11142014_SSN_RFI.docx

Draft Performance Work Statement For Wide Area Network Design, Install, Maintain, and Service

Department of Housing and Urban Development Office of the Inspector General Office of Management and Technology Information System Division 1250 Maryland Ave. SW 3rd Floor Suite 300 Washington, DC 20024-2141

11/07/2014

1.

INTRODUCTION

This Task Order supports the Department of Housing and Urban Development Office of Inspector General (HUD OIG Office of Management and Technology), Infrastructure Services Division (ISD). The work described in this Performance Work Statement (PWS) includes the contract scope and objectives, to design, build, deploy, and maintain the HUD OIG Wide Area Network (WAN) and to provide WAN services (Network services).

The Department of Housing and Urban Development (HUD), Office of Inspector General (HUD OIG) is a semi-autonomous operational organization within HUD that was authorized with the signing of the Inspector General Act of 1978 (Public law 95-452). The Inspector General (IG) has the authority to inquire into all of the programs and administrative activities of the Department. The HUD OIG serves its customers by being a proactive force in identifying and mitigating problems while remaining committed to its statutory mission of identifying and preventing waste, fraud, and abuse and promoting the effectiveness and efficiency in the Department’s programs, activities, and functions. The HUD OIG receives and processes complaints of inappropriate behavior or violations of law; conducts audits and investigations of HUD activities; and develops, analyzes, and reviews legislative and policy proposals.

The HUD OIG’s mission is independent and objective reporting to the Secretary and the Congress for the purpose of bringing about positive change in the integrity, efficiency, and effectiveness of HUD business operations.

The success of the HUD OIG mission requires a cost-efficient, reliable, and fast telecommunications infrastructure.

2. SCOPE

HUD OIG has determined the current WAN telecommunications infrastructure does not provide the reliability, scalability, high availability and quality of the Network service. The scope of this RFI is to identify a vendor (Offeror) that can design, deploy and maintain a secure, fast and reliable WAN telecommunications infrastructure for HUD OIG at the best value. Included in the scope are the high level requirements to design, deploy and maintain a secure end-to-end telecommunications infrastructure that meets compliance frameworks: FISMA, US-CERT, NIST, OMB directives and Government directives that establish security requirements for protecting Government data and privacy.

The WAN is just one component of the HUD OIG Distributed Computing Environment (DCE). The other components of the DCE are the two datacenters (Central Server Facility and Disaster Recovery Facility) and the HUD OIG offices. Maintenance and support of the datacenters and HUD OIG offices are not in the scope of this PWS.

The Offeror Provider Edge (PE) routers, switches, and software are within the scope of this PWS.

3. OBJECTIVES

The overarching objective of the HUD OIG is to have a robust and secure, nationwide and enterprise-wide information technology infrastructure that helps it accomplish its mission and complies with Federal rules, regulations, and policies.

· Cost efficient and reliable, secure, fast nationwide telecommunications infrastructure.

· Improve telecommunications infrastructure operational availability.

· Life Cycle engineering support.

· HUD OIG requires an Offeror that can meet the following business objectives:

1. Offer realistic and transparent prices.

2. Efficient management of the Offeror’s telecommunications resources, components and circuits.

3. Effective and responsive Network Managed Services (MNS).

4. Proactive monitoring, addressing and communication of any network issues.

5. Expeditious execution of HUD OIG’s change requests.

6. Provide timely service and product cost information when requested.

7. Proactive and prompt communication of planned and unplanned network maintenance activities.

8. Provide a scalable solution that will enable HUD OIG to add business services such as video streaming and VOIP (for example).

9. Implement dedicated replication circuit between HUD OIG datacenters.

10. Be proactive in regularly identifying solutions that would lower costs without a reduction in service, performance or availability.

11. Provide HUD OIG with assistance configuring and troubleshooting customer-edge devices.

12. Assist HUD OIG in meeting new and existing Federal mandates and regulations.

4. HUD OIG LOCATIONS

The HUD OIG WAN encompasses various locations within the continental US and Puerto Rico and two datacenters. Network services for HUD OIG are currently implemented at/between two primary datacenters, the Central Server Facility (CSF) located in Washington, D.C., and the Disaster Recovery Facility (DRF), located in Denver CO. The two datacenters provide failover capabilities to the organization.

• CSF address – 1845 4th Street, NE Washington DC 20002-1503

• DRF address – 335 Inverness Drive South, Englewood, CO 80112-5882

The Offeror will terminate WAN circuits between each of the sites listed in Appendix A, and the CSF and DRF. HUD OIG requests pricing for Ethernet handoff at all locations. Where Ethernet handoff is not available, HUD OIG requests that the most cost effective access be proposed that meets the stipulated service delivery requirements in this PWS. Additionally, HUD OIG requests that all sites have an alternate, cost effective handoff proposed. Finally, HUD OIG seeks to future proof the sites as much as possible in terms of bandwidth augmentations.

The Offeror shall deploy a synchronous dedicated link between the two datacenters for replication and failover purposes.

5. TECHNICAL REQUIREMENTS

HUD OIG developed the requirements found in this section through a review of the existing contract requirements, by an analysis of mandated changes from NIST, OMB and other oversight organizations, and by gathering additional requirements from HUD OIG Managers. All information and requirements contained within this document are requirements that the Offeror shall provide as part of their service.

The Offeror shall be able to satisfy the requirements described herein; all services are required to operate and perform as defined in the attached Service Level Requirements.

5.1 WAN REQUIRMENTS

The Offeror shall meet the following requirements:

· The Offeror shall be responsible for the provisioning, installation, and coordination of all circuits.

· The Offeror shall deploy the WAN that connects all HUD OIG Offices to the CSF and DRF.

· The Offeror shall provide network bandwidth and system capacity for the WAN based on infrastructure and application requirements.

· The Offeror shall develop, maintain, and deliver network specifications, configuration, and topology diagrams.

· The Offeror shall deliver network engineering plans and schedules to support new and enhanced network applications, architectures, and standards.

· The Offeror shall conduct pre-installation site surveys, as applicable, stage new and upgraded equipment to smoothly install and transition components into the network.

· The Offeror shall deploy Ethernet access type (preferred).

· The Offeror shall ensure a minimum bandwidth of 10 Mbps for Field Office locations.

· The Offeror shall ensure a minimum bandwidth 50 Mbps for Region Office locations.

· The Offeror shall ensure a minimum bandwidth of 200 Mbps for HUD OIG Headquarters.

· The Offeror shall ensure a minimum bandwidth of 1 Gbps for the synchronous dedicated link between the two datacenters.

5.1.1 WAN TRANSITION

The Offeror shall provision and install circuits as identified with the following requirements:

· The Offeror shall be responsible for transitioning the current WAN from the current contract vehicle to the new contract vehicle.

· The Offeror shall ensure continuity of operations during the transition period.

· The Offeror shall complete the transition from the current contractor to the Offeror with minimal disruption to the users.

· The Offeror shall provision HUD OIG datacenter’s circuits first.

· All new circuits should be operational within 15 business days of contract award.

· The Offeror shall ensure circuits are tested and fully functional. Test results shall be provided to HUD OIG.

· The Offeror shall terminate circuits at the customer-edge router.

· All pertinent circuit information shall be provided to HUD OIG on the install date.

5.1.2 MOVES ADDS AND CHANGES

It is the intent of HUD OIG to maintain a stable WAN environment. Business requirements will require changes on as as-needed basis. As required the following requirements include:

· The Offeror shall cancel, and relocate circuits, as authorized by HUD OIG, on an as needed basis.

· The Offeror shall provide quotes to be delivered to HUD OIG within 5 days of request.

· The Offeror shall provide operational circuits within 15 business days after the authorization date.

· The Offeror shall decommission circuits no later than 15 business days after the authorization date.

· The Offeror shall ensure all new circuits are operational within 15 business days of authorization date.

· The Offeror shall ensure circuits are tested and fully functional. Test results shall be provided to HUD OIG.

· The Offeror shall terminate circuits at the customer-edge router.

· The Offeror shall provide a report of pertinent circuit information to HUD OIG on the install date.

5.1.3 ACCESS MEDIA TYPES

HUD OIG is primarily interested in Ethernet access at all sites where it is available. In the case that Ethernet hand off is not available.

· The Offeror shall identify the hand-off that is available at each of the sites. If access is available in multiple forms, please indicate any price differences related to the different hand-offs.

· The Offeror shall describe in detail each proposed access service for each site, including guaranteed availability and bandwidth scalability for each proposed access service.

5.1.4 DIVERSITY REQUIREMENTS

HUD OIG seeks Point-of-Presence (POP) level diversity for circuits. POP level diversity is HUD OIG’s preferred diversity strategy. HUD OIG will entertain solutions that are based around card level diversity in a single POP.

· HUD OIG is interested in understanding the diversity options that are available for each site listed above. HUD OIG may choose not to purchase diversity for any or all of the sites listed above.

· The Offeror shall provide a description of the diversity options available for each site as well as a cost comparison for the different options.

5.1.5 ROUTING PROTOCAL SUPPORT

The Offeror shall provide HUD OIG with the list of routing protocols and technologies the Offeror supports.

· The Offeror shall provide HUD OIG with the limitations of the proposed protocols. For example: Describe table-size limits for BGP / MBGP or identify any PRIVATE ASNs. The Offeror shall indicate whether or not these are hard limitations or soft limitations.

· If the service offering is a Layer 3 based MPLS VPN, then HUD OIG expects to run BGP with the service provider.

· The Offeror shall detail the maximum number of paths per prefix.

5.1.6 TRAFFIC ENGINEERING SUPPORT

Depending on the solution proposed by the Offeror, HUD OIG may need to influence traffic flows across diverse circuits in order to protect circuit capacity for a variety of reasons. HUD OIG is interested in understanding the mechanisms available for Traffic Engineering.

· The Offeror shall describe any mechanisms that exist for HUD OIG to influence the data paths over diverse circuits based upon the available routing protocols. For example: BGP Attributes: AS PATH, Communities, Local Preference, and Multiple Exit Discriminators.

· The Offeror shall describe any mechanisms that exist for HUD OIG to influence the data paths over diverse circuits based upon VPLS/MPLS label switching.

· If the network being proposed is a Layer 2 MPLS VPN (VPLS), the Offeror shall indicate whether or not customers may run their own Layer 3 MPLS VPN over the proposed network. The Offeror shall highlight any limitations that are imposed upon this scenario.

5.1.7 QUALITY OF SERVICE

HUD OIG’s QoS strategy involves a potential of six forwarding classes with classification based upon DiffServ code points (DSCP). HUD OIG is interested in understanding the Offeror’s QoS options available on the provider network.

· The Offeror shall describe QoS implementation options available. In addition, the Offeror shall detail the number of forwarding classes available as well as the bandwidth allocations available to HUD OIG for each forwarding class.

· The Offeror shall advise whether or not the customer may choose custom sizes for the different forwarding classes.

· The Offeror shall provide the specifics of the DiffServ code point mappings per forwarding class.

· The Offeror shall advise policy for accepting and preserving any class marking set by HUD OIG.

5.1.8 VOIP

HUD OIG intends to implement VOIP/Video on the WAN; the Offeror shall describe how this requirement will be supported. VOIP traffic shall be prioritized across the entire carrier backbone network with minimal delay and jitter. Jitter within the VOIP queue must be < 10ms.

The VOIP network shall be a separate network at each of the HUD OIG sites. The Offeror shall describe routing mechanisms available to prioritize and distribute this traffic over the WAN.

5.1.9 IP MULTICAST

HUD OIG may run Multicast natively across point to point circuits and over GRE tunnels with MBGP across the network. HUD OIG prefers to run IP multicast natively and eliminate the GRE tunnel and MBGP requirements if possible.

· The Offeror shall provide the ability to support IP multicast natively.

· The Offeror shall document requirements or limitations that exist including but not limited to the following: MBGP, Rendezvous Points, MSDP, and Multicast address space reservations.

5.1.10 DATACENTER REPLICATION

HUD OIG intends to implement a separate circuit for replication between the data centers in Colorado and the District of Columbia. This circuit shall be capable of extending the same VLAN’s between the two datacenters.

· This replication circuit shall also be used for user traffic in the event of one of the primary data center WAN circuit fails.

· The Offeror shall propose what technologies will be used to support these requirements.

6. SECURITY

The Offeror shall provide system security in compliance with the Federal Information Security Management Act (FISMA), security-related OMB Circulars and Memorandums (e.g., OMB Circular A-130), security-related compliance standards and requirements for federal agencies issued by the National Institute of Standards and Technology (NIST), and any future statutes, regulations, requirements, or guidelines for securing federal systems.

6.1 PERSONNEL SECURITY REQUIREMENTS

The Offeror must have the necessary procedures in place to ensure that all personnel working on the project are properly screened and cleared to work on the project. The personnel security requirements are detailed below.

· The Offeror shall ensure that all their personnel working on the project with access to OIG data circuits are U.S. citizens and have a full background investigation for a security clearance (required level will be determined by HUD OIG ) prior to either directly or remotely accessing HUD OIG computer system(s). HUD OIG has final determination on acceptability. Favorable adjudication is required prior to any access to HUD OIG systems.

· The Offeror shall be responsible for all expenses associated with the clearance/security process and procedures for its personnel.

· The Offeror shall ensure that personnel and third-party resources it uses for non-data related maintenance and dispatch/repairs are escorted and monitored when working in secure areas. The Offeror shall be responsible for any actions of personnel performing activities on their behalf.

· The Offeror shall ensure that all Offeror’s personnel working on the project take and pass the Basic Systems Security Awareness course approved by HUD OIG , and available on-line before commencing their HUD OIG duties and annually thereafter.

· The Offeror shall have and implement a documented formal sanctions process for personnel failing to comply with established security policies and procedures.

· The Offeror shall ensure that terminated employees have no access to government computing systems immediately prior to their termination in accordance with the MAC Delete procedures.

· The Offeror shall ensure the return of all government information system-related property (e.g., documentation, software, equipment, keys, identification cards, building passes) when an employee is terminated. These shall be surrendered to HUD OIG immediately upon termination.

· The Offeror shall train personnel in their incident response roles and responsibilities with respect to the DCE, and provide refresher training no less than every twelve (12) months.

6.2 PHYSICAL SECURITY

The Offeror shall control all physical access points (including designated entry/exit points) to HUD OIG CSF and DRF facilities containing information systems (except for those areas within the facilities officially designated as publicly accessible).

· The Offeror shall complete appropriate access agreements (based on approved background checks) for individuals requiring access to the CSF and DRF facilities.

· The Offeror shall limit access to the CSF and DRF facilities to authorized personnel at all times. The Offeror personnel or agents thereof must present official identification for physical access to equipment.

· The Offeror shall establish and maintain a list of personnel with authorized access to the CSF and DRF facilities. This list must be provided to the government as needed.

· The Offeror shall monitor all non-cleared personnel performing work functions in the CSF and DRF facilities.

· After receiving HUD OIG approval, Offeror personnel shall properly display issued credentials (e.g., badges, identification cards, and smart cards) for use within CSF and DRF facilities.

· The Offeror on an on-going and continuing basis shall monitor physical access to CSF and DRF to detect and respond to incidents.

· The Offeror shall monitor on an on-going and continuing basis HUD OIG caged area in the CSF and DRF facilities.

· The Offeror shall ensure that access to CSF and DRF housing storage media shall be strictly controlled with all access recorded in a log.

· The Offeror shall review, on no less than a daily basis, the physical access log to identify apparent security violations or suspicious physical access activity; and shall take remedial action.

· Offeror personnel shall not remove equipment or media from the DCE facility unless authorized in writing by HUD OIG. In the event an emergency necessitates oral authorization, HUD OIG POC will follow-up with written authorization within 2 hours of providing the oral authorization.

· The Offeror shall ensure that HUD OIG staff has “read-only” access to logs (including but not limited to router logs).

6.3 SYSTEMS AND INFORMATION SECURITY

At all points throughout the DCE, security must be in place to protect access to systems and the data contained on the systems. The systems and data security requirements are presented below.

· The Offeror shall support resolution of any CSF or DRF related security findings generated during HUD OIG’s security certification and accreditation of the DCE network system, in compliance with federal regulations and implementing NIST standards.

· The Offeror shall support action to detect, and prevent malicious software (malware) using accepted best practices. This solution shall be maintained and kept current at all times.

· The Offeror shall support critical updates, patch management, and system integrity checks commensurate with the security risk.

· The Offeror shall provide a network security monitoring capability for HUD OIG Security Manager, with “Read-only” access to all security monitoring tools and logs.

· The Offeror on an ongoing and continuing basis shall review information system security alerts/advisories (e.g., CERTS, SANS, NIST) as published and take appropriate actions in response.

· The Offeror shall report, in real-time, all DCE network incidents and attacks to HUD OIG Incident Response Team.

· The Offeror shall notify the United States Computer Emergency Response Team of all network incidents and attacks in accordance with the CERT requirements.

· The Offeror immediately shall inform HUD OIG Incident Response Team of any notifications to the United States Computer Emergency Response Team.

· The Offeror shall support the test and installation of newly released relevant security patches, service packs, and hot fixes in accordance with federal regulations and the implementing NIST standards.

· The Offeror shall address immediately flaws discovered during security assessments, continuous monitoring, or incident response activities.

· The Offeror shall support testing of the cyber incident response capability for the DCE network at least every twelve (12) months using government approved tests and exercises to determine the Cyber Incident Response Plan effectiveness and document the results, and improve where necessary.

· The Offeror shall support a self-assessment of the security controls in the DCE network at least every twelve (12) months to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. Any findings shall be reported in the POAM and resolved in accordance with federal regulations.

· The Offeror shall maintain, review, and provide to HUD OIG DCE network audit logs as required.

· The Offeror shall support the monitoring of the DCE network for indications of inappropriate and or unusual activity and shall provide the results immediately to HUD OIG upon discovery of such activity.

· The Offeror shall archive and index network audit logs for management purposes. The audit logs must be available and provided upon HUD OIG management request.

· The Offeror shall ensure that the network protects audit information and audit tools from unauthorized access, modification, and deletion.

· The Offeror shall track and document network security incidents on an ongoing basis, and shall within one hour of discovery report incident information to HUD OIG Incident Response Team.

· The Offeror shall obtain concurrence from HUD OIG Federal Security Team prior to implementing any change to network security.

· The Offeror shall ensure that the network supports a Three-key Triple DES Encryption and Decryption as described in NIST 800-13.

· The Offeror shall insure that personal information collected for employee and Offeror identification purposes is handled consistent with the Privacy Act of 1974 (5 U.S.C. § 552a) and OMB 06-16.

· The Offeror shall satisfy all the requirements of OMB 09-32 including those requirements for executing essential agreements to facilitate integrating the National Cyber Protection system and for synchronizing with US-CERT.

· The Offeror shall insure that all infrastructure-related security controls identified for a moderate level system are implemented and supported in the network (FIPS 200).

· The Offeror shall support assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency. NIST Special Publication 800-30 provides guidance on conducting risk assessments including threat, vulnerability, and impact assessments.

· The Offeror shall support the conduct of a self-assessment of the security controls in the DCE network at least every twelve (12) months to determine the extent to which the network-related controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the network. Any deficiencies shall be reflected in the POAM and resolved in accordance with federal regulations.

7. WAN ADMINISTRATION

Continuous monitoring 24x7 is crucial for ensuring that the HUD OIG WAN is always available to HUD OIG employees, and that the network is operating at the desired performance and availability levels. The network administration requirements are presented in accordance with Federal mandates and requirements are listed below.

· The Offeror shall provide real/near real time network monitoring and network performance tools for monitoring the status and performance of the network.

· The Offeror shall use these network monitoring and network performance tools to optimize performance of the network.

· The Offeror shall provide circuit error/discard monitoring with applicable reporting to HUD OIG.

· The Offeror shall ensure all exceptions to normal operating conditions are communicated to HUD OIG.

· The Offeror shall provide the HUD OIG ISD oversight/monitoring (“read –only”) access to the network, servers, and performance tools. This oversight shall be without limit or restriction.

· The Offeror shall provide training to the designated HUD OIG ISD POC in the use of the oversight and monitoring tools.

· The Offeror shall provide immediate and ready access to any Offeror infrastructure components, including but not limited to routers, when HUD OIG ISD requires such access and support to maintain the components for which it is responsible.

· The Offeror shall ensure that any problem causing more than a 99.9 % deviation from the target shall be fixed within 1 hour period of time

· The Offeror shall provide 24x7 technical support of the WAN infrastructure.

· The Offeror shall provide the HUD OIG ISD COR with reports and statistics resulting from real/near real time network monitoring.

· The Offeror shall provide HUD OIG ISD unrestricted “read-only” access to the database used for producing reports and statistics from the network monitoring tool.

· The Offeror shall perform speed tests after each circuit is provisioned. Results will be provided to HUD OIG.

8. SUPPORT

In the design of its WAN, the Offeror must include elements that safeguard against outages. The Offeror must also have plans and facilities in place to ensure continued operations of HUD OIG ISD identified critical functions in the event of a disaster or major damage to the CSF. The outage prevention and disaster recovery requirements are presented below.

· The Offeror shall provide a Service Escalation Plan.

· The Offeror shall provide 24x7x365 support and access to Tier 2 & 3 support engineers.

· In the event of errors on a circuit, non-intrusive testing shall be performed first to try and isolate the cause of errors.

· Intrusive testing shall only be performed during pre-scheduled downtime coordinated with HUD OIG. Intrusive testing will be completed according to this schedule and on-demand when approved by HUD OIG.

9. PROJECT MANAGEMENT

HUD OIG intends to reduce risk and uncertainty through industry standard project management activities. The Offeror shall propose the project management activities to create repeatability, reliable performance and standardization. As such HUD OIG expects the Offeror to plan, organize, and control all activities, tasks, and resources that impact of otherwise effect the service delivery, or the identified Service Level Requirements.

· The Offeror shall propose the Project Manager as a Key Person.

· Responder shall demonstrate in their offering, problem or service ticket escalation methodology to ensure circuit, or service delivery problems are aggressively resolved with minimal customer intervention required.

· The escalation process shall allow for OIG input to Offeror’s upper management if lower tier management of service tickets is not acceptable to the OIG.

· The Offeror shall develop, and submit to HUD OIG for approval, a Project Management Plan that includes but is not limited to the rationale for the proposed organization, key persons, the work to be performed, the schedule for performance, the method by which communications with HUD OIG will be accomplished, the method for problem resolution, and the resources allocated to each task.

· The Offeror shall develop, and submit to HUD OIG for approval, a Risk Management Plan that includes but is not limited to: specifying the context, identifying and prioritizing the risks, specifying the identified risk management strategies, and describing how the risk management program will be monitored. In addition it should describe the process by which risks will be recorded and managed.

10. DELIVERABLES AND REPORTING

The Offeror shall develop, deliver to HUD OIG for acceptance and regularly update a prescribed set of deliverables.

· Within 5 business days of contract award, the Offeror shall deliver a Transition Plan.

· Within 15 days of contract award, the Offeror shall deliver WAN circuits that meet or exceed the Service Level Requirements.

· Within 30 business days of contract award, the Offeror shall deliver a Service Escalation Plan.

· Within 30 business days of contract award, the Offeror shall deliver a Project Management Plan.

· Within 30 business days of contract award, the Offeror shall deliver a Risk Management Plan.

· Within 30 days of contract award, the Offeror shall deliver a Configuration Management Plan.

· Within 30 days of contract award, the Offeror shall deliver network specifications

· Within 30 days of contract award, the Offeror shall deliver network topology diagrams.

· The Offeror shall deliver within five business days of each month a Monthly Service Level Requirements Compliance Report for the previous month.

APPENDIX B SERVICE LEVEL REQUIREMENTS

This appendix defines the Service Level Requirements for the Offeror to provide levels of service that meet HUD OIG expectations.

Since technology and services change through each year, this document will be updated on a regular basis to reflect those changes. This Service Level Agreement defines the service environment, service descriptions with roles and responsibilities, and service level requirements (SLRs) for the provisioning of HUD OIG Network services.

HUD OIG has established several goals for network performance and network administrative services. The overall goal is to provide high-quality support services to customers using the physical network in a cost-effective manner.

A summary of the network services goals follows:

Network Performance SLR

· All pre-scheduled system downtime, unless otherwise agreed upon in advance by Delivery Services will occur one weekend a month.

· Work must conform to Configuration Management standards.

Network Administration Service SLR

16 | Page image1.jpeg