Draft_Dot_Gov_SOO_3-14-16.pdf

Statement of Objectives

.Gov Internet Domain Registration and Analytical Reporting Service

5 YR Contract

1. BACKGROUND

The General Services Administration (GSA), Office of Government-wide Policy (OGP) and Office of Information, Integrity, and Access (OIIA), are responsible for the policy, operations, management and direction of the .Gov Internet Top Level Domain Registry and for maintaining the (only) .gov Registrar and Registry Service for domain name registrations by Federal agencies, State and Local governments, and Native Sovereign Nations (NSNs).

As the designated sponsor of the .Gov generic Top Level Domain (gTLD), GSA is the official

“policy authority” vice Internet Corporation for Assigned Names and Numbers (vice ICANN).

GSA’s registry and registrar requirements conform to those of ICANN, unless otherwise specified in this Statement of Objectives (SOO). Registration requests are serviced by way of web enabled applications hosted at https://dotgov.gov. Currently, there are approximately

5,600 domains within the .Gov gTLD.

4. TASKS

4.1 TASK 1: PROJECT MANAGEMENT SUPPORT

The Contractor shall provide program management support that includes the management and oversight of all activities performed by Contractor personnel, including Sub-Contractors, to satisfy the requirements identified in this SOO. The Contractor shall identify a Program

Manager (PM) that shall provide management, direction, administration, quality assurance, and leadership.

The Contractor shall facilitate Government and Contractor communications, use industry best-standards and proven methodologies to track and document .gov requirements and activities to allow for continuous monitoring and evaluation by the Government, and ensure all support and requirements performed are accomplished in accordance with the SOO. The Contractor shall notify the Contracting Officer Representative (COR) and Government Program Manager

(PM) of any technical, financial, personnel, or general managerial problems encountered throughout the period of performance (PoP).

The Contractor shall provide strategic enterprise-level guidance that integrates support across all task areas and ensure that support is in accordance with the SOO requirements.

4.1.1 KICK-OFF MEETING

The Contractor shall schedule and coordinate a Project Kick-Off meeting at the location approved by the Government within ten (10) business days after contract award. The meeting will provide an introduction between the Contractor personnel and government personnel to be involved with the requirement. The meeting will provide the opportunity to discuss technical, management, and security issues, and travel authorization and reporting procedures.

At a minimum, the attendees shall include Key Personnel, representatives from the GSA OGP, other relevant government personnel, and the COR.

GSA shall outline all the security testing required for accreditation (if required), and the

Contractor shall discuss their understanding of the project, and review the background information and materials provided by the government. Discussion shall also include the scope of work to be performed, the deliverables to be produced, how Contractor work efforts will be planned and organized, and any assumptions being made jointly by the Government and the

Contractor before work commences. A concerted effort shall be made by the Contractor to gain a thorough understanding of the Government’s expectations.

4.1.2 BRIEFINGS

Upon request, the Contractor shall prepare a summary briefing and present it to the GSA

DotGov Program Management team. Other federal entities and their representatives may attend the briefings. Details of this briefing shall be on the results of efforts performed under this contract. In addition, the Contractor shall provide a quarterly formal program review briefing, known as the .gov In-Progress Review (IPR) ninety (90) days following each formal review; the operator shall file updated pertinent performance statistics and DNSSEC activity.

Briefings will be conducted at a minimum of once per quarter and may occur more frequently to meet the needs of the Government.

4.1.3 MEETINGS

The Contractor shall attend meetings and briefings with government/non-government entities as requested by the Government. Generally all meetings and briefings will be conducted at the

DotGov Program Office located in Washington, DC or Contractor’s site, but the Government may stipulate other meeting and briefing locations, or may request teleconferences as appropriate. Meetings may be held at contractor’s facility if consent by DotGov Program

Manager is granted. Meetings will be conducted at a minimum of once per month.

4.1.4 QUARTERLY REVENUE REPORTS

The Contractor shall be required to provide Quarterly Revenue Reports on the 15th of the month following the last business day of the quarter. The Contractor shall submit a Quarterly

Revenue Report identifying Registration fees received delineated by source and revenue type.

Also required are registration fees if any, in arrears.

4.1.5 AD-HOC REPORTS AND QUERIES

The Government may request a special report on .gov data and/or activities such as, but not limited to: database queries relating to total number of domains supported by the system;

domains owned by a particular agency or state/county/local or NSN government; approved domain names in the database or for a particular agency or state/county/local or NSN government. The number of reports will not exceed 1 per month or 12 in a year.The

Government may also request backup or recovery of specific or all records. The Contractor shall provide periodic performance reports such as weekly, monthly and yearly reports to denote additions, deletions, registrations, overdue payments, and domain totals by category, to be made available to Management personnel online and on demand. These reports should be able to be run by Government personnel through a menu of options.

4.2 TASK 2: WEBSITE MANAGEMENT AND ADMINISTRATION

4.2.1 WEBSITE MANAGEMENT

The Website (www.dotgov.gov) is the entry point for .gov Internet domain management and registration services. The Contractor shall host the Website and provide the requisite network management services as appropriate for the level of mission criticality and information sensitivity. The Contractor shall also be proactive and make recommendations for improving the level of service, content quality, and value to the Government.

At a minimum, the Contractor shall perform the following work requirements:

● Operation and maintenance of the http://www.dotgov.gov registration Website and supporting infrastructure. A redundant failover/backup site shall also be provided. In the event of a catastrophic failure or other service disruption at the primary site, the failover/backup site shall continue all operations with limited interruption.

● Operation and maintenance of the WHOIS directory service.

● Operation and maintenance of the DNSSEC analyzer tool for agencies to determine if a

.gov domain name is signed with a Domain Name System Security Extension.

● Operation and maintenance of provisioning systems to a minimum 99.9% uptime per month, and resolution systems to 100% per month.

● Location of all provisioning sites within the continental United States (CONUS).

● Operation and maintenance of at least one failover/backup site for the registrar, registry, and all related systems, with the ability to failover all resolution sites within 10 minutes, and 100% of all services within 90 minutes. The failover/backup site shall be hosted on a separate power grid and telecommunications network and not less than http://www.dotgov.gov/

100 miles from the primary site. The Contractor should also take into consideration any other factors that may be relevant (e.g. seismic zones) to best ensure that the failover site is at a location that will remain operational in the event the primary site is not.

● Development and maintenance of a disaster recovery/continuity of operations plan in accordance with National Institute of Standards and Technology (NIST) Special

Publication (SP) 800-34.

● The website will be able to show / report fees per domain per their respective group of

Federal agency, State and Local governments, or NSN jurisdiction(s).

● Development and submission of regular audits and reports (including modifying filing, archiving, and securely submitting the .gov zone file to the respective root name servers).

● Frequently Asked Questions (FAQs):

● Responsiveness to ad hoc requests for additional zone file updates as a result of an emergent, high priority domain name request, to be available within one hour to the

Internet upon notification by the government.

● A Strong two-factor authentication meeting NIST SP 800-63 Level of Assurance 4 requirements for all Privileged users involved in managing the solution infrastructure inclusive but not limited to any databases, websites, servers, or hosting environment involved in solution delivery and operations;

Any website or web application development must meet the following requirements.

The websites or web applications must work correctly in all GSA supported browsers and platforms. This includes:

○ Internet Explorer 9 and above on Microsoft Windows

○ The two latest versions of Google Chrome on Microsoft Windows and Mac OS X

○ The two latest versions of Mozilla Firefox on Microsoft Windows and Mac OS X

○ Safari 6 and above on Mac OS X

○ iPhone, iPad, Android phones and tablets

The websites or web applications must meet Web Content Accessibility Guidelines (WCAG) 2.0

A, AA, and select AAA standards. The site must use well-formed, semantic code, including

HTML5, CSS3, and unobtrusive scripting.

4.2.2 GSA Landing Portal with Two Factor Authentication

No later than 6 months past contract award GSA will activate a new Web Services landing page.

GSA will provide a portal to access Internet Domain and Web information to include web policies, OMB Memoranda, How to procure Web Services, etc., and a Domain Registration and

Domain Management Button / Icon. GSA will provide user authentication and login mechanism for all users.

● Seamless integration and transition from bifurcated system of GSA hosted information to Contractor hosted information and database systems with Contractor adhering to use of GSA federal web policies

● GSA will provide strong two-factor authentication through the OMB’s https:\\www.max.gov for all registrants and Federal agency users to include support for authentication to the website via PIV and CAC credentials. Compliance may be achieved through an assertion based model aligned with NIST SP 800-63 Section 9 to include support for SAML 2.0 Web SSO Standards and one or more integrations with a government Authentication service;

● GSA / MAX will provide all login accounts w/ temporary passwords. All password reset and update will be serviced through MAX authentication services.

4.3 TASK 3: .GOV HELP DESK SUPPORT AND DOMAIN MANAGEMENT SERVICES

4.3.1 HELP DESK SUPPORT

The Contractor shall provide the necessary support to assist in resolving customer issues.

The Contractor will staff a live program Help Desk and provide customer service via a toll-free number and e-mail. The Contractor must initiate either a return phone call or an e-mail reply to the customer within two (2) business hours of initial contact by the customer.

At present, an average of six hundred (600) help desk calls/emails are serviced each month and the customer database consists of approximately 13,000 customers. The Contractor shall keep an electronic log of all calls/emails received by the .gov Help Desk. Help Desk will be manned from 7 AM to 7 PM Monday through Friday EST. Emergency notification and assistance will be available 24/7/365.

The Contractor will provide timely support from a Help Desk, with public switch telephone network (PSTN) voice and, email. The Contractor shall also maintain such specialized communications facilities as may be required to support sensitive, security related registrants’ services, such as satellite phones.

4.3.2 DOMAIN MANAGEMENT SERVICES

The Contractor shall provide services including, but not limited to:

● 24/7/365 technical assistance to registered points of contact, auditing and reporting, modifying, filing/archiving, and securely submitting the .gov zone file to the respective root-nameservers. Data input by the Contractor shall be checked for validity to insure the correct .gov domain name is activated for the customer.

The zone file updates shall be submitted at a minimum twice daily, to include all DNSSEC records. The GSA PM may request an additional zone file update as a result of an emergent, high priority domain name request, which must be pushed out to the Internet upon notification by the Government.

4.4 TASK 4: DYNAMIC DOMAIN NAME SYSTEM ANALYTICAL AND REPORTING SERVICES

The Contractor shall provide a comprehensive subscription service for dynamic DNS analytic and reporting services in direct support of managing the .gov domain space for the government. Data points that satisfy the robustness of the subscription service are listed below.

The subscription shall be secured, including encryption at rest and in transport. The scope of services to be acquired from this subscription includes:

● Summary and detailed reporting data for metrics such as DNS traffic data,

● Performance indicators to facilitate the identification of performance and usage trends,

● Technical support and tool enhancements,

● Special ad hoc reports to meet dynamic government requirements, (e.g. rate of IPV6 adoption by federal agencies.)

There will be a minimum of one report per month with an option of at least 12 ad-hoc reports per year.

Reports must be made available in machine-readable data formats, such as JSON or CSV.

Data points to be collected, recorded, and reported should include:

● Functionality (e.g. determine whether a given domain is functional);

● Geographic location of all servers that directly host web services on the .gov gTLD (this pertains to servers directly in support of the services, i.e. the standard caching of DNS information by edge service providers is exempt);

● Ownership and fee collection status of .gov domains ;

● Web server hosting details;

● Domain redirects, and if so, to where;

● DS Records (where they exist),;Certificates, issuer, date of expiration;

● Certificate, type and provider;

● IPv6 adoption analysis;

● Traffic scores;

● List of subdomains;

● Possible security identifiers, showing trends toward malware or dysfunction; and

● Statistics on potentially malicious traffic designed to either exploit the DNS system itself or as other indicators of compromise, and such potentially malicious command and control servers.

Other potential metrics may be discussed, defined, and agreed to by the Contractor and the

Government over the life of the contract. In addition, the Contractor is expected to propose potentially valuable metrics based on industry experience and best practices.

Government data rights of software deliverables shall be in accordance with FAR 52.22719

Commercial Computer Software License and/or FAR 52.22714 Rights in Data General.

Ownership of data entered into any and all systems, system documentation, all deliverables produced in the performance of this contract, and other related system information shall reside with the Government.

4.5 TASK 5: SYSTEM SECURITY

4.5.1 INFORMATION SECURITY REQUIREMENTS

The Contractor shall be responsible for adhering to all NIST Special Publications and Standards, Office of Management and Budget (OMB) circulars and memoranda, the Federal Information Security Management Act of 2002 (FISMA), and all revisions and updates thereof.

The Contractor shall provide all Assessment and Accreditation (A&A) support documentation to support the testing of the security controls of the system at the FIPS 199 High Impact level;

as well as to ensure the system's functional needs satisfies Federal security mandates for the processing of Controlled Unclassified Information (CUI) and protection of sensitive data.

All medium and high findings/vulnerabilities shall be remediated prior to the Accreditation decision by the Authorizing Official.

The Contractor shall ensure that the documentation remains current throughout the system life cycle. Re-certification is required every three (3) years or any time that sufficient changes to the system's software, hardware, or firmware has occurred. GSA will contact the Program manager to ensure a update to the A&A is accomplished. The GSA program manager and the Contractor will work to accomplish the task by the end of the 3 year ATO date.

The Contractor shall support the testing of the security controls in the system in accordance with the most current version of NIST 800-53 (currently revision 4) and NIST

800-53A1. In addition, the Contractor will need to be prepared to host penetration testing activities, including the use of governmentpersonnel. The Contractor shall include their primary and backup (or “failover”) sites as both will be reviewed and tested.

Automated scans can be performed by government personnel or agents acting on behalf of the government using government operated equipment and government specified tools. GSA will schedule the Scan with the Contractor. If the Contractor chooses to run its own automated scans or audits, results from these scans may, at the Government’s discretion, be accepted in lieu of government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the government. In addition, the results of Contractor-conducted scans shall be provided, in full, to the Government.

Review activities include but are not limited to: operating system vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, and security of federal information. General support system infrastructure will also be included and verified.

The Contractor shall initiate work on this A&A requirement by meeting with key client agency representatives (GSA PM and GSA IT Security), to include GSA’s A&A Contractor, to ensure that a common understanding of the requirements, expectations, and ultimate end products exists between all parties. The Office of the Chief Information Officer (OCIO) and A&A Contractor shall conduct all the security testing required for accreditation.

The Contractor shall comply with all the requirements referenced in the GSA publication: "Security Language for IT Acquisition Efforts - CIO IT Security 09-482.” The Contractor shall provide only personnel who have completed and passed a Federal National Agency Check with Inquiries (NACI) background investigation. The Contractor shall provide and support overall Infrastructure Security efforts which include all aspects of Technical, Operational, & Management Security. This task requires the Contractor to manage the current and future security efforts without compromising security.

The Contractor shall assist GSA in the compilation and documentation of the potential risks, and assist in the development of a Risk Management Plan. The risk management plan shall be reviewed with the COR and DotGov Program Manager at least semi-annually. This plan shall identify the potential risks and probability of occurrence consistent with the environment proposed.

All data shall be protected against unauthorized disclosure, modification, theft, and

NIST SP 800-53 (currently revision 4) and NIST SP 800-53A - Use latest edition of Federal IT

Security program regulations.

Security Language for IT Acquisition Efforts - CIO IT Security 09-48 - GSA guidance on purchasing IT Products and Services destruction in accordance with all applicable National Institute of Science and Technology

(NIST) guidelines, but in particular NIST SP 800-81-2.

The Contractor shall be responsible for providing documentation that demonstrates that the system has been certified to be in compliance with all applicable NIST, GSA and Federal regulations and guidance throughout the life of the contract. The Contractor shall maintain the documentation and ensure that the documentation remains current throughout the system life-cycle.

● All requisite A&A support documentation shall be completed on demand within the timeline of each A&A segment as outlined in the A&A deliverables list and delivered to the COR for review and forwarding to the GSA Approving Official (AO) for the accreditation decision.

The Contractor shall be responsible for correcting any identified security shortfalls within the time specified by the OCIO, Information Security Office. The AO is the GSA Chief Information Officer (CIO).

● The Contractor shall be responsible for reporting cyber security incidents to the US

-CERT. through the GSA OCIO Information Security Office within 2 hours.

4.5.2 A&A DELIVERABLES:

In completing and documenting the various A&A-related tasks, the Contractor shall be required to develop and maintain the following A&A required documents in accordance with applicable NIST Special Publications and/or GSA guidelines:

1. The System Security Plan shall be prepared no later than 90 days after award (Draft due 60 days after award), and updated annually or as system/environmental changes occur in accordance with the most current version of NIST Special Publication 800-18, Guide for Developing Security Plans for Information Technology Systems. The SSP shall include as appendices:

● A completed GSA 800-53 Control Tailoring worksheet included in Appendix A of GSA Procedural Guide - CIO IT Security 09-48 "Security Language for IT Acquisition Efforts". Column E of the worksheet titled "Contractor Implemented Settings" shall document all Contractor implemented settings that are different from the GSA defined setting and where the GSA defined setting allows a Contractor-determined setting);

● Required policies and procedures across 18 control families mandated per FIPS 200;

● Rules of Behavior;

● Interconnection Agreements (in accordance with NIST Special Publication 800-473):

● System architecture documentation;

● Network architecture diagram including IP addresses and subnets for individual devices;

NIST Special Publication SP 800-47 Guidance on System Interconnections

● List of web applications and web services, including descriptions and corresponding URLs;

● List of servers, including descriptions of the applications and information residing on each server;

● List of database management systems (e.g. Oracle, SOL Server, Sybase) including descriptions;

● Vulnerability scanning practices; and

● A Patch Management process.

2. Contingency Plan (including a Disaster Recovery Plan) - The contingency plan shall be prepared in accordance with NIST 800-34.4

3. Contingency Test, Test Plan, and Contingency Test Report shall be prepared in accordance with the most current version of GSA CIO IT Security Procedural Guide CIO-IT Security-06-29 (Contingency Plan Testing).5

4. Configuration Management Plan - The configuration Management Plan shall be prepared in accordance with the most current version of GSA CIO-IT Security Procedural Guide: 01-05 (Developing a Configuration Management)6.

5. Business Impact Analysis - Identify key business processes affected by different levels of disaster or service interruption and impact these services would have to GSA and its customers in the case of each scenario.

6. Business Continuity Plan - Identify key processes, personnel and relying systems that must be available in the case of a major disaster. Provide planning and recommendations for continuing service.

7. Plan of Actions & Milestones (POA&Ms) - Provide methodology for identifying, tracking and remediating POA&Ms.

8. Lessons Learned Report - This report shall contain any information including GSA's methodology that could improve the process.

4.5.3 HIGH IMPACT SYSTEM REQUIREMENTS

NIST SP 800-34 Guidance on Federal System Contingency plan development and application

GSA CIO IT Security Procedural Guide CIO-IT Security-06-29 (Contingency Plan Testing) GSA guidance on Contingency Plan testing GSA CIO-IT Security Procedural Guide: 01-05 (Developing a Configuration Management) GSA

Guidance on use and development of Configuration Management Guide

The Contractor shall provide at a minimum, plans, approximate timeframes, and methodologies for accomplishing each of the following milestones and components of a High Impact system:

● FIPS 199 High - [confidentiality, integrity, availability] at highest level of Interoperable agency customers are the driver (multifactor authentication for access and changes);

● Continuous monitoring by Contractor - at multiple levels (ie full packet capture, I/ E points from the accreditation boundary of the system);

● Root cause evaluation capability within a 3 hours;

● Controlled environments in accordance with FIPS;

● Publication controls and release controls limited to government approval only;

● Operation of the system based on FIPS 199 High Impact Level;

● Dedicated ISSO at Contractor;

● Full and complete DNSSEC tested implementation;

● Automated logging - (i.e. NIST controls - CM family and AU family);

● Tiered administrative override checks and balances;

● Automated process controls/not manual;

● Full test suite capabilities; and

● 24/7 on call technical support.

4.5.4 AUTHORITY TO OPERATE (ATO)

The Contractor shall provide evidence of their capability to obtain an Authority to Operate

(ATO) by the target transition date unless an ATO already exists, as approved by GSA in the

Contractor’s transition plan. The Contractor shall document and demonstrate that the registry, registrar, and related systems adhere to HIGH security controls as identified by the FISMA and any successor acts. The Contractor shall maintain all documentation supporting FISMA compliance and ensure that documentation and system controls remain current throughout the system life-cycle, in accordance with GSA OCIO-IT Security-09-48, “Security Language for IT

Acquisition Efforts7.”

Before operation, the Contractor shall obtain and maintain a valid assessment and accreditation (A&A) from the GSA Authorizing Official. All medium and high findings/vulnerabilities shall be remediated, or have appropriate mitigating compensations, before an accreditation decision by the GSA Authorizing Official. The Contractor shall ensure

GSA OCIO-IT Security-09-48, “Security Language for IT Acquisition Efforts - GSA’s IT Security

Guidance for systems.

that the documentation remains current throughout the system life-cycle. For any identified shortfalls, the provider shall document a plan of actions and milestones (POA&M) as well as outlining compensating and mitigating controls for approval by the GSA Authorization Official, COR, and any other Government representative designated by the COR.

In addition to the above, the Contractor shall employ code analysis tools to examine the software used for common flaws and document results in a Code Review Report. The Code

Review Report shall be submitted as part of the security authorization package (reference NIST

800-53 control SA-11, Enhancement 1 for additional details).8

The Contractor shall mitigate all security risks found during authorization and subsequent continuous monitoring activities. All high-risk vulnerabilities must be mitigated within thirty

(30) days and all moderate risk vulnerabilities must be mitigated within ninety (90) days from the date vulnerabilities are formally identified, unless otherwise approved by the government.

The Government will determine the risk rating of vulnerabilities.

Maintenance of the security authorization to operate will be through continuous monitoring of security controls of the Contractor's system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to GSA per the deliverable schedule. The submitted deliverables shall provide a current understanding of the security state and risk posture of the information systems and to allow GSA authorizing officials to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur.

4.6 TASK 6: REGISTRAR FEES AND SERVICES

The Contractor shall provide a system for collecting fees for services. Activities include, but are not limited to: assessing fees from customer agencies; issuing notifications of delinquent accounts; resolving credit card disputes and; coordinating financial transactions.

The Contractor will collect all fees from the entities directly, and all collected fees shall be kept by the Contractor. Collection of fees for domain registration applies only to new and annual renewals.

NIST 800-53 control SA-11, Enhancement 1 for additional details on all security controls)

The Contractor shall be responsible for management of the root .gov domain and registration of 2nd level domains only (for example, gsa.gov). Fees must only be assessed on 2nd level domains. Monies collected shall be recorded for review during government domain approval process, tracked, and reported to the government at a minimum quarterly (see "Quarterly Revenue Reports" in Section 4.1.5 above). For reporting purposes, fees from entities of the Federal Government (Legislative, Executive, and Judicial branches, and Native Sovereign Nations) will be flagged with a marker which is distinct from the non-federal entities (State and Local governments). The Contractor shall be responsible for collecting and processing fees for payment when registering a new domain name or renewing an existing domain name. Fees shall not be collected through PayPal portal as Federal agency credit cards cannot access PayPal.com.

Registrations are processed and approved based on established criteria, detailed in both the

Federal Networking Council Request For Comments (RFC) 2146, May 1997 and 41 CFR Part 102-

173, and in accordance with the guidance and direction of the .Gov Program Manager. Other policies that must be adhered to by agencies in the Federal Executive Branch include OMB

Memorandum M-11-24, M-05-04, and M-08-23.

The per-registration and renewal price shall comply with 41 CFR Part 102-173 “Internet GOV

Domain” (for the base year). Fees are set by the Government; presently, fees for both new registrations and renewals will be $400.00/year. The Contractor is encouraged to illustrate their use of commodity and industry best practices to provide cost-effective solutions for customer care and billing and payment processing for fee collection.

4.7 TASK 7: CONTINGENCY PLANNING IMPLEMENTATION AND TESTING

The Contractor shall develop a Contingency Plan which documents the strategy and testing focusing on service restoration and data recovery in the event of unforeseen circumstances

(See 7a - A&A Guidance). The Contingency Plan shall be prepared in accordance with NIST

800- 34 & GSA CI0-17 Security -06-29 {available from GSA-FAS-CIO via CD). Identify frequency and type of testing to be provided. For example, once a year, a tabletop exercise will be conducted followed by a true system test six months later and witnessed by GSA personnel.

4.8 TASK 8: DOMAIN NAME SYSTEM SECURITY (DNSSEC)

The Government's preference is for any incoming Contractor to follow the current DNSSEC security measures solution for the .gov TLD system. Current .gov DNSSEC implementation information is available at www.dotgov.gov under the DNSSEC tab. However, other solutions will be considered if they meet the DNSSEC standard, but any agencies current implementation should not be interrupted. There are approximately 1200 agency domains which have implemented DNSSEC. The Department of Homeland Security (DHS) will be advising GSA concerning DNS Security.

http://www.dotgov.gov/

Delegation holders may require limited technical assistance implementing DNSSEC in accordance with OMB policy. The current OMB policy is found at:

http:/www.whitehouse.gov/omb/assets/omb/memoranda/fy2008/m08-23.pdf.

The .gov Domain Name Registration Services shall include procedures for record signing and managing zone updates using a validated FIPS 140-3 level 3 solution to distribute and manage the .gov DNSSEC key infrastructure to the DNS administrator. The service should include, but not be limited to:

● Key management system for the root .gov domain, maintaining security delegation information for second level domains; automation distribution;

● Support of incremental updates to the zone and an automated rollover management;

● Acquiring additional bandwidth to support zone clearing; and

● Key archiving for the top-level .gov domain (i.e. .gov only and NOT the approximately

5,600 second-level .gov domains).

The service shall assist in maintaining the chain of trust by adding the ability to securely track and verify .gov domains and to allow the domain administrator to upload secure delegation material (DNSKEY RRs) to their parent zone. The automated support services should consist of:

testing; reporting; signing; release management; and notifications of configuration errors and expired signatures.

The Contractor shall maintain and update the current written procedures and develop sample agency implementation requirements for posting on the .gov website www.dotgov.gov under the tab entitled DNSSEC implementation. These written procedures must explain in detail the new DNSSEC implementation with detailed procedures on exactly what the current .gov registrants must do in order to comply with the DNSSEC implementation.

The DNSSEC solution was implemented by GSA in the .gov top-level domain in February

2009. The Contractor shall provide automated and manual technical support services to

Federal Agencies, State, County, Local and NSN Government Technical IT Staff to implement the DNSSEC Secure Naming Infrastructure for second level .gov domains. The support will be provided under the same time frame perimeters as Task 3 above. This will provide support for end user rollouts, upgrades, troubleshooting, and configuration with Federal, State, Local and NSN technical IT staff implementing the U.S. Government Secure Naming Infrastructure policies and procedures. The manual technical support services should consist of telephone support, signed name server configuration testing, troubleshooting, and rollout support as requested by end users through the GSA .gov Helpdesk.

The DNSSEC service must adhere to the guidance and/or standards outlined in the http://www.whitehouse.gov/omb/assets/omb/memoranda/fy2008/m08-23.pdf following publications:

● National Institutes of Standards and Technology's (NIST) Special Publication 800-53 revision 4, and 800-81 revision 2 (http:// http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf)

● NIST Special Publication 800-57 (parts 1, 2 and 3), Recommendation for Key Management - Part 1 :.General, Part 2: Best Practices for Key Management Organization, and Part 3, Application-Specific Key Management Guidance (http://csrc.nist.gov/publicati ons/PubsSPs.html)

● RFC 4033 R. Arends, R. Austein, M. Larson, D. Massey, S. Rose. DNS Security

Introduction and Requirements. October 10, 2004.

(http://www.ietf.org/rfc/rfc4033.txt)

● RFC 4034 R. Arends, R. Austein, M. Larson, D. Massey, S. Rose. Resource Records for the DNS Security Extensions. March 2005. (http://www.ietf.org/rfc/rfc4034.txt ).

● RFC 4045 R. Arends, R. Austein, M. Larson, D. Massey, S. Rose. Protocol Modifications for the DNS Security Extensions . March 2005. (http://www.ietf.org/rfc/rfc4045.txt)

In addition, the Contractor shall implement a DNSSEC deployment solution that:

● Supports RFC5155 (http://www.ietf.org/rfc/rfc5155.txt);

● Supports existing encryption algorithms and migration to newly specified algorithms;

● Supports DNSSEC-aware Utilities;

● Complies with FIPS 140-3 level 3 (www.csrc.nist.gov/publications/PubsFI

PS.html). Supports IPv6 (http://www.ietf.org/rfc/rfc2460.txt); and

● Ensures interoperability with IETF specified Internet protocols Supports Dynamic DNS updates that complies with NIST Special Publication 800-81 revision 2.

4.9 TASK 9: TRANSITION-IN / OUT SERVICES

Transition-In:

The Contractor shall present a transistion plan at the kickoff meeting on how it intends to transition in to the Registrar and Registry provider of the .Gov TLD. The plan will show at a minimum the following activity and milestones:

http://csrc.nist.gov/publications/PubsSPs.html) http://csrc.nist.gov/publications/PubsSPs.html) http://csrc.nist.gov/publications/PubsSPs.html) http://csrc.nist.gov/publicati http://www.ietf.org/rfc/rfc4033.txt) http://www.ietf.org/rfc/rfc4034.txt http://www.ietf.org/rfc/rfc4045.txt) http://www.ietf.org/rfc/rfc5155.txt) http://www.ietf.org/rfc/rfc5155.txt) http://www.csrc.nist.gov/publications/PubsFI http://www.ietf.org/rfc/rfc2460.txt).

http://www.ietf.org/rfc/rfc2460.txt).

Website cutover;

Zone files transition to include shadow, joint and sole operation period;

DNSSEC Activities and Key Rollover;

Billing;

Failover facility;

Resolution plan;

Transition-Out:

The Contractor shall perform all services necessary to transition the work performed under this task order to the Government or another Contractor at the conclusion of this task order. The transition shall be performed without any interruption or degradation in any services. The

Contractor shall perform all transition-out services necessary to provide a smooth and efficient transition.

The Contractor shall provide a draft Transition-Out Plan within ninety (90) days of contract award. The Government will work with the Contractor to finalize the Plan. The Contractor shall ensure the transition to the next Contractor is effectively facilitated and executed.

The Contractor shall provide Transition-Out support when required by the Government. The

Transition-Out Plan shall facilitate the accomplishment of a seamless transition from the incumbent to incoming Contractor/Government personnel at the expiration of the contract.

The Contractor shall provide a Transition-Out Plan to the Government and provide updates. The

Contractor shall identify, at a minimum, how it will coordinate with the incoming Contractor and/or Government personnel to transfer knowledge regarding the following:

a. Project management processes;

b. Points of contact;

c. Location of technical and project management documentation;

d. Status of ongoing technical initiatives;

e. Appropriate Contractor–to-Contractor coordination to ensure a seamless transition;

f. Transition of Key Personnel;

g. Schedules and milestones;

h. Actions required of the Government; and

i. A final invoice and close-out schedule with the dates and actions to be completed for contract close-out.

In addition, the transition plan must incorporate the following specific steps:

● A shadow operation of not less than thirty (30) days. During this period, the Contractor facilities shall not be connected but shall otherwise be fully operational and shall receive all inputs received by the incumbent.

● A joint operation of not less than thirty (30) days. During the joint operation period, the Contractor facilities shall be capable of being fully connected to the network both for resolution and provisioning and shall function transparently.

● A sole operation of not less than fifteen (15) days. During the sole operation period, the incumbent operator shall provide at least one site capable of full demand resolution and one site capable of provisioning.

GSA shall review the readiness of, and approve the cut-over timing for, registry and registrar responsibilities. Service level requirements must be satisfied upon transition. Unless otherwise directed by GSA, any deficiencies below the minimal requirement shall require a reversion of service back to the incumbent until such time that any deficiency is resolved to the satisfaction of the Government.

The Contractor shall also establish and maintain effective communication with the incoming

Contractor/Government personnel for the period of the transition.