ePS_RFP_Attach_27_Managed_Services_and_Commercial_Cloud_Hosting_and_Services_PWS_20170307.docx

PMW 220

PMW 220 Plan Template

File name:

PMW220_ Plan_Template_v1p0

Page:

2/39

Version:

Version 1.0

Date of Creation

11 Apr 2015

Managed Services and Commercial Cloud Hosting and Services (CCHS)

File name:

ePS_RFP_Attach_27_Commercial_Cloud_Hosting_and_Services_PWS.docx

Page:

17/17

Version:

Version 1.0

Date of Creation:

07 Mar 2017

Electronic Procurement System Request for Proposal Attachment 27: Managed Services and Commercial Cloud Hosting and Services (CCHS) Performance Work Statement (PWS)

Acquisition Category (ACAT 1) Version 1.0 7 March 2017

Distribution Notice D: Authorized to the Department of Defense (DoD) and DoD Contractors only. This document is for administrative or operational use, as of the date of approval for this document. Refer to the Program Manager (PM), PMW 220 Navy Enterprise Business Solutions (Navy EBS), Program Executive Office Enterprise Information System (PEO EIS), Washington Navy Yard, 1325 10th St. SE, Bldg. 196, Washington, D.C. 20374 for additional document requests.

Handling and Destruction Notice: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document.

N00039-17-R-0002

Table of Contents

Document History

Background and Introduction The Prime Contractor shall host, integrate, operate, and maintain the ePS in a Commercial Cloud Hosting Service (CCHS). The Prime Contractor shall provide all of the necessary services and infrastructure (applications, data, runtime, middleware, operating system, virtualization services, compute, storage and networking) including the Non-classified Internet Protocol (IP) Router Network (NIPRNet) peering point location to support the ePS Program. The Government will be responsible for the application Assessment and Authorization (A&A), with support from the Prime Contractor.

Objectives The objectives of commercial cloud hosting and services are as follows:

· To obtain secure cloud services that enable scaling of infrastructure and application resources to meet evolving application and user demand

· To have daily visibility into resource usage and performance

· To provide services that meet Service Level Agreement (SLA) thresholds and to set up and receive notifications when thresholds are not met Scope The Prime Contractor shall provide managed services and commercial cloud hosting and services that include general cloud computing requirements, application support, cloud service management, hosting requirements, technical services, authorization of hosting and technical services, impact level migration, and hosting migration in order to host an Information Impact Level 5 (IL5) application.

The Prime Contractor shall deliver a cloud hosting environment capable of meeting Department of Defense (DoD) IL5. (Impact levels are defined in the most current version of the DoD Cloud Computing Security Requirements Guide (CCSRG)).

For cloud services that are not NIPRNet based, the cloud service hosting provider must be connected through a cloud access point (CAP) provided either by Defense Information Systems Agency (DISA) or another DoD component. The CCSP shall have a signed DoD Provisional Authorization (DoD PA) for IL5 prior to award.

The Prime Contractor shall also deliver and leverage Technical Services to enable cost-savings. If included within the CCSP, then the Technical Services shall also be included in the CCSP Navy Authority to Operate (ATO) Authorization package. If separate from the CCSP, then the Technical Service Offering shall obtain its own Navy ATO. The Prime Contractor will provide all necessary support, services, and testing evidence for the Government to complete the Navy A&A package and obtain a separate Navy ATO for the ePS application. The ePS ATO will inherit security controls from the Cloud Service Authorization package and any Technical Services that the application uses. The Government must obtain a Navy Interim Authorization to Test (IATT) prior to installing the ePS application into the Cloud for integration and testing efforts. The ePS application must achieve Navy ATO before it can be installed into the Cloud for production.

The ePS is a High Impact System as defined in National Institute of Science and Technology (NIST) Federal Information Processing Standards (FIPS) Publication 199 and must accommodate Unclassified Navy Nuclear Propulsion Information (UNNPI) and commercial proprietary information.

The Prime Contractor shall provide the necessary Random Access Memory (RAM), compute, storage and networking required for all of the ePS components such as the Contract Writing System (CWS), Enterprise Service Bus (ESB), Business Intelligence (BI), and vendor portal through the CCSP. This will be for each of the ePS environments including integration, pre-production, production, disaster recovery, training, mock-conversion and break/fix. All pre-production and production environments will be IL5.

For information on data base sizing see “Attachment 25: Legacy System Data Statistics.”

Requirements The Prime Contractor shall provide all of the necessary services (applications, data, runtime, middleware, operating system, virtualization services, storage and networking) including the commercial side of the NIPRNet peering point location to support the ePS Program.

The Prime Contractor shall identify which services are provided by the Prime Contractor (CLIN 0044 Managed Services) versus those provided by the Commercial Cloud Service Provider (CCSP) (CLIN 0045 Commercial Cloud Hosting and Services).

The Prime Contractor shall provide all the necessary services to support IL5 data.

The Prime Contractor shall provide a DoD PA for IL5 CCSPs, which shall be maintained for the duration of the contract.

All requirements shall be performed in accordance with the ePS Performance Work Statement (Attachment 1).

General Cloud Computing Requirements The Prime Contractor shall provide a Cloud Computing solution that aligns to the Department of Defense (DoD) Cloud Computing Security Requirements Guide (CCSRG), “Cloud Computing, Cloud Service, and Cloud Deployment Models.”

Application Support The Prime Contractor Shall:

1. Analyze and provide written assessment of the overall ePS requirements as documented in the Capabilities Requirements Document (CRD) and System Requirements Specification (SRS), including the System Performance Measures (SPMs) and other System Attributes (CDRL A043 ePS Service Level Agreement (SLA) Analysis and Assessment)

a. Provide technical architecture detailing hosting requirements for each software component in each environment to include but not limited to (CDRL A004 Baseline Description Document):

i. Computing Requirements such as quantity CPU, RAM, type chipset supported, OS supported

ii. Networking Requirements such as VLANs, Ports and Protocols, bandwidth requirements, latency requirements, load balancer requirements

iii. Storage Requirements for application and data such as Input/Output per Second (IOPS)

iv. Any requirements for application or application integration that would not be typically available in a commercial cloud environment

v. Technical architecture - the Prime Contractor shall maintain a set of technical architecture diagrams and descriptions of the cloud hosting environment. The diagrams shall be inclusive and illustrative of combining multiple services such as, compute, storage, and networking to solve the ePS Cloud Service requirements.

2. Prepare and provide a presentation of the separation of responsibilities and decomposition of the E2E SPMs into SLAs for the Prime Contractor and the CCSP (CDRL C002 Presentation Materials) to the ePS Program Management Office (PMO)

3. Submit the final Prime Contractor SLA (CDRL A044 ePS Master Service Level Agreement) that will be approved by the Government and incorporated by modification to the contract

4. Coordinate with the CCSP and install, configure, and integrate application components

5. Conduct integration, testing, and deployment efforts in the cloud hosting environment in accordance with applicable SLAs

6. Prepare itemized CCSP Hosting cost reports in accordance with the instructions contained in the most recently approved versions of Data Item Descriptions (DIDs), and in accordance with DoD Instruction 5000.02 and DFARS 252.234-7003 “Notice of Cost and Software Reporting System” and DFARS 242.234-7004 “Cost and Software Data Reporting System” (CDRL C013 Cost Data Summary Report, C014 Functional Cost-Hour Report, C015 Contractor Business Data Report).

Validated Cryptography The Prime Contractor shall use only cryptographic mechanisms that comply with FIPS 140-2 “Security Requirements for Cryptographic Modules,” as specified in the CCSRG.

Non-Repudiation The Prime Contractor shall provide a system that implements DoD Public Key Infrastructure (PKI) authentication which provides for origin authentication, data integrity, and signer non-repudiation.

Audit Record Retention The Prime Contractor shall:

1. Provide a system in accordance with the requirement for Federal agencies to manage their electronic records in accordance with 36 Code of Federal Regulations (CFR) § 1236.20 & 1236.22 (ref. a), including but not limited to capabilities such as those identified in:

a. DoD STD-5015.2 V3 (ref. b), “Electronic Records Management Software Applications Design Criteria Standard”

b. National Archives and Records Administration (NARA) Bulletin 2011-03, December 22, 2010, “Guidance Concerning the use of E-mail Archiving Applications to Store E-mail” (ref. c)

c. NARA Bulletin 2010-05 September 08, 2010, “Guidance on Managing Records in Cloud Computing Environments” (ref 8)

2. Maintain records to retain functionality and integrity throughout the records’ full life cycle including:

a. Maintenance of links between records and metadata

b. Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records, in accordance with NARA-approved retention schedules Identification and Authentication (Organizational Users) Multi-Factor Authentication The Prime Contractor shall:

1. Provide a secure DoD-approved, multi-factor method of remote A&A to identified Administrators that will allow designated personnel the ability to securely perform management duties on the system

2. Provide multi-factor authentication including DoD PKI implementation Incident Reporting The Prime Contractor shall report all computer security incidents in accordance with CCSRG, section 6.4, “Cyber Incident Reporting and Response” and the ePS Security Plan. The Prime Contractor shall also notify the ePS Government Cybersecurity Lead, COR, and the PCO. (CDRL A045 Cybersecurity Incident Response Reports) Media Transport The Prime Contractor shall:

1. Offer a bulk data import and export service for moving large amounts of encrypted data both into and out of the cloud service in accordance with DoD Policy. Bulk data movement includes the ability to physically ship datasets via traditional express-mailing techniques (for example, FedEx, United Parcel Service [UPS] and United States Postal Service [USPS]).

2. Document activities associated with the transport of Federal agency information stored on digital and non-digital media and employ cryptographic mechanisms to protect the confidentiality and integrity of this information during transport outside of controlled areas.

3. Encrypt digital media containing Federal agency information that is transported outside of controlled areas using FIPS 140-2 level 3 (or other DoD-approved encryption mode), must be secured using the same policies and procedures as paper.

4. Ensure accountability for media containing Federal agency information that is transported outside of controlled areas in accordance with all applicable DoD and DON standards.

5. Encrypt federal agency data that resides on any devices (e.g., external hard drives, and SD cards) using DoD PKI encryption. All federal agency data residing on laptop computing devices must be protected with NIST-approved encryption software.

Protection of Data at Rest The Prime Contractor shall provide security mechanisms for handling data at rest and in transit in accordance with DoD and DON-approved encryption policy.

Security Alerts, Advisories, and Directives The Prime Contractor shall provide a list of their personnel, identified by name and role, with system administration monitoring, and/or security responsibilities that are to receive security alerts, advisories, and directives. This list shall include the Cybersecurity team.

Cloud Service Management The Prime Contractor shall:

1. Perform Cloud Service Management services to centrally manage, track, and report cost and performance data for the ePS application hosted within one or more CCSPs. This section specifies the management activities in support of the CCSP.

a. CCHS Plan. The Prime Contractor shall incorporate cloud hosting services activities and milestones into the Integrated Program Management Report (IPMR). (CDRL C016 Integrated Program Management Report (IPMR))

b. Impact Plan. The Prime Contractor shall provide an Impact Plan (CDRL C021 Impact Plan) describing the procedure for delivery of contracted services and data to the Government in the event of corporate merger, acquisition, divestiture, change in service provider(s), a threat, or other instances that have potential to result diminished availability that fails the contracted SLAs. In the event of a divestiture or bankruptcy, the maximum advanced written and telephonic notice to the Procuring Contracting Officer (PCO) and Contracting Officer Representative (COR) is required to implement the Impact Plan or otherwise permit the Government to obtain its data.

c. Monitor Performance and Manage Alerts and Reporting. The Prime Contractor shall continuously monitor performance and provide alerts and reports for cloud hosting services. This shall include, but not be limited to the following activities (CDRL C001 Status Reports):

i. General health and availability

ii. Provide automatic monitoring of resource utilization and other events such as failure of service, degraded service, etc. via service dashboard or other electronic means

iii. SLA performance

iv. Security Management Portal

v. Configuring real time alarms and alerts

vi. Active service summary

vii. Provide visibility into usage metering using metrics and granularity appropriate to the type of service

viii. Offer a real-time performance-monitoring service that must be accessible from a service interface or the management console and not require that the PMO build its own performance-monitoring hooks or integration points. The services shall support monitoring of the following:

a. Compute metrics: CPU utilization, memory utilization disk I/O and network I/O

b. Storage metrics: Utilization, IOPS and queue length

c. Network metrics: bandwidth and packet loss

d. Load-balancer metrics: request latency and connection count

ix. Offer the ability to receive alerts when a performance-monitoring threshold is reached or exceeded within one minute of the threshold occurring (at a minimum CPU, memory, or disk utilization)

d. Monitor and report on Resource Provisioning and Utilization. The Prime Contractor shall monitor resource provisioning and utilization, and provide cost metering and controls (CDRL C014 Functional Cost-Hour Reports). These capabilities include, but are not limited to the following:

i. Historical utilization for all resources (CPU, memory, storage)

ii. Price breakdown per unit consumed per day/month/year

iii. Customizable reports to group resources by user command, application, and server (as examples)

iv. Set alerts for utilizations and costs thresholds

e. Price and Billing Requirements: the Prime Contractor shall meet the following pricing and billing requirements:

i. The Prime Contractor shall allow the Government to download or receive electronic detailed bill reports that list costs on a line-by-line basis. The detailed bill shall itemize each individual billable item and allow the Government to perform analytics on which cloud assets are contributing to cloud costs.

ii. The Prime Contractor shall offer the Government itemized bills/invoices that are based on groups or metadata tags

iii. The Prime Contractor shall ensure that the Government has visibility into how much spend has been accrued to allow the Government the ability to scale and meet financial targets during the billing period

iv. The Prime Contractor shall provide a self-service capability for the Government to generate e-mail or SMS alerts based on Government -defined financial thresholds

v. During the time that a service is unavailable, the Government shall not be charged for the use of that service. SLA deductions shall be negotiated and applied as mutually agreed between the parties in accordance with the terms of the contract.

vi. The Prime Contractor shall count all non-Government-initiated downtime events as outages, no matter how the downtime occurs. This means that any scheduled, announced, planned, unplanned, or malicious events, all count against documented SLAs. The Prime Contractor shall ensure that downtime calculations begin immediately when the downtime starts.

Hosting Requirements This section provides specific commercial cloud computing services and hosting requirements.

Service Management Requirements The Prime Contractor shall provide:

1. SLA Management. A service offering that meets or exceeds the threshold SPMs (Table 1) and other System Attributes (Table 4) per the CRD (Attachment 3)

2. Operational Management. Manage the network, storage, server, and virtualization layer, to include performance of internal technology refresh cycles

3. Disaster Recovery (DR). Operate a DR service which provides DR architecture and processes, to provide full planning, annual testing to include an annual test report, and execution of a managed disaster recovery solution encompassing applications, systems, and environments. The DR shall meet the requirements in Table 4 of the CRD (Attachment 3). (CDRL A005 Test Report)

4. Data Management

a. Ensure data segmentation and isolation in a multi-tenant environment

b. Transfer data back to Government either on-demand or in case of contract termination for any reason in accordance with paragraph 4.2.6. “Media Transport”

c. Provide a Cryptographic Key Management Plan (CDRL C024 Key Management Plan) for managing the DoD PKI keys used to encrypt storage volumes. The keys shall not be managed by the CCSP. Any/all cryptographic keys associated with the encryption of ePS data shall be retained and accessible only by Navy employees or authorized Prime Contractor personnel. The Prime Contractor shall ensure that all data within the Cloud is encrypted in accordance with the Cryptographic Key Management Plan.

CCSP Baseline Requirement The following criteria are baseline requirements for all CCSPs. The Prime Contractor shall:

1. Ensure that connectivity and transport is implemented in accordance with DoD Cloud Computing Security Requirements Guide (CCSRG) and DoD Cloud Connection Process Guide

2. Provide Hosting environments for hosting of IL5 data

3. Ensure that each individual CCSP has and maintains, for the duration of the contract, a valid and appropriate DoD PA in accordance with current DoD CCSRG

4. Provide on-demand, self-service provisioning of compute instances and storage volumes

5. Develop solution(s) for ensuring secure remote management of assets in order to facilitate remote access to cloud hosted technologies (e.g., Secure Shell (SSH), Remote Desktop Protocol (RDP). This is inclusive of service consoles, mission owner containers and systems. The solution shall include the design, implementation, configuration, operation, and management for remote access connectivity.

6. Provide support to the government to ensure the ePS applications are accessible through the NIPRNet

7. Provide pay-per-use pricing via a web-based tool to model pricing for services (e.g., per hours, per GB/month) Compute Requirements The Prime Contractor shall:

1. Provide rapid provisioning and de-provisioning of resources, which includes, a workflow capability for the Government to approve requested resources prior to deployment. The workflow must clearly identify costs associated with the resources being requested.

2. Provide instance maintenance/failure notifications to the Government Storage Requirements The Prime Contractor shall:

1. Storage Sizing. Provide sufficient storage for ePS requirements

2. Storage Performance. Ensure storage components/attributes (e.g. Input/Output Operations Per Second (IOPS), RPO, RTO, port processors, SAN latency, SAN bandwidth, write caching, snapshots, snapclones), and facilitate achievement of threshold and objective system attributes as specified in Table 4 of the CRD (Attachment 3) Backup and Restore The Prime Contractor shall:

1. Provide daily full database backups and hourly database archive log backups for all ePS databases, and weekly full and daily differential backups of non-database file systems. All backups must be performed at both the primary site and the alternate (DR) site.

2. Provide an underlying physical storage environment that retains the full backups on separate physical device than the primary storage for the active database and non-database file systems

3. Ensure all full backups complete within 24 hours

4. Ensure all full restores complete within 24 hours

5. Backup retention for full backups will follow grandfather, father, son cycle of:

a. Daily full backups for 60 days

b. Thereafter weekly full backups for 6 months

c. Thereafter every 4 weeks full backups for 1 year

6. Backup retention for incremental backups will be retained for 30 days, providing point in time recovery for databases as far back as 30 days

7. Provide capability to restore individual database tables for a period of 30 days

8. Provide a backup solution that supports an annual growth rate (data protected) of 30% for 10 years once data has entered sustainment phase

9. Ensure that backup resource requirements (e.g., network utilization, compute resources, etc.) do not adversely impact the system performance. The active host server and associated storage shall have sufficient compute resources (CPU, Memory, I/O) available to support both application and backup requirements simultaneously.

10. Backups shall be encrypted using the same cryptographic key management framework as that required for database and file system storage volumes

11. Backup virtualized server images

12. Ensure operational availability of the backup and restore solution in accordance with the CRD Network and Transport Requirements The Prime Contractor shall:

1. Build LAN topology according to DoD and DON Cybersecurity policy, which includes, but is not limited to:

a. The ability to design hierarchical network infrastructure in the hosting environment and choose a private IP addressing scheme, without dependency on having instances in place at the Prime Contractor.

b. The ability to design the following network components and layouts prior to deploying any compute instances:

i. Firewalls

ii. Subnet or VLANs

iii. VPN

iv. Network address translation (NAT)

v. Load-balancing

2. Offer the ability to connect instances in accordance with DoD CCSRG, at a minimum:

a. Provide two different virtual network interface cards (NICs) and routing networks simultaneously

b. Support at least two network segments

3. Offer network segments that are fully isolated and not routable externally

a. Instance configurations must exist that can reside only on these isolated network segments and without having any public IP address or internet routing

b. An instance must be able to be deployed with only a private-facing network address, or the Contractor shall allow for customers to remove a public-facing network address

4. Provide Static IPs and if a computer instance is dynamically assigned an IP address, that address must remain the same across the lifetime of the instance

5. Offer network segments that are fully isolated and routable externally in accordance with the DoD CCSRG

6. Offer network segments that provide for demilitarized zone (DMZ) access from the internet via the NIPRNet

7. Support the ability to load-balance front-end (external-facing) instances and back-end instances (instances with private IP addresses or where the traffic is passed from compute instance to instance)

8. Have the ability to configure global load-balancing where requests are directed to endpoints that may be located in different data centers. These endpoints can be different front-end load-balancer pools.

9. Operate a proactive monitoring and management service that provides configuration management of cloud service provider components for networking, firewalls, virtual private networking (VPN), subnets, access control lists (ACLs), and virtual networks Management and Development Operations Requirements The Prime Contractor shall:

1. Offer the ability to the Government to monitor the health of the infrastructure (at a minimum compute, storage, and network) and send an alert if a failure occurs.

2. Log provisioning and catalog actions. In this case, "provisioning" refers to both the provisioning (creation) and de-provisioning (termination) of infrastructure elements. The log service shall include, but is not limited to:

a. Logging provisioning events for compute instances

b. Logging provisioning events for storage volumes

c. Logging when changes are made to the ePS image catalog (e.g., adding, deleting or updating an image)

d. Logging when changes are made to the ePS template catalog (e.g., adding, deleting or updating a template)

3. Log security configuration changes, at a minimum:

a. Changes in network ACLs

b. Changes in firewall configurations

4. Offer the access to the provisioning logs. Logs shall be provided by default for at least twelve months, and customers shall have the ability to export these logs for longer retention.

Technical Services Technical Services shall be provided by the Prime Contractor or the CCSP; or coordinated with existing DoD capability (e.g. Online Certificate Status Protocol (OCSP), Simple Mail Transfer Protocol (SMTP)). The Prime Contractor shall specify which services are shared. All services shall meet current STIG and CTO requirements. Technical services include, but are not limited to: (A002 DOD Risk Management Framework (RMF))

1. ePS Application Administration

2. Database Administration

3. Operating System Administration

4. ESB / Middleware Administration

5. Network Administration

6. Network Time Protocol (NTP)

7. Domain Name Service (DNS)

8. Active Directory (AD)

9. OCSP

10. SMTP

11. Secure File Transfer

12. Remote Administrative Access

13. Patch Management

14. Malware Protection (e.g. Host Based Security System (HBSS), Assured Compliance Assessment Solution (ACAS)) (CDRL A005 Test Report)

15. Audit Logging Aggregation and Correlation Services in accordance with CCSRG Authorization of Hosting and Technical Services Policy for the acquisition and consumption of commercial cloud services is provided in the Navy Enterprise Cloud Computing Strategy document. All Navy cloud services must be brokered through a Managed Service Organization (MSO) also referred to as the “Cloud Broker.” Program Executive Office for Enterprise Information Systems is the Navy’s MSO.

All Navy contracted CCSPs must meet security requirements aligned to the Risk Management Framework (RMF) to ensure that all data is hosted is a secure and defendable network. These requirements include approval from the Federal Risk and Authorization Management Program, and Provisional Authority from Defense Information Systems Agency.

The Prime Contractor shall:

1. Cooperate with the Navy to obtain Authority to Operate (ATO) from NAO for any Technical Services that are not authorized in the CCSP’s ATO:

a. Risk Management Framework (RMF). Cooperate with the ePS Cybersecurity team to develop an A&A Package for ePS (CDRL A002 Risk Management Framework (RMF)).

b. Experienced Personnel. In support of this task, provide personnel who are experienced in the assessment process required to satisfy the RMF Security Controls applicable to the system under review.

c. Additional Information. Enter such artifacts as are required to the Navy Enterprise Mission Assurance Support Service (eMASS) application under direction of the ePS Cybersecurity Lead.

d. Ensure the solution shall also meet contracted DoD Cloud Security Requirements Guidance, DoDI 8520.03, “Identity Authentications for Information Security,” DoD Cloud Connection Process Guide (CCPG), DoD CCSRG and DoD Security Technical Implementation Guides (STIGs) applicable to technologies implemented. This requirement applies to all Impact Level environments.

Impact Level Migration The Prime Contractor shall:

1. Prepare a plan for migrating the ePS data and applications from one Impact Level to another within the same CCSP (e.g. IL5 to IL4) (CDRL C022 Impact Level Migration Plan)

2. Execute the migration after the Option exercise (CLIN 0046 Impact Level Cloud Migration) (Optional)

3. Ensure all IL5 data is destroyed and not released

4. Document the destruction according to the approved methods identified in the Navy Telecommunications Directives and DON CIO Memorandum of August 2012, and the Key Management Plan (CDRL C022 Impact Level Migration Plan) Hosting Migration The Prime Contractor shall:

1. Submit a hosting migration plan for the transition of the ePS application software and data, to include but not limited to software, data, backups, accounts, documentation, and disposal of electronic data, as required. The plan shall include mitigation of impact to operational availability, including baselining data at the target data center and applying near real time changes to the target data center data stores in order to shorten the downtime to operations (CDRL C023 Hosting Migration Plan).

2. Execute the plan as directed (CLIN 0047 Hosting Migration) (Optional)

3. Ensure all data is destroyed and not released

4. Document the destruction according to the approved methods identified in the Navy Telecommunications Directives and DON CIO Memorandum of August 2012, and the Key Management Plan (CDRL C023 Hosting Migration Plan) Data Storage Location Storage of data shall be in accordance with DFARS 252.239-7010(b)(3).

Government Furnished Software The Government will furnish licenses for ACAS and HBSS. As part of the managed hosting environment, the Prime Contractor shall provide and manage an instantiation of HBSS including anti-virus IAW DoD policy on all virtual machines, to support the customer’s virtual machines, and implement a secure (encrypted) connection between the HBSS agents and the control server.

Government will furnish software license key(s) for HBSS software which the Prime Contractor may then download from the DISA site, at no expense to the Prime Contractor. The software is for use only on Prime Contractor servers supporting the contract, and the licenses shall be removed upon completion of the contracted work.

For Official Use Only N00039-17-R-0002 image1.png image2.png image3.png