Attach 5 .1 URHD SOW 1Jun.docx

UNCLASSIFIED

NGA Unclassified Remote Hosted Desktop Pilot SOW

National Geospatial-Intelligence Agency (NGA)

STATEMENT OF WORK (SOW)

For the

NGA Unclassified Remote Hosted Desktop Pilot

RFP HM0177-11-R-0021

ATTACHMENT #5.1

Date: June 1, 2011

Table of Contents

Scope and Background

1.1 Introduction

NGA is a Department of Defense (DoD) Combat Support Agency that provides Geospatial-Intelligence to both the DoD and the Intelligence Community (IC). NGA provides timely, relevant, and accurate Geospatial-Intelligence in support of National Security. The Director of NGA is the functional manager for the National System for Geospatial-Intelligence (NSG), which is the combination of people, technology, policies, capabilities, doctrine, activities and community necessary to produce Geospatial-Intelligence (GEOINT) in an integrated multi-intelligence environment to support National Security Strategy objectives.

NGA is looking to change how the agency procures and provisions Information Technology in order to meet expanding mission requirements given budgetary constraints. NGA plans on implementing a managed services model that decreases complexity, increases agility, enhances reliability, while improving efficiency and effectiveness of IT delivery in support of the National System for Geospatial Intelligence (NSG). NGA intends to implement these services under the consolidated Information Technology Enterprise Managed Services (ITEMS) program. In order to position the agency for successful implementation of this program, NGA is currently executing risk reduction activities and intends to award several pilots as part of these activities. The purpose of the pilot activities is to explore commercially available technologies for application in NGA facilities as well as external sites. The four pilots being contemplated are Unclassified Remote Hosted Desktop (URHD) pilot, Managed Data Center Services (MDCS) pilot, User-Facing Capability (UFC) pilot, and Deployed Services (DS) pilot.

The URHD pilot will explore the use of a commercial Cloud as an alternative to in-house solutions. The outcome of this pilot is to determine if the following benefits are achievable: flexible managed service capacity at a commodity price; free up one-third of data center floor space for other uses; flatten recapitalization spikes; provide efficiencies that will free up other IT resources for repurposing toward mission; and provide 24 x 7 access to voice, email, data and cloud applications via Personal Information Technology Devices (PITDs), Smart Phones, etc. NGA expects that the pilot will drive out policy concerns and solutions.

The Managed Data Center Services (MDCS) pilot will explore a flexible, on-demand alternative to standard government owned data centers. The objective of this pilot will determine if the following benefits are achievable: flexible managed service capacity to provide parallel operations that allows thin client transition; parallel dissemination operations; on-demand flexible capacity to allow rapid provisioning of it services; and benefit from the elimination of expensive facility modifications in limited data center space.

The User-Facing Capability (UFC) pilot will explore flexible, on-demand alternatives to government owned user-facing hardware. The objective of this pilot will determine if the following benefits are achievable: eliminate need for multiple thin-clients at the desktop; modern, flexible, user-facing hardware; replacement or augmentation of voice and video services; and implementation of mobile thin-client devices.

The Deployed Services (DS) pilot will explore flexible, cross-security domain collaboration capabilities. The objective of this pilot will determine if the following benefits are achievable: deployed personnel collaboration capability for use by deployed personnel in crisis; CONUS and OCONUS situations; and a deployed PITD capability, regardless of whether an existing cell phone network exists.

These four pilots form an integrated architecture, shown in Figure 1, that mirrors the ITEMS operational objective architecture, albeit at a reduced capability and scope. By demonstrating this reduced architecture, NGA will gain high confidence in the feasibility of implementing the ITEMS approach, and detailed knowledge of how to structure the enterprise ITEMS acquisition.

FIGURE 1: INTEGRATED ITEMS RISK REDUCTION PILOT ARCHITECTURE

1.2 Background

NGA currently operates a mission and administrative support network (named SBU). The material on this network is not classified, but may have access and distribution restrictions such as For Official Use Only (FOUO), Source Selection Sensitive, Privacy Act, and Proprietary. This network is hosted, operated, and maintained internally by the NGA. It provides services to approximately 20,000 users distributed across both CONUS and OCONUS regions, predominately residing at a number of consolidated campuses with user populations ranging from 50-10,000 users. NGA’s IT performance and security requirements can be compared to global commercial finance, commerce, and health care systems, but shall need to operate in consideration of US government requirements. NGA desires to explore alternatives to this internally-hosted business model via an Unclassified Remote Hosted Desktop solution pilot program as a means to reduce total lifecycle costs and better utilize the limited data center space available. The pilot shall enable NGA to determine the policies, implications, impacts, engineering modifications, and performance that transition to this approach would have on the NGA’s enterprise. The pilot has three objectives:

1) Demonstrate the use of a externally provisioned Unclassified Remote Hosted Desktop (URHD) to do the unclassified functions currently provided by the SBU

2) Enable NGA to determine what is necessary and sufficient to accredit such an architecture, and satisfy security needs and concerns

3) Assess the performance of the URHD when accessing it through various client-end device types and connection mechanisms

1.3 Scope

NGA requires the provisioning of an Unclassified Remote Hosted Desktop (URHD). This URHD shall be delivered using the Software-as-a-Service (SaaS) and Computing-to-Go Service Models, and the Public Cloud Deployment Model.

The SaaS delivery of the URHD shall provide hardware and software capabilities to the NGA clients via a distributed architecture. Section 6.2.5 describes the devices to be acquired. The delivery mechanism shall be via secure communications between the client and URHD host, within web browser or installed applications as most appropriate and cost-effective. Solutions shall use industry standard, COTS-based applications to the greatest extent practical and cost-effective. The NGA clients may add or subtract software capabilities as desired (within the terms of the pre-arranged menu of service options).

The Computing-To-Go capabilities shall provide mobile computing to approved NGA clients. The URHD solution shall be able to support mobile personal electronic computing devices such as Blackberry and internet-capable cell phones.

The final solution architecture for the Pilot shall use a Public Cloud Deployment Model[footnoteRef:1] as shown in Figure 2. However, the architecture should be extensible to support a Private Cloud Deployment Model[footnoteRef:2] for some of the services and/or NGA-associated data if requested. [1: NGA shall purchase usage rights for the Service Provider’s commodity infrastructure and services in a computing environment. NGA’s user and application data may or may not be intermingled with other customer’s data in the Service Provider’s enterprise infrastructure – the decision to do so is based on variables such as maximizing utilization, satisfying security requirements, minimizing overhead and operating costs, system availability, reliability, back-up/recovery, etc. The decision is left to the Service Provider.] [2: NGA is provided their own private hardware and/or software service without any other customer’s data or applications being co-mingled – for example, a storage device dedicated solely to storing NGA data.]

FIGURE 2: URHD PILOT OBJECTIVE ARCHITECTURE

The Government will use the data and information gathered in the course of this pilot to determine the feasibility of SaaS, Computing to Go Service Models, and Public/Private Cloud Computing for NGA. If this proof of concept is successful, NGA intends to procure these services agency-wide through a competitive acquisition. As such, pursuant to DFARS 227.7202-1(c)(1), the Service Provider is required to provide deliverables detailing changes to or within the Government’s hardware and software systems with Government Purpose Rights, as defined in DFARS Clause 252.227-7013 and 252.227-7014. This will enable NGA to provide potential vendors in the follow-on competitive procurement with the information necessary for modifying the Government system to enable these services through any commercial vendor.

If the Service Provider wishes to assert more restrictive rights than Government Purpose Rights in any deliverable or part thereof, it shall do so in accordance with DFARS Clause 252.227-7017. Any Government requests to validate asserted restrictions will be done in accordance with the procedures in DFARS Clause 252.227-7019.

Applicable Documents

2.1 Compliance Documents (see Appendix A.1)

2.2 NGA Policies (see Appendix A.2)

Description of Work

3.1 General

The purpose of this acquisition is to obtain URHD services to NGA clients via the SaaS and Computing-To-Go Service and Public Cloud Deployment Models. The Service Provider shall provision the URHD within their enterprise infrastructure, and operate and maintain the capabilities in order to reliably deliver these services to the NGA clients. The services shall be accessible to NGA clients within NGA workcenters and remotely via desktop, laptop and mobile computing devices.

3.2 Description of Work Authorized with Contract Award

The URHD contractor is responsible for provisioning SOW-designated portions of the URHD Pilot Objective Architecture shown in Figure 2 per the following Concept of Operations views (from URHD CONOPS, RFP attachment #5.3).

By the beginning of initial operations of the URHD Pilot (per Section 6.4.4 herein), the URHD contractor shall deliver the portion of the overall objective architecture as shown in Figure 3. This delivery shall be provisioned in the following manner:

· Outside NGA Facilities, the laptop and mobile computing client devices shall be provisioned by the URHD contractor and distributed to NGA users as directed by NGA’s URHD Pilot Program Management Office (PMO). The URHD Pilot PMO shall provide the URHD contractor with a list of approved users at contract award, and arrange for the selected users to interface with the URHD contractor for receipt, set-up, and training for the devices.

· The URHD Cloud shall be provisioned, operated, and maintained by the URHD contractor in a facility and manner that is most efficient and cost-effective to the effort, subject to meeting the necessary security and performance requirements established herein. The URHD Cloud shall not be hosted in an NGA facility – the purpose of this effort is to obtain a managed services solution for the NGA’s required unclassified services.

FIGURE 3: INITIAL OPERATIONS OF URHD ARCHITECTURE DELIVERY

PHASES 2 AND 3

The URHD contractor shall support the NGA in accomplishing several tasks in this phase:

· Demonstrate the use and operations of the components of the URHD service catalogue.

· Enable NGA staff to determine the requirements, procedures, and measures necessary to accredit the solution for general NGA use for the data types specified in paragraph 6.3.1, and assess the quality of the solution’s security profile via hands-on evaluation of the contractor’s solution per the requirements in sections 6.2, 6.3, and 6.4, as appropriate. Contractor shall be prepared to support site assessments of the URHD service and facilities, to include relevant Information Assurance measures.

· Gather metrics on SLA parameters for performance from external client devices, and compare the delivery to requirements and specifications in the SOW.

· Evaluate the URHD overall quality of service.

Subject to favorable results from the initial operations, the contractor shall support the NGA in moving to final operations, which expands the URHD architecture to include the “Inside NGA Facilities” elements in Figure 4 (per Section 6.4.4).

FIGURE 4: FINAL OPERATIONS OF URHD ARCHITECTURE DELIVERY

PHASES 4, 5, AND 6

In the final operations of the URHD Pilot (per Section 6.4.4), the URHD Contractor shall support the NGA in accomplishing several tasks:

· Provide the necessary information to configure internal NGA terminals to access the URHD Cloud infrastructure and services.

· Compare performance of external-to-NGA connections to internal-to-NGA connections.

· Gather metrics on SLA parameters for performance from external client devices, and compare the delivery to requirements and specifications in the SOW.

· Evaluate the URHD overall quality of service.

The URHD contractor shall not deliver any of the “Inside NGA Facilities” client terminals.

Deliverables

4.1 Contract Data Requirement List (CDRL) (see Appendix B)

Period and Place of Performance

The NGA URHD Pilot contract is planned for a 9-month base starting in Fiscal Year (FY) 2011 with two 6-month options.

Requirements (unless otherwise noted, all tasks below are applicable to CLINs 0001, 0002, 0101, 0102, 0201, and 0202)

6.1 Services To Be Provisioned on the URHD

The URHD service catalogue shall include at least one application providing each of the capability types shown in Table 1 (e.g. Forms, Database, E-mail, etc.). The current SBU application(s) providing the capability is noted in the second column. The URHD Service Provider shall provision either one or more of the exact applications, or a functional equivalent, to provide the capability in the URHD service catalogue. These services constitute the SaaS portion of the URHD Pilot Service Models.

TABLE 1: URHD SERVICES MENU

Furthermore, there are a collection of other services that shall be provided:

TABLE 2: OTHER SERVICES

These services contain the Computing-To-Go Service Model capabilities NGA shall demonstrate in the URHD Pilot. The list of mobile device types to be provided is in Section 6.2.5. The URHD Service Provider shall document the delivered service catalogue from Tables 1 and 2 via CDRL A003 (see Appendix B).

Additionally, NGA requires the ability to print data produced in the URHD session to a local printer, to upload scanned data from a local device into the URHD session, and desktop faxing within the URHD session. These capabilities are essential.

Where applicable, the application selected must be capable of ingesting, processing, manipulating, and exporting to MS Office 2007 file formats (e.g. docx, etc.).

6.2 Technical Capabilities

6.2.1 Device Independence / Compatibility – The URHD solution must be client-device independent, in that it is compatible with Windows, Apple, Unix, or other operating system-based client devices.

6.2.2 Service Provisioning – The URHD solution shall have the capability to add and delete services to an individual client’s profile from the service menu offering in an agile, responsive manner (documented in CDRLs A004 and A008). The service menu of allowable offerings shall be contractually agreed upon at the start of the pilot via CDRL A003.

6.2.3 Records Management – The URHD solution shall provide an archive and storage solution to meet NGA’s Records Management obligations per the guidance in Appendices A.1 and A.2. The solution may take a form and architecture best suited to reduce cost, complexity and infrastructure demands, and shall be documented in CDRL A007 (see Appendix B).

6.2.4 Local Upload / Download Option for User-Generated Data – The URHD solution shall provide the capability to have data generated in the URHD session saved to a local storage device. The URHD solution shall also provide the capability to have data uploaded from the local storage device to the user’s allocated file storage area. Authorization whether to allow these tasks or not shall be set as part of the user’s profile.

6.2.5 Client Configuration – The URHD Service Provider shall acquire and deliver to NGA, client-side devices as described below, properly configured to allow connection to the URHD Service Provider’s URHD infrastructure. There shall be 100 user accounts. The number and type of client-side devices shall be:

A) 100 Thin Client laptops configured to access the URHD, 1 per user account B) 20 Blackberry or equivalent client mobile devices, configured to access the URHD, using 20 of the 100 accounts.

C) 20 iPhone or equivalent client mobile devices, configured to access the URHD, using 20 of the 100 accounts.

D) 20 Android or equivalent client mobile devices, configured to access the URHD, using 20 of the 100 accounts.

E) 20 Tablet PC-type client devices configured to access the URHD, using 20 of the 100 accounts.

F) 5GB hosted e-mail storage per user account G) 25GB hosted file storage per user account H) 5 multi-function printer / scanners

The hosted file storage solution (G) shall have the option for either personal storage or shared storage. Shared storage folders should have the ability to control access to an approved group of users, analogous to how Windows Explorer controls folder access permissions via the security settings.

The choice of mobile carriers and contract terms shall be decided by the URHD Service Provider based on what is most cost advantageous to the NGA.

The client device acquisition shall be:

· 2 each of the 5 client device types from (A-E) above shall be purchased for NGA ownership with associated support agreements for the duration of the pilot.

· The remaining client devices are to be issued to NGA users in a manner that is most cost advantageous to the NGA.

NGA will retain ownership of the 10 devices total as noted. The remaining devices will be returned to the URHD service provider at the end of the contract. The URHD service provider may acquire the remaining terminals in whatever manner is most advantageous to the NGA and service provider. The client devices must have replacement coverage arrangement in the event one or more is damaged by government personnel during the contract such that NGA users are not personally liable.

The Service Provider shall provision the hosted e-mail accounts on a mail server within the URHD environment.

The client-issued equipment and software inventory shall be documented in CDRL A006 (see Appendix B), and indicate what is to be returned to the contractor at contract end, and what is transferred to the government.

6.2.6 Service Provider’s Internet Point of Presence (POP) – The Service Provider’s internet POP must be adequate to support the full range of services in the URHD, and do so for the full complement of NGA client connections, to the availability metrics established in the SLAs.

6.2.7 Documented Service Level Agreements – The Service Provider must provide documented SLAs for the URHD services and overall URHD connection, delivered as CDRL A004 (see Appendix B). The contractor shall report SLA performance via a metrics report (CDRL A005). The SLAs must include, at a minimum:

· URHD services availability

· URHD services file / data parameters (e.g. maximum file size allowed, maximum file storage allowed per user, etc.)

· Trouble Ticket / Help Desk Maximum and Average Response Time

· Trouble Ticket / Help Desk Maximum and Average Resolution Time

· Minimum Session Connection Speed (measured at the Service Provider’s Internet POP)

· Time to provision new services or delete existing services

6.2.8 Extensibility – The URHD solution must be extensible to the full NGA enterprise needs as described in Section 1.2.

6.2.9 Private Cloud vs. Public Cloud (Option CLINs 004, 0104, and 0204) – The URHD solution is assumed to be of a Public Cloud Deployment Model for the purposes of the URHD Pilot. The solution should be able to support a Private Cloud request for some or all of the service menu options.

6.2.10 Software Licensing (Option CLINs 003, 0103, and 0203) – The URHD Service Provider shall be responsible to provide all software and associated licensing to provision the URHD service menu from Tables 1 and 2 except the “Non-Standard Software” line-item. NGA shall be responsible for any non-standard applications to be provisioned.

6.2.11 Patch, Upgrade and Version Management – The Service Provider shall be responsible for all patching, upgrading, and version management of the URHD baseline. The Service Provider’s approach and process shall be consistent with industry standard practices, and ensure the integrity and security of NGA data and applications (e.g. timely adherence to IAVA alerts, vendor vulnerability patch releases, etc.), but at a minimum, periodic patch, update, and version decisions shall be implemented every 30 days. Any required outages shall be pre-notified to the clients, and conducted at low usage periods, whenever possible. The Service Provider shall provide a copy of the current URHD installed software and hardware baseline to NGA as CDRL A002 (see Appendix B).

6.2.12 Service Desk / Help Desk – The Service Provider is responsible for providing all necessary Service Desk / Help Desk functions to support the URHD architecture. The procedures for the clients to use this capability shall be provided as CDRL A008 (see Appendix B). The Service Provider shall provide periodic reports to NGA of Help Desk-related metrics, such as number of tickets created, number closed, response times, incident priority, etc., as part of the reporting of SLA compliance / performance in CDRL A005.

6.3 Security Capabilities

6.3.1 Data Classification Level – The Service Provider’s URHD architecture solution must be extensible to create, receive, store, process and disseminate among approved URHD recipients, information up to Unclassified / For Official Use Only (FOUO), Contract Sensitive, Privacy Act Data, Budget Sensitive, and Proprietary. NGA may or may not elect to actually demonstrate this capability within the pilot, however, the Service Provider’s solution must, in principle, be able to do this task.

6.3.2 Identity and Access Management (IDAM) – NGA requires a robust IDAM capability for the URHD Pilot that uses multi-factor authentication. Client accounts shall use userID / password combinations to provide the first factor of identification. The password solution shall provide the ability to require minimal password strength rules and time-based password updating to be enforced. NGA shall provide the strength rules to be implemented to the Service Provider at contract award.

An individually unique physical object shall provide the second-factor of user identity verification, such as a functional equivalent to the current Common Access Card (CAC)-based solution. The Service Provider shall provision the remote desktop in such a way that initiating a session into the URHD infrastructure requires successful negotiation with the client using both IDAM factors. The URHD contractor shall acquire the IDAM devices and distribute them with the client devices from section 6.2.5. The solution shall be documented via CDRL A009.

The chosen IDAM solution must be supportable from any potential client-side device, to include the issued URHD clients from section 6.2.5, existing SBU terminals inside NGA facilities, and NGA user’s personally-owned devices. The IDAM solution may use different technology solutions depending on the type of client device being used – it is not necessary to restrict to a single method for 2nd factor authentication. However, it is desirable to minimize the total number of 2nd factor devices.

6.3.3 Secure Communications – The URHD solution shall provide secure communications to the overall URHD session. Additionally, the e-mail solution shall provide methods to secure communications between the sender and recipient (signed / encrypted message).

6.3.4 Information Assurance – The URHD solution shall provide information assurance capabilities to ensure the integrity and security of the URHD Service Provider infrastructure, and URHD client data created, processed, and stored within that infrastructure, from threats introduced into the Service Provider’s infrastructure through non-URHD Pilot clients using the Service Provider’s shared enterprise infrastructure. The URHD solution must be capable of detecting, responding, mitigating, recovering, auditing, and reporting on the full range of IA threat technologies and techniques, such as viruses, active code, intrusion, etc. URHD Clients must have the necessary information assurance features within the terminals / networks / mobile devices, and the URHD Service Provider’s solution must also provide capabilities to detect and mitigate / quarantine IA threats introduced into the URHD environment by URHD client-end devices. The Service Provider must also have a pre-arranged plan (CDRL A013) to respond to such incidents, and the ability to remediate problems such as inappropriate data on the URHD infrastructure (e.g. data spillage). Incidents are documented via CDRL A014.

6.3.5 NGA-Owned Client Configuration – For operational scenarios where the URHD session is routed through NGA-owned networks, the Service Provider shall provide NGA the information required to properly configure the client-side enterprise controlled interface(s) as necessary to allow connection to the URHD Service Provider’s URHD infrastructure, via CDRL A010 (e.g. ports, protocols used, browser settings, etc.).

6.3.6 Client Browsing and Applications – The Service Provider shall provide the ability to block designated sites and applications from being accessible to the URHD clients. NGA shall provide the Service Provider with a list of all so-designated sites and applications by name or type (e.g. gambling sites, etc.) on contract award, and the URHD implementation documented in CDRL A011.

6.3.7 Client Content Filtering – The Service Provider’s solution shall detect and block SPAM, viruses and other such undesirable content within the e-mail solution. The Service Provider shall also provide “dirty word” scanning of files stored in the URHD environment. NGA shall provide the Service Provider with a list of all so-designated keywords upon contract award. The Service Provider shall report incidents to NGA (e.g. notification of virus discovery / event, trigger of “dirty word” search, etc.) via CDRL A014.

6.3.8 Account Management – The Service Provider shall provide an account management process. The account management solution shall allow NGA to vet and approve all account requests prior to being created in the URHD environment. Additionally, the solution shall be capable of providing periodic checks of account status, and the creation and maintenance of “whitelists” and “blacklists” of accounts and users.[footnoteRef:3] These checks must allow for NGA review and approval of the findings / actions before being implemented by the Service Provider. Requests for new accounts shall originate from the NGA PMO. The Service Provider shall report account management activity to NGA (number of new accounts, closeouts of old/inactive accounts, etc.) via CDRL A012. [3: “Blacklist” and “Whitelist” refer to lists of users, usernames, and accounts that are forbidden to have access (blacklist) or are approved for access (whitelist). Blacklists are typically comprised of previously-approved accounts that have violated policies and been involuntarily removed.]

6.3.9 Host Location and Staff Personnel Security – The URHD host location must be in the US. All personnel assigned to this contract shall possess U.S. citizenship and be able to read and speak fluent English. Contractor personnel must also possess necessary security clearances to gain access to facilities, networks, and equipment.

6.3.10 Security Auditing and Incident Response – The Service Provider shall provide periodic security audit reports to NGA for the URHD enterprise as CDRL A016. An example list of auditable events is provided at Appendix C. The Service Provider shall have pre-NGA approved plans and procedures in place (CDRL A013) to respond to and recover from data spillage / unauthorized data exposure incidents (e.g. accidental uploading of classified data, etc.). The Service Provider shall assist and work with NGA to respond to such incidents, assess damage and impact from the incident, and work to resolving and mitigating the incident from further impacts and repeated occurrence (CDRL A014).

6.3.11 Security Assessment (Option CLINs 005, 0105, and 0205) – The Service Provider is required to support a security assessment of the URHD solution architecture for the purposes of verifying and certifying the IDAM, Information Assurance, and Secure Communications approaches (documented via CDRL A015). The Service Provider shall also work with NGA to complete the necessary Certification and Accreditation process for operations within NGA facilities and processing / management of NGA-owned data (documented via CDRL A017).

6.3.12 URHD Network Isolation – The URHD solution must be capable of temporarily severing connection between the service provider’s URHD environment and any external networks. This action shall be taken upon coordination with NGA as a necessary step to respond to security and IA threats as appropriate.

6.3.13 Consent Notifications – The URHD solution must be capable of displaying a consent / legal notification, whether via pop-up window, default display or other such technologically convenient mechanism, upon login. This notification must be prominently displayed and easily read by users. The verbiage for this notification shall be provided by the NGA at contract award.

6.4 Program Management

6.4.1 Operations and Customer Interface – The Service Provider is responsible to provide the skilled and qualified personnel necessary to implement their responsibilities within the URHD effort. The Service Provider shall designate a single management interface to the NGA PMO for this effort. This management interface shall provide periodic updates on the overall progress of the URHD Pilot effort, covering items of significance and interest to the NGA customer such as key activities and requirements accomplished, key near-term future activities, issues / concerns that require resolution, shortfalls in requirements satisfaction, security / accreditation issues identified, etc. This reporting shall be included in CDRL A005.

6.4.2 Configuration Management – The Service Provider is responsible for the Configuration Management of the URHD implementation within their enterprise infrastructure. The Service Provider shall provide NGA users with as much advance notification as possible of any changes to the configuration that may impact or require modifications on the client end terminals and mobile computing devices. Changes to the configuration after the start of the pilot should be kept to a minimum. The use of “configuration” in this section does not include changes to individual service menu options for individual users – the ability to provision new services or remove existing services for individual user profiles from the menu of agreed-to services is highly desired and should be supported in an agile, responsive manner. This is documented via CDRLs A001 through A004 inclusively.

6.4.3 Data Management – The Service Provider shall maintain in softcopy, using appropriate tools and databases/repositories, all technical and programmatic documentation and other data developed in support of this contract. All documentation, including all CDRL deliveries, and client data shall be delivered in softcopy to the Government at the time defined elsewhere in the SOW or at the end of contract. All documentation, including all CDRL deliveries, shall be readable using MS Office 2007. All client data shall be delivered in the native format of the URHD service in which it was created. After delivery at contract end, all NGA-associated and generated data shall be erased from the URHD environment in a manner that precludes later recovery / restoration.

6.4.4 Schedule and Phases – The URHD Pilot notional program schedules are shown in Figures 5 (base) and 6 (option). The URHD contractor shall provide an integrated schedule (CDRL A018) to NGA showing when the various requirements and capabilities shall be delivered to support this schedule. The URHD Pilot Schedule has six phases as follows:

Phase 1: Contract Award (Day 1) – The URHD Pilot starts.

Phase 2: Configuration (Days 1-30) – The Service Provider implements the URHD environment per the initial phase diagram in Figure 3. The length of this phase shall be no longer than 30 days. This phase is considered complete when the Service Provider has provisioned the URHD environment and delivered the client devices, so it could be shortened if the full 30 days is not required. NGA desires the length of this phase to be as short as feasible, but subject to minimizing cost impacts for expedited delivery.

Phase 3: Initial Operations (Days 30-90) – At the start of this phase, the URHD Service Provider shall have delivered all the capabilities outlined in Section 6 to deliver the URHD architecture as shown in Figure 3, and shall be ready to commence operations for clients outside NGA facilities. NGA security and accreditation review is conducted during this phase, and modifications to the URHD environment are implemented if necessary. This phase’s completion is dependent upon successful accreditation and security review.

During this phase, NGA may be conducting an important demonstration of the URHD capability to select mission partners. This demonstration shall show the use of the entire range of the URHD capabilities available at that time. During this timeframe, the URHD shall provide enhanced trouble ticket support and highest priority response to problems for a designated set of 5 each of the client devices, types A-E, from section 6.2.5. NGA shall designate the specific user accounts and associated client devices to be so supported during this window. NGA will give the URHD service provider ten (10) working days notice prior to the demonstration.

Phase 4: Final Operations (Days 90-240) – NGA clients conduct the URHD Pilot operations from within and outside NGA facilities.

Phase 5: Results Analysis (Days 240-270) – NGA shall analyze and evaluate the results of the pilot. NGA shall also make a decision on whether or not to implement an optional 180 day extension to the contract. The URHD contractor shall disposition data per Section 6.4.3, unless an option is exercised extending the contract period.

Phase 6: End or Option Start (Day 270) – The URHD Pilot base period ends. URHD Pilot contract ends unless an option is exercised. If an option is exercised, then the option shall follow the schedule of Figure 6, repeating Phases 4-6 from the base program schedule for the appropriate number of days.

6.4.5 Travel – NGA anticipates some travel may be required within the Continent of the United States (CONUS) to support the demonstration and other requirements of the SOW. The Contractor shall obtain approval from the NGA PMO for non-local travel (greater than 50 miles) not included in the Contractor’s accepted proposal. Travel costs shall be reimbursed on a cost reimbursable basis (i.e. non-fee bearing) as Other Direct Costs (ODCs) in accordance with the Joint Travel Regulation (JTR) requirements. Basis for travel shall be for one trip to support the demonstration (United States – CONUS) (for bidding purposes include the costs of a trip to California), one trip to St. Louis, Missouri, and one trip to the Greater Washington DC Metro Area.

FIGURE 5: URHD PILOT BASE PROGRAM SCHEDULE

FIGURE 6: URHD PILOT OPTION PROGRAM SCHEDULE

Appendix A: Applicable Documents

A.1 Compliance Documents

(CURRENT VERSIONS SHALL BE UTILIZED)

OMB Circular A-130, Management of Federal Information Resources; (http://www.whitehouse.gov/omb/circulars_a130_a130trans4)

DoD Directive 5015.2, DoD Records Management Program

Records Management Code, 36 Code of Federal Regulations Chapter XII, Subchapter B , (http://www.archives.gov/about/regulations/subchapter/b.html), with emphasis on Part 236, Electronic Records

DoD Directive 8500.01E, "Information Assurance” dated 24 October 2002

DoD Instruction 8500.2, "Information Assurance Implementation” dated 6 February 2003

DoD Instruction 8510.01, "DoD Information Assurance Certification and Accreditation Process (DIACAP)" dated 28 November 2007

DoD Directive 8570.01, "Information Assurance Training, Certification, and Workforce Management" dated 19 December 2005

Intelligence Community Directive ICD-503 “Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation” dated 15 September 2008

DoD Information Assurance Vulnerability Alert (IAVA) memorandum dated December 30, 1999

NIST Special Publication 800-53 Revision 3, "Recommended Security Controls for Federal Information Systems and Organizations" dated August 2009

Committee on National Security Systems (CNSS) Instructions No. 1253 “Security Control Catalog for National Security Systems” dated December 2007

Committee on National Security Systems (CNSS) Policy No. 25 “National Policy for Public Key Infrastructure on National Security Systems” dated March 2009

Committee on National Security Systems (CNSS) Instruction No. 1001 “National Instruction on Classified Information Spillage” dated February 2008

DoD Instruction 8552.01 "Use of Mobile Code Technologies on DoD Information Systems” dated 23 October 2006

DoD Instruction 8551.1 "Ports, Protocols and Services Management (PPSM)” dated 13 August 2004

DoD Policy Memorandum "DoD Guidance on Protecting Personally Identifiable Information (PII)” dated 18 August 2006

DoD Policy Memorandum "Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media” dated 3 July 2007

Strategic Command Directive (SD) 571-1 “DoD Information Operations Conditions” dated 27 January 2006

Federal Information Management Security Act (FISMA) [Title III of E-Government Act of 2002]

Federal Cloud Computing Strategy

DISA Security Technical Implementation Guides (STIGs) – http://iase.disa.mil/stigs/index.html

Director of Central Intelligence Directive 6/3 “Protecting Sensitive Compartmented Information within Information Systems” dated 5 June 1999

DoD Manual 5220.22M "National Industrial Security Program Operating Manual (NISPOM) dated 28 February 2006

NSA Security Configuration Guides – http://www.nsa.gov/ia/guidance/security_ configuration_ guides /index.shmtl

A.2 NGA Policies

(CURRENT VERSIONS SHALL BE UTILIZED)

NI 1000.6R4 – NGA Instruction for Telework

NI 2060.1R4 – NGA Instruction for Export Controls

NI 3020.2R2 – NGA Instruction for Information Technology Disaster Recovery Planning

NI 4160.1R3 – NGA Instruction for Determining Property Accountability

NI 5410.1R10 – NGA Instruction for Travel Management

NI 5500.7R11 – NGA Instruction for Privacy Program Implementation

NI 8010.3R7 – NGA Instruction for Certification and Accreditation of Information Systems

NI 8010.9R7 – NGA Instruction for Information Operations Condition (INFOCON) Including Information Assurance Vulnerability Management (IAVM)

NI 8010.11R5 – NGA Instruction for NGA-Controlled Computer Network Connectivity at Contractor and Other Facilities

NI 8010.14R8 – NGA Instruction for Password Administration

NI 8040.1R10 – NGA Instruction for Records and Information Life-Cycle Management

NI 8410.1R4 – NGA Instruction for Implementation of Mobile Code

NI 8420.2R8 – NGA Instruction for Antivirus Response

NI 8470.2R8 – NGA Instruction for Internet Usage

Appendix B: CDRL List All CDRLs shall be delivered to the NGA PMO for this effort

Appendix C: Example Security Audit Contents

Auditable Events or Activities

Category: Authentication events Logons (Success/Failure) Logoffs (Success)

Category: File & Object events Create (Success/Failure) Access (Success/Failure) Delete (Success/Failure) Modify (Success/Failure) Permission Modifications (Success/Failure) Ownership Modifications (Success/Failure) Writes/downloads to external devices/media (e.g., A-Drive, CD/DVD drives, printers) (Success/Failure) Uploads from external devices/media (e.g., CD/DVD drives) (Success/Failure) Print to a device (Success/Failure) Print to a file (e.g., pdf format) (Success/Failure) Application (e.g., Netscape, IE, Lotus Notes, etc.) initialization (Success/Failure) Export of information (Success/Failure) Import of information (Success/Failure)

Category: User & Group Management events (DATA CENTER ONLY) User add, delete, modify, suspend, lock (Success/Failure) Group/Role add, delete, modify (Success/Failure)

Category: Use of Privileged/Special Rights events (DATA CENTER ONLY) Security or audit policy changes (Success/Failure) Configuration changes (Success/Failure) Admin or root-level access (Success/Failure) Privilege/Role escalation (Success/Failure) Audit and log data accesses (Success/Failure) System Reboot, Restart & Shutdown (Success/Failure)

Auditable Event Details/Information Elements Date of the event Time of the event using the common network time (e.g., Network Time Protocol).

Type of the event (e.g., login, print, etc.)

Identifier indicating the source/system of the event activity.

Identifier indicating the identity of the subject or actor (e.g., UserId, ProcessId, etc.

Details identifying any objects or resources accessed or involved (aka Resource List), e.g., files (including location), document id, peripherals, storage devices, etc.

Outcome (e.g., Success or Failure).

Signature Events* Indicating Violation of System/Target Malicious code detection Unauthorized local device access Unauthorized executables Unauthorized privileged access After-hours privileged access System reset/reboot Disabling of the audit mechanism Downloading to local devices Printing to local devices Uploading from local devices

* ”Events” of concern that require further analysis/review of additional information or events. Some of these may require tools or utilities (e.g. malicious code detection).

Appendix D: Government Furnished Information & Equipment List (GFI/GFE)

Appendix E: Acronyms

image3.emf image4.emf image5.emf image6.emf image7.emf image8.emf image9.emf image1.jpeg image2.emf