HQ0516-FY-25-0005 Questions and Answers.pdf

Sources Sought HQ0516-25-FY-0005

AFN TV Infrastructure Continuity of Operations (COOP) Plan

Questions and Answers

Q1. If we were to implement on JWCC, do we still need to have our own Information System

Security Officer (ISSO) with the direction of the AFN team in order to meet the requirements of maintaining the cyber compliant system as a whole?

A1. Yes. Although the cloud portion is vetted and will be relatively easy to manage in the RMF process, the functional architecture will require continuous RMF management.

Q2. What are the current TS formats and bit rates of each input listed under Content

Contribution (page 5)? MPEG-2 or MPEG-4; SD or HD? Data rate of each? We ask in order for us to provide budgetary pricing.

A2. We are asking that the interested vendors make suggestions for best practice and best value, as well as manage the “input” portion of the environment. As the sources are from multiple providers there will likely be a mix. The Video format will be HD 720p 59.94 or 1080i 29.97, MPEG-2, H264 4:2:0 to HEVC 4:2:2 with a maximum bitrate of 25Mb per source.

Q3. What is the current TS format and bit rate for each of these outputs? We ask in order for us to provide budgetary pricing.

A3. At minimum, SRT, HEVC H.265, 720p, 30fps, >10Mbps. The Statement of Objectives that will be released with the RFQ shall have these salient characteristics/requirements.

Q4. What is the current bit rate of each input that will be captured (saved to storage) from each input? We ask in order for us to provide budgetary pricing.

A4. See answer number two. We are asking that the interested vendors make suggestions for best practice and best value.

Q5. What is the anticipated amount of usable storage that will be needed?

A5. We anticipate storage being measured in “hours”, based on the determined file format and parameters. It would be good to see a simple comparison chart of 100, 500, and 1000 hours, for example; 100 hours @ uncompressed I-Frame, 50MBps = 18TB

Q6. Will this usable storage amount be consistent or grow over time?

A6. It would be prudent to anticipate growth over time

Q6a. If over time, by how much and over what time?

A6a. Difficult to tell. Growth in storage amount will be considered during requirements development and may be addressed through the addition of separately priced line item option CLINs.

Q6b. Is there a need to move the content to another Tier of storage?

A6b. No, not at this time.

Q7. What standard is currently being used to receive uploads (i.e. FTP)?

A7. The AFN-BC currently receives non-linear asset files by sFTP, secure links from providers, 3rd party accelerated download applications such as Aspera.

Q8. Under ‘Video Switching’ section (page 5) it reads, “...switch away from commercial content to stored or captured assets.” What is the definition/difference between “stored” and “captured”?

A8. “Stored” would mean files uploaded from our on-premises system to a repository in the cloud system, whereas “captured” assets are recorded from the inbound linear contribution sources, or the Program buss output, and “clipped” out as an independent asset.

Q9. Under “Dependencies”, number 4, the system should be, “able to be brought on-line within four hours of initiation.” Please define “on-line” and “initiation.”

A9. The primary function of this environment is to provide Continuity of Operations/Disaster

Recovery for the AFN-BC mission. This system will be dormant, “off-line”, (or running only necessary services) until AFN-BC Operations requires the environment to be initiated, “spun-up”. Four hours is the service level required to bring this system online and performing the

AFN-BC mission.

Q10. Does the system need manual control of the virtual switcher or will transitions be scheduled in the playlist?

A10. “Live” switching (manual control) is the requirement for this capability. Scheduled playlists/automation is a future consideration.

Q11. Will there be any other cloud-related services required that go beyond DR Playout and

Master Control in a cloud-based environment? Examples are cloud-based storage, archive, language translation/transcription, transcoding, asset management etc.

A11. These capabilities are currently not required for this acquisition, however, they are future considerations. Interested vendors should include their capabilities and suggestions for best practices in their response to the SOO.

Q12. Does AFN have any cloud-based interoperability requirements for the desired solution?

i.e., Microsoft Government Community Cloud (GCC), GCC-HIGH or AWS GovCloud?

A12. Not at this time for this acquisition.

Q13. Is it understood that for ease of cloud-based infrastructure management, that the initial phase of this project be a 100% SaaS offering?

A13. Ideally, yes. We are asking that the vendor negotiate with the specific Broadcast Networks for direct contribution, as well as the capability to accept two dynamically addressable SRT feeds.

Q14. After initial deployment, will Diversified be responsible for Tier 1 support and function as an MSP (Managed Service Provider), or will support related activities (such as support cases and ticketing, software updates, health checks, billing, etc.) be managed directly with the vendor?

A14. This would be between the vendor and integrator (if involved). Software updates will be managed through the vendor ISSO and our Change Control Board and Cyber team. The SLA of the awarded contract would be to provide Tier 1 support for the user/operator level, and Tier 2 and higher for engineering, bug fixes, code pushes, etc.

Q15. The cybersecurity compliance requirements have numerous overlaps and potential conflicts with each other that we would appreciate clarification on. DFARS 7012, 7019, 7020 all require implementation of NIST 800-171 rev 2 for CMMC compliance (110 practices). The Sources

Sought also lists CMMC Level 1 which is only protection for FCI (17 practices). Additionally, NIST RMF is also requiring the implementation of NIST 800-53 (1000+ controls across 20 control families) which represents a superset of controls relative to NIST 800-171. Lastly, during the industry day, AFN stated its desire that the solution be 100% Cloud Native which in accordance with DFARS 7012 and 7020 would necessitate FedRAMP which entails even further control requirements beyond 800-53. Please clarify the data types the vendor is required to protect. Is it just FCI? FCI & CUI? FCI & CUI in the cloud? Hybrid?

A15. This will be addressed and clarified in the solicitation SOO.

Q16. Are there existing ATO and NIST compliant artifacts (i.e., System Security Plan, FIPS 199 categorization, POA&M, etc.) for the current production systems?

A16. The current system is in the categorization phase of the RMF process. There are NIST compliant documents, to include Privacy Assessment, Categorization, and the System Security plan.

Q17. Do you have a job description for the ISSO role desired including clearance requirements, if any, place of performance (or remote), certification requirements (i.e., DoDD 8140)?

A17. We do not have a position description, however, the roles and responsibilities for the ISSO representative will be detailed in the SOO.

Q18. For Business Continuity and Disaster recovery, does AFN have a desired uptime/availability SLA? (i.e., 99.9%? 99.99%? etc.)

A18. Reference A9; The SLA for availability is 5-9’s, 99.999.%. The minimum operational runtime for the environment is 10 hours a month for training and exercise, to possibly 24/7 in a full contingency situation.