to 150,000 QPS, Supports up to 100,000 users/devices (Virtual Appl), Infoblox TE-V2220 (max QPS for virtual is 143,000 QPS)

Enterprise DNS Appliance Virtual Large (Virtual Chassis)

Bluecat Virtual DNS & DHCP, S100-V, up to 260,000 QPS, Supports 100,000 + users/devices (Virtual Appl), Infoblox TE-4010

Enterprise DNS Security Appliance Virtual (Virtual Chassis)

Bluecat Virtual DNS Security, SS500-V, up to 100,000 QPS w 2048-bit DNSSEC key lengths, Supports 100,000+ users/devices (Virtual Appl), Infoblox TE4010

Enterprise DNS Connector Plugin (Module)

Bluecat Virtual Appliance IPAM connector for VMware, Infoblox VMWare Cloud Adapter

The following minimum features must be met:

· Capable of meeting all DISA STIG requirements for DNS and DHCP

· Supports the integration of IP management and DNS management through a centralized appliance

· Must support zone transfers to existing Solaris based DNS devices in the existing infrastructure

· Must support delegation of records to the global load balancer proposed in this contract

· DNS manager must also include IP address management as an added function

· Supports acting as an NTP server for downstream devices

· Must be managed through a centralized platform

· Has the ability to manage and maintain configurations and code versions through a centralized management platform

· Must be deployed with redundant power supplies

· Supports deployment in multiple locations to provide redundant DNS capability across the enterprise

· Supports DNS lookup and DNS caching services for enterprise systems, users, and applications

· Supports features such as DHCP, DNSSEC, and integration with IP Management platforms

· Supports IPv6 and dual-stacked networks

· Supports management console with capability to manage child DNS servers through a single pane of glass

· Supports split-view DNS resolutions

· Devices should be available in several tiers

· Small requirement:

· Support for a minimum of 30,000 queries per second

· Support for a minimum of 210 DHCP leases per second

· Medium requirement:

· Support for a minimum of 50,000 queries per second

· Support for a minimum of 300 DHCP leases per second

· Large requirement:

· Support for a minimum of 140,000 queries per second

· Support for a minimum of 600 DHCP leases per second

· Extra-large requirement:

· Support for a minimum of 200,000 queries per second

· Support for a minimum of 1,000 DHCP leases per second

1.7 Enterprise Intrusion Detection System Virtual Appliances, Licenses and Modules

Example Products

Enterprise Intrusion Detection System Virtual Appliance (Virtual)

Cisco NGIPSv for VMware – Cisco FirePOWER (formerly Sourcefire) Virtual Appliance

Enterprise Intrusion Detection System App Control Add-on (License)

Cisco FirePOWER Virtual IPS and Apps Service Sub

Enterprise Intrusion Detection System Advanced Malware Protection Add-on (License)

Cisco AMP for FirePOWER Virtual Appl Service Sub

Enterprise Intrusion Detection System URL Filtering Add-on (License)

Cisco FirePOWER Virtual Appl. URL Filtering Service Sub

Enterprise Intrusion Detection System App Control and URL Filtering Add-on (License)

Cisco FirePOWER Virtual IPS, Apps and URL Service Sub

Enterprise Intrusion Detection System App Control and Advanced Malware Protection Add-on (License)

Cisco FirePOWER Virtual IPS, Apps and AMP Service Sub

Enterprise Intrusion Detection System App Control, Advanced Malware Protection, and URL Filtering Add-on (License)

Cisco FirePOWER Virtual IPS, Apps, AMP and URL Service Sub

The following minimum features must be met:

· Supports centralized management through Offeror provided management tool

· Must be compatible with existing security management console in use (Defense Center)

· Supports data center specific protection for web servers, databases, and storage, including Oracle, SAP enterprise class applications, and custom software

· Supports the ability to continuously defend critical servers due to OS and application vulnerabilities, reducing emergency patch fire drills and IT expenses

· Supports the ability to create and deploy security signatures across the enterprise to change along with evolving security concerns

1.8 Enterprise WAN Acceleration Virtual Appliances and Licenses

Example Products

WAN Acceleration Virtual Appliance, small (Virtual)

Steelhead CX for Virtual VCX1555

WAN Acceleration Virtual Appliance, medium (Virtual)

Steelhead CX for Virtual VCX5055

WAN Acceleration Virtual Appliance, large (Virtual)

Steelhead CX for Virtual VCX7055

The following minimum features must be met:

· Support the ability to enhances control and visibility across data centers

· Supports the ability to accelerate application and data transfer over wide area and hybrid networks

· Supports the ability to increase performance

· Supports the routing of multiple communications protocols, including IPv4 and IPv6

· Device should be available in multiple tiers

· Requirement for small:

· Minimum 100Mbps Optimized capacity

· Minimum 6,000 optimized flows

· Max data store of 400GB

· Requirements for medium:

· Minimum 400Mbps Optimized capacity

· Minimum 25,000 optimized flows

· Max data store of 640GB

· Requirements for large:

· Minimum 1Gbps Optimized capacity

· Minimum 100,000 optimized flows

· Max data store of 2.2TB

1.9 Network Analysis Platform Virtual Appliances, Licenses, Modules, and Management Devices

Example Products

Collection Station or Sensor – small (Virtual)

Riverbed NetProfiler Virtual Edition F5

Collection Station or Sensor – medium (Virtual)

Riverbed NetProfiler Virtual Edition F6

Collection Station or Sensor – large (Virtual)

Riverbed NetProfiler Virtual Edition F8

Collection Station or Sensor – extra-large (Virtual)

Riverbed NetProfiler Virtual Edition F9

The following minimum features must be met:

· Support for VMWare ESXI

· Supports collection of both IPv4 and IPv6 communication

· Supports collection of flow data, such as Cisco NetFlow, Juniper J-Flow, sFlow and Huawei NetStream, from flow-enabled routers and switches for analysis by the management console

· Supports enterprise data center requirements

· Capable of being managed by a centralized device that provides the ability to view statistics from all associated devices in the enterprise

· Supports intelligence that will help DISA teams optimize the existing network infrastructure for peak performance by forecasting bandwidth growth or recognizing capacity shortfalls before they begin negatively affecting performance

· Supports network, application and service visualization with real-time and historical views for detailed performance analysis activities with access to comprehensive packet level deep-dive analysis

· Supports recognition and monitors all applications or services, including web-based, voice and peer-to-peer applications

· Supports the ability to analyze flow datagrams and generate key metadata tags than can be linked back to the management console

· Supports threshold-based alarming for monitored interfaces

· Supports the routing of multiple communications protocols, including IPv4 and IPv6

· Devices should be available in a tiered model

· Requirements for small:

· Minimum 200,000 flows

· Requirements for medium:

· Minimum 400,000 flows

· Requirements for large:

· Minimum 800,000 flows

· Requirements for extra-large:

· Minimum 1,000,000

2. Virtual Firewalls:

2.1 Enterprise Application Aware Virtual Firewalls, Licenses, and Modules

Example Products

Enterprise Application Aware FW Small (Virtual)

Cisco ASA (multi-context)

Brocade vWAF

Palo Alto VM-Series – VM-100

Barracuda NextGen Virtual Firewall F10, F18, F80

Enterprise Application Aware FW Medium (Virtual)

Brocade vWAF

Palo Alto VM-Series – VM-200

Barracuda NextGen Virtual Firewall F180, F280, F380, F400

Enterprise Application Aware FW Large (Virtual)

Brocade vWAF

Palo Alto VM-Series – VM-300

Barracuda NextGen Virtual Firewall F600, F800

Enterprise Application Aware FW Extra-Large (Virtual)

Polo Alto VM-Series – VM-1000-HV

Brocade vWAF

Barracuda NextGen Virtual Firewall F900, F1000

Enterprise Application Aware FW Management Device (Virtual)

Palo Alto Networks M-100, central management up to 100 PAN-OS devices

The following minimum features must be met:

· Supports fine-grained visibility and policy control over application access/functionality, multi-gigabit, low latency and in-line deployment

· Supports identification of applications regardless of port, protocol, evasive tactic or Secure Sockets Layer (SSL)

· Supports protection against known and unknown application-borne threats

· Supports management through a centralized platform capable of managing firewall policies

· Supports the ability to logically partition management instances to allow mult-tenancy on a single platform

· Can deploy in both traditional HA as well as N+1 high availability architectures

· Supports protection by IP address, port/protocol, and also by inspecting certain application elements at layer 7

· Supports the ability to identify and control users regardless of IP address, location or device

· Supports the ability to perform layer 7 analysis in order to restrict access based on application layer filtering rule sets

· Supports the routing of multiple communications protocols, including IPv4 and IPv6

· These devices should be available on a tiered basis; small, medium, large, extra-large

· Requirements for small:

· Minimum 5Gbps throughput

· Minimum 2Gbps IPSEC VPN throughput

· Minimum 1,000,000 concurrent sessions

· Minimum of 8,000 security policies

· Requirements for medium:

· Minimum 10 Gbps throughput

· Minimum 4Gbps IPSEC VPN throughput

· Minimum 2,000,000 concurrent sessions

· Minimum of 15,000 security policies

· Requirements for large:

· Minimum 20Gbps throughput

· Minimum 4Gbps IPSEC VPN throughput

· Minimum 4,000,000 concurrent sessions

· Minimum 40,000 security policies

· Requirements for extra-large:

· Minimum 100Gbps throughput

· Minimum 20Gbps IPSEC VPN throughput

· Minimum 20,000,000 concurrent sessions

· Minimum 80,000 security policies

2.2 Data Center and Enterprise Stateful Virtual Firewall, Licenses and Modules

Example Products

Data Center Stateful Firewall Small (Virtual)

Fortinet FortiGate-VM01

Data Center Stateful Firewall Medium (Virtual)

Fortinet FortiGate-VM02

Data Center Stateful Firewall Large (Virtual)

Fortinet FortiGate-VM04, FortiGate-VM08

Data Center/Enterprise Stateful Security Context License 11-25 (License)

Virtual Domain (VDOM) Upgrade License 11-25

Data Center/Enterprise Stateful Security Context License 26-50 (License)

Virtual Domain (VDOM) Upgrade License 26-50

Data Center/Enterprise Stateful Security Context License 51-100 (License)

Virtual Domain (VDOM) Upgrade License 51-100

Data Center/Enterprise Stateful Security Context License 101-250 (License)

Virtual Domain (VDOM) Upgrade License 101-250

Data Center/Enterprise Stateful Security Context License 11-250 (License)

Virtual Domain (VDOM) Upgrade License 11-250

The following minimum features must be met:

· Supports IPS, SSP, VPN, and multiple context licenses

· Supports options to support different levels of throughput performance based on requirements

· Supports the ability to either terminate or support end remote access VPN

· Supports the ability to incorporate an intrusion prevention system as part of the overall platform

· Supports the ability to operate in routed or bridged mode

· Can deploy in both traditional HA as well as N+1 high availability architectures

· Supports the ability to logically partition managmenet instances to allow mult-tenancy on a single platform

· Supports management through a centralized platform capable of managing firewall policies

· Supports the ability to provide stateful layer 3 and layer 4 inspection of traffic

· Supports the ability to terminate FIPS 140-2 compliant site to site VPN tunnels

· Supports the routing of multiple communications protocols, including IPv4 and IPv6, includes DS-3 Interface, BGP support, port mirror capability

· Devices should be available on a tiered basis: small, medium, large

2.3 Database Virtual Firewall, Licenses and Modules

Example Products

Database Firewall Virtual Appliance (Virtual)

Oracle Audit Vault and Database Firewall

Microsoft Azure

Imperva SecureSphere

Database Firewall, User Rights Management Add-on License – 100 (License)

Database Firewall, User Rights Management License for 100 Dbis (used on both 4500 or 6500)

Database Firewall, User Rights Management Add-on License – 500 (License)

Database Firewall, User Rights Management License for 500 Dbis (used on both 4500 or 6500)

The following minimum features must be met:

· Ability to control database queries through a software appliance or a software client loaded on a database server

· Supports a management system

· Supports automated scalable activity monitoring, auditing, and reporting for heterogeneous database environments

· Must integrate with firewall load balancer

· Supports highly available configuration

· Supports real-time database protection against internal and external threats by alerting or blocking attacks and abnormal access requests

· Supports the ability for organizations to demonstrate regulatory compliance through automated processes, analysis, and reporting

· Supports user management licenses

3. Virtual Load Balancers:

3.1 Data Center Load Balancer Virtual Appliances, Licenses and Modules

Example Products

Data Center Load Balancer Virtual Appliance (Virtual)

F5 BIG-IP Virtual Edition, no license

Data Center Load Balancer Local Traffic Manager Lab (License)

F5 LTM VE Lab License

Data Center Load Balancer Local Traffic Manager Small (License)

F5 LTM VE 1G License

Data Center Load Balancer Local Traffic Manager Medium (License)

F5 LTM VE 3G License, F5 LTM VE 5G License

Data Center Load Balancer Local Traffic Manager Large (License)

F5 LTM VE 10G License

Data Center Load Balancer Access Policy Manager Lab (License)

F5 APM VE Lab License

Data Center Load Balancer Access Policy Manager Small (License)

F5 APM VE 1G License

Data Center Load Balancer Access Policy Manager Medium (License)

F5 APM VE 3G License, F5 APM VE 5G License

Data Center Load Balancer Access Policy Manager Large (License)

F5 APM VE 10G License

Data Center Load Balancer WAF Module Lab (License)

F5 ASM VE Lab License

Data Center Load Balancer WAF Module Small (License)

F5 ASM VE 1G License

Data Center Load Balancer WAF Module Medium (License)

F5 ASM VE 3G License, F5 ASM VE 5G License

Data Center Load Balancer WAF Module Large (License)

F5 ASM VE 10G License

Data Center Load Balancer Global Traffic Manager (License)

F5 GTM VE License

The following minimum features must be met:

· Local load balancer must have direct integration with the global load balancer so that health status for multiple URLs can be obtained through a single control connection

· Must support advanced authentication through CAC, Kerberos, and SAML

· Must support different high availability options. Different options would include traditional HA as well as N+1 options

· Support for BGP for use with anycast

· Requires the option to automatically sync configurations across multiple devices in the same cluster

· Must meet all FIPS 140-2 guidelines with regards to TLS/SSL termination

· Supports access policy management via a single management interface

· Supports configuration to meet chassis, interface, and session count requirements

· Supports enhancements to a load balancer provided via software modules

· Supports global load balancing, SSL offload, DNSSec enhancements, access control, and firewall functionality.

· Must support multiple SSL capabilities to include SSL man in the middle, SSL bridging, SSL offload, and SSL passthrough

· Must support LACP LAG

· Product has extensible capabilities (scripting)

· Can be managed by a redundant central management system

· Can support forward proxy function

· Supports FIPS 140-2 capability in either locally or through an HSM

· Supports FIPS 140-2 compliant key length requirements

· Supports FIPS 140-2 compliant application delivery services

· Supports multiple authentication methods such as Kerberos Constrained Delegation (KCD), LDAP, and OCSP, hardware accelerated SSL offload and IPv6

· Supports multiple persistence methods including cookies, source IP address, and SSL Session ID

· Supports protections against structured query language (SQL) injection as well as cross site scripting (XSS)

· Supports reverse DNS look-up and only answer back to traffic sourcing from a .mil address

· Supports reverse-proxy load balancer that is capable of tearing down front-side Virtual IP address when some or all back-end servers cannot be reached

· Supports small software module for use with small data center load balancers

· Supports web application firewall functionality which resides as a software license on top of the existing enterprise load balancers.

· Supports web application functionality

· Optional availability of lab licensing for extra-small scale deployment for configuration testing

· Requirements for small:

· Must support up to 1Gbps throughput

· Requirements for medium:

· Support up to 5Gbps throughput

· Must support up to 10Gbps throughput

3.2 Firewall Load Balancer Virtual Appliances and Modules

Example Products

Firewall Load Balancer Virtual Appliance (Virtual)

A10 vThunder ADC

Firewall Load Balancer Virtual Appliance License, lab (License)

A10 vThunder ADC Lab/Developer Edition

Firewall Load Balancer Virtual Appliance License, small (License)

A10 vThunder ADC Production-Entry Level/Lab Editions, 1Gbps

Firewall Load Balancer Virtual Appliance License, medium (License)

A10 vThunder ADC Production-High-performance Editions, 4 Gbps, 8Gbps

Firewall Load Balancer Virtual Appliance License, large (License)

A10 vThunder ADC Production-High-performance Editions, 10 Gbps

Firewall Load Balancer Virtual Appliance License, extra-large (License)

A10 vThunder ADC Production-High-performance Editions, 20 Gbps

The following minimum features must be met:

· Must support at least 20 routing instances or partitions for isolation or workloads and functions

· Must support the ability to be scaled in an N+1 configuration

· Must have the ability to support load balancing across all firewall platforms

· Optional support to participate in multicast streams

· Supports capability of balancing traffic and supporting “firewall sandwich” infrastructure

· Supports capability of persistence methods based on source and/or destination IP address, and mac-addresses

· Supports layer 3/4 load-balancing methods through adjacent firewall devices

· Supports scalability

· Supports the routing of multiple communications protocols, including IPv4 and IPv6

· Supports OSPFv3

· Supports OSPFv3 within a VRF

· Optional availability of lab licensing for extra-small scale deployment for configuration testing

· Requirements for small:

· Must support up to 1Gbps throughput

· Requirements for medium:

· Must support up to 8Gbps throughput

· Requirements for large:

· Must support up to 10Gbps throughput

· Requirements for extra-large:

· Must support up to 20Gbps throughput

4. Virtual Routers:

4.1 Data Center Router

Example Products

Data Center Virtual Router (Virtual)

Cisco IOS XRv (Production Image)

The following minimum features must be met:

· Must support IPSEC VPN

· Must support point to point and point to multipoint VPN

· Supports dynamic multipoint tunel IPSEC mesh

· Dynamic multipoint VPN should include the following:

· Support for IPv4 and IPv6 tunnel endpoints

· PKI tunnel authentication

· ability to route multicast traffic over the mesh

· ability to automatically choose the most preferred path based on available devices within the mesh

· Supports full function BGP

· Supports segmentation of routes through the use of VRFs or virtual routers

· Supports bidirectional forwarding detection (BFD) for small/medium

· Supports MPLS fast reroute for small/medium

· Supports Multi-protocol label switching (MPLS) for large/extra-large

· Supports the ability to be automated via a 3rd party tool

· Supports the routing of multiple communications protocols, including IPv4, IPv6, OSPF, BGP

· Supports VPLS

5. Virtual Switches:

5.1 Campus LAN Access Layer Virtual Switch (Redundant Supervisors)

Example Products

Campus LAN Access Switch

Nexus 1000V for VMware vSphere

Campus LAN Access Switch – Access Switch

Nexus 1000V switch only upgrade – All versions

Campus LAN Access Switch – Edge Switch

Cisco Application Virtual Switch (AVS)

The following minimum features must be met:

· Supports VMWare ESXI/vSphere

· Access layer switch and used for layer 2 and 3 connectivity supporting virtual appliances and virtual servers

· Supports VLAN tagging

· Supports the ability to be automated via an external tool

6. Software Defined Network:

6.1 Software Defined Networking (SDN)

Example Products

Software Defined Networking (SDN) w/Annual Software Maintenance (License)

Juniper Contrail, Cisco ACI, VMWare NSX, Brocade SDN

SDN Centralized Controller, Virtual

Cisco APIC, Juniper NorthStar, VMWare NSX Controller, Brocade SDN Controller

The following minimum features must be met:

· Server-to-edge, server-to-server network configuration deployment and control

· Supports network function virtualization

· Centralized controller

· Centralized controller should support clustering for scalability as the network grows

· Supports logical separation of routed networks - VRFs, routing instances, etc

· Supports automation functions through scripting/API

· Supports integration with with VMWare for tracking vMotion of servers

· Supports integration of 3rd party devices, such as F5/A10 load-balancers

· Support network scalability through addition of physical and virtual network appliances

· Virtual SDN devices must be compatible with physical SDN devices selected under Appendix 5-1

RFP No. HC1028-16-R-0012

Section J, Attachment C-2 Revised, Amendment 0004

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

1. Contract or Task Order Title: DISA Communications (COMM) Capacity Services Contract (CSC) II

2. Work Requirements:

· Task 1 – Communications Capacity Solutions and Capabilities

· Task 2 – Support

· Task 3 – Ordering

· Task 4 – Invoice Creation and Billing Cycle

· Task 5 – Contract Transition Strategy

· Task 6 – Meeting and Reporting Requirements

· Task 7 – ADPE Maintenance Records/DISA Form 7 Process

· Task 8 – Supply Chain Risk Management (SCRM) Plan

· Task 9 – Technical Expert Status Accreditation/Analytical Support Status Accreditation. (TESA/ASSA) Certification

· Task 10 – Cyber Threat Security Plan

· Task 11 – Availability and Performance

3. Primary Method of Surveillance:

Periodic inspection, 100% inspection and random sampling are the methods used by the Government to ensure contractor performance. The method used for each task is documented in the table in Section 5 below.

4. Scope of Performance:

The contractor shall provide all personnel, equipment, tools, materials, supervision, and other items and non-personal services necessary to perform to the standards and terms defined in this contract.

5. Performance Standards:

Performance Standard

Acceptable Quality Level (AQL)

Method of Surveillance

Task 1 – 6.1.1 – Subtask 1 – thru 6.1.16 – Subtask 16

Validate all criteria is met.

Random sampling of contractor reporting/solution for validating and viewing features and components installed.

Task 1 – 6.1.17 – Subtask 17 - Provide Delivery, Installation and Acceptance

Validate all criteria is met

Periodic inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 1 – 6.1.18 – Subtask 18– New Technology

Provide new solution engineering proposals at no cost to DISA.

Periodic inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 1 – 6.1.19 – Subtask 19 – Remote diagnostics

Validate all criteria is met.

Periodic inspection of remote diagnostics and management throughout the life of the contract. 100% inspection of meeting STIG requirements, operational availability and full functionality.

Task 1 – 6.1.20- Subtask 20– Maintenance of capacity equipment.

Validate all criteria is met.

100% inspection of Form 7 reports.

Task 1 – 6.1.21 - Subtask 21 – New solution testing

Provide new solution engineering proposals at no cost to DISA.

Random sampling of contractor reporting/solution for validating and viewing features and components installed.

Task 1 – 6.1.22 - Subtask 22 – Tech refresh of equipment

Provide tech refresh replacement to for end of life equipment.

Random sampling of contractor reporting/solution for validating and viewing features and components installed.

Task 1 –6.1.23 - Subtask23 Removal of equipment

Provide any necessary de-installation and removal during and at end of contract.

Periodic 100% inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 1 –6.1.24– Subtask 24–Training

Provide in-depth detailed training for all provided solutions.

Random sampling of contractor reporting/solution for validating and viewing features and components installed.

Task 1 – 6.1.25 – Subtask 25- Hardware security

Contractor must comply with all Government security requirements including the applicable STIG and closing out all possible findings.

100% inspection.

Task 1 – 6.1.26– Subtask26 – Technical assistance support

Validate all criteria is met. Technical support will be provided on as needed basis to provide flexibility to modify services to meet the needs of DISA and its customers. The support will be divided into five levels depending upon the level of support required. See Attachment 3, Technical Assistance and Consulting Support. . The labor categories will also be used for performing services that will require a Firm-Fixed Price effort with a detailed agreement with DISA on the scope of work. For relocation - contractor shall support free and cost reimbursable moves of equipment

Random sampling of contractor reporting/solution for validating and viewing features and components installed.

Task 1 – 6.1.26.3– Relocation

Contractor shall support free and cost reimbursable moves of equipment.

Periodic inspection of Contractor reporting/solution for validating and viewing features and components installed.

Task 2 – 6.2.1 – Subtask 1 – PMO problem escalation/resolution

Documented processes as defined.

Periodic inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 2 – 6.2.5 – Subtask 5 – Test/Lab Equipment

Contractor shall provide the ability for the Government to test out newly released comm. equipment in a lab setting for a 3 – 6 month timeframe as requested by the Government.

Periodic inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 2 – 6.2.6 – Subtask 6 – Call order management system

Contractor shall create a secure call order management system. In addition to being fully functional, all server operating systems and applications will be required to meet the DISA STIG security. All tools must be fully functional within 60 calendar days of contract award.

Periodic 100% inspection of ordering process to include ordering, order validation, invoicing, billing, returns, financial tracking and contractor asset management throughout the life of the contract. 100% inspection of invoicing, meeting STIG requirements, operational availability and full functionality.

Task 3 –6.3.1 Subtask 1 – Ordering (a)

Call orders shall be processed within one (1) business day for contractor to validate a call order for accuracy.

Random sampling of contractor reporting/solution for validating and viewing features and components installed.

Task 3 – 6.3.1 Subtask 1 – Ordering (b)

Hardware shall be delivered or removed (in the case of a decommission call order) within 30 calendar days for CONUS and 45 calendar days for OCONUS for non-expedited call orders. For expedited call orders, the timeframe is 15 calendar days for CONUS and 25 days for OCONUS.

Periodic 100% inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 4 –6.4.1– Invoice creation and billing cycle

Contractor will create invoices directly from Government provided data with contractor created draft invoices for COR review.

Periodic 100% inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 5 – 6.5 – Contract Transition strategy

Contractor will provide a transition strategy plan.

Periodic inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 6 – 6.6.1 Subtask 1 – Program meeting requirements

Program meetings lasting no more than 2 business days will be required and held at various CONUS geographical locations. The contractor shall include all costs associated with meeting attendance in the proposed prices.

100% inspection.

Task 6 – 6.6.3 Subtask 3 – Semi-annual review meetings

Government and contractor will have semi-annual contract review meetings. The contractor shall prepare and provide the summarizing meeting report within 5 business days after completion.

100% inspection.

Task 6 – 6.6.6 Subtask 6 – Monthly inventory report

Contractor to provide monthly inventory report to the Government.

100% inspection.

Task 6–6.6.7 Subtask 7 – Weekly order summary

Contractor to provide weekly order support report to the Government.

Random sampling of contractor reporting/solution for validating and viewing features and components installed.

Task 6 – 6.6.8 Subtask 8– Monthly incident summary report

Contractor to provide monthly incident summary report to the Government.

100% inspection.

Task 7 – 6.7 – DISA Form 7 Process

Contractor shall provide all required information to complete the form 7.

Periodic inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 8–6.8.1 – Supply chain risk management plan

Contractor to provide Supply Chain Risk Management Plan within 30 calendar days of contract award

100% inspection.

Task 8- 6.8.1.1 – Corrections on Supply chain risk management plan

Offer to provide updated Supply Chain Risk Management Plan within 30 calendar days of Government feedback

100% inspection.

Task 8– 6.8.2 – Supply chain risk management plan update

Contractor to provide updated Supply Chain Risk Management Plan within 5 business days of any change that impacts any CNSSI 1253 security controls

100% inspection.

Task 9 – 6. 9 TESA/ASSA

Contractor shall obtain TESA/ASSA accreditation to comply with German labor laws as required.

100% inspection of contractor reporting/solution for validating and viewing features and components installed.

Task 10 – 6.10 Cyber Threat Security Plan

Contractor shall provide Cyber Threat Security plan 30 days after contract award to the contracting officer (KO) and Contracting Officer’s Representative (Officer and COR) for acceptance

100% inspection.

Task 11 – 7.1.1 Subtask1 –Availability

Communications equipment availability will meet or exceed 99.95% based on the calculation: (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time communications equipment is unavailable) / (Total available hours for number of calendar days in reporting month –Measurement Exceptions)*100=“Service Level Attained”. 24x number of calendar days in reporting month for each orderable system.

Communications equipment availability for High Availability Systems will meet or exceed 99.999% based on the following calculations:

Measurement 2A (summary): (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time communications equipment is unavailable) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions)*100=“Service Level Attained”. Total available hours = Total available hours = 24xnumber of calendar days in reporting month averaged over all five nine’s orderable systems.

Measurement 2B (per system): (Total available hours for number of calendar days in reporting month– Time communications equipment is unavailable) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions)*100=“Service Level Attained”. Total available hours = 24x number of calendar days in reporting month for each five nine’s orderable system.

Monthly 100% inspection of downtime reports

Task 11 – 7.1.2 Subtask 2 - Performance: Delivery of capability

Communications equipment performance - delivery of capability

Monthly 100% inspection of call orders delivered to ensure compliance

Task 11 – 7.1.3 – Subtask 3 – Performance: Delivery of onsite hardware support

Communications equipment performance - delivery of onsite hardware support

Monthly 100% inspection of predictive and remedial maintenance reports to ensure compliance

Task 11 – 7.1.4 – Subtask 4 - Performance: Relocations

Communications equipment performance - relocations

Monthly 100% inspection of call orders issued for relocations to ensure compliance

6. Mandatory or regulatory compliance items: The contractor will provide initial proof of compliance with regulatory and compliance items contained in the contract. The COR and KO will evaluate the initial submission. The COR and KO will conduct ad hoc reviews of the contractor’s compliance throughout the remainder of the contract. The contractor will monitor compliance as required by FAR 52.222-50, Combating Trafficking in Persons, and report any issues to the KO.

7. Acceptable Quality Level (AQL):

See AQL listed in Performance Standards for guidance.

8. Evaluation Method:

The COR will track the response to the requirements of inspected tasks, conduct a comparison with actual maintenance performance, and otherwise verify and validate contractor performance. Help desk ticket logs will be used as documentation and compared to the AQL specific to the task.

The COR will review the “ADPE Maintenance Record/FORM 7” to document the time elapsed between the initial call for support of a hardware maintenance/repair requirement, voice and physical response by the contractor, and resolution to verify and validate contractor performance. The “ADPE Maintenance Record/FORM 7” and is defined as the official documentation from the Government that hardware maintenance/repair is required. The “ADPE Maintenance Record/Form 7” captures the time the hardware error occurred, when the Government requests support from the contractor, and the time that the hardware error is resolved. The “ADPE Maintenance Record/Form 7” is the official measure of response and resolution time.

9. Incentives (Positive and/or Negative):

9.1 Performance/Availability Incentives/Disincentives:

9.1.1 Availability: Communications capacity shall deliver 99.95% availability per orderable system with ability to deliver up to 99.999 % availability per orderable system. The definitions and performance measurement is identified below.

Performance Measure 1: Communications Equipment Availability 99.95%

1. Explanation: The percentage of time each system is available for productive use.

1. Availability Objective: 24x number of calendar days in reporting month minus Measurement Exception (see definition below).

1. Standard: Satisfactory = 99.95%

1. Contractor Escalation Solution: Provide contractor solution.

1. Contractor Responsibility: Maintain communications equipment availability and related operating equipment in operating condition at a level to meet or exceed 99.95%.

1. Measurement: (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time communications equipment is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions )*100=“Service Level Attained”. Total available hours = 24x number of calendar days in reporting month for each orderable system.

Measurement Exception: Measurement Exception: DISA or customer initiated downtime, contractor Preventative maintenance (not break fix or hardware/software repair) that is appropriately coordinated through the Authorized Service Activity (ASA)/Authorized Service Interruption (ASI) process with DISA and the customer, and environmental failures not attributed to the contractor.

Performance Measure 2: Communications Equipment Availability for High Availability Systems 99.999%

1. Explanation: The percentage of time each system is available for productive use.

1. Availability Objective: 24x number of calendar days in reporting month minus Measurement Exceptions (see definition below).

1. Standard: Satisfactory = 99.999%

1. Contractor Escalation Solution: Provide contractor solution.

1. Contractor Responsibility: Maintain communications equipment and related operating equipment in operating condition at a level to meet or exceed 99.999%.

· Measurement: 2A (summary): (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time communications equipment is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions)*100=“Service Level Attained”. Total available hours = 24xnumber of calendar days in reporting month averaged over all five nine’s orderable systems.

1. Measurement 2B(per system): (Total available hours for number of calendar days in reporting month – Measurement Exceptions – Time communications equipment is unavailable, unable to perform core function, or core function is significantly degraded) / (Total available hours for number of calendar days in reporting month – Measurement Exceptions)*100=“Service Level Attained”.

Measurement Exception: Measurement Exception: DISA or customer…