Attachment 1 - Performance Work Statement Network Operations & Support Center (NOSC)

Solicitation Number: SSN26-7571-IHSNOSC

CONTENTS

1 Purpose

2 Background

3 Contract Objectives

4 Scope of Work

5 Performance

5.1 Contract Type

5.2 Period of Performance

5.3 Place of Performance

5.4 Federal Holidays

5.5 Travel

6 Tasks

6.1 Contract Management

6.2 Network Engineering and Modernization

6.3 Telecommunication Service Management

6.4 Network Event and System Monitoring

6.5 Cloud Network Connectivity

6.6 Firewall & Security Appliance Management

6.7 Network Vulnerability Management

6.8 System Security and Compliance

6.9 Network Operations Support Center (NOSC) Service Desk

6.10 Network Automation and Tool Administration

6.11 Network Device Configuration

6.12 Network Inventory Management and Reporting

6.13 Hosted VoIP Administration Support

7 General Requirements

7.1 Scheduled Outages for Network Upgrades

7.2 Internet Protocol version Six (IPv6)

8 Contract Administration

8.1 Authorities of Government Personnel

8.2 Technical Monitoring, Inspection and Acceptance

8.3 Contract Transition Plan

8.4 Special Terms and Conditions

8.5 Contract Deliverables

Appendix A: Reference Materials and Technical standards

Appendix B: System Environment

Appendix C: Service Level Objectives (SLO)

1 PURPOSE

The purpose of this contract is to obtain contractor support to operate, secure, and modernize the Indian Health Service (IHS) network infrastructure, ensuring reliable and secure access to critical administrative and health IT systems that enable the delivery of patient care.

The contractor shall provide qualified and experienced network engineering and operations personnel to support the design, implementation, modernization, troubleshooting, and continuous improvement of the IHS network environment. All services shall be performed in full compliance with applicable Federal cybersecurity and information security requirements, including but not limited to the Federal Information Security Modernization Act (FISMA), National Institute of Standards and Technology (NIST) standards and guidance, Department of Health and Human Services (HHS) and IHS security policies and procedures.

The contractor shall ensure the confidentiality, integrity, and availability of IHS information systems and data through the implementation of secure network architectures, continuous monitoring, incident response support, vulnerability management, and adherence to federal risk management and reporting requirements.

The Contractor shall furnish all necessary personnel, supervision, and related support resources required to meet program objectives. Network support services shall be provided 24 hours per day, 7 days per week (24x7x365) to ensure operational continuity and rapid resolution of connectivity issues.

2 BACKGROUND

The IHS is an agency within the Department of Health and Human Services (HHS) and is responsible for providing Federal health services to American Indians and Alaska Natives.

The provision of health services to members of Federally recognized tribes grew out of the special Government-to-Government relationship between the Federal Government and Indian tribes. The IHS is the principal Federal health care provider and health advocate for Indian people, and its goal is to raise their health status to the highest possible level. The IHS provides a comprehensive health service delivery system for approximately 2.6 million American Indians and Alaska Natives who belong to 574 Federally recognized tribes in 37 states.

The IHS healthcare delivery system is composed of 12 administrative Area Offices which oversee local Service Units. Each Area Office has the responsibility for operating the IHS program within a designated geographical region. Their administrative duties include budget, operation, personnel and property management, program planning and implementation tribal affairs, community development, statistical monitoring, grants and contract management, and environment program direction. Health care is provided at the Service Unit level through the IHS itself, through tribally operated facilities, urban programs or through the contract health services program. Additional information on the organizational structure is available on the agency web site at the URL below.

• https://www.ihs.gov/aboutihs.

In support of the agency mission, the Office of Information Technology (OIT) manages the design, implementation and support of Information Technology (IT) solutions for the agency. The IT solutions are based on a common architecture that incorporates Government and industry standards for the collection, processing and transmission of information. IHS hospitals and clinics increasingly rely on IT applications and services to deliver patient care, meet regulatory compliance and to operate efficiently. In addition, IHS is actively expanding the use of Telehealth technology to modernize healthcare delivery and improve access to care.

Additional information on the IHS Office of Information Technology is available on the agency web site - https://www.ihs.gov/OIT/.

3 CONTRACT OBJECTIVES

Vision: Provide a secure, reliable, and high-performing network, enabling IHS healthcare professionals to deliver exceptional patient care.

Mission: To provide enterprise network operations, engineering, and support services that ensure secure, reliable, and high-performing network connectivity for IHS staff to deliver healthcare services and improved patient outcomes.

The objective of this contract is to ensure the IHS enterprise network operates as a secure, resilient, and highly available infrastructure capable of supporting mission-critical healthcare operations. Specific contract objectives include:

https://www.ihs.gov/aboutihs https://www.ihs.gov/OIT/

• Provide the engineering and operational expertise required to modernize the network architecture, seamlessly integrate new technologies and support the evolving technological needs of the IHS mission.

• Maintain secure network connectivity and operations processes in compliance with federal cybersecurity requirements.

• Deploy resilient network connectivity to interconnect IHS facilities, data centers, cloud services, and healthcare partner organizations.

• Provide rapid detection, response, and resolution of network incidents affecting healthcare operations.

• Provide effective administration and support for enterprise cloud hosted voice and unified communications services.

• Leverage automation, AIOps, and advanced monitoring capabilities to improve operational efficiency, reduce manual effort, and enable proactive identification and resolution of issues.

4 SCOPE OF WORK

This contract provides enterprise network operations, engineering, and support services through a Network Operations and Support Center (NOSC). The Contractor shall deliver operational, engineering, and technical support for the IHS enterprise network infrastructure to have secure, reliable, and high-performance connectivity in support of mission-critical healthcare operations.

The Contractor shall provide all personnel, technical expertise, tools, and operational support necessary to monitor, manage, secure, troubleshoot, and continuously improve the enterprise network environment. The scope of this contract includes the following functional areas:

• Network Infrastructure Operations. Support for enterprise network infrastructure, including:

o Routing and switching devices and associated management systems o Wireless networking infrastructure, including controllers, access points, and authentication systems o Network security infrastructure, including firewalls, intrusion prevention systems, and related security platforms

• Telecommunications and WAN Services. Management of Wide Area Network (WAN) connectivity and telecommunications services, including:

o MPLS, Internet, wireless, satellite, SD-WAN, and SASE technologies o Circuit provisioning, installations, moves, adds, and changes o Coordination with telecommunications service providers and incident management

• Cloud Network Connectivity. Support for network connectivity and integration with cloud service providers, including:

o Microsoft Azure and Oracle Cloud Infrastructure environments o Secure connectivity solutions such as ExpressRoute, FastConnect and IPsec tunnels o Integration of cloud networking with on-premises infrastructure

• Network Monitoring, Operations, and Service Desk. Operation of network monitoring and management capabilities, including:

o Operation of the Network Operations Support Center (NOSC) Service Desk o Continuous monitoring of network performance, availability, and security o Incident detection, response, escalation, and resolution

• Voice and Collaboration Services. Support for voice communications infrastructure, including:

o Cloud-hosted unified communications platform o Voice circuit incident management reporting to telecommunication providers

• Automation, Tools, and Data Management. Implementation and management of network management tools and automation capabilities, including:

o Network monitoring and management applications o Automation and orchestration tools o Data collection, reporting, and dashboard capabilities to support operational visibility and decision-making

• Network Engineering and Modernization. Support for the design, testing, and implementation of new technologies and enhancements to the network infrastructure, including:

o Network architecture and design o Technology evaluation and proof-of-concept testing o Deployment of new and upgraded network capabilities

The Contractor shall support both the existing network infrastructure and new and evolving technologies deployed as part of ongoing network modernization initiatives throughout the period of performance. All services shall be performed in a manner that maintains network availability, security, and performance in support of IHS healthcare delivery operations.

5 PERFORMANCE

5.1 CONTRACT TYPE

The contract type is a Firm Fixed Price (FFP) contract.

5.2 PERIOD OF PERFORMANCE

The contract period of performance shall be one 12-month base-year with four 12-month option periods.

5.3 PLACE OF PERFORMANCE

As IHS shall not provide office space for the Contractor’s staff, the Contractor shall furnish the necessary facilities for the contractor’s staff to perform the work specified in the PWS.

The locations for the IHS managed data center are shown below.

• 5600 Fishers Lane, Rockville, MD 20857.

o This is also the address for IHS headquarters with approximately 600 staff connected to the network.

• 1011 Indian School Road NW, Albuquerque, NM 87104.

The locations of IHS area sites are shown at the URL below.

• https://www.ihs.gov/locations/

5.4 FEDERAL HOLIDAYS

A list of federal holidays can be found at the URL below.

• https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

As IHS operates multiple hospitals providing services 24-hour per day, 7-day per week (24x7), the Contractor shall provide network support services on a 24x7 basis to monitor and remediate network connectivity issues that may occur.

5.5 TRAVEL

Travel within the continental United States may be required in rare circumstances in support of the tasks within this PWS. All travel will require approval of cost by the COR and in accordance with the Federal Travel Regulation (FTR).

https://www.ihs.gov/locations/ https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

6 TASKS

6.1 CONTRACT MANAGEMENT

High Level Objective: IHS requires a comprehensive contract management framework, supported by qualified personnel, standardized processes, and effective quality assurance to ensure consistent delivery of network operations services, successful project execution, and continuous service improvement throughout the contract lifecycle.

• The Contractor shall have a staffing plan and management structure to consistently provide the required services, manage projects, produce deliverables and complete contract administrative tasks.

• The Contractor shall staff the contract with the relevant technical skillsets, experience and team structure to manage and perform the tasks specified in the PWS for the duration of the contract.

• The Contractor shall provide a working environment and remuneration package to retain and motivate staff performance for the duration of the contract.

• The Contractor shall update and enhance staff knowledge and skillsets as network technology, security threats and cloud network services evolve during the life of the contract.

• The Contractor shall incorporate Information Technology Infrastructure Library (ITIL) Service Management principles in all aspects of service management and improve service maturity.

• The Contractor shall use a Quality Control Plan (QCP) to measure quality and timeliness in executing the tasks specified in the PWS.

• The Contractor shall document customer Service Level Objectives and verify delivery through relevant performance measures.

• The Contractor shall plan, monitor and report on all projects and major activities.

• The Contractor shall provide all contract deliverables on schedule.

6.2 NETWORK ENGINEERING AND MODERNIZATION

High Level Objective: IHS requires continuous improvements to the network architecture through the adoption of new network technology and telecommunication services to support the agency's mission to deliver comprehensive healthcare services.

• The Contractor shall design and implement new technology and enhance network management capabilities to modernize the network infrastructure, improve security and increase operational efficiency.

• The Contractor shall analyze the functionality, performance, reliability and security posture of network components and provide recommendations on changes and improvements to increase network reliability.

• The Contractor shall create conceptual and detailed target state architectures to describe changes that would improve performance, add functionality and increase resiliency.

• The Contractor shall create network reference designs to standardize wired and wireless networks at area sites and data centers.

• The Contractor shall perform proof-of-concept testing to validate design assumptions and vendor claims on functionality and interoperability.

• The Contractor shall create implementation schedules and test plans for the deployment of new and enhanced network technology.

• The Contractor shall incorporate new network technology into 7x24 support and monitoring processes.

6.3 TELECOMMUNICATION SERVICE MANAGEMENT

High Level Objective: IHS requires comprehensive telecommunications service management across a diverse portfolio of connectivity solutions to ensure optimal performance, cost-effectiveness, and reliability in support of mission-critical patient care delivery.

• The Contractor shall manage telecommunication service additions, moves, and disconnections which may be the result of a change in requirements or service transfer between telecommunication providers due to contract changes.

o Telecommunication services are acquired through various contract vehicles and provided through multiple providers.

• The Contractor shall staff all telecommunication service activations and implement the required configuration on network devices.

• The Contractor shall report circuit issues to telecommunication providers and escalate based on telecommunication provider Service Level Agreements (SLA).

• The Contractor shall measure and report network circuit utilization to identify congestion, forecast future bandwidth needs and to report networks readiness to support new services.

• The Contractor shall measure uptime for each circuit to provide network availability metrics per site and overall network.

• The Contractor shall proactively notify IHS sites about scheduled circuit maintenance events planned by telecommunication providers.

6.4 NETWORK EVENT AND SYSTEM MONITORING

High Level Objective: IHS requires operational excellence to proactively identify and resolve network issues before they impact patient care and provide transparent customer communication on network status.

• The Contractor shall implement comprehensive monitoring of the network infrastructure to detect conditions that impact network connectivity and proactively identify deviations from normal operating levels. The monitoring must be capable of detecting both hard failure conditions and performance degradation that could affect healthcare applications and services.

• The Contractor shall configure, support, and enhance the network management tools, proactively identifying areas for improvement and optimization.

• The Contractor shall monitor the network infrastructure continuously to detect circuit and equipment issues that would impact functionality or degrade performance.

• The Contractor shall initiate immediate corrective actions with third-party vendors such as circuit providers or hardware manufacturers.

• The Contractor shall manage the progress of third-party vendors in their efforts to implement corrective actions and escalate based on vendor service level agreements.

• The Contractor shall proactively communicate network status, maintenance windows, and expected resolution times to IHS staff impacted by network connectivity issues.

6.5 CLOUD NETWORK CONNECTIVITY

High Level Objective: IHS requires seamless and secure network connectivity with authorized cloud service provider environments hosting IT applications and services that are required to support daily operations.

• The Contractor shall manage and maintain secure, reliable, and high-performance network connectivity to the agency's cloud service providers which currently includes Microsoft Azure and Oracle Cloud Infrastructure.

• The Contractor shall configure and support virtual network components within cloud provider Infrastructure-as-a-Service (IaaS) environments.

• The Contractor shall configure and support IPsec, ExpressRoute and FastConnect connections to cloud provider networks.

• The Contractor shall manage and configure the agency Secure Access Service Edge (SASE) environment and integrate with the agency network.

6.6 FIREWALL & SECURITY APPLIANCE MANAGEMENT

High Level Objective: IHS requires secure, reliable, and compliant operation of firewall and security appliances through effective configuration, monitoring, maintenance, and continuous improvement to protect network infrastructure and sensitive data.

• The Contractor shall design, implement and support advanced threat defense capabilities on firewall and security appliances, including intrusion prevention, malware and vulnerability protection, data loss prevention (DLP), and decryption, to detect and prevent cybersecurity threats and unauthorized access to the IHS network.

• The Contractor shall maintain firewall and intrusion prevention configuration rules, signature sets and patch levels to ensure a coherent defense-in-depth security posture is maintained.

• The Contractor shall configure network firewalls and routers to access the IHS network using Internet Protocol Secure (IPsec) tunnels. In some cases, the Contractor shall configure both the IHS side and the remote side of the IPsec tunnel connection at tribally managed IHS sites.

• The Contractor shall troubleshoot connectivity issues related to access and performance issues over the IPsec tunnel connections.

• The Contractor shall follow all policies and procedures mandated by the IHS Division of Information Security on firewall configuration management.

• The Contractor shall support the IHS Division of Information Security during incident response investigations.

• The Contractor shall configure and support inline security appliances required for traffic inspection and port mirroring by the Division of Information Security.

• The Contractor shall perform annual firewall configuration audits to identify unused, duplicated and non-compliant rules that could expose the IHS network to cybersecurity threat.

6.7 NETWORK VULNERABILITY MANAGEMENT

High Level Objective: IHS requires effective processes to manage security vulnerabilities on network devices and network management applications to prevent unauthorized access to the IHS network and protect access to patient information. The Division of Information Security shall provide the Contractor with weekly vulnerability reports identifying affected network devices and systems for review and action.

• The Contractor shall remediate vulnerabilities (e.g., patching, configuration hardening) on network devices and network management applications in accordance with established timelines and security policies.

• The Contractor shall mitigate all Critical and High vulnerabilities within the timelines defined in the Division of Information Security Vulnerability Management Plan.

• The Contractor shall maintain and update Plans of Action and Milestones (POA&Ms) for all unresolved vulnerabilities, including risk characterization, remediation status, and expected completion dates.

• The Contractor shall report vulnerabilities that cannot be remediated within required timelines and recommend risk-based mitigation strategies or compensating controls.

• The Contractor shall support security audits and assessments by providing vulnerability status, remediation evidence upon request.

• The Contractor shall track and report vulnerability trends, recurring issues, and systemic risks, and recommend improvements to reduce the overall vulnerability posture.

6.8 SYSTEM SECURITY AND COMPLIANCE

High Level Objective: IHS requires an authorized Authority to Operate (ATO) for the network infrastructure, ensuring compliance with applicable federal security requirements, implementation of required security controls, and continuous monitoring to support a high-impact system designation.

• The Contractor shall maintain the network infrastructure System Security Plan (SSP), Information System Contingency Plan (ISCP) and associated documents for ATO compliance.

• The Contractor shall implement and maintain all applicable NIST SP 800-53 security controls required for a high-impact system, in coordination with the Division of Information Security.

• The Contractor shall continuously monitor and assess security controls to ensure ongoing compliance and effectiveness, in accordance with federal continuous monitoring requirements.

• The Contractor shall review, implement, and maintain secure configurations for network devices in accordance with DISA Security Technical Implementation Guides (STIGs).

• The Contractor shall update security documentation (e.g., SSP, ISCP) to reflect changes to the network architecture, systems, and security controls.

• The Contractor shall develop and maintain Plans of Action and Milestones (POA&M) for identified security weaknesses and track remediation activities through completion.

• The Contractor shall provide evidence of security control implementation and effectiveness in response to requests from the Division of Information Security, auditors, and other authorized entities.

• The Contractor shall support security assessments, audits, and authorization activities by providing required documentation, artifacts, and subject matter expertise to achieve and maintain ATO.

• The Contractor shall develop all required security documentation (e.g., SSP, ISCP, control implementations) for new or significantly modified network systems requiring an Authority to Operate

• The Contractor shall perform periodic security control self-assessments and support independent security control assessments.

• The Contractor shall ensure all changes to the network infrastructure are assessed for security impact and documented in accordance with configuration management and change control processes.

• The Contractor shall support incident response activities by providing system-level expertise, logs, and forensic data as required.

• The Contractor shall ensure audit logging is enabled and that logs are forwarded and searchable in the agency’s Security Information and Event Management (SIEM) system.

6.9 NETWORK OPERATIONS SUPPORT CENTER (NOSC) SERVICE DESK

High Level Objective: IHS requires prompt resolution of all network-related issues on a 24x7 basis and Tier 1 support for all non-network issues reported during off-hours.

• The Contractor shall operate a 24 hours per day, 7 days per week (24x7) Service Desk to resolve network connectivity and performance issues reported by users or detected by network monitoring systems.

• The Contractor shall ensure all Service Desk calls are answered directly by technically qualified network personnel and shall not utilize non-technical call screening or callback-only support models.

• The Contractor shall staff the Service Desk with qualified network specialists capable of performing real-time troubleshooting, configuration changes, and remote support for network devices.

• The Contractor shall provide support to area IT staff, including after-hours assistance for network equipment upgrades, configuration changes, and lifecycle replacement activities.

• The Contractor shall document all incidents, service requests, and actions in the Government-provided IT Service Management (ITSM) system (e.g., ServiceNow).

• The Contractor shall escalate incidents to higher-tier support or external service providers as required to ensure timely resolution.

• The Contractor shall provide timely status updates and communications to users and stakeholders throughout the incident lifecycle.

• The Contractor shall meet defined response and resolution time objectives for incidents and service requests.

The Office of Information Technology operates the National IT Service Desk during the days and times listed below, excluding Federal holidays.

• Monday – Friday: 6:30am – 10:30pm ET

• Saturday: 9:30am – 6:00pm ET

Calls placed to the National IT Service Desk outside the hours listed above and on Federal holidays are automatically forwarded to the NOSC. For non-network related customer calls received by the NOSC:

• The contractor shall provide Tier 1 assistance to resolve issues when possible.

• The contractor shall create ServiceNow incident tickets to document all issues reported and actions taken.

For calls impacting patient care systems or clinical operations and requiring resolution prior to next business day when the National IT Service Desk is available:

• The Contractor shall follow the escalation procedures, including the call tree provided by the Contracting Officer’s Representative (COR), to engage Tier 3 technical staff with appropriate domain expertise.

• The Contractor shall create incident tickets in ServiceNow to document issues reported, actions taken, and escalation activities.

• The Contractor shall prioritize incidents impacting patient care systems as high priority and ensure immediate escalation and continuous effort until resolution or stabilization.

6.10 NETWORK AUTOMATION AND TOOL ADMINISTRATION

High Level Objective: IHS requires the integration of automation and Artificial Intelligence for IT Operations (AIOps) to improve operational efficiency and enable predictive, proactive network operations that identify and mitigate issues before service disruption occurs.

• The Contractor shall install, configure, and maintain network management applications and develop automation solutions to enhance tool effectiveness, improve operational efficiency, and reduce manual intervention.

• The Contractor shall integrate automation with network management applications to routinely collect network performance, device inventory and utilization statistics.

• The Contractor shall develop and execute automated scripts to audit network device configurations for compliance with DISA STIGs and other security baselines.

• The Contractor shall automate the generation of executive summary reports by integrating data sources with Government-approved AI services via their APIs.

• The Contractor shall develop, maintain, and publish a set of network status dashboards to provide at-a-glance visibility into the health and performance of the network for IHS stakeholders.

o The dashboards shall be embedded and accessible within a designated SharePoint Online site.

• The Contractor shall evaluate, recommend, and integrate AIOps and AI-driven capabilities available within network management tools, cloud platforms, and network equipment vendor solutions to enhance event correlation, anomaly detection and automated responses to network issues.

• The Contractor shall incorporate approved AIOps capabilities into daily network operations and workflows, where feasible, to improve incident detection, reduce mean time to resolution (MTTR), and enable proactive issue mitigation.

• The Contractor shall remain current with emerging automation and AI capabilities from network tool and equipment vendors and assess their applicability to the IHS environment.

6.11 NETWORK DEVICE CONFIGURATION

High Level Objective: IHS requires network devices to be securely and consistently configured to meet functional and security requirements, ensuring reliable connectivity to enterprise IT applications and services that support daily operations across the IHS enterprise.

• The Contractor shall manage the configuration of network routers, switches, wireless devices, and security appliances.

• The Contractor shall develop, maintain, and enforce standardized configuration templates for network infrastructure devices deployed across the IHS network.

• The Contractor shall conduct proactive configuration reviews to ensure consistency and compliance with federal security requirements, approved baselines, and vendor best practices.

• The Contractor shall provide remote technical support and guidance to IHS personnel and vendors performing installation, configuration, and deployment of network devices at IHS sites.

• The Contractor shall implement and maintain an automated system to back up all network device configurations at defined intervals and prior to configuration changes.

• The Contractor shall maintain a configuration management system that automatically records, tracks, and logs all configuration changes to network devices.

• The Contractor shall ensure all configuration changes are performed in accordance with approved change management processes, including documentation, approval, and rollback procedures.

• The Contractor shall restrict and manage administrative access to network devices in accordance with least privilege principles and federal security requirements.

6.12 NETWORK INVENTORY MANAGEMENT AND REPORTING

High Level Objective: IHS requires a comprehensive, accurate, and continuously maintained inventory of network infrastructure devices, external connections, and IP address space to support effective operations, security compliance, and lifecycle management.

• The Contractor shall maintain a comprehensive and up-to-date inventory of all network devices deployed across the IHS network.

• The Contractor shall automate the collection and updating of inventory data to ensure timely and accurate reporting as devices are added, modified, or removed from the network.

• The Contractor shall ensure inventory data is accessible to the Government via a centralized repository (e.g., Government managed SharePoint or approved platform) and supports search, filtering, and reporting capabilities.

• The Contractor shall validate inventory data on a periodic basis to ensure accuracy, completeness, and consistency with authoritative data sources.

• The Contractor shall generate quarterly reports identifying network equipment approaching or reaching End-of-Sale (EOS) and End-of-Support (EOL) status based on vendor-provided information.

• The Contractor shall maintain records of maintenance coverage and support status and generate annual reports to support maintenance contract renewals.

• The Contractor shall maintain accurate records of all external network connections and ensure compliance with the Federal Trusted Internet Connections (TIC) program.

• The Contractor shall manage IP address allocation and assignment, including IPv4 and IPv6 subnets, and maintain an accurate inventory tracking assignment, utilization and available address space.

• The Contractor shall maintain a real-time inventory of all public-facing IP addresses accessible from the Internet.

• The Contractor shall maintain an accurate and continuously updated inventory of site and circuit information to support incident management, circuit inventory management, and reporting on overall network bandwidth capacity.

6.13 HOSTED VOIP ADMINISTRATION SUPPORT

High Level Objective: IHS requires administrative support for hosted VoIP services to ensure timely provisioning, accurate configuration, and effective coordination with the service provider in support of reliable voice communication.

• The Contractor shall provide administrative and operational support for IHS hosted VoIP services.

o The hosted VoIP service provider is responsible for platform operations, infrastructure, and core service delivery. The NOSC Contractor’s role is service administration, user support, and coordination activities.

• The Contractor shall provision, modify, and decommission VoIP user accounts, extensions, and associated features (e.g., voicemail, call forwarding, hunt groups, auto-attendants) within the hosted VoIP platform.

• The Contractor shall perform Moves, Adds, and Changes (MACs) in accordance with approved service requests and established timelines.

• The Contractor shall maintain accurate user profiles, dialing configurations, and call routing settings.

• The Contractor shall serve as the primary point of contact for VoIP-related service requests and issues, and coordinate with the hosted VoIP service provider for escalation and resolution of service disruptions.

• The Contractor shall track and manage VoIP-related incidents and service requests to resolution, ensuring compliance with service level requirements.

• The Contractor shall maintain documentation of VoIP configurations, including dial plans, hunt groups, and auto-attendant structures.

• The Contractor shall assist with onboarding new sites and users, including number assignment and feature configuration.

• The Contractor shall support basic troubleshooting and validation of VoIP services prior to escalation to the service provider.

• The Contractor shall provide reporting on VoIP service requests, incidents, and service provisioning activities.

7 GENERAL REQUIREMENTS

7.1 SCHEDULED OUTAGES FOR NETWORK UPGRADES

All network upgrades and configuration changes shall be scheduled and performed at times that minimize disruption to IHS staff and mission-critical systems that rely on network connectivity. For headquarters data centers, hospitals, and other facilities operating 24-hour services, upgrades and changes shall be performed outside of normal business hours unless otherwise approved by the Government.

The Contractor shall provide qualified personnel to support all scheduled upgrades and changes, including evenings, nights, weekends, and holidays, as required by IHS. The Contractor shall coordinate all activities with the Government and ensure appropriate staffing and support are available to minimize service disruption and ensure timely completion.

7.2 INTERNET PROTOCOL VERSION SIX (IPV6)

As a Federal entity, the IHS network infrastructure shall support the Internet Protocol Version 6 (IPv6). The Contractor shall support the implementation and support IPv6 across all network infrastructure devices in accordance with applicable Office of Management and Budget (OMB) mandates and federal directives.

The Contractor shall ensure that all network devices and circuits are configured to process IPv6 network traffic and implemented in a manner that maintains network security and interoperability with connected devices.

All network management applications shall be configured to operate and process functions for both the IPv4 and IPv6 network protocols.

8 CONTRACT ADMINISTRATION

8.1 AUTHORITIES OF GOVERNMENT PERSONNEL

The administration of this contract will require maximum coordination between the Government and the Contractor. The Government may, upon contract award or thereafter, name representatives with titles such as Project Officer, Contracting Officer's Representative(s) and other Federal Managers named in writing by the Contracting Officer.

The letter of appointment will indicate the individuals, titles, and stipulate the rights, responsibilities, and limitations of their appointment.

8.2 TECHNICAL MONITORING, INSPECTION AND ACCEPTANCE

The COR, as a duly authorized representative of the Contracting Officer, shall assume the responsibilities for monitoring the Contractor’s performance, evaluating the quality of services provided by the Contractor, and performing final inspection and acceptance of deliverables. Performance of the work under this contract shall be subject to the technical monitoring of the COR. The term “Technical Monitoring” is defined to include the following:

• Technical directions to the Contractor that redirect the contract effort, shift work emphasis between work areas or assignments, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual scope of work.

• Providing information to the Contractor for assistance in the interpretation of business requirements, specifications or technical direction of the work description.

• Review and, where required by the contract, provide approval of the deliverables.

8.2.1 Technical direction must be within the general scope of the work stated in the contract. The COR does not have authority to and may not issue any technical direction which (a) constitutes any assignment of additional work outside the general scope of the contract; (b) constitutes a change as defined in the contract clause entitled, “Changes”; (c) in any manner causes an increase in the total contract cost or the time required for contract performance; or (d) changes any of the expressed terms, conditions, or specifications of the contract.

8.2.2 All technical directions issued in writing by the COR or designated federal personnel shall be acknowledged with a written receipt within five (5) working days after issuance.

8.2.3 The Contractor shall proceed promptly with the performance of technical directions duly issued by the COR, that are within scope of the contract, in the manner prescribed within his authority.

8.3 CONTRACT TRANSITION PLAN

The Contractor shall provide a phase-in/phase-out plan describing actions, milestones, plans and procedures to ensure (1) a smooth transition from contract award to full operational status and (2) a smooth transition from contract performance in the current term of performance, perhaps by a different contractor, in another term. The final phase-out portion of the plan shall be updated 30 days prior to completion of the contract. The phase-out portion shall include provisions for completion of appropriate Contractor responsibilities should there be a contract termination proceeding.

8.3.1 Phase-In

The Contractor shall provide a transition-in approach that identifies and mitigates cost, schedule and performance risks. This should include the identification of the physical location of all staffing resources as well as the location of the network circuits that would need to be installed for support readiness and be ready to assume total responsibility for all operations required by the contract as of the Operations Start Date identified.

Therefore, as of the Operations Start Date, the Contractor shall provide a workforce that is fully qualified and capable of performing all work required under this contract. The Contractor shall submit in the plan identified, the detailed procedures for assuming responsibility and accountability for all Government-furnished information and property.

The Contractor shall provide the process that will maximize efforts to retain the existing highly qualified staff as well as the hiring of any new or replacement highly qualified staff to ensure qualified resources are identified and confirmed availability to support the roles and responsibilities required within the PWS. The Contractor shall address areas of risk management and provide mitigation plans as part of the transition plan schedule. The transition plan should identify a clear hiring process to include a pre-qualifying of staff resources for suitability.

8.3.2 Phase-In Observation

Beginning immediately after contract award for approximately 2 weeks, the Contractor shall observe daily operations of the Government and incumbent contractor to include office functions, procedures and operations; service/maintenance operations; and any other operations deemed necessary by the Contractor that will enable the personnel to become both knowledgeable in, and familiar with, their assigned areas of responsibility.

The Contractor shall ensure, during phase-in activities, that: he/she shall not interfere with productivity; he/she shall coordinate all visits in advance and arrange to be accompanied by a Government employee previously designated for that purpose; he/she shall confine his activities to transition-in only responsibilities. The designated Government representative shall coordinate discussions with Government or Contractor’s employees while they are on duty. During this phase-in period, the Contractor has no responsibility for on-site operational services required on this contract. No payments will be made to the Contractor prior to the full operations start date. The Contractor shall complete all transition activities within 14 days of contract award and include a detailed plan to complete this transition to include a risk management plan in order to ensure minimal disruption of operations. The Contractor shall specify the labor category, the quantities, location and when and how the transition shall occur. The Contractor shall provide when and in what order Contractor personnel are provided. The Contractor shall provide a contract schedule with critical activities and milestones. All incumbent personnel transitioning to a new Contractor will be required to be re-badged (PIV) before the end of the transition period.

8.3.3 Phase-Out Period

The Contractor shall present a detailed plan for any phase-out period, regardless of precipitating reasons. The plan shall include procedures for minimizing impact on performance in compliance with standards in the contract. The plan shall also describe in detail how responsibility and accountability will be relinquished for all Government furnished items/property, network device passwords and diagrams.

8.3.4 Phase-Out Observation

During the "phase-out" period the Contractor shall remain totally responsible for the services required in this contract. The Contractor shall not defer any needed tasks for the purpose of avoiding responsibility to the successor contractor.

8.3.5 Contractor Coordination

The Contractor shall coordinate phase in/out activities with the incoming Contractor to ensure a smooth and orderly transition at the end of the contract period. The Contractor shall provide on-the-job familiarization and knowledge transfer to the incoming Contractor, as required. This shall include the transfer and explanation of all relevant operational documentation, including runbooks, standard operating procedures, network diagrams, configuration baselines, device configurations, automation scripts, and system administration guides. All documentation shall be current, complete, and provided in a format accessible to the Government and incoming Contractor to ensure continuity of operations without degradation of service.

8.4 SPECIAL TERMS AND CONDITIONS

8.4.1 Safety

The Contractor shall perform all tasks in such a manner as to ensure the safety of all individuals associated with this PWS and associated tasks. During the performance of tasks, if it becomes apparent at any time that continuation of work may result in damage to equipment or structures or cause injury to personnel, the Contractor must stop that portion of work and report the circumstances immediately to the COR. It shall be the Contractor’s responsibility to comply with all federal, state, and local safety regulations, procedures, and instructions. It shall be the Contractor’s responsibility to adhere to all applicable Occupational Safety and Health Act (OSHA) standards and documents during performance of tasks under this contract.

8.4.2 Records/Data

The Contractor shall ensure that records and data are documented in deliverable reports (electronically). Any databases/code shall be delivered electronically and become the sole property of the United States Government.

8.4.3 Government Furnished Information

The Government will provide the Contractor with Government Furnished Information (GFI) relevant to the support required within this PWS. This information will include, and is not limited to the following:

• System Security Plans, Information System Contingency Plans and latest security assessment report

• Network device configurations and inventory

• Network architecture diagrams

• Network equipment maintenance contract numbers

• Telecommunication circuit vendors and numbers

• IHS policies, procedures, audit reports, etc

• Access to the IHS IT Service Management system (ServiceNow) and Security information and Event Management system (Splunk) shall be provided to the Contractor’s staff.

Disposition of GFI will be coordinated with the IHS COR/Federal Manager at the end of the period of performance and as part of the Phase Out Period. GFI will either be returned to the Government or destroyed, as determined by the IHS COR/Federal Manager.

8.4.4 Government Furnished Equipment (GFE)

The Government intends to provide the following equipment in support of the efforts within this PWS:

• Government issued workstation/laptop and associated peripherals

• The Government will also provide one router and one telecommunication circuit for connectivity between the IHS network and the Contractor’s primary site.

o To remove dependencies on the circuit installation schedule and to begin the onboarding/phase in process, the Contractor may establish an IPsec VPN tunnel connection to the IHS network. The Contractor shall be responsible for all equipment and Internet service costs to establish the IPsec VPN tunnel connection until the IHS circuit is in place and approved for use.

o Early notification of primary location for circuit installation is required.

• Government issued Personal Identity Verification (PIV) cards.

The Contractor shall provide the receipt for and maintain custody and accountability of all GFE including hardware, or software provided during performance of this effort. All assigned GFE shall be monitored and tracked with annual validation.

The Contractor shall have access to Government managed ServiceNow and SharePoint applications. Government provisioned Virtual Machines (VM) shall be provided for the Contractor to install and maintain Government provided network management applications and tools.

8.4.5 Minimum Experience Requirements

The Contractor shall provide fully qualified staff, possessing the necessary experience, certifications, knowledge and technical skills to perform the functions described in the PWS and reflected in the resumes of all key personnel. IHS will address all issues related to contract performance through the Contract Officer and annual CPARS reporting.

At a minimum, the Contractor shall demonstrate experience in:

• Providing enterprise network operations and management services for a network connecting more than 400 dispersed locations.

• Operating and supporting a 24x7 Network Operations Center (NOC)

• Managing telecommunications services and multiple service providers, including circuit provisioning, monitoring, and reporting

• Designing, implementing, and supporting secure network architectures, including firewalls, intrusion prevention systems, and IPsec connectivity

• Supporting federal cybersecurity requirements, including NIST SP 800-53 controls, continuous monitoring, and Authority to Operate (ATO) processes

• Managing cloud network connectivity in Infrastructure-as-a-Service (IaaS) environments (e.g., Microsoft Azure, Oracle Cloud Infrastructure, or equivalent)

• Implementing and maintaining network automation, monitoring, and reporting capabilities

• Managing configuration change, and inventory systems for network infrastructure

• Supporting network modernization initiatives, including design, testing, and deployment of new technologies

• Administering hosted VoIP services, including user provisioning, call routing configuration and coordination with service providers for incident resolution.

8.4.6 Information Security

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including subcontractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum-security controls for management, operational and technical safeguards needed to protect the confidentiality, integrity and availability of a federal information system and its information. This PWS requires the Contractor to (1) develop,

(2) have the ability to access information from, or (3) host and/or maintain a federal information system(s). Pursuant to Federal and HHS Information Security Program Policies the Contractor and any subcontractor performing under this contract shall comply with the IHS Security requirements.

Reference: Federal Information Security Management Act of 2002 (FISMA), Title III, E- Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002).

• http://csrc.nist.gov/policies/FISMA-final.pdf

8.4.7 Federal Suitability Security Clearance Requirements

The Contractor (and/or any subcontractor) and its employees…