IDC_SOW_8_19.pdf

Statement of Work Draft This draft is based on our existing EIS contract with updates for areas that I have knowledge of.

There were other aspects of the EIS contract that are outside of my scope and may need to be covered by other subject matter experts (Project Management/Task Orders/Transition Planning

ETC.)

There are currently two data centers, one in Ashburn, VA and one in El Segundo, CA, currently support under the AOUSC’s EIS contract. This contract is currently with (Vendor) that works as an intermediary between the AOUSC and the IDC owners. This contract will expire in July of 2029. These data centers are geographically dispersed to guarantee that a disaster in one IDC will not affect the remaining IDC so that during a disaster traffic can be routed to the other data center to avoid outages. The awardee/contractor shall support services consistent with current IDC deployments and all required services under task orders that may be awarded for the two locations. Requirements include but are not limited to moves, changes, additions, and disconnects of services to the AOUSC. The awardee/ contractor shall maintain the two data centers with both remaining fully operational and available 24 x 7 x 365 per year.

The awardee/contractor shall provide space, power, cooling, and network connectivity at the two IDCs to support the AOUSC’s internally provided Infrastructure-as-a-Service and Platform-as-a-Service offerings. Additionally, the awardee/contractor will provide services in support of the following AOUSC-managed services from the IDCs;

• High Speed Internet Access

• Dedicated high speed connectivity between IDCs

• Session Initiated Protocol (SIP) Trunking

• Redundant high speed Local Area Network, Server Area Network (LAN/SAN)

Infrastructure

• Redundant security infrastructure across multiple security zones

• Network Time Protocol

• Domain Name Services (Internal and External DNS)

• Simple Mail Transfer Protocol (SMTP)

• Secure Remote Access (Remote Access VPN, IPSEC/SSL)

• Identity Management and AAA Services

• Wireless LAN

• External Content Delivery Service

• Voice over Internet Protocol

• Video Teleconferencing Services

• Application Delivery Services

• National Logging Service

• DDOS

The services listed above are managed internally and directly by AOUSC. The requirements in the SOW include the EIS services and the Service-Related Labor (SRL) components necessary to support the infrastructure to continue providing those services with the expiration of the current EIS contract. While there are no requirements for Managed Network Services (MNS) or other managed services under the expiring EIS contract, the AOUSC is not opposed to some level of managed services with any new offering. AOUSC will still require majority internal management of our systems.

The AOUSC currently manages the Judiciary’s national infrastructure and application resources which are hosted in two data centers, referred to as the IDCs. In addition to providing a trusted and secure Internet gateway, the data centers provide colocation services and internet connectivity to the various AOUSC program offices in their support of a variety of national information technology (IT) initiatives and operational programs.

The following description of network/Internet routing is provided so the provider of the IDC services will have a broad and complete understanding of the routing. However, only IPS and associated Internet routing in and out of the two IDCs are the subject of this requirement. The VPNS connectivity between the IDCs and the various court locations and the associated VRFs/routing over the VPNS services is not part of this requirement.

The AOUSC advertises all Internet routes out of each IDC with Border Gateway Protocol (BGP) metrics used to determine the preferred IDC and preferred circuit within a data center. Traffic is routed from each court location geographically. In general, courts located east of the Mississippi River (judicial circuit headquarters in Boston, New York, Philadelphia, Richmond, Cincinnati, and Atlanta) are routed to Ashburn as their primary data center, while courts geographically west of the Mississippi River (judicial circuits in New Orleans, Chicago, St Louis, Denver and San Francisco) are routed to San Diego.

Current Internet traffic loads are equal at each IDC. However, in a failover scenario, the remaining IDC is required to handle the traffic load of the entire Judiciary. See Figure C-3 for the latest IPS Network Map.

Connectivity

The awardee/contractor shall provide Ethernet Transport Service (ETS) in accordance with EIS level services. ETS E-Line services with ports and EVC speeds to meet or exceed core level requirements. The main purpose of ETS under this request is to interconnect the two IDCs as well as CSP connectivity. These high-speed connections are required to support large volumes of data transfers and storage synchronization.

The awardee/contractor shall provide dynamic alternate path routing in the event a portion of the ETS services becomes unavailable due to maintenance, outages, a break in connections or any other issue that causes those services to become unavailable.

The awardee/contractor shall provide advance notice of at least 7 days notification via e-mail to the contracting officer (CO), contracting officer representative (COR), and ordering officials of any planned maintenance or outage that will result is the service being unavailable. Any awardee/contractor provided customer portals will all include that information.

The awardee/contractor shall provide long-haul path diversity when using two E-Line EVCs between locations. Other options are also acceptable, including E-LAN, EVPL, Carrier Ethernet, Cloud Direct Connects and must include path diversity. The primary path shall be the shortest path with the least number of hops between the two IDCs. The alternate path may take a different route.

The contractor shall provide Telecommunications Service Priority (TSP) for service restoration for the ETS installed at the IDCs.

Performance

• CONUS latency of < 55 ms

• 99.99 critical availability of the ETS service

• Internet Access (IDC and all circuits) providing overall availability of 99.999%

Connectivity

• Internet Access to the IDCs

• High speed IPS connections o Separate cross-connects o Redundancy/High Availability

• TSP required for all IPS connections

Technical

• Automated IDC Internet failover using BGP routing protocol and metrics

• Active/Active Internet connections within and across the IDCs

• Automated failover between IPS connections within an IDC based on BGP routing metrics

• Automated Internet failover between IDCs based on BGP routing metrics

• Default routes, partial routes, full Internet routing table, or any combination to the U.S.

Courts

• Routing protocol support for IPv4 and IPv6: BGP, Multi-protocol BGP, and OSPF

• Fourteen (14) publicly available IPv4 Class C address blocks, with appropriate Geo

Location identification

• Four (4) publicly available IPv6 ranges, with appropriate Geo Location identification

• Carrier diversity — two or more carriers with physically diverse entry points

• Fiber path diversity — separate conduits, separate long-haul routes

• Dual long-haul transport types — MPLS + DWDM, or E-Line + wavelength

• Redundant edge routing platforms — dual routers per IDC, no single point of failure

• Dual DNS architectures — internal + external resolvers with failover

• DDoS protection integration — carrier-based + cloud-based scrubbing

• Zero-trust segmentation — micro-segmentation for east/west traffic

• Cloud Direct Connect / ExpressRoute / Fast Connect diversity

• Out-of-band management network — physically isolated OOB network for survivability

Co-located Hosting Service

The Contractor’s CHS solution shall provide the AOUSC a secure location with cage, racks, power, cooling, and site surveillance. The Contractor shall provide access for equipment installed or to be installed in these cages/racks to external connections specified in other sections of this solicitation such as IPS and ETS, as well as other connections the AOUSC may bring to the IDCs outside of the scope of this solicitation. The Contractor shall provide maintenance support and operational support as needed.

• Dual power feeds from separate utility substations

• Redundant UPS systems (N+1 or 2N)

• Generator redundancy with on-site fuel storage

• Cooling redundancy (N+1 or 2N HVAC)

• Fire suppression systems (VESDA, clean agent)

• Physical security controls (badging, biometrics, mantraps)

• Rack density planning (high-density zones for hyperconverged/cloud gear)

• Structured cabling standards (Cat6A, OM4/OM5 fiber)

• Cross-connect diversity

AOUSC Current IDC Cage Space

• Multiple adjacent cages

• A pod-based layout

• High-density zones for compute clusters

• Separate cages for security segmentation

• 3500–4000 lbs load rating

• High-density cooling zones for these racks

• Secure receiving

• Quarantine area

• Burn-in/testing zone

• Temporary storage for migration waves

• High-density cooling support (liquid cooling optional)

• Hot aisle / cold aisle containment

• Dual power feeds per rack

• A/B power distribution units (PDUs)

• Structured cabling standards (Cat6A + OM4/OM5 fiber)

• Seismic bracing (depending on region)

• Cable tray diversity (overhead + underfloor)

• Rack depth requirements (42–48 inches for modern gear)

• Minimum cage height clearance for overhead busways and fiber trays

Power Requirements

The Contractor shall support the following power requirements:

• Power in N+1 redundancy (Service, UPS, Generators, Feeds, Panels) to each rack

• Power density to support at least 250W per square foot with rack densities up to 20KVA for fully equipped racks

• N+1 or 2N UPS redundancy

• Generator-backed power with fuel reserves

• Per-rack power density requirements (10–20 kW/rack minimum)

• High-density zones up to 30–40 kW/rack

• Smart PDUs with remote monitoring

• Power metering per circuit

The Contractor shall provide sufficient breakers to meet the requirements for powering the systems/servers within the AOUSC CHS environment based on the current inventory and will support any growth in the power needs resulting from systems/servers added to the environment. Power will be available to AOUSC equipment at least 99.999% of the time each month

The Contractor shall support the following standard power types:

• 110 Volt, 20 Amp, Single Phase

• 110 Volt, 30 Amp, Single Phase

• 208 Volt, 20 Amp, Single Phase

• 208 Volt, 30 Amp, Single Phase

• 208 Volt, 20 Amp, Three Phase

• 208 Volt, 30 Amp, Three Phase

The Contractor shall support the following non-standard power types:

• 208 Volt, 50 Amp, Single Phase

• 208 Volt, 60 Amp, Single Phase

• 208 Volt, 50 Amp, Three Phase

• 208 Volt, 60 Amp, Three Phase

Cooling Requirements

• N+1 or 2N cooling redundancy

• CRAC/CRAH diversity

• Support for rear-door heat exchangers

• Support for liquid cooling loops (optional)

• Temperature and humidity SLAs

• Hot and cold aisle configuration

• 24 hours per day, 7 days per week, and 365 days per year temperature and humidity monitoring and alerting for any faults including reduced airflow, ambient temperature in each rack/row at height of intake

• Ability to support fully equipped racks (1 Pair 208v-60a-3ph 40% per leg = 17.3KVE per rack)

• Ability to support power and cooling to 250w per square foot (actual consumption) or 500w per square foot (delivered)

• Emergency cooling apparatus available within 10 minutes of degradation of service event

• Redundant HVAC systems

• Proper Humidity controls

• Non-compliance will entitle AOUSC to HVAC or Environmental Control SLA credits

• Real Time read only access to any vendor monitoring portals for temperature and power status, not just notification of failures

• Water detection and suppression systems

• Fire detection and suppression response

• Security systems o Access control o Cage-level badge access o Biometric access (optional) o Mantrap entry o 24/7 CCTV with retention capabilities o Visitor escort requirements o Audit logging for cage access

Internet Protocol Voice Services –

• Support for 60k current VOIP endpoints and scalable growth to 100K endpoints

• Provide SIP-based IP Trunk services interoperable with any PBX supporting SIP trunk interfaces

• Provide redundant SIP TRUNKING across both IDCs with automated failover for inbound and outbound calls.

• Support 2000 concurrent calls per circuit and provide one 200MB Ethernet circuit per IDC per 2000 concurrent calls.

• Provide Ethernet handoff and interoperability with Acme Packet Session Border

Controllers.

• Support local, long-distance, and international calling.

• Support porting of 80,000–100,000 telephone numbers with minimal downtime.

• Provide active/active SBC clusters in each IDC with automated failover across

IDCs.

• Support TLS/SRTP encryption, SIP normalization, SIP OPTIONS health checks, and

SIP overload control.

• Provide dual Call Manager clusters with automated failovers and support for multi-site dial plans.

• Provide QoS enforcement, MOS scoring, jitter/latency SLAs, and real-time SIP monitoring.

• Support STIR/SHAKEN, CNAM, LIDB, DID blocks, toll-free numbers, and emergency services routing.

• Provide centralized logging, SIEM integration, and 24/7 NOC monitoring.

• Support full disaster recovery failover between IDCs, including call control, voicemail, and unified messaging.

Equipment Installation

• Follow structured cable standards, ensure proper cable management, and validate A/B power feeds prior to installation.

• Install equipment in alignment with hot/cold aisle containment and high-density cooling zones.

• Validate fiber path diversity, install cross-connects, and support optical equipment turn-up.

• Maintain cage access logs, escort third-party vendors, and ensure compliance with physical security requirements.

• Update rack elevations, CMDB records (aligned to CSDM), and asset tags after each installation.

• Perform power, network, SIP, and BGP failover testing as required.

• Follow AOUSC change control processes, update runbooks, and meet defined SLAs for installation tasks.

• Support secure receiving, burn-in testing, spare parts management, and chain-of-custody documentation.

• Ensure compliance with FISMA, CJIS, SOC 2, ISO 27001, and OSHA equipment handling standards.

Hardware and Tape Administration

The Contractor shall provide full tape system administration and maintenance services, including tape library hardware support, tape media lifecycle management, secure tape handling, backup/restore operations, compliance enforcement, and inventory tracking.

The Contractor shall:

• Perform preventive maintenance on tape drives, robotics, and library controllers.

• Conduct periodic cleaning, calibration, and firmware updates of tape hardware.

• Maintain tape inventory, scratch pools, and lifecycle tracking in accordance with

AOUSC standards.

• Enforce chain-of-custody procedures for all tape movements, including vaulting, transport, and destruction.

• Perform quarterly restore tests to validate tape integrity and backup recoverability.

• Support backup software integration, tape library configuration, and connectivity validation.

• Ensure compliance with FISMA, CJIS, SOC 2 Type II, ISO 27001, and AOUSC retention policies.

• Provide secure storage, handling, and disposal of tapes and failed tape media.

• Document all tape operations in the AOUSC ticketing system and update CMDB records as required.

Statement of Work Draft