RFI technical requirements.pdf

RFI-ISS-20-102, Technical Requirements

TECHNICAL REQUIREMENTS

COLOCATION SERVICES FOR NETWORK HOSTING

U.S. DEPARTMENT OF THE TREASURY, BUREAU OF THE FISCAL SERVICE

1.0 OBJECTIVE

The objective of this document is to describe the U.S. Department of the Treasury, Bureau of the Fiscal Service (Fiscal Service), Office of Information and Security Services (ISS) technical requirements for hosted colocation data centers. ISS has a need to place network equipment within two hosted colocation data centers; this placement will allow for low-latency network availability to several hosted cloud services. The colocated data center locations shall have direct connectivity to multiple cloud providers as described in this document.

2.0 TECHNICAL REQUIREMENTS

Site requirements

Two hosted colocation data centers are required by Fiscal Service. One colocation data center shall be located on the east coast of the United States, and one colocation data center shall be located on the west coast of the United States.

The hosted colocation data centers shall:

1. Ensure security for Fiscal Service’s deployed systems within secure data center facilities through secure cage spaces, 24x7x365 on-site security guards, biometric hand readers, CCTV access, access control lists, motion detectors and PIV card readers.

2. Have back-up service which includes 99.999% power uptime, 99.99% availability of temperature and humidity control, and 99.99% cross-connect availability.

3. Have on-site services which provide customers access to highly-trained data center personnel for troubleshooting or a range of hands-on services when Fiscal Service personnel are not available to be on site.

4. Have space for up to 12 server racks (48U X 600W X 1200D) within a private caged area secured by Fiscal Service PIV card access.

5. Have dual 30amp/200-240v circuits installed to each rack (5Kva rating).

6. Have an interconnected cloud ecosystem, which helps Fiscal Service achieve the fastest, most scalable level of cloud interconnection possible for each specific workload and providing a high-speed fabric of globally distributed cloud PoPs out to the edge.

7. Provide two (2) 10G direct onramp connections to the colocation center’s on-site cloud exchange provider. The onramp connections shall not utilize a third-party provider. Fiscal Service will provision the layer 3 connectivity to the cloud providers at that point. The on-site cloud exchange provider shall have a minimum of 40 onsite cloud provider onramps at the colocation data center campus where the Fiscal Service hardware will be housed. The cloud exchange provider shall include the following services on their exchange (but not be limited to): Amazon Web Services (AWS) Direct Connect, Microsoft Azure Government ExpressRoute, Google Cloud Services, Verizon Communications SD Interconnect, and ServiceNow.

8. Provide two (2) 10G dedicated connections between the two (2) colocation data center sites that were selected by Fiscal Service on the provider’s backbone. These connections shall not utilize a third-party provider.

9. Have UPS configuration block redundant with N+1 redundancy; cooling availability must be N+1 redundant with generator back-up.

10. Have fire suppression; at a minimum, fire suppression shall be a double-interlocked, pre-action dry pipe system.

11. On-site parking availability.

12. On-site facility mantrap for access to colocation facility.

13. Fiscal Service shall be notified 24 hours prior to entry into our private cage unless an operational emergency is declared by the colocation data center.

14. Allow Fiscal Service to install its own camera system for monitoring access to Fiscal Service’s private cage and server racks.

15. Ability to install Fiscal Service’s own card systems for access into the private cage.

16. Have on-site conference rooms, crash carts, work kiosks and Wi-Fi available for Fiscal Service personnel use.

17. Have a minimum of two utility power sources available to the data center at all times.

18. Have a rollup generator termination cabinet to allow for rapid deployment in the event of a generator failure.

19. Have a secure (remotely monitored/recorded and locked) dock area for receiving of equipment, and an area large enough for the unpacking of server racks (12 server racks (48U X 600W X 1200D) before placement into Fiscal Service’s private cage.

20. Provide a Web-based portal for remote provisioning of user access to the private cage, submitting trouble tickets, and requesting onsite support.

Compliance certifications

The hosted colocation centers shall satisfy the following compliance certifications:

1. Security Assessment & Authorization (SA&A) for critical Federal compliance standards and security controls

2. NIST 800-53 Revision 4/FISMA High

3. SOC 1 Type II

4. SOC 2 Type II

5. ISO 27001

6. HIPAA

7. PCI DSS

Required services

Colocation Data Center Services: The colocation data center shall provide a private caged/secured area for up to 12 server racks with dual power circuits to each server rack. Each circuit shall have a 5 KVA minimum rating. There shall also be redundant power and cooling for the space with redundant generator backup.

Connectivity to a Cloud Exchange Fabric: The colocation data center shall provide two (2) 10G connections to a cloud exchange which shall allow the provisioning of multiple virtual connections to Amazon AWS Government, Microsoft Azure Government Cloud, Google Cloud Services, Verizon Communications SD Interconnect, ServiceNow, and other cloud providers as needed. The 10G connections shall be either multi-mode or single-mode fiber from the Fiscal Service demarcation to the provider’s connectivity. This connectivity maps to Section 2, Requirement 7 above.

Connectivity Between Colocation Data Centers: The colocation data center shall provide two (2) 10G connections between the colocation data centers. The connections shall utilize the provider’s backbone between its data center locations and shall be delivered to the Fiscal Service demarcation point in the private cage. This connectivity maps to Section 2, Requirement 8 above.

Internet services: The colocation data center shall provide two dedicated, low latency Internet connections from separate network/Internet service providers in a carrier POP/hotel.

1. Connectivity: each connection shall support IP version 4 and 6

2. Bandwidth: each connection shall have a separate 10G port with 2G commit and shall have the ability to incrementally upgrade the bandwidth to the full 10G bandwidth at Fiscal Service’s request

3. The network/Internet service provider shall utilize BGP to exchange full IPv4 and IPv6 Internet routing tables

4. The network/Internet service provider shall offer distributed denial of service (DDoS) solutions. The solution will offer 24x7x365 proactive monitoring, incident detection, incident notification, incident reporting, scheduled reporting, upstream protection, and restoration of normal services. Scheduled reporting shall be provided once per month on the first business day of each month.

5. The network/Internet service provider shall have a 24x7x365 DDoS Security Operations Center

(SOC) service desk. The service desk shall provide an escalation path & procedures, redundant geographically-located mitigation sites, the ability to dynamically block attack or a manual approval process to block attacks, the ability to block upstream traffic within the provider’s network, an option for portal access to manage and report on the DDoS protection service, and the service desk shall work with multiple IP blocks for both IPv4 and IPv6 networks.

6. Each connection shall have telecommunications service priority (TSP) configured to provide for priority restoration of telecommunication services.

7. The service level shall be Routine.

8. The access method shall be Ethernet, and the underlying access type shall be Ethernet.

9. The service shall meet as a minimum the performance levels and acceptable quality level (AQL) of key performance indicators (KPIs) for routine Internet services

10. The network/Internet service provider shall provide 24x7 customer service support via a call to a live person located in the United States.

Hands-on, on-site professional services: The colocation data center shall provide hands-on assistance by qualified and trained data center personnel. Examples of these services include, but are not limited to, the following:

1. Restarts of physical equipment

2. Running patch cables

3. New cable installations

4. Assistance with troubleshooting PDU’s (Rack-mounted Power Distribution Units)

5. Assistance with the diagnosis of temperature alarms

Routine maintenance

The colocation data center shall perform routine facility maintenance activities in agreement with Fiscal Service timeframes.

Service interruptions shall be scheduled with and approved by Fiscal Service a minimum of 96 hours before such interruptions occur. In the case of emergency maintenance or otherwise unplanned interruptions, the contractor shall notify Fiscal Service immediately before performing such maintenance.

The colocation data center shall notify as soon as the service is returned to normal operating parameters.

Colocation help desk requirements

1. The colocation data center’s help desk shall be an avenue for receiving, reporting, and resolving trouble calls from Fiscal Service, shall be available 24 hours a day, 7 days a week (24x7), and shall provide Fiscal Service with a single help desk telephone number to report service outages.

2. The colocation data center’s shall provide updates to Fiscal Service’s IT Service Desk (304 480-

7777) within 30 minutes of initial outages/degradation notification and every 2 hours thereafter until the issue has been resolved.

For each service issue, the colocation help desk shall provide the following information to Fiscal Service’s IT Service Desk:

a) Date and time of outage notification

b) Colocation problem tracking number

c) Description of issue

d) Date and time service returned to normal

e) Description of all actions taken

Mandatory level of service

Colocation data center services shall be available for Fiscal Service’s use 99.5% of each calendar month.

”Available time” includes scheduled maintenance periods. Monthly availability shall be determined in accordance with the following calculation, and the calculation will apply to each Ethernet circuit:

Monthly availability = 1 – (total minutes non-availability per calendar month/total minutes in the calendar month) x 100. The term month is defined as starting at 12:00:00 AM on the first day of the calendar month to 11:59:59 PM on the last day of the calendar month