EVOIP_PWS_1.pdf

Page 1 of 31 Pages

PERFORMANCE WORK STATEMENT (PWS)

as of 03 JUL 2018

Contract Number: (completed by the KO at time of contract or TO award) Task Order Number: (completed by the KO at time of TO award or N/A) Contractor Name (completed by the KO at time of contract or TO award) Tracking Number: 621809648 Follow-on to Previous Contract and Task Order Number:

HC1028-13-D-0009-0002; HC1028-13-D-0011-0003

1. Contracting Officer’s Representative (COR)

a. Primary COR.

See Points of Contacts Clause 52.204-9000

b. Alternate COR.

See Points of Contacts Clause 52.204-9000

2. Contract Title. DISA Enterprise Voice Services

3. Background.

DISA Enterprise Voice over Internet Protocol service provides a reliable, cost-effective, and secure means of unclassified and classified voice communications for the United States (US) DoD and Federal Agencies, on a worldwide basis. Enterprise Voice service offers Voice over Internet Protocol services with flexible point-to-point calling, ad-hoc voice conferencing, Enterprise Audio Conferencing (EAC), Automated Call Distribution (ACD) / Customer Interaction Center (CIC), Federated XMPP-based IM/Chat and Presence (within soft client) and Voice Enterprise Directory Services (EDS). The Enterprise Voice Service provides this capability to hard phones and soft clients on the MILDEP Base/Post/Camp/Station (B/P/C/S), and assures voice communications to Command and Control (C2) customers. The service also includes Multi-Level Precedence and Preemption (MLPP) that allows senior leadership to preempt routine phone calls. Enterprise Voice capabilities are currently delivered through Avaya, Cisco, and Ribbon architectures deployed worldwide.

The Sensitive but Unclassified (SBU) Internet Protocol (IP) network softswitch backbone supports the Enterprise Voice Service infrastructure and integrates with the Defense Switched Network (DSN). The DISA IP-based SBU voice service designated as the Voice Internet Service Provider (VISP) is accessible over the NIPRNet infrastructure.

The VISP and Voice over Secure Internet Protocol (VoSIP) support and Mission Partner on-boarding is also provided by the Enterprise Voice Service Program department wide.

Department of Defense Instruction (DoDI) 8100.4 “DOD Unified Capabilities” and Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6211.02D “Defense Information Systems Network (DISN) Responsibilities” direct the Defense Switched Network (DSN) Single System Manager to provide Command and Control (C2) performance, vulnerability mitigation, technology migration, sustainment and configuration management assessments and reports to the Assistant Secretary of Defense/Chief Information Officer (ASD/CIO) and the Joint Staff on an annual basis.

Specifically, the DSN is an inter-base, non-secure or secure C2 telecommunications system that provides end-to-end (E2E) dedicated telephone service, voice-band data, and Video Teleconference Conferencing for C2 and non-C2 Department of Defense (DoD) authorized uses in accordance with national security directives. Non-secure voice service is the system’s principal requirement. Furthermore, it is the telecommunications system of the DoD and is under the operational direction and management control of the Director, Defense Information Systems Agency

(DISA).

4. Objectives: The overall objective of this contract is to enable the Enterprise Voice Services Program to accomplish its mission of providing voice, video, data, services and applications to Mission Partners worldwide on unclassified and classified networks. Enterprise Voice Services include Voice over Internet Protocol capability on the classified

Page 2 of 31 Pages and unclassified network, Enterprise Audio Conferencing, Automated Call Distribution / Customer Interaction Center, Voice Internet Service Provider (VISP), Voice over Secure Internet Protocol (VoSIP), and collaboration tools such as Cisco Jabber.

5. Scope.

The scope of this contract includes the design, development, architecture, engineering, planning, testing, integration, implementation, optimization, and support of network solutions and Enterprise Voice over Internet Protocol services using Cisco and Avaya Enterprise Session Controllers (ESCs). Additionally, it includes the management of information assurance and risk management for the Enterprise Voice Services Program in a Unified Capabilities architecture and Converged IP environment. The contracted services shall also provide the on-boarding support and engineering to enable Mission Partners to utilize the service.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed to 15% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements.

6.1 Task 1.0– Contract Management.

The performance of Task 6.1 requires an IT-II eligibility in order to access NIPRNet/DISANet resources.

Task 6.1 shall be performed on-site or off-site.

The Contractor shall provide all management and labor to ensure all contract requirements are met. The Contractor shall plan, schedule, direct, coordinate, and control the Contractor’s resources necessary for effective and efficient accomplishment of all contract requirements. The Contractor shall coordinate efforts with DISA approved plans, schedules, and milestones.

6.1.1 Weekly Status Report – The Contractor shall provide a Weekly Status Report which covers all tasks contained under this effort. The report shall include a description of work performed during the week, progress, all results, conclusions and recommendations, changes to the Contractor’s organization, problem areas, travel planned expenditures and actual travel expenditures, significant results, commitments, contract schedule status, deliverables status, mandatory training progress, staffing summary, vacancy report, and Government Furnished Equipment report.

6.1.2 Quarterly Progress Review – The Contractor shall provide a Quarterly Progress Review (QPR) including presentation materials on all requirements covered by this effort.

6.1.3 Travel – The performance of this contract requires intermittent travel (see PWS paragraph 9.4). The

Contractor shall manage travel arrangements. The Contractor shall submit a Travel Authorization Request (TAR) no later than 15 days prior to the planned travel date for CONUS travel, and 30 days prior to the planned travel date for OCONUS travel. The TAR shall be reviewed and approved by the COR/ACOR prior to the Contractor incurring allowable travel expenses. Authorized travel shall be billed against the reimbursable line of the contract in accordance with the Federal Acquisition Regulation Part 31. Travel receipts for all expenses including lodging, airfare, and rental cars shall be provided with the invoice. Travel shall be reimbursed on a cost basis and limited to the Government travel rates. The Contractor shall submit a Trip Report within 7 calendar days of returning from each trip. The trip report shall include: name of traveler(s), travel dates, location, purpose of trip; description of activities performed, accomplishments achieved, problem/issues identified or encountered during the travel; and any other significant details.

6.1.4 Other Direct Costs (ODCs) – The contractor shall be required to purchase incidental hardware and software components in order to complete specific projects. The contractor shall maintain an approved purchasing system. Authorizations for ODC purchases shall be approved in advance by the COR/ACOR using the Purchase Authorization Request form provided by the Government prior to the contractor incurring allowable ODCs. The contractor shall provide the COR/ACOR with at least three quotes with the Purchase

Page 3 of 31 Pages

Authorization Request in order to document cost reasonableness. The contractor shall provide a receipt and breakout of the ODCs for each billing period in its invoice/voucher. ODC expenses shall be reimbursed on a cost basis.

6.1.5 Transition-in/out Plan – The Contractor shall develop and execute a Transition-in Plan that describes the procedures and tasks the Contractor will execute to ensure its staff is available and on-site, ready to perform, no later than 30 calendar days after the PoP start date. The transition period will be day 1 through day 30 of the PoP.

The Contractor shall create a detailed Transition-out Plan describing the method of transferring responsibility of the PWS requirements. The Transition-out Plan will transition services from this contract to any follow-on contractor or Government team. The transition strategy shall provide for completing the transition of all services at the end of the existing contract's period of performance. The Contractor shall coordinate service transition with any follow-on Contractor or Government team to prevent service disruption during the transition. The Contractor’s Transition-out Plan shall:

• Provide familiarization training and documentation to the Government and/or follow-on service provider.

• Transition service operations outlined in the PWS to any follow-on service provider. The plan shall address the orderly transition of responsibility between Government and/or service providers while ensuring continuity of operations. This should include a risk assessment and mitigation strategy.

• Include inventories and locations of all documentation (technical drawings, configuration data [including warranty, maintenance, etc.] implementation plans, Concept of Operations, etc.). The plan shall address current retention schemes and access for Government and/or follow-on service provider.

• Provide a smooth transition of all engineering efforts to the Government and/or follow-on service provider.

• Include transition milestones and a communication plan. The plan shall address the milestones required to successfully transition the effort to Government and/or a follow-on service provider. The plan shall also include a reporting plan to address milestone progress updates.

The Contractor shall meet with the Government within 120 days of the end of the contract period of performance to plan the transition strategy. The contractor shall provide a written Transition-out Plan within 90 days prior to the end of contract period of performance. If the Government notifies the contractor that it will not exercise an optional period, the contractor shall work with the Government to perform all transitions activities from the day of notification.

The Contractor shall conduct a joint inventory with Government personnel of all Government Furnished Property. The Contractor shall deliver to the Government COR a final inventory of all Government Furnished Property no later than 90 business days before the end of contract period of performance.

Deliverables:

The collective set of deliverables for Task 1 are:

-Weekly Status Report -Quarterly Progress Review -Travel Authorization Request -Trip Report -Transition-in Plan -Transition-out Plan

6.2 Task 2.0– Architecture, System Integration, Systems Engineering and Sustainment Support.

The performance of task 6.2 requires a Top Secret security clearance and IT-I eligibility in order to gain privileged-user access on DISA Enterprise Classified Voice over IP (ECVOIP) systems which are classified up to the Top Secret level.

Task 6.2 Unclassified work shall be performed on-site or off-site. Classified work shall be performed on-site.

Page 4 of 31 Pages

The Contractor shall lead the development, testing, integration, and sustainment of the Enterprise VoIP solutions. The Contractor shall employ industry best practices. The Contractor’s staff shall specialize in IP and support engineering converged Unified Capabilities (UC) for the DoD. The current deployed system includes implemented Cisco, Avaya, Oracle, Juniper, Ribbon and other Voice over Internet Protocol technologies deployed at locations through-out the world. For this task, the Contractor shall provide IP based advanced engineering services employing IP-based converged technologies, protocols and standards operating in a DoD secure, Secret and unclassified environment.

Engineering services shall encompass the following areas: network architecture, network interoperability, network interfaces, and network protocols, transport technology, network testing, security, reliability and prototyping and development of network solutions to support Unified Capabilities and Voice over Internet Protocol architectures.

Performance of this task also requires the understanding of the Department of Defense and National Security Agency’s

6.2.1 The Contractor shall:

6.2.1.1 Ensure the Enterprise Voice Services architecture and implementation meet the technical requirements of the

Defense Unified Capabilities Regulations.

6.2.1.1 Perform on-going testing and integration work to support the upgrade of system components to future software/OS/firmware releases.

6.2.1.2 Perform weekly patching of systems to keep the program VoIP infrastructure up-to-date, and maintain security posture on the classified and unclassified networks.

6.2.1.3 Test existing and emerging technologies and services identified by the government to determine viability for integration into the current Enterprise VoIP solution and the Defense Information Systems Network (DISN) as an expanded/new service or feature. Provide test report upon completion.

6.2.1.4 Design, develop, and engineer, configuration and change management processes for system installations to include upgrades, system modifications, and site support at DISA and customer locations.

6.2.1.5 Support the Enterprise Voice infrastructure to include building, configuring, and maintaining the Call Manager Virtual Machines (VMs), installing Call Manager Software, Security Technical Implementation Guides (STIGs), and activating the Call Manager nodes, configuring Session Border Controllers, routers, firewalls, and switches.

6.2.1.6 Test and integrate monitoring tools, configuration tools, and provisioning tools for the Enterprise VoIP solution.

6.2.1.7 Integrate, test, and provide engineering expertise to enhance and maintain the current UC technology to IP-based service.

6.2.1.8 Troubleshoot integration, interoperability and other customer identified issues within the architecture, system or application levels and provide recommended fix actions.

6.2.1.9 Provide end-of-life and end-of-support guidance to include software and hardware replacement for all integrated Voice Service Technologies.

6.2.1.10 Investigate, analyze, and develop customer and engineering requirements for technology architectures (Next Generation IP Networks) with emphasis in IP internet working with the current/future DISN Service Delivery Node Networks. The artifacts and documents will be in areas of engineering design, systems engineering plans, and test plans. Analyze user requirements, translate user needs into the technical design of networks for IP networks end-to-end.

6.2.1.11 Support UC network hardware and software in-depth analysis by developing and evaluating network architecture plans, security, reliability, and implementation or cutover plans, integration plans, and interoperability plans based on different Unified Capabilities and environments. Draft and document engineering designs and solutions that define system requirements, logical layouts, network architectures, interfaces and protocols used, equipment and server roles, component and application configuration, interconnectivity, interoperability, and hardware and software requirements of the Enterprise Voice System infrastructure.

6.2.1.12 Draft system administration guides for system users and operators/maintainers defining routine, repeatable procedures applicable to include end-points, application changes, user management, patching and other configuration changes.

6.2.1.13 Support technical cross program integration and synchronization efforts with Office of the Secretary of Defense (OSD), Joint Information Environment, MILDEP/C/C/S/A UC requirements and planning efforts.

6.2.1.14 Plan, analyze, engineer and test UC enterprise wide infrastructure for the Enterprise Voice Program.

Page 5 of 31 Pages

6.2.1.15 Design, develop and evaluate network architecture plans, implementation, cutover plans, integration plans, and interoperability plans based on Unified Capabilities and business environments of DoD components.

6.2.1.16 Coordinate and meet with Joint Staff (JS), Office of the Secretary of Defense (OSD), and Military Departments (MILDEPs) on policy, service level agreements, and transition planning for enterprise voice and Unified Capabilities.

6.2.1.17 Conduct testing and ensure Information Assurance (IA) posture is compliant with current government IA requirements and up to date for production, pre-production, and laboratory environments.

6.2.1.18 Issue, discontinue, and update Facility Identifications (FIDs) and associated switch information, quarterly.

Maintain FID database.

6.2.1.19 Issue, discontinue, and update Soft Switch Call Connection Identifications (CCA-IDs) and associated information. Maintenance of CCA-ID database and Issue Network Change Orders for Global DSN/EVoIP/ECVoIP/VISP/VoSIP implementation. Maintain Network Change Order database.

6.2.1.20 Issue, update and monitor Configuration Change Requests or Orders for VoSIP, VISP, ECVoIP and EVoIP and other voice components in the government provided tool. Also issue, update and monitor network implementation change requests in the government provided tool.

6.2.1.21 Issue change requests to implement Patch Bundles, patches, and software updates weekly. Monitor, track, and report to the Change Advisory Board (CAB) on completion.

6.2.1.22 The DISN Worldwide Routing/Numbering Plan (WWR/NP) provides critical global DISN traffic routing information to network managers. The Program Management Office (PMO) uses the WWR/NP to provide effective and non- conflicting numbering assignments to global DISN units. The contractor shall update the network changes within 24 hours of receiving the change from the network routing officer. Publish the WWR/NP quarterly, in the format and using the method directed by the Government.

6.2.1.23 Maintain DSN Email Inquiry Mailbox - answer questions and requests received in the DSN mailbox, and manage DSN Directory Updates requests from customers.

6.2.1.24 Maintain the DSN/EVoIP/VISP Telephone Directory. Provide monthly updates to the telephone directory.

The directory is a comprehensive source of DSN/EVoIP/VISP telephone numbers and site location information. The directory is currently provided in Microsoft Excel and Adobe Acrobat. The contractor shall subdivide the directory into logical subsections (geographically) and include a ten-digit number (KXX-KXX- XXXX format, where K = 2-8 and X = 0-9) for both DSN and commercial equivalent number, if known. The directory shall be updated not less than monthly. The updated directory shall be kept on the EVoIP Customer Defense Enterprise Portal Service (DEPS) repository in PDF format.

6.2.1.25 Maintain engineering libraries and repositories with plans, reports, briefs and solutions created as part of the task deliverables in this PWS.

6.2.1.26 Maintain and updated quarterly Voice Services Engineering implementation diagrams (using CAD or Visio software) that include equipment rack elevations and serial number/power/current consumption of each device in the rack for all the Voice Services sites and any associated drawings or flow diagrams.

6.2.2 Task 2.0 Key Personnel Qualifications:

Education: Personnel performing this task shall have a Bachelor’s of Science degree in Computer Engineering, Electronic Engineering, Computer Science or a related subject.

Experience: Minimum qualifications / experience shall be minimum of 6 years of experience in secure voice engineering, design and Tier III level troubleshooting to include VoIP, VISP and VoSIP to work on unclassified or secure voice over IP. Experience can be demonstrated in the following areas:

- Internet Protocol (IP),

- Session Initiation Protocol (SIP),

- UC

- Quality of Service (QoS),

- Session Controller/Failover.

- Military grade security/encryption devices and technologies (HAIPE, DSCD)

Certifications: Shall have at least one of the following certifications:

- Cisco Certified Network Associate (CCNA);

- Juniper Networks Certified Internet Associate (JNCIA) or higher;

- Cisco Certified Networking Professional (CCNP) Voice and Wireless;

- Certified Information Systems Security Professional (CISSP); or

Page 6 of 31 Pages

- CompTIA Security+.

The collective set of deliverables for Task 2 are:

-Architecture Design Plans -System Design Plans -Test Plans and Reports of test results -Engineering Plans, Design, Solutions and Reports -Quarterly DSN/EVoIP/VISP Telephone Directory -Global UC Numbering Plan -Global UC Directory Updates -UC Unique Identifier Allocation Report -System Administration Guides -Configuration Change Orders -Network Change Orders -Quarterly Facility Identifications

- Implementation Diagrams

6.3 Task 3.0– Engineering Requirements Analysis Support.

The performance of task 6.3 requires a Secret security clearance and IT-I eligibility in order to gain privileged-user access on DISA systems.

Task 6.3 shall be performed on-site or off-site.

6.3.1 The Contractor shall:

6.3.1.1 Review, analyze and draft portions of various Enterprise Voice documents on the system and network architectures. The Contractor shall provide the Government guidance on specifications such as the Voice Internet Service Provider (ISP), Continuity of Operations (COOP), and the UC Concept of Operations

(CONOP).

6.3.1.2 Review and update the Information Awareness, Voice, Video, and the Unified Capabilities Sections of the UC Requirements (UCR)/UC Framework (UCF) documents and other sections of those documents annually.

The UCR and UCF documents comprise a total of ~2500 pages.

6.3.1.3 Coordinate with the various DISN Service Managers (SM) (e.g. UC, data, transport etc.) and their engineering staffs for their individual updates. Updates shall be provided in a Government approved format for e-mailing to the Joint Staff, Office of the Assistant Secretary of Defense (OASD)/Chief Information Officer (CIO), Theater Joint Tactical Network (TJTN/JOIN), MILDEPs, and Joint Interoperability Test Command (JITC). Dates for incremental updates shall be specified by the Government.

6.3.1.4 Answer questions monthly from vendors and JITC. The questions range from quick response to possible detailed analysis that may require more time to answer.

6.3.1.5 Address major interoperability issues among vendors under test at JITC and the operational network on the following subjects: IPv6, E911/911, IA, Secure End Instrument, DoD PKI, Session Controller/Failover, Mass Notification Warning System, QoS, SIP, AS-SIP and XMPP (IM/Chat/Presence).

6.3.1.6 Update the Multifunction Mobile Devices Sections of the UC Framework and Requirements documents and other sections of those documents annually.

6.3.2 Task 3.0 Key Personnel Qualifications

Education: Staff performing this task shall have a Bachelor’s of Science degree in Computer Engineering, Electronic Engineering, or Computer Science or a related subject.

Experience: Minimum qualifications / experience shall be at least 6 years of experience in network design requirements and Information Assurance, developing system and network design requirements in a large scale implementation of Voice and Video over IP and Unified Capabilities/Communications, using Internet Protocol (IP), Page 7 of 31 Pages

Session Initiation Protocol (SIP), UC or Assured Services (AS) SIP, Extensible Messaging and Presence Protocol (XMPP), Quality of Service (QoS), and H.323.

Certifications: Shall have at least one of the following certifications:

- Cisco Certified Network Associate (CCNA);

- Juniper Networks Certified Internet Associate (JNCIA) or higher;

- Cisco Certified Networking Professional (CCNP) Voice and Wireless;

- Certified Information Systems Security Professional (CISSP);

- CompTIA Security+.

The collective set of deliverables for Task 3 are:

-System architecture documents

- UC Requirements (UCR)/UC -Framework (UCF) documents -DISN updates -Q&A’s from vendors and JITC -Multifunction Mobile Devices Sections of the UC Framework and Requirements documents -Technical/Functional Requirement Specifications

6.4 Task 4.0– Voice Services Tier III Support

The performance of task 6.4 requires a Secret security clearance and IT-I eligibility in order to gain privileged-user access on DISA systems.

Task 6.4 shall be performed on-site or off-site.

6.4.1 The contractor shall provide Tier III voice and UC Subject-Matter Expert (SME) support. Tier III engineering and operational support troubleshoots and resolves all Enterprise Voice system issues in the deployed voice platforms. The contractor shall provide Tier III support to interface with all stakeholders and customers internal and external to resolve incidents and problems escalated to the Tier III level for all Enterprise Voice Services. Additionally, the Tier III support shall ensure system stability and provide reliable service to all Enterprise Voice Services customers and ensure the voice technologies or any other deployed solution is functioning correctly. The Tier III support shall receive, support and resolve Tier II escalated tickets with Government provided incident management systems.

6.4.1.1 Routine after-hours support: For scheduled maintenance after-hours and authorized service interruptions (ASI) the Contractor shall provide operational support during evenings/weekends/holidays and other non-business hours as requested by the Government COR/ACOR. The contractor shall perform routine/scheduled maintenance by flexing regular contractor hours when feasible to prevent the need for overtime.

6.4.1.2 Non-routine after-hours support: For unscheduled incidents requiring after-hours support, the contractor shall provide support on an on-call basis. Should assistance be required after-hours, the contractor shall be notified by the Government COR/ACOR and shall have up to two-hours to acknowledge the request and begin support unless a longer time period is otherwise agreed to in writing by the Government COR/ACOR. After-hours support is estimated not to exceed 100 hours annually.

6.4.1.3 The contractor shall provide Problem Management support, this includes ensuring engineering and operational issues are tracked and resolved for the Enterprise Voice system voice platforms. The contractor shall provide Problem Management support to interface with all stakeholders and customers internal and external to resolve incidents and problems escalated to the Tier III level. The Problem Management support shall review all escalated tickets and correlate with other issues. The contractor shall use the Government provided incident and problem ticket management system.

6.4.2 Task 4.0 Key Personnel Qualifications

Experience:

- Shall have minimum of 5 years of experience using Internet Protocol (IP), Session Initiation Protocol (SIP), UC or Assured Services (AS) SIP, Extensible Messaging and Presence Protocol (XMPP), Quality of Service (QoS), and H.323.

- Detailed expertise to include IPv6, E911/911, Secure End Instruments, DoD public key infrastructure (PKI), and Session Controller/Failover.

Page 8 of 31 Pages

- Shall have at least 5 years of experience in secure voice engineering, design and Tier III level troubleshooting to include VoIP, VISP and VoSIP to work on unclassified or secure voice over IP.

6.5 Task 5.0– System Test Engineering, Pilot, and Spiral Deployment Engineering Support.

The performance of task 6.5 requires a Secret security clearance and IT-I eligibility in order to gain privileged-user access on DISA systems.

Task 6.5 shall be performed on-site.

6.5.1 The Contractor shall provide system engineering services to support UC and voice services (classified and unclassified) within the DISN. The effort shall include the performance of the following activities:

6.5.1.1 Create, operate, and maintain one standard lab enclave in the UC lab for the program which supports both

EVoIP and ECVoIP and other Enterprise Voice Services technologies to ensure the maintenance of similar baselines and versions.

6.5.1.2 Evaluate and assess test tools for an IP converged network.

6.5.1.3 Develop engineering plans and technical documents to support the lab and integration of new technologies in the environment. Create simulation environments and test beds in the Voice Services designated Laboratory and Testing Center for testing and assessment of Tier II elevated anomalies to Tier III and evaluation of next generation network equipment.

6.5.1.4 Maintain the simulation environment test bed with operational baseline configurations for diagnosing Tier II elevated anomalies and developing solutions to address the anomalies.

6.5.1.5 Develop and maintain simulation environment accreditation for continued operation of laboratory devices and systems.

6.5.1.6 Develop baseline configurations, test plans, execute tests, and develop test reports detailing the test environment, limitations, configurations, and results of each production issue tested or new solution to be implemented.

6.5.1.7 Identify and develop laboratory sufficient solutions to simulate or replicate production components and services for accurate test bed operations in a cost efficient manner.

6.5.1.8 Develop laboratory common use components for all laboratory test beds to integrate into on demand. This common use environment will host common services such as Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), Network Time Protocol (NTP), Secure Shell (SSH), Trivial File Transfer Protocol (TFTP) remote management, logging, and load generation and analysis.

6.5.1.9 Analyze AS-SIP protocol and other metrics which can assess the performance and quality of IP-based UC services.

6.5.1.10 Operate, maintain and configure all secure communications equipment (phones, endpoints and link encryptors used in the Fort Meade, Maryland UC lab).

6.5.1.11 Perform operational disruptive test and evaluation of supporting VoIP Spiral initiatives among the UC lab, JTIC, and other certified laboratory facilities.

6.5.1.12 Test and provide recommendation on all IA findings on UC laboratory equipment and test suites.

6.5.1.13 Maintain the results of tests and analyses in an easily accessible and manageable repository.

6.5.1.14 Provide the operational engineering support, testing, and quality assurance (QA) checks of new and existing

Enterprise Voice capabilities and services.

6.5.1.15 Maintain and operate the existing Enterprise Voice system to include system administration (SA).

6.5.1.16 Develop engineering designs, implementation plans, deployment guides, conduct pre-production testing within the Lab.

6.5.1.17 Develop configuration change orders, develop network change requests, test plans/reports, and develop point papers and briefs on technologies and updates completed in the lab.

6.5.1.18 The ccontractor shall provide pilot and spiral development, engineering, and implementations activities that include the development of engineering designs, development/review of bill-of-material (BOM), lab testing, test plans/reports, implementation plans, deployment plans, as-built documentation updates, Rehearsal of Operational Concept (ROC) Drill and Operational Acceptance support.

6.5.2 Task 5.0 Key Personnel Qualifications

Page 9 of 31 Pages

Experience: Minimally, Key Personnel shall have at least six (6) years of experience using Internet Protocol (IP), Session Initiation Protocol (SIP), Unified Capabilities or Assured Services (AS) SIP, Extensible Messaging and Presence Protocol (XMPP), Quality of Service (QoS), and H.323 are required.

Certifications: Shall have at least one of the following certifications:

- Cisco Certified Network Associate (CCNA);

- Juniper Networks Certified Internet Associate (JNCIA) or higher,

- Cisco Certified Networking Professional (CCNP) Voice and Wireless certifications

The collective set of deliverables for Task 5 are:

-Test Plans -Test Reports -Implementation Plans -Technical Analysis White Papers/Engineering Reports -Deployment Guides -Bill-of-Material (BOM) -Engineering Plans -Engineering Designs

6.6 Task 6.0– Customer On-Boarding onto Enterprise Voice Service and direct connect Services:

The performance of task 6.6 requires a Secret security clearance and IT-I eligibility in order to gain privileged-user access on DISA systems.

Task 6.6 shall be performed on-site or off-site.

6.6.1 The contractor shall manage the customer onboarding to grow the Enterprise Voice Services, and direct connect user base. Sample activities include: VISP submission, Change Orders, Network Change Orders, Circuit Actions, Telecommunications Service Orders, analysis of transmission media and interfaces, developing and implementing session management, identifying leased circuit requirements, and identifying and reserving unused transmission to satisfy future session management requirements and customer engagement to ensure EVoIP, ECVoIP, and direct connect user base continues to expand.

6.6.2 The contractor shall manage and engage in customer onboarding projects as Mission Partners transition to and adopt Enterprise Voice services. The contractor shall have both telecommunication and project management experience and should be prepared to use Microsoft Project to manage customer onboarding schedules. They shall have the necessary technological expertise required to assist the mission partners with transitioning to Enterprise Voice Services and shall act as the project lead. The contractor shall meet with customers and assist the Government with promoting the customer transition to the Enterprise Service.

Additionally, the contractor shall assist the customer through the on-boarding process. Activities include:

engineering discussions, requirement gathering, service ordering, phone acquisition, site surveys, the creation and management of customer project schedules, and the development transition and test plans.

6.6.3 The contractor shall develop guides and training materials to be used by customers, operations and PMO staff regarding user interfaces, end-points, web portals and services. Activities include developing training documentation, customer administration guides, and end-user guides in electronic format.

6.6.4 The contractor shall provide engineering and technical support to customers’ onboarding VoIP services.

Activities include assisting customers perform site surveys, technical assessments of their telecommunications infrastructure, develop engineering solutions to integrate customer requirements to VoIP services, and creating configuration and network change requests to allow the delivery of VoIP services to all customers.

6.6.5 The contractor shall coordinate bi-weekly status meetings between the vendor and the program management office in support of Voice ISP. Tasks would include sending out meeting invitations, establishing conference bridge, lead meeting by reviewing status of all customer orders, maintaining Excel database, prepare PowerPoint briefings, reviewing status of all pending circuit orders and program status. Upload Voice ISP related artifacts for access by stakeholders. Maintain Voice ISP team email distribution list, sustain and

Page 10 of 31 Pages update the Voice ISP information presented on the DISA catalogue website. Manage and provide access to the vendor portal for DoD customers and DISA organizations that need to review usage statistics, submit trouble tickets, and obtain customer billing information. Create and maintain Telecommunications Service Request (TSR) templates to assist both internal DISA service ordering as well as customer ordering of services. Track the status and execution of TSRs until full establishment. Coordinate turn up and testing calls with Tier 2 Operations Center, customer and vendors. Review vendor portal billing information to ensure all billing from vendor is accurate. Maintain Voice ISP questionnaire and distribution, and perform customer outreach through briefings (e.g. “selling the service”). Submit the requests to renew the Voice ISP Session Border Controller PKI certs.

The collective set of deliverables for Task 6 are:

-Training documentation -Customer administration guides and End-user guides -TSR Templates -Service Questionnaire

6.7 Task 7.0– System Information Assurance and Risk Management Framework Support.

The performance of task 6.7 requires a Secret security clearance and IT-I eligibility in order to gain privileged-user access on DISA systems.

Task 6.7 shall be performed on-site or off-site. The contractor shall perform Information Systems Security Manager and Information Systems Security Officer duties to include the following:

6.7.1 Ensure the Enterprise Voice Services remains compliant with applicable DISA, Joint Force Head Quarters

–Department of Defense Information Network, and United States Cyber Command security policies such as Advisory Messages, Fragmentary Orders, General Information Technology Administrative Orders, Warning Orders, Strategic Technical Implementation Guides, Information Assurance Vulnerability Alerts, and Security Requirements Guides on the DISA IA portal. Products in the Enterprise Voice Service portfolio include, but are not limited to, EVoIP, ECVoIP, VISP, VOSIP, DSN, Enterprise Audio Conference (EAC), Customer Interaction Center (CIC) and Automated Call Distribution (ACD).

6.7.2 Create security documentation and artifacts needed to obtain and maintain a DoD Authority to Operate (ATO) under the Risk Management Framework (RMF), including Change Requests associated with new software.

6.7.3 Advise the Government on security matters in a continuous cycle for the duration of the Period of Performance (PoP) in a frequency commensurate with the ongoing activities of the project and documented in the project schedule as agreed to by all parties.

6.7.4 Create the RMF package documents required to obtain Authority to Operate. Use the automated validation capabilities of the SIPRNet/NIPRNet Enterprise Mission Assurance Support Service (eMASS) for preparation of the RMF Package.

6.7.5 Develop required RMF package to include the registration with the DoD IA Program, assigning IA controls Categorizations level based on Confidentiality, Integrity and Availability, identifying the RMF Team members, and initiating the Committee on National Security Systems Instruction (CNSSI) 1253 review. The contractor shall assist in the implementation and validation of assigned National Institute of Standards & Technology (NIST) 800-53 Controls including the overlays, conducting validation activities, and compiling the status of the validation results in the RMF lifecycle Security Assessment Report (SAR). The contractor shall assist in preparing the supporting documentation (Security Plan of Actions and Milestones (POA&M), actual validation results, artifacts associated with implementation of NIST 800-53 controls, etc.) required for the RMF Lifecycle; ATO.

6.7.6 Prepare all required Security POA&M documentation. A Security POA&M is required for any ATO decision that requires corrective action and is also used to document status of NIST 800-53 controls that have been accepted by the responsible Authorizing Official (AO). The Security POA&M will address why the system

Page 11 of 31 Pages needs to operate, any operational restrictions imposed to lessen the risk during an interim authorization, the AO's rationale for accepting certain NIST 800-53 controls that are categorized as Non-Compliant (NC) or Not Applicable (NA), specific corrective actions necessary to ensure that assigned NIST 800-53 controls have been implemented correctly and are effective, the agreed-upon timeline for completing and validating corrective actions, and the resources necessary and available to properly complete the corrective actions. The security POA&M is a permanent record and once posted, weaknesses will be updated, but not removed after correction or mitigation actions are completed. The Contractor shall recommend corrective actions and implementation strategies for the corrective actions identified in the security POA&M.

6.7.7 Develop the SAR to document the assigned NIST 800-53 controls, including inherited NIST 800-53 controls.

The SAR also includes the NIST 800-53 control implementation status, responsible entities, resources, and the estimated completion date for each assigned NIST 800-53 control. The report shall reference applicable supporting implementation material and artifacts.

6.7.8 Provide Security Engineering Services to the Government for RMF lifecycle activities that include the implementation solutions to address new customer requirements, as well as upgrades/patches to the applications in compliance with NIST publications, to include:

- CNSS Instruction 4009, “Information Assurance Glossary”

- NIST (Special Publication (SP) 800-37 (Revision 1), “Guide for Applying the Risk Management

Framework to Federal Information Systems – A Security Life Cycle Approach”

- NIST SP 800-53, “Recommended Security Controls for Federal Information Systems”

- CNSSP 22, “Information Assurance Risk Management Policy for National Security Systems”

- CNSSI 1253, “Security Categorization and Control Selection for National Security Systems”

- DoD Instructions 8500.2 (IA Controls) and 8510.01 (DIACAP/RMF)

6.7.9 The appointed AO, a Government employee, will ensure all vulnerabilities on the product are fixed or risk mitigation is performed before granting the ATO approval. The product shall receive an ATO before it is placed on any DoD network. This process is the Government’s method of ensuring the solution(s) is STIG compliant.

6.7.10 Prepare the necessary documentation to describe the protection and sustainment of the information assurance requirements such as protection of the operating environments and software, and databases; integration and implementation of information assurance features for client-server and web enterprises; participation in the planning and performance of Security Test & Evaluation (ST&E) and other testing scenarios; support for DoD PKI requirements and implementation strategies and other authentication methods as identified by the Government.

6.7.11 Maintain certification and accreditation (C&A) of the program automated information systems required to sustain DoD compliance standards according to the RMF (IAW DODI 8510.01).

6.7.12 Evaluate systems, identify risks, and risk mitigation strategies to meet the DoD requirements. The contractor shall conduct a weekly C&A meeting; shall provide meeting agenda and minutes to the Government.

6.7.13 Provide a monthly C&A status report to the Government cataloging the security controls addressed mitigated, or for which a POA&M was developed, in the past month, to include actual validation results, artifacts associated with implementation of NIST 800-53 controls, etc.

6.7.14 Update and maintain IA controls and POA&M status spreadsheet weekly, cataloging all the security controls for which a POA&M was developed.

6.7.15 Maintain integrity and confidentiality of DISA Voice Services information by ensuring appropriate standards are in compliance with DoD standards and procedures.

6.7.16 Track compliance reports with the system owners and maintain the POA&Ms for all accepted risks upon completion of system ATO.

6.7.17 Prepare ATO documentation to meet the DoD compliance standards, to include: Concept of Operations, Standard Operating Procedures, Continuity of Operations and Disaster Recovery Plan, System Configuration/Network Diagrams, Incident Response Plan, Change Management Plan, and System Security Plan. The contractor shall plan and implement by reviewing and developing program documentation. All of the RMF controls shall be addressed in one or more of the below deliverables.

Page 12 of 31 Pages

The collective set of deliverables for Task 7 are:

-Voice Services Concept of Operations -Voice Services Standard Operating Procedures -Voice Services Continuity of Operations and Disaster Recovery Plan -Voice Services System Configuration / Network Diagrams -Voice Services Incident Response Plan -Voice Services Change Management Plan -Voice Services System Security Plan -Voice Services Weekly C&A Agenda and Meeting Minutes -Voice Services Monthly C&A Status Report -Voice Services Security POA&Ms -Voice Services IA Controls and POA&M Status Spreadsheet -Voice Services SAR -Voice Services IA Documentation

6.8 Task 8.0– Legacy and Low Speed Time Division Multiplexing (TDM) to IP Conversion and Elimination

The performance of Task 6.8 requires a Secret security clearance and IT-I eligibility in order to gain privileged-user access on DISA systems.

Task 6.8 shall be performed on-site or off-site. The Contractor shall:

6.8.1 Coordinate and help engineer transition solutions for TDM elimination efforts and provide monthly status reports to the Mission Partners.

6.8.2 Retrieve and monitor all low speed TDM circuits that have a DISA Program Designator Code (PDC).

6.8.3 Coordinate with DISA Operations and the DISA Theater Field Offices in the effort to eliminate TDM circuits or transferring the circuits to a customer provided PDC.

6.8.4 Coordinate with customers on the elimination of the remaining TDM circuits that are homed to the two remaining Multifunction Switches (MFSs) to facilitate the downgrade to End Office. Maintain and monitor the status of these circuits until they are all eliminated or transitioned and the MFSs are officially downgraded.

6.8.5 Initiate customer outreach effort for DSN customer access circuits that are on low speed TDM (T1s, PRIs, 4- Wires) transport to help the customer eliminate circuits by transitioning to EVoIP or direct connect services via email and web portal updates.

6.8.6 Submit Telecommunication Service Requests in DISA Storefront, to amend, change, and/or discontinue services as required.

Deliverables:

The collective set of deliverables for Task 8 are:

Mission Partner Monthly Status reports (6.8.1)

6.9 Task 9.0 - Voice Project Management Support

The Contractor shall:

6.9.1 Participate in weekly project meetings and provide suggestions and recommendations pertaining to various aspects of voice services engineering and integration projects.

6.9.2 Manage engineering/technical/integration project efforts and tasks for Enterprise Voice Service engineering.

6.9.3 Review and edit documents such as Concept of Operations, Service Level Agreements, Solution

Descriptions, Risk Register assessments and Work Breakdown Structures in accordance with DoD Instruction 5000.02.

Page 13 of 31 Pages

6.9.4 Develop processes and procedures for services integration, implementation and delivery for the Enterprise Voice Services and update quarterly. Create and maintain flow charts and documentation to support processes and procedures.

6.9.5 Create and distribute configuration and network changes to the Enterprise Voice Service infrastructure.

6.9.6 Provide program quality assurance/control for the voice services engineering and integration.

6.9.7 Create program standards and ensure all documentation is kept updated as changes to the engineering and integration impact the baseline.

Deliverables:

The collective set of deliverables for Task 9 are:

-Concept of Operations -Service Level Agreements -Solution Descriptions -Risk Register Assessments -Work Breakdown Structures

6.10 Task 10.0 Enterprise Voice Service Tech Refresh and Installation Support (OPTIONAL TASK) The Contractor shall:

6.10.1 Coordinate, unpackage, install, move, and configure equipment to government provided specifications. This is for the equipment for the tech refresh of the Enterprise Voice Services projects and shall be completed up to 4 times per year.

6.10.2 Track all Enterprise Voice Services equipment for end of life and end of sale dates and provide recommendations to the government for replacements.

6.10.3 Plan, develop, implement, and manage the life-cycle sustainment of all Enterprise Voice Services equipment.

Provide a comprehensive, cost effective, life-cycle replacement strategy for equipment going end of life or end of support. The goal is to ensure sustainment considerations are integrated into all planning, implementation, management, and oversight activities associated with the acquisition, development, production, fielding, support, and disposal of IT systems across the life cycle of the Enterprise Voice Services equipment. The planning activities shall include maintenance and warranty planning, property accountability support planning, training and training support.

6.11 Task 11.0 Enterprise Voice Service New Customer Site Onboarding Support (OPTIONAL TASK) The Contractor shall install and test customer voice endpoints at the customer sites. The voice endpoints shall receive dial tone from one or more designated Enterprise Session Controller (ESC) sites that may be geographically diverse from the local endpoints. The Government will provide a listing of which ESCs will host specific site voice endpoints.

The Contractor shall follow the process outlined below when deploying each customer site:

• Preliminary Site Survey

• Initial Pilot / Acceptance testing

• User onboarding and endpoint installation

• Closeout and Signoff

6.11.1 Preliminary Site Survey. The Contractor shall include in the Integrated Master Schedule (IMS) a proposed schedule for executing the survey and deployment of all customer site locations. The objective of this task is to migrate customer sites in groups and do as many in parallel as possible in order to expedite the on boarding process for all sites. During this step, the Contractor shall execute travel to all sites to complete all survey activities.

The Contractor shall conduct a comprehensive site survey…