PWS Attachment 3- B2B Gateway Implementation Plan and Questionnaire.pdf

DD FORM 1423-1, FEB 2001

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

PREVIOUS EDITION MAY BE USED.

Form Approved OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services and Communications Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

1. DATA ITEM NO. 2. TITLE OF DATA ITEM 3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.) 5. CONTRACT REFERENCE 6. REQUIRING OFFICE

7. DD 250 REQ

8. APP CODE

9. DIST STATEMENT

REQUIRED

10. FREQUENCY

11. AS OF DATE

12. DATE OF FIRST SUBMISSION

13. DATE OF SUBSEQUENT

SUBMISSION

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

Draft Final

Reg Repro

15. TOTAL

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

G. PREPARED BY H. DATE I. APPROVED BY J. DATE

Page of Pages

B2B Gateway Questionnaire

THP/HPOSB

B

See Block 16

See Block 16

See Block 16

See Block 16

0 0 0

16. REMARKS

FIRST SUBMISSION:

Frequency: As Required Reporting Period Start Date: Contract Award Due Date: Within 30 calendar days after contract award.

SUBSEQUENT SUBMISSION: CONTINUE FROM FIRST SUBMISSION

PHI/PII: No FILE FORMAT: No specified file format

CONTENT DETAILS:

The contractor shall complete the current version of the B2B Gateway Questionnaire (to be provided by DHA) identifying the required system communication infrastructure between the contractor and the MHS systems. This includes all Wide Area Network (WAN), LAN, VPN, Web DMZ, and B2B Gateway access requirements. The completed Questionnaire shall be returned to the DHA designated POC for review and approval. J-6 External Gateway Management (EGM) Program Office will coordinate any requirements for additional information with the DHA POC and schedule any meetings required to review the Questionnaire. The contractor shall provide DHA or the equivalent office with a copy of the approved and signed B2B Questionnaire for all system communication efforts.

Contract Reference: See PWS Paragraph 6.9.3.

Current B2B Questionnaire is attached with updates provided by the government as required.

/ /2024 / /2024

1 2

Orla do Januario Jr.Steven F Alvarado

Michael.Bilicki Cross-Out

Michael.Bilicki Cross-Out

Michael.Bilicki Cross-Out

CUI

CUI

DEFENSE HEALTH AGENCY

EXTERNAL GATEWAY MANAGEMENT – SERVER 2 SERVER SOLUTION

[COMMERCIAL VENDORNAME FOR SUPPORTED SYSTEMNAME]

2022 January 03 Version 1.0

Defense Health Agency CUI

B2B Implementation Plan v1.0 January 2022

CUI

CHANGE / REVISION RECORD

This record is maintained throughout the life of the document; each published update is recorded. A Change Package (re issue of changed pages only) carries change bars in the page margins to identify differences from the preceding issue. Due to the scope of change that necessitates a Revision (re issue of entire document); a Revision does not carry change bars.

DOCUMENT VERSION

NUMBER

REVISION SUMMARY DATE

Version 1.0 Post transition from DISA to DHA 01/03/22

CUI

TABLE OF CONTENTS

INTRODUCTION

DHA POLICY

GENERAL INFORMATION

DOD POC INFORMATION

VENDER PARNTER POC INFORMATION

APPENDIX A: SOFTWARE AND SETTINGS/HARDWARE REQUIREMENTS

APPENDIX B: SYSTEM PERFORMANCE REQUIREMENTS

APPENDIX C: VPN IMPLEMENTATION FORM

APPENDIX D: DHA B2B CONNECTIVITY REQUIREMENTS SUBMISSION

APPENDIX E: “AS IS” DIAGRAM

APPENDIX F: LAST MILE DIAGRAM

APPENDIX G: DEVICE PACKAGE SLIP

APPENDIX H: SITE ISSM APPROVAL

APPENDIX I: PROGRAMMANAGER APPROVAL

APPENDIX J: SECURITY APPROVAL

CUI

Introduction Defense Health Agency (DHA) oversees the Military Health System (MHS) Infrastructure and Operations (I&O). DHA is chartered to design, provision, and deploy a standard based, common telecommunications infrastructure throughout the MHS.

This information paper identifies the required parameters for Business Partners to connect to a DHA managed enclave, system, or Military Treatment Facility (MTF) remotely, leveraging DHA’s Server to Server (S2S) dedicated platform. This is one of two approved solutions for external access/management.

This is intended do the following:

Explain adherence to the DoD Guidelines for remoted access by appropriate partners Explain adherence to the policies of connectivity and device management for remoted access by appropriate partners Support the functional and technical requirements as designed for a given project Acknowledge through digital signature the agreed upon functional and technical requirements

In prioritizing security and confidentiality of DoD system resources and networks, the gateway approach is the standard for all non DoD resources to connect, communicate, and manage systems within the DoD. This is the recommended solution to ensure data and system resource security and confidentiality.

The following criterion depicts a S2S dedicated platform solution:

There is a single reference point for the partner affiliate into the DoD/DHA thus eliminating any back doors to the DoD MHS traffic can be more effectively managed Adheres to the DoD initiative to move away from partner (third party or non.mil) affiliates connecting directly to an MTF

This document is to serve as a template to identify the requirements of the sponsoring organization and the partner to DHA. Below will be detailed information that when completed will be used for:

Establishing necessary requirements of DHA resources Configuring the S2S dedicated platform router

CUI

DHA Policy

References: (a) Defense Federal Acquisition Regulation, DFARS 252.239 7010

(b) Defense Federal Acquisition Regulation, DFARS 252.204 7012

(c) Defense Federal Acquisition Regulation, DFARS Subpart 239.76

(d) Defense Federal Acquisition Regulation, DFARS Subpart 204.73

(e) Department of Defense Instruction (DoDI) 8582.01, “Security of Non DoD Information Systems Processing Unclassified Nonpublic DoD Information,” December 9, 2019

(f) Department of Defense Instruction (DoDI) 8500.01, “Cybersecurity,” Incorporating Change 1 October 7, 2019

(g) Department of Defense Instruction (DoDI) 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT),” Incorporating Change 2, July 28, 2017

(h) “Department of Defense Cloud Computing Security Requirements Guide,” Version 1 Release 3, March 6, 2017

(i) “Department of Defense Cybersecurity Activities Performed for Cloud Service Offerings,” November 15, 2017

(j) TRICARE Systems Manual (TSM 7950.1 M)

CUI

General Information

Project Information Request Type � New Connection(s)

Select “New Connection(s)” if this is a new source destination flow (connection).

� Changes/Updates to Existing Connection(s) Select “Changes/Updates to Existing Connection(s)” for updates to current connections.

� Decommission Connection(s)

NOTE: If “Changes/Updates” is selected then the connections in Appendix D will replace the current connections. If running in parallel is intended, please select “New Connections”.

Once fully migrated to the new connections, submit a request to decommission the old connections.

Connection Type:

What is Server to Server Allows continuous connectivity between the partner and DHA hosted servers. The commercial partner (vendor) will be required to procure and install a DHA configured and tested Cisco VPN router (Cisco ISR) on its premise at all appropriate locations. The device (which will be remotely managed by DHA) will provide a controlled entry/exit point and an encrypted pathway for all communications between the commercial partner and its DHA hosted system(s). System to system communications are defined as automated processes between two systems that require always on connectivity.

eMASS # (DHA ID for the system with which the support team is communicating.)

Provided by DHA Site ISSM. ID # can be found on .mil side’s ATO

Project Name (Vendor Name to MHS Name)

[Vendor] in support of [Contract or Contractual Requirement]

Program Office HPOSB Description:

What is this for?

This S2S solution will allow [vendor] to remotely support [Project Name] (additional details)

Requested by Date: ?I would like this completed by?

Critical need Date: ?I NEED this completed by?

CUI

DoD POC Information

Please complete the following:

DoD Organization Name Phone E Mail Government POC Sponsoring the B2B Gateway Connection

Dr. Steven Alvarado 303.676.3523 steven.f.alvarado2.civ@health.mil

HPOSB Support Ms. Sandra (Sandy) Baugh (303) 676 3904 sandra.j.baugh.ctr@health.mil

HPOSB Support Ms. Jowanna (Jo) Patterson (303) 676 3748 Jowanna.patterson.ctr@health.mil

Contracting Officer/COR System ISSM DHA B2B ISSM Mr. Eric Wildermuth 703.681.1145 Eric.R.Wildermuth.civ@health.mil

DHA B2B Project Manager

Mr. Edward R. Chaplin Jr. (854) 444 5594 edward.r.chaplin.civ@health.mil

DHA B2B Project Lead

Mr. Orlando Januario Jr. (210) 295 3599 orlandojr.januario.civ@health.mil

DHA B2B PM

Support

B2B Distro Use email dha.ncr.ops sustain.list.b2b phase2@health.mil

DHA B2B Cyber Support

S2S ISSM – Mr. Eric Wildermuth S2S ISSO – Mr. Jay Dwight C2S ISSM – Mr. Stephan Worcester C2S ISSO – Mr. Stephen Baker

Use email

Use email Use email

Use email eric.wildermuth2.civ@health.mil james.h.dwight4.ctr@health.mil stephan.p.worcester.civ@health l.mil stephen.d.baker38.ctr@health.mil

DHA

Implementation / engineer teams

Enterprise Network Systems Management

Data Center Operations Support

Use email

Use email usn.jbcharleston.niwcatlanticsc.list.hss e ens@health.mil dha.jbcharleston.j 6.list.dcops support@health l.mil

DHA Global Service Center

MHS Helpdesk

MHS Helpdesk Chat:

GSC Online Services Portal:

MHS Service Helpdesk:

(800) 600 9332 dha.jbsa.j 6.mbx.mhs service desk@health l.mil https://chat.gsc.health.mil/ https://gsc.health.mil https://mhsservicehelpdesk.serviceno wservices.health.mil/

Your POC position Your POC position

CUI

Vendor Partner POC Information

Please complete the following:

Organization Name Phone E Mail

PM

Application /System Engineer Network Administrator Security Manager Network Manager

Organization Name Phone E Mail Procedures Help Desk Contact Information After Hours Support Contact Information

Organization Address:

Physical Device Location: {NOTE: Be sure to include the full address, building, room, and rack where the MHS router node will be deployed}

CUI

Appendix A: Software and Settings/Hardware Requirements

For Server to Server Connections:

The commercial partner will be required to purchase one of the following Cisco device(s) for their location(s):

Question Response Less than 5Mb Between 5Mb 30Mb Between 30Mb 300Mb

ISR 1111x ISR 4331x ISR 4451x CSR 000v variable based on license and circuit availability

Also, please make certain to provide (on Appendix F) 2 public IP addresses for each device to be installed.

Note: The Cisco pubs indicate higher bandwidth capabilities for models noted above; however, the Cisco figures are under ideal conditions (UDP, low overhead, etc.). These considerations were evaluated by the DHA engineers and factored in the configurations and other overhead/loading factors (noted above). If you opt to select the next lower/smaller model, then there is a potential risk of overloading the device, which will require the procurement of a replacement with the next higher model.

A 3 year maintenance agreement and required; at minimum the Security PAK (i.e., SL 44 SEC K9) and the AppX licenses (i.e., L SL 44 APP K9) on top of IP base. This allows Cisco to bring the appliance into DHA’s Smart License account. If you are unsure of your actual throughput requirement, DHA recommends the HSEC license be also purchased.

Also, please make certain to provide (on appendix C, section 4.) two public IP addresses [external and RLOC] for each appliance to be installed.

CUI

Appendix B: System Performance Requirements

Project Name Program Office HPOSB Project POC Dr. Steven Alvarado

System (Third Party Partner) to System (MHS) Requirements Subject Matter Metric

Expected screen refresh time Expected response time Expected % availability uptime Meantime between failure Meantime to repair Sustained throughput requirement Max packet loss acceptable Max latency Expected bandwidth between systems Peak bandwidth requirements Other Other Other Other Other

CUI

Appendix C: VPN Implementation Form Project Name Program Office HPOSB Project POC Dr. Steven Alvarado

Last Mile Information – WAN Access

Gov Sponsor: Please check the following for the .MIL side of the connection:

Question Answer

1. Who is your Internet Service Provider? (Please Specify)

2. Assessment and Authorization: What is the name of the system in eMASS that contains the .mil side of the connection? (Please attach Authorization Determination Document for the ATO) a.

DODI8510 program applies to my system and / or DODI8582.01 program applies to my system

Commercial partner: Please check the following for the .COM side of the connection:

Question Answer

1. Who is your Internet Service Provider? (Please Specify)

2. Assessment and Authorization: What is the name of the system in eMASS that contains the .mil side of the connection? (Please attach Authorization Determination Document for the ATO) a.

DODI8510 program applies to my system and / or DODI8582.01 program applies to my system

CUI

Network Boundary Information

1. What are the Interfaces of the Border Router?

Interface IP Address Subnet Mask Default Gateway

2. What are the External and DMZ Interfaces of the Firewall?

Interface IP Address Subnet Mask Default Gateway

3. What is the Network Space between the Firewall and Border Router where the Cisco ISR will be installed?

a. Ensure the Network between the Firewall and the Border Router has sufficient address space to support splitting the network.

b. Ensure the Bit Boundaries are valid and are NOT CROSSED when splitting into smaller subnets.

IP Network/ Mask Subnet Mask

4. What are the new Network Addresses for the Cisco ISR device?

External Interface Subnet Mask Default Gateway

Primary ISR Secondary ISR

RLOC IP Subnet Mask Default Gateway Primary ISR 255.255.255.255 NA Secondary ISR 255.255.255.255 NA

Internal Interface Subnet Mask Default Gateway Primary ISR Secondary ISR Floating

Note 1: For HA setup, each device would require a unique External, Internal and RLOC IP address. One additional floating Internal IP is required for VRRP failover.

Note 2: All IP addresses for the ISR need to be publicly routable. Private address space using a NAT is not permitted.

Note 3: RLOC IP addresses should be /32 addresses and not a part of the subnet used by the External or Internal interfaces.

CUI

5. What are the new Network Addresses for supporting your Warm DRE ISR device?

External Interface Subnet Mask Default Gateway

Primary ISR Secondary ISR

Note 1: In the event a vendor cannot maintain a fully functional DRE circuit a small bandwidth (10 – 30 Mbps) circuit is required. DHA requires connectivity to all ISR devices at any given time to maintain the configuration and IOS updates. This is a STIG requirement. The secondary interface on the ISR will be used and it will require an additional IP address on a different subnet from the main WAN interface.

Firewall Specifics/Proxy Servers

Please check the following:

Question Yes No

1. Is this site using Network Address Translation (NAT) Static (1 to 1)?

Defense Health Agency

The information contained in this document is of a sensitive nature to the Department of Defense. The reader shall not disclose such information to any person or entity except employees and affiliates who have a need-to-know and who have been informed of the reader’s obligations under this paragraph.

Appendix D: DHA B2B Connectivity Requirements Submission

Reference “Converted Appendix D v2” excel workbook (Separate document) Highlight rows for test flows Orange Highlight rows for production flows Green Application – what is the supported system called Description – what does the application do IP Protocol – TCP or UDP Service – well named port service name (i.e., HTTPS) Low port – if ranged, what is the starting port number (i.e., 8530) High port – if ranged, what is the highest port number (i.e., 8531) Source server – host/machine name Source server IP – IP address of server Destination server – host/machine name Destination server IP – IP address of server Destination site location – Base; Post; Station name/MTF name/DECC/CAP Connection – flow source; .com or .mil

Include workbook with questionnaire in email package submission

The information contained in this document is of a sensitive nature to the Department of Defense. The reader shall not disclose such information to any person or entity except employees and affiliates who have a need-to-know and who have been informed of the reader’s obligations under this paragraph.

Appendix E: “As Is” Diagram

High level diagram of how your enterprise connects to the internet

The information contained in this document is of a sensitive nature to the Department of Defense. The reader shall not disclose such information to any person or entity except employees and affiliates who have a need-to-know and who have been informed of the reader’s obligations under this paragraph.

Appendix F: Last Mile Diagram

Internet

Lan Switch

Inside Interface IP __.__.__.__ Cisco ISR

External IP __.__.__.__ Subnet Mask __.__.__.__

RLOC IP __.__.__.__/32

Internal IP __.__.__.__ Subnet Mask __.__.__.__External Interface

IP __.__.__.__

Server Network

Network Address __.__.__.__ Subnet Mask __.__.__.__

The information contained in this document is of a sensitive nature to the Department of Defense. The reader shall not disclose such information to any person or entity except employees and affiliates who have a need-to-know and who have been informed of the reader’s obligations under this paragraph.

Appendix G: Device Package Slip

INCLUDE THIS DOCUMENT INSIDE THE CISCO ISR SHIPPING PACKAGE

Name of Project

Point of Contact (POC)

Name of Company ATTN: POC Name

ADDRESS

Contact Number

Email

Device Serial Number

Device Model

Shipping Tracking Number

NOTE:

(Please send and expect to receive appliance from the contact and address below for configuration:

ATTN: NSOC WAN – Doug Auton DHA Warehouse 2202 Commissary Rd., BLDG 4188, Bay D, RM3 Ft Sam Houston, TX 78234 210 808 2927

After shipment, please send a copy of this appendix to DHA B2B PM Support at <dha.ncr.ops sustain.list.b2b phase2@mail.mil>.

The information contained in this document is of a sensitive nature to the Department of Defense. The reader shall not disclose such information to any person or entity except employees and affiliates who have a need-to-know and who have been informed of the reader’s obligations under this paragraph.

Appendix H: Site ISSM Approval (For all connections, i.e., add/remove/modify)

Information Assurance Manager B2B Implementation Approval

As the Site ISSM for [appropriate program office or installation], I have reviewed the appropriate documentation and provide the approval to proceed as planned.

TYPED NAME

PROGRAM OFFICE

SIGNATURE DATE

The information contained in this document is of a sensitive nature to the Department of Defense. The reader shall not disclose such information to any person or entity except employees and affiliates who have a need-to-know and who have been informed of the reader’s obligations under this paragraph.

Appendix I: Program Manager Approval (For all connections, i.e., add/remove/modify)

Program Manager B2B Implementation Approval

As the Government Sponsor or Program Manager for [HPOSB], I have reviewed the appropriate documentation and vendor certification. I provide the approval to proceed as planned.

Dr. Steven Alvarado_______________________________________________________

TYPED NAME

The information contained in this document is of a sensitive nature to the Department of Defense. The reader shall not disclose such information to any person or entity except employees and affiliates who have a need-to-know and who have been informed of the reader’s obligations under this paragraph.

Appendix J: Security Approval (For all connections, i.e., add/remove/modify)

Vendor Partner Security Manager B2B Implementation Approval

As the Security Manager of the [VENDOR partner], I have reviewed the appropriate documentation and provide the approval to proceed as planned.

TYPED NAME

APPLICATION NAME DESCRIPTION IP PROTOCOL SERVICE LOW PORT HIGH PORT SOURCE SERVER NAME SOURCE SERVER IP SOURCE SERVER NAT ENS Provided

DHA/EQU

NAT IP

ENS Provided

DESTINATION

SERVER NAME

DESTINATION

SERVER IP

DESTINATION

SERVER NAT

ENS Provided

DESTINATION

SITE LOCATION

CONNECTION

SOURCE

Eg. BDMS Eg. Blood Donor

Management Server Eg. TCP Eg. SFTP Eg. 22 Eg. 22 Eg. Comm Vault xxx.xxx.xxx.xxx Provided by NSOC RSM team If Applicable Eg. INSIGHT SERVER xxx.xxx.xxx.xxx

Provided by

NSOC RSM

team Eg. NMC San

Diego Eg. .COM/.MIL CT Application Prod Application

Key:

CT Connections Prod Connections

Phase II Environment Type

(paired with S2S solution for_Commercial vendor_ B2B Gateway Questionare) test flows production flows