Attach 5 1 URHD SOW 23May11.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency (NGA)

STATEMENT OF WORK (SOW)

For the

NGA Unclassified Remote Hosted Desktop Pilot

RFP HM0177-11-R-0021

ATTACHMENT #5.1

Date: May 23, 2011

NGA Unclassified Remote Hosted Desktop Pilot SOW

V1.0 2 5/24/2011

Table of Contents

1. Scope and Background

1.1 Introduction

1.2 Background

1.3 Scope

2. Applicable Documents

2.1 Compliance Documents (see Appendix A.1)

2.2 NGA Policies (see Appendix A.2)

3. Description of Work

3.1 General

3.2 Description of Work Authorized with Contract Award

4. Deliverables

4.1 Contract Data Requirement List (CDRL) (see Appendix B)

5. Period and Place of Performance

6. Requirements

6.1 Services To Be Provisioned on the URHD

6.2 Technical Capabilities

6.3 Security Capabilities

6.4 Program Management

Appendix A: Applicable Documents Appendix B: CDRL List

Appendix C: Example Security Audit Contents Appendix D: Government Furnished Information & Equipment List (GFI/GFE)

Appendix E: Acronyms

V1.0 3 5/24/2011

1. Scope and Background

1.1 Introduction

NGA is a Department of Defense (DoD) Combat Support Agency that provides

Geospatial-Intelligence to both the DoD and the Intelligence Community (IC). NGA provides timely, relevant, and accurate Geospatial-Intelligence in support of National

Security. The Director of NGA is the functional manager for the National System for

Geospatial-Intelligence (NSG), which is the combination of people, technology, policies, capabilities, doctrine, activities and community necessary to produce Geospatial-

Intelligence (GEOINT) in an integrated multi-intelligence environment to support

National Security Strategy objectives.

NGA is looking to change how the agency procures and provisions Information

Technology in order to meet expanding mission requirements given budgetary constraints. NGA plans on implementing a managed services model that decreases complexity, increases agility, enhances reliability, while improving efficiency and effectiveness of IT delivery in support of the National System for Geospatial Intelligence

(NSG). NGA intends to implement these services under the consolidated Information

Technology Enterprise Managed Services (ITEMS) program. In order to position the agency for successful implementation of this program, NGA is currently executing risk reduction activities and intends to award several pilots as part of these activities. The purpose of the pilot activities is to explore commercially available technologies for application in NGA facilities as well as external sites. The four pilots being contemplated are Unclassified Remote Hosted Desktop (URHD) pilot, Managed Data

Center Services (MDCS) pilot, User-Facing Capability (UFC) pilot, and Deployed

Services (DS) pilot.

The URHD pilot will explore the use of a commercial Cloud as an alternative to in-house solutions. The outcome of this pilot is to determine if the following benefits are achievable: flexible managed service capacity at a commodity price; free up one-third of data center floor space for other uses; flatten recapitalization spikes; provide efficiencies that will free up other IT resources for repurposing toward mission; and provide 24 x 7 access to voice, email, data and cloud applications via Personal Information Technology

Devices (PITDs), Smart Phones, etc. NGA expects that the pilot will drive out policy concerns and solutions.

The Managed Data Center Services (MDCS) pilot will explore a flexible, on-demand alternative to standard government owned data centers. The objective of this pilot will determine if the following benefits are achievable: flexible managed service capacity to provide parallel operations that allows thin client transition; parallel dissemination operations; on-demand flexible capacity to allow rapid provisioning of it services; and benefit from the elimination of expensive facility modifications in limited data center space.

V1.0 4 5/24/2011

The User-Facing Capability (UFC) pilot will explore flexible, on-demand alternatives to government owned user-facing hardware. The objective of this pilot will determine if the following benefits are achievable: eliminate need for multiple thin-clients at the desktop; modern, flexible, user-facing hardware; replacement or augmentation of voice and video services; and implementation of mobile thin-client devices.

The Deployed Services (DS) pilot will explore flexible, cross-security domain collaboration capabilities. The objective of this pilot will determine if the following benefits are achievable: deployed personnel collaboration capability for use by deployed personnel in crisis; CONUS and OCONUS situations; and a deployed PITD capability, regardless of whether an existing cell phone network exists.

These four pilots form an integrated architecture, shown in Figure 1, that mirrors the

ITEMS operational objective architecture, albeit at a reduced capability and scope. By demonstrating this reduced architecture, NGA will gain high confidence in the feasibility of implementing the ITEMS approach, and detailed knowledge of how to structure the enterprise ITEMS acquisition.

4 Proof of Concepts – 4 Separate RFPs

Unclassified Remote

Hosted Desktop

(UHRD)

Managed Data Center

Services

Inside NGA.

User-Facing

Capability

Deployed Services

Test Network

Thin Client Laptops

Thin Clients (NCE & St. Louis)

Thin Clients (NCE & St. Louis)

Thick Clients NCE & St. Louis)

FIGURE 1: INTEGRATED ITEMS RISK REDUCTION PILOT ARCHITECTURE

V1.0 5 5/24/2011

1.2 Background

NGA currently operates a mission and administrative support network (named SBU).

The material on this network is not classified, but may have access and distribution restrictions such as For Official Use Only (FOUO), Source Selection Sensitive, Privacy

Act, and Proprietary. This network is hosted, operated, and maintained internally by the

NGA. It provides services to approximately 20,000 users distributed across both CONUS and OCONUS regions, predominately residing at a number of consolidated campuses with user populations ranging from 50-10,000 users. NGA’s IT performance and security requirements can be compared to global commercial finance, commerce, and health care systems, but shall need to operate in consideration of US government requirements.

NGA desires to explore alternatives to this internally-hosted business model via an

Unclassified Remote Hosted Desktop solution pilot program as a means to reduce total lifecycle costs and better utilize the limited data center space available. The pilot shall enable NGA to determine the policies, implications, impacts, engineering modifications, and performance that transition to this approach would have on the NGA’s enterprise.

The pilot has three objectives:

1) Demonstrate the use of a externally provisioned Unclassified Remote Hosted

Desktop (URHD) to do the unclassified functions currently provided by the SBU

2) Enable NGA to determine what is necessary and sufficient to accredit such an architecture, and satisfy security needs and concerns

3) Assess the performance of the URHD when accessing it through various client-end device types and connection mechanisms

1.3 Scope

NGA requires the provisioning of an Unclassified Remote Hosted Desktop (URHD).

This URHD shall be delivered using the Software-as-a-Service (SaaS) and Computing-to-

Go Service Models, and the Public Cloud Deployment Model.

The SaaS delivery of the URHD shall provide hardware and software capabilities to the

NGA clients via a distributed architecture. Section 6.2.5 describes the devices to be acquired. The delivery mechanism shall be via secure communications between the client and URHD host, within web browser or installed applications as most appropriate and cost-effective. Solutions shall use industry standard, COTS-based applications to the greatest extent practical and cost-effective. The NGA clients may add or subtract software capabilities as desired (within the terms of the pre-arranged menu of service options).

The Computing-To-Go capabilities shall provide mobile computing to approved NGA clients. The URHD solution shall be able to support mobile personal electronic computing devices such as Blackberry and internet-capable cell phones.

V1.0 6 5/24/2011

The final solution architecture for the Pilot shall use a Public Cloud Deployment Model as shown in Figure 2. However, the architecture should be extensible to support a Private

Cloud Deployment Model for some of the services and/or NGA-associated data if requested.

RHD Cloud

Outside NGA

Facilities Inside NGA

Facilities

STL Thick Client

NCE Thin Client

Other Site Client

FIGURE 2: URHD PILOT OBJECTIVE ARCHITECTURE

The Government will use the data and information gathered in the course of this pilot to determine the feasibility of SaaS, Computing to Go Service Models, and Public/Private

Cloud Computing for NGA. If this proof of concept is successful, NGA intends to procure these services agency-wide through a competitive acquisition. As such, pursuant to DFARS 227.7202-1(c)(1), the Service Provider is required to provide deliverables detailing changes to or within the Government’s hardware and software systems with Government Purpose Rights, as defined in DFARS Clause 252.227-7013 and

252.227-7014. This will enable NGA to provide potential vendors in the follow-on competitive procurement with the information necessary for modifying the Government system to enable these services through any commercial vendor.

NGA shall purchase usage rights for the Service Provider’s commodity infrastructure and services in a computing environment. NGA’s user and application data may or may not be intermingled with other customer’s data in the

Service Provider’s enterprise infrastructure – the decision to do so is based on variables such as maximizing utilization, satisfying security requirements, minimizing overhead and operating costs, system availability, reliability, back-up/recovery, etc. The decision is left to the Service Provider.

NGA is provided their own private hardware and/or software service without any other customer’s data or applications being co-mingled – for example, a storage device dedicated solely to storing NGA data.

V1.0 7 5/24/2011

If the Service Provider wishes to assert more restrictive rights than Government Purpose

Rights in any deliverable or part thereof, it shall do so in accordance with DFARS Clause

252.227-7017. Any Government requests to validate asserted restrictions will be done in accordance with the procedures in DFARS Clause 252.227-7019.

2. Applicable Documents

2.1 Compliance Documents (see Appendix A.1)

2.2 NGA Policies (see Appendix A.2)

3. Description of Work

3.1 General

The purpose of this acquisition is to obtain URHD services to NGA clients via the SaaS and Computing-To-Go Service and Public Cloud Deployment Models. The Service

Provider shall provision the URHD within their enterprise infrastructure, and operate and maintain the capabilities in order to reliably deliver these services to the NGA clients.

The services shall be accessible to NGA clients within NGA workcenters and remotely via desktop, laptop and mobile computing devices.

3.2 Description of Work Authorized with Contract Award

The URHD contractor is responsible for provisioning SOW-designated portions of the

URHD Pilot Objective Architecture shown in Figure 2 per the following Concept of

Operations views (from URHD CONOPS, RFP attachment #5.3).

By the beginning of initial operations of the URHD Pilot (per Section 6.4.4 herein), the

URHD contractor shall deliver the portion of the overall objective architecture as shown in Figure 3. This delivery shall be provisioned in the following manner:

- Outside NGA Facilities, the laptop and mobile computing client devices shall be provisioned by the URHD contractor and distributed to NGA users as directed by

NGA’s URHD Pilot Program Management Office (PMO). The URHD Pilot PMO shall provide the URHD contractor with a list of approved users at contract award, and arrange for the selected users to interface with the URHD contractor for receipt, set-up, and training for the devices.

- The URHD Cloud shall be provisioned, operated, and maintained by the URHD contractor in a facility and manner that is most efficient and cost-effective to the effort, subject to meeting the necessary security and performance requirements established herein. The URHD Cloud shall not be hosted in an NGA facility – the

V1.0 8 5/24/2011 purpose of this effort is to obtain a managed services solution for the NGA’s required unclassified services.

Outside NGA

Facilities

NGA analyst

NGA analyst

FIGURE 3: INITIAL OPERATIONS OF URHD ARCHITECTURE DELIVERY

PHASES 2 AND 3

The URHD contractor shall support the NGA in accomplishing several tasks in this phase:

Demonstrate the use and operations of the components of the URHD service catalogue.

Enable NGA staff to determine the requirements, procedures, and measures necessary to accredit the solution for general NGA use for the data types specified in paragraph 6.3.1, and assess the quality of the solution’s security profile via hands-on evaluation of the contractor’s solution per the requirements in sections

V1.0 9 5/24/2011

6.2, 6.3, and 6.4, as appropriate. Contractor shall be prepared to support site assessments of the URHD service and facilities, to include relevant Information

Assurance measures.

Gather metrics on SLA parameters for performance from external client devices, and compare the delivery to requirements and specifications in the SOW.

Evaluate the URHD overall quality of service.

Subject to favorable results from the initial operations, the contractor shall support the

NGA in moving to final operations, which expands the URHD architecture to include the

“Inside NGA Facilities” elements in Figure 4 (per Section 6.4.4).

Inside NGA

Facilities

STL Thick Client

NCE Thin Client

Other Site Client

NGA analysts

FIGURE 4: FINAL OPERATIONS OF URHD ARCHITECTURE DELIVERY

PHASES 4, 5, AND 6

V1.0 10 5/24/2011

In the final operations of the URHD Pilot (per Section 6.4.4), the URHD Contractor shall support the NGA in accomplishing several tasks:

Provide the necessary information to configure internal NGA terminals to access the URHD Cloud infrastructure and services.

Compare performance of external-to-NGA connections to internal-to-NGA connections.

Gather metrics on SLA parameters for performance from external client devices, and compare the delivery to requirements and specifications in the SOW.

Evaluate the URHD overall quality of service.

The URHD contractor shall not deliver any of the “Inside NGA Facilities” client terminals.

4. Deliverables

4.1 Contract Data Requirement List (CDRL) (see Appendix B)

5. Period and Place of Performance

The NGA URHD Pilot contract is planned for a 9-month base starting in Fiscal Year (FY)

2011 with two 6-month options.

6. Requirements (unless otherwise noted, all tasks below are applicable to CLINs 0001, 0002, 0101, 0102, 0201, and 0202)

6.1 Services To Be Provisioned on the URHD

The URHD service catalogue shall include at least one application providing each of the capability types shown in Table 1 (e.g. Forms, Database, E-mail, etc.). The current SBU application(s) providing the capability is noted in the second column. The URHD

Service Provider shall provision either one or more of the exact applications, or a functional equivalent, to provide the capability in the URHD service catalogue. These services constitute the SaaS portion of the URHD Pilot Service Models.

V1.0 11 5/24/2011

SBU Capabilities SBU Application

Briefing / slide MS Powerpoint

Database MS Access

Desktop Publishing MS Publisher

E-mail MS Outlook

File Compression WinZIP

Forms MS InfoPath

Forms FormFlow + Approvelt

Forms IBM Lotus Forms Viewer

Forms PureEdge Viewer

Identity Management PCSCDiagnostics (CAC Card Reader)

Identity Management Tumbleweed Valicert

Instant Messaging Jabber

Multimedia Player Windows Media Player

Multimedia Player Roxio Digital Media

Non-Standard Software various via Remedy CR Request

Operating System Tools Windows XP / 7

PDF Reader Adobe Reader

RSS FeedReader

Spreadsheet MS Excel

Virus Scanning McAfee

Web Browsing Internet Explorer

Web Browsing Firefox

Web Conferencing Adobe Connect Professional Plug-In

Web Conferencing NetMeeting (Window XP only)

Word Processing MS Word

TABLE 1: URHD SERVICES MENU

Furthermore, there are a collection of other services that shall be provided:

Other Services

Blackberry integration

Cell Phone integration

Desktop Faxing

Local Printer / Scanner Integration

TABLE 2: OTHER SERVICES

V1.0 12 5/24/2011

These services contain the Computing-To-Go Service Model capabilities NGA shall demonstrate in the URHD Pilot. The list of mobile device types to be provided is in

Section 6.2.5. The URHD Service Provider shall document the delivered service catalogue from Tables 1 and 2 via CDRL A003 (see Appendix B).

Additionally, NGA requires the ability to print data produced in the URHD session to a local printer, to upload scanned data from a local device into the URHD session, and desktop faxing within the URHD session. These capabilities are essential.

Where applicable, the application selected must be capable of ingesting, processing, manipulating, and exporting to MS Office 2007 file formats (e.g. docx, etc.).

6.2 Technical Capabilities

6.2.1 Device Independence / Compatibility – The URHD solution must be client-device independent, in that it is compatible with Windows, Apple, Unix, or other operating system-based client devices.

6.2.2 Service Provisioning – The URHD solution shall have the capability to add and delete services to an individual client’s profile from the service menu offering in an agile, responsive manner (documented in CDRLs A004 and A008). The service menu of allowable offerings shall be contractually agreed upon at the start of the pilot via CDRL A003.

6.2.3 Records Management – The URHD solution shall provide an archive and storage solution to meet NGA’s Records Management obligations per the guidance in

Appendices A.1 and A.2. The solution may take a form and architecture best suited to reduce cost, complexity and infrastructure demands, and shall be documented in

CDRL A007 (see Appendix B).

6.2.4 Local Upload / Download Option for User-Generated Data – The URHD solution shall provide the capability to have data generated in the URHD session saved to a local storage device. The URHD solution shall also provide the capability to have data uploaded from the local storage device to the user’s allocated file storage area.

Authorization whether to allow these tasks or not shall be set as part of the user’s profile.

6.2.5 Client Configuration – The URHD Service Provider shall acquire and deliver to

NGA, client-side devices as described below, properly configured to allow connection to the URHD Service Provider’s URHD infrastructure. There shall be

100 user accounts. The number and type of client-side devices shall be:

A) 100 Thin Client laptops configured to access the URHD, 1 per user account

B) 20 Blackberry or equivalent client mobile devices, configured to access the URHD, using 20 of the 100 accounts.

V1.0 13 5/24/2011

C) 20 iPhone or equivalent client mobile devices, configured to access the

URHD, using 20 of the 100 accounts.

D) 20 Android or equivalent client mobile devices, configured to access the

URHD, using 20 of the 100 accounts.

E) 20 Tablet PC-type client devices configured to access the URHD, using 20 of the 100 accounts.

F) 5GB hosted e-mail storage per user account

G) 25GB hosted file storage per user account

H) 5 multi-function printer / scanners

The choice of mobile carriers and contract terms shall be decided by the URHD

Service Provider based on what is most cost advantageous to the NGA. The client device acquisition shall be:

2 each of the 5 client device types from (A-E) above shall be purchased for NGA ownership with associated support agreements for the duration of the pilot.

The remaining client devices are to be leased in a manner that is most cost advantageous to the NGA.

The Service Provider shall provision the hosted e-mail accounts on a mail server within the URHD environment.

The client-issued equipment and software inventory shall be documented in CDRL

A006 (see Appendix B), and indicate what is to be returned to the contractor at contract end, and what is transferred to the government.

6.2.6 Service Provider’s Internet Point of Presence (POP) – The Service Provider’s internet POP must be adequate to support the full range of services in the URHD, and do so for the full complement of NGA client connections, to the availability metrics established in the SLAs.

6.2.7 Documented Service Level Agreements – The Service Provider must provide documented SLAs for the URHD services and overall URHD connection, delivered as CDRL A004 (see Appendix B). The contractor shall report SLA performance via a metrics report (CDRL A005). The SLAs must include, at a minimum:

URHD services availability

URHD services file / data parameters (e.g. maximum file size allowed, maximum file storage allowed per user, etc.)

Trouble Ticket / Help Desk Maximum and Average Response Time

Trouble Ticket / Help Desk Maximum and Average Resolution Time

Minimum Session Connection Speed (measured at the Service Provider’s

Internet POP)

Time to provision new services or delete existing services

V1.0 14 5/24/2011

6.2.8 Extensibility – The URHD solution must be extensible to the full NGA enterprise needs as described in Section 1.2.

6.2.9 Private Cloud vs. Public Cloud (Option CLINs 004, 0104, and 0204) – The URHD solution is assumed to be of a Public Cloud Deployment Model for the purposes of the URHD Pilot. The solution should be able to support a Private Cloud request for some or all of the service menu options.

6.2.10 Software Licensing (Option CLINs 003, 0103, and 0203) – The URHD Service

Provider shall be responsible to provide all software and associated licensing to provision the URHD service menu from Tables 1 and 2 except the “Non-Standard

Software” line-item. NGA shall be responsible for any non-standard applications to be provisioned.

6.2.11 Patch, Upgrade and Version Management – The Service Provider shall be responsible for all patching, upgrading, and version management of the URHD baseline. The Service Provider’s approach and process shall be consistent with industry standard practices, and ensure the integrity and security of NGA data and applications (e.g. timely adherence to IAVA alerts, vendor vulnerability patch releases, etc.), but at a minimum, periodic patch, update, and version decisions shall be implemented every 30 days. Any required outages shall be pre-notified to the clients, and conducted at low usage periods, whenever possible. The

Service Provider shall provide a copy of the current URHD installed software and hardware baseline to NGA as CDRL A002 (see Appendix B).

6.2.12 Service Desk / Help Desk – The Service Provider is responsible for providing all necessary Service Desk / Help Desk functions to support the URHD architecture.

The procedures for the clients to use this capability shall be provided as CDRL

A008 (see Appendix B). The Service Provider shall provide periodic reports to

NGA of Help Desk-related metrics, such as number of tickets created, number closed, response times, incident priority, etc., as part of the reporting of SLA compliance / performance in CDRL A005.

6.3 Security Capabilities

6.3.1 Data Classification Level – The Service Provider’s URHD architecture solution must be extensible to create, receive, store, process and disseminate among approved URHD recipients, information up to Unclassified / For Official Use Only

(FOUO), Contract Sensitive, Privacy Act Data, Budget Sensitive, and Proprietary.

NGA may or may not elect to actually demonstrate this capability within the pilot, however, the Service Provider’s solution must, in principle, be able to do this task.

6.3.2 Identity and Access Management (IDAM) – NGA requires a robust IDAM capability for the URHD Pilot that uses multi-factor authentication. Client accounts shall use userID / password combinations to provide the first factor of

V1.0 15 5/24/2011 identification. The password solution shall provide the ability to require minimal password strength rules and time-based password updating to be enforced. NGA shall provide the strength rules to be implemented to the Service Provider at contract award.

An individually unique physical object shall provide the second-factor of user identity verification, such as a functional equivalent to the current Common Access

Card (CAC)-based solution. The Service Provider shall provision the remote desktop in such a way that initiating a session into the URHD infrastructure requires successful negotiation with the client using both IDAM factors. The URHD contractor shall acquire the IDAM devices and distribute them with the client devices from section 6.2.5. The solution shall be documented via CDRL A009.

The chosen IDAM solution must be supportable from any potential client-side device, to include the issued URHD clients from section 6.2.5, existing SBU terminals inside NGA facilities, and NGA user’s personally-owned devices. The

IDAM solution may use different technology solutions depending on the type of client device being used – it is not necessary to restrict to a single method for 2 nd factor authentication. However, it is desirable to minimize the total number of 2 nd factor devices.

6.3.3 Secure Communications – The URHD solution shall provide secure communications to the overall URHD session. Additionally, the e-mail solution shall provide methods to secure communications between the sender and recipient

(signed / encrypted message).

6.3.4 Information Assurance – The URHD solution shall provide information assurance capabilities to ensure the integrity and security of the URHD Service Provider infrastructure, and URHD client data created, processed, and stored within that infrastructure, from threats introduced into the Service Provider’s infrastructure through non-URHD Pilot clients using the Service Provider’s shared enterprise infrastructure. The URHD solution must be capable of detecting, responding, mitigating, recovering, auditing, and reporting on the full range of IA threat technologies and techniques, such as viruses, active code, intrusion, etc. URHD

Clients must have the necessary information assurance features within the terminals

/ networks / mobile devices, and the URHD Service Provider’s solution must also provide capabilities to detect and mitigate / quarantine IA threats introduced into the URHD environment by URHD client-end devices. The Service Provider must also have a pre-arranged plan (CDRL A013) to respond to such incidents, and the ability to remediate problems such as inappropriate data on the URHD infrastructure (e.g. data spillage). Incidents are documented via CDRL A014.

6.3.5 NGA-Owned Client Configuration – For operational scenarios where the URHD session is routed through NGA-owned networks, the Service Provider shall provide

NGA the information required to properly configure the client-side enterprise controlled interface(s) as necessary to allow connection to the URHD Service

V1.0 16 5/24/2011

Provider’s URHD infrastructure, via CDRL A010 (e.g. ports, protocols used, browser settings, etc.).

6.3.6 Client Browsing and Applications – The Service Provider shall provide the ability to block designated sites and applications from being accessible to the URHD clients. NGA shall provide the Service Provider with a list of all so-designated sites and applications by name or type (e.g. gambling sites, etc.) on contract award, and the URHD implementation documented in CDRL A011.

6.3.7 Client Content Filtering – The Service Provider’s solution shall detect and block

SPAM, viruses and other such undesirable content within the e-mail solution. The

Service Provider shall also provide “dirty word” scanning of files stored in the

URHD environment. NGA shall provide the Service Provider with a list of all so-designated keywords upon contract award. The Service Provider shall report incidents to NGA (e.g. notification of virus discovery / event, trigger of “dirty word” search, etc.) via CDRL A014.

6.3.8 Account Management – The Service Provider shall provide an account management process. The account management solution shall allow NGA to vet and approve all account requests prior to being created in the URHD environment. Additionally, the solution shall be capable of providing periodic checks of account status, and the creation and maintenance of “whitelists” and “blacklists” of accounts and users.

These checks must allow for NGA review and approval of the findings / actions before being implemented by the Service Provider. Requests for new accounts shall originate from the NGA PMO. The Service Provider shall report account management activity to NGA (number of new accounts, closeouts of old/inactive accounts, etc.) via CDRL A012.

6.3.9 Host Location and Staff Personnel Security – The URHD host location must be in the US. All personnel assigned to this contract shall possess U.S. citizenship and be able to read and speak fluent English. Contractor personnel must also possess necessary security clearances to gain access to facilities, networks, and equipment.

6.3.10 Security Auditing and Incident Response – The Service Provider shall provide periodic security audit reports to NGA for the URHD enterprise as CDRL A016.

An example list of auditable events is provided at Appendix C. The Service

Provider shall have pre-NGA approved plans and procedures in place (CDRL

A013) to respond to and recover from data spillage / unauthorized data exposure incidents (e.g. accidental uploading of classified data, etc.). The Service Provider shall assist and work with NGA to respond to such incidents, assess damage and impact from the incident, and work to resolving and mitigating the incident from further impacts and repeated occurrence (CDRL A014).

“Blacklist” and “Whitelist” refer to lists of users, usernames, and accounts that are forbidden to have access

(blacklist) or are approved for access (whitelist). Blacklists are typically comprised of previously-approved accounts that have violated policies and been involuntarily removed.

V1.0 17 5/24/2011

6.3.11 Security Assessment (Option CLINs 005, 0105, and 0205) – The Service Provider is required to support a security assessment of the URHD solution architecture for the purposes of verifying and certifying the IDAM, Information Assurance, and

Secure Communications approaches (documented via CDRL A015). The Service

Provider shall also work with NGA to complete the necessary Certification and

Accreditation process for operations within NGA facilities and processing / management of NGA-owned data (documented via CDRL A017).

6.3.12 URHD Network Isolation – The URHD solution must be capable of temporarily severing connection between the service provider’s URHD environment and any external networks. This action shall be taken upon coordination with NGA as a necessary step to respond to security and IA threats as appropriate.

6.3.13 Consent Notifications – The URHD solution must be capable of displaying a consent / legal notification, whether via pop-up window, default display or other such technologically convenient mechanism, upon login. This notification must be prominently displayed and easily read by users. The verbiage for this notification shall be provided by the NGA at contract award.

6.4 Program Management

6.4.1 Operations and Customer Interface – The Service Provider is responsible to provide the skilled and qualified personnel necessary to implement their responsibilities within the URHD effort. The Service Provider shall designate a single management interface to the NGA PMO for this effort. This management interface shall provide periodic updates on the overall progress of the URHD Pilot effort, covering items of significance and interest to the NGA customer such as key activities and requirements accomplished, key near-term future activities, issues / concerns that require resolution, shortfalls in requirements satisfaction, security / accreditation issues identified, etc. This reporting shall be included in CDRL A005.

6.4.2 Configuration Management – The Service Provider is responsible for the

Configuration Management of the URHD implementation within their enterprise infrastructure. The Service Provider shall provide NGA users with as much advance notification as possible of any changes to the configuration that may impact or require modifications on the client end terminals and mobile computing devices. Changes to the configuration after the start of the pilot should be kept to a minimum. The use of “configuration” in this section does not include changes to individual service menu options for individual users – the ability to provision new services or remove existing services for individual user profiles from the menu of agreed-to services is highly desired and should be supported in an agile, responsive manner. This is documented via CDRLs A001 through A004 inclusively.

6.4.3 Data Management – The Service Provider shall maintain in softcopy, using appropriate tools and databases/repositories, all technical and programmatic

V1.0 18 5/24/2011 documentation and other data developed in support of this contract. All documentation, including all CDRL deliveries, and client data shall be delivered in softcopy to the Government at the time defined elsewhere in the SOW or at the end of contract. All documentation, including all CDRL deliveries, shall be readable using MS Office 2007. All client data shall be delivered in the native format of the

URHD service in which it was created. After delivery at contract end, all NGA-associated and generated data shall be erased from the URHD environment in a manner that precludes later recovery / restoration.

6.4.4 Schedule and Phases – The URHD Pilot notional program schedules are shown in

Figures 5 (base) and 6 (option). The URHD contractor shall provide an integrated schedule (CDRL A018) to NGA showing when the various requirements and capabilities shall be delivered to support this schedule. The URHD Pilot Schedule has six phases as follows:

Phase 1: Contract Award (Day 1) – The URHD Pilot starts.

Phase 2: Configuration (Days 1-30) – The Service Provider implements the

URHD environment per the initial phase diagram in Figure 3. The length of this phase shall be no longer than 30 days. This phase is considered complete when the Service Provider has provisioned the URHD environment and delivered the client devices, so it could be shortened if the full 30 days is not required. NGA desires the length of this phase to be as short as feasible, but subject to minimizing cost impacts for expedited delivery.

Phase 3: Initial Operations (Days 30-90) – At the start of this phase, the URHD

Service Provider shall have delivered all the capabilities outlined in Section 6 to deliver the URHD architecture as shown in Figure 3, and shall be ready to commence operations for clients outside NGA facilities. NGA security and accreditation review is conducted during this phase, and modifications to the

URHD environment are implemented if necessary. This phase’s completion is dependent upon successful accreditation and security review.

Phase 4: Final Operations (Days 90-240) – NGA clients conduct the URHD Pilot operations from within and outside NGA facilities.

Phase 5: Results Analysis (Days 240-270) – NGA shall analyze and evaluate the results of the pilot. NGA shall also make a decision on whether or not to implement an optional 180 day extension to the contract. The URHD contractor shall disposition data per Section 6.4.3, unless an option is exercised extending the contract period.

Phase 6: End or Option Start (Day 270) – The URHD Pilot base period ends.

URHD Pilot contract ends unless an option is exercised. If an option is exercised, then the option shall follow the schedule of Figure 6, repeating

Phases 4-6 from the base program schedule for the appropriate number of days.

V1.0 19 5/24/2011

ID

Day Number

Contract Award

Configuration *

Initial Operations **

Results Analysis

End or Option Start

Phase Name 30 90 240 270

4 Final Operations

* = could be shortened ** = ending contingent upon accreditation / security

FIGURE 5: URHD PILOT BASE PROGRAM SCHEDULE

ID

Day Number

Option Exercised

Pilot Operations

Results Analysis

End or Option Start

Phase Name 30 150 180

FIGURE 6: URHD PILOT OPTION PROGRAM SCHEDULE

V1.0 20 5/24/2011

Appendix A: Applicable Documents

A.1 Compliance Documents

(CURRENT VERSIONS SHALL BE UTILIZED)

OMB Circular A-130, Management of Federal Information Resources

DoD Directive 5015.2, DoD Records Management Program

Records Management Code, 36 Code of Federal Regulations Chapter XII, Subchapter B , (http://www.archives.gov/about/regulations/subchapter/b.html), with emphasis on Part 236, Electronic

Records

DoD Directive 8500.01E, "Information Assurance” dated 24 October 2002

DoD Instruction 8500.2, "Information Assurance Implementation” dated 6 February 2003

DoD Instruction 8510.01, "DoD Information Assurance Certification and Accreditation Process

(DIACAP)" dated 28 November 2007

DoD Directive 8570.01, "Information Assurance Training, Certification, and Workforce Management" dated 19 December 2005

Intelligence Community Directive ICD-503 “Intelligence Community Information Technology

Systems Security Risk Management, Certification and Accreditation” dated 15 September 2008

DoD Information Assurance Vulnerability Alert (IAVA) memorandum dated December 30, 1999

NIST Special Publication 800-53 Revision 3, "Recommended Security Controls for Federal

Information Systems and Organizations" dated August 2009

Committee on National Security Systems (CNSS) Instructions No. 1253 “Security Control Catalog for

National Security Systems” dated December 2007

Committee on National Security Systems (CNSS) Policy No. 25 “National Policy for Public Key

Infrastructure on National Security Systems” dated March 2009

Committee on National Security Systems (CNSS) Instruction No. 1001 “National Instruction on

Classified Information Spillage” dated February 2008

DoD Instruction 8552.01 "Use of Mobile Code Technologies on DoD Information Systems” dated 23

October 2006

DoD Instruction 8551.1 "Ports, Protocols and Services Management (PPSM)” dated 13 August 2004

DoD Policy Memorandum "DoD Guidance on Protecting Personally Identifiable Information (PII)” dated 18 August 2006

DoD Policy Memorandum "Encryption of Sensitive Unclassified Data at Rest on Mobile Computing

Devices and Removable Storage Media” dated 3 July 2007

Strategic Command Directive (SD) 571-1 “DoD Information Operations Conditions” dated 27 January

Federal Information Management Security Act (FISMA) [Title III of E-Government Act of 2002]

Federal Cloud Computing Strategy

DISA Security Technical Implementation Guides (STIGs) – http://iase.disa.mil/stigs/index.html

Director of Central Intelligence Directive 6/3 “Protecting Sensitive Compartmented Information within

Information Systems” dated 5 June 1999

DoD Manual 5220.22M "National Industrial Security Program Operating Manual (NISPOM) dated 28

February 2006

NSA Security Configuration Guides – http://www.nsa.gov/ia/guidance/security_ configuration_ guides

/index.shmtl

V1.0 21 5/24/2011

A.2 NGA Policies

(CURRENT VERSIONS SHALL BE UTILIZED)

NI 1000.6R4 – NGA Instruction for Telework

NI 2060.1R4 – NGA Instruction for Export Controls

NI 3020.2R2 – NGA Instruction for Information Technology Disaster Recovery Planning

NI 4160.1R3 – NGA Instruction for Determining Property Accountability

NI 5410.1R10 – NGA Instruction for Travel Management

NI 5500.7R11 – NGA Instruction for Privacy Program Implementation

NI 8010.3R7 – NGA Instruction for Certification and Accreditation of Information Systems

NI 8010.9R7 – NGA Instruction for Information Operations Condition (INFOCON) Including

Information Assurance Vulnerability Management (IAVM)

NI 8010.11R5 – NGA Instruction for NGA-Controlled Computer Network Connectivity at Contractor and Other Facilities

NI 8010.14R8 – NGA Instruction for Password Administration

NI 8040.1R10 – NGA Instruction for Records and Information Life-Cycle Management

NI 8410.1R4 – NGA Instruction for Implementation of Mobile Code

NI 8420.2R8 – NGA Instruction for Antivirus Response

NI 8470.2R8 – NGA Instruction for Internet Usage

V1.0 22 5/24/2011

Appendix B: CDRL List All CDRLs shall be delivered to the NGA PMO for this effort

CDRL # Title First Delivery Additional

Delivery

Acceptance Criteria

A001 URHD Architecture

Definition Contract Award

Every 30 days if changes occur

Detailed description of the URHD service provider and client architecture

A002 URHD Installed

Baseline Configuration Start of Phase 3

Every 30 days if changes occur

Detailed description of the URHD installed baseline of hardware and software

A003 URHD Service

Catalogue Start of Phase 3

Every 30 days if changes occur

Full inventory of all services available in the URHD

A004

URHD Service Level

Agreement(s) (to be numbered CDRL

A004.1, A004.2, etc.)

Start of Phase 3 Every 30 days if changes occur

Full definition of the service specifications the URHD Service

Provider is committed to delivering in the URHD

A005

URHD Service Level

Agreement(s) Metrics

Report(s)

Start of Phase 3

+ 30 days Every 30 days

Reporting of the satisfaction levels of the service specifications from the

SLAs

A006 Client-Issued Hardware

/ Software Inventory Start of Phase 3

Every 30 days if changes occur

Comprehensive list of all HW/SW issued to NGA clients

A007 Records Management

Plan / Process Start of Phase 3

Every 30 days if changes occur

Detailed description of URHD

Records Management approach

A008 Service Desk / Help

Desk Procedures Start of Phase 3

Every 30 days if changes occur

Specific procedures, names, contacts, and phone numbers for Help Desk contact

A009

Identity and Access

Management Design

Description

Contract Award Every 30 days if changes occur

Detailed description of the URHD

IDAM solution

A010 Client Configuration

Description

Start of Phase 2

+ 30 days

Every 30 days if changes occur

Detailed description of the required client-side HW/SW configurations

A011 Website and

Application Block List

Start of Phase 2

+ 30 days

Every 30 days if changes occur

Full list of the websites and applications the URHD Service

Provider shall block

A012 Account Management

Report Start of Phase 3 Every 30 days

Report of activities in the Account

Management task

A013 Security Incident

Response Plan

Start of Phase 2

+ 30 days

Every 30 days if changes occur

Detailed plan to address security incidents in the URHD

A014 Security Incident

Report On occurrence n/a

Detailed description, assessment and remediation report for the security incident

A015 Security Assessment

Report

Start of Phase 2

+ 30 days n/a

Description of actions and mitigations taken by the URHD

Service Provider based on findings during the Security Assessment task

A016 Security Audit Report Start of Phase 3 Every 30 days Report of the parameters from the

Security Audit task

A017 Certification and

Accreditation Report

Start of Phase 2

+ 30 days n/a

Description of actions and mitigations taken by the URHD

Service Provider based on findings during the Certification and

Accreditation support task

V1.0 23 5/24/2011

CDRL # Title First Delivery Additional

Delivery

Acceptance Criteria

A018 Integrated Project

Schedule Contract Award

Every 30 days if changes occur

Service Provider’s schedule to deliver the URHD capabilities

V1.0 24 5/24/2011

Appendix C: Example Security Audit Contents

Auditable Events or Activities

Category: Authentication events

Logons (Success/Failure)

Logoffs (Success)

Category: File & Object events

Create (Success/Failure)

Access (Success/Failure)

Delete (Success/Failure)

Modify (Success/Failure)

Permission Modifications (Success/Failure)

Ownership Modifications (Success/Failure)

Writes/downloads to external devices/media (e.g., A-Drive, CD/DVD drives, printers)

(Success/Failure)

Uploads from external devices/media (e.g., CD/DVD drives) (Success/Failure)

Print to a device (Success/Failure)

Print to a file (e.g., pdf format) (Success/Failure)

Application (e.g., Netscape, IE, Lotus Notes, etc.) initialization (Success/Failure)

Export of information (Success/Failure)

Import of information (Success/Failure)

Category: User & Group Management events (DATA CENTER ONLY)

User add, delete, modify, suspend, lock (Success/Failure)

Group/Role add, delete, modify (Success/Failure)

Category: Use of Privileged/Special Rights events (DATA CENTER ONLY)

Security or audit policy changes (Success/Failure)

Configuration changes (Success/Failure)

Admin or root-level access (Success/Failure)

Privilege/Role escalation (Success/Failure)

Audit and log data accesses (Success/Failure)

System Reboot, Restart & Shutdown (Success/Failure)

Auditable Event Details/Information Elements

Date of the event

Time of the event using the common network time (e.g., Network Time Protocol).

Type of the event (e.g., login, print, etc.)

Identifier indicating the source/system of the event activity.

Identifier indicating the identity of the subject or actor (e.g., UserId, ProcessId, etc.

Details identifying any objects or resources accessed or involved (aka Resource List), e.g., files (including location), document id, peripherals, storage devices, etc.

Outcome (e.g., Success or Failure).

Signature Events* Indicating Violation of System/Target

V1.0 25 5/24/2011

Malicious code detection

Unauthorized local device access

Unauthorized executables

Unauthorized privileged access

After-hours privileged access

System reset/reboot

Disabling of the audit mechanism

Downloading to local devices

Printing to local devices

Uploading from local devices

* ”Events” of concern that require further analysis/review of additional information or events.

Some of these may require tools or utilities (e.g. malicious code detection).

V1.0 26 5/24/2011

Appendix D: Government Furnished Information & Equipment List

(GFI/GFE)

GFI/GFE Title Delivery

GFI Initial Approved User List Contract Award

GFI Password Strength Rules Contract Award

GFI Website Site and Application Block List Contract Award

GFI Content Filtering Keyword List Contract Award

GFI Consent Legal Notification Contract Award

GFE Common Access Cards (CAC) for NGA Users As required

GFE NGA Facility Terminals and Infrastructure Start of Phase 4

V1.0 27 5/24/2011

Appendix E: Acronyms

CAC Common Access Card

CDRL Contract Data Requirement List

CLIN Contract Line Item Number

COTS Commercial-Off-the-Shelf

DoD Department of Defense

FOUO For Official Use Only

FY Fiscal Year

GEOINT Geospatial Intelligence

GFE Government Furnished Equipment

GFI Government Furnished Information

HW Hardware

IA Information Assurance

IAVA Information Assurance Vulnerability Alert

IC Intelligence Community

IDAM Identity and Access Management

ITEMS Information Technology Enterprise Managed Services

NGA National Geospatial Intelligence Agency

NSG National System for Geospatial Intelligence

ODC Other Direct Cost

PITD Personal Information Technology Device

PMO Program Management Office

POP Point of Presence

SaaS Software-as-a-Service

SBU Sensitive-but-Unclassified

SLA Service Level Agreement

SW Software

URHD Unclassified Remote Hosted Desktop

VoIP Voice Over Internet Protocol