SOW_FOR_RFQ.pdf

Request for Quotation SB1341-15-RQ-1055

Statement of Work

BACKGROUND

The general mission of the Materials Measurement Science Division (MMSD) of the Material Measurement

Laboratory (MML) at the National Institute of Standards and Technology (NIST) is to provide research, reference materials, and data to support accurate and selective analysis of microscopic particles and surfaces including the spatial distribution of chemical species relevant to industrial, environmental, and biological processes.

MMSD is currently operating an Information Technology (IT) system using a Check Point firewall System consisting of Check Point appliances (hardware and software). This Check Point firewall system handles the division's internal network security. Regular firmware updates and control software updates are necessary to maintain the firewall. However, the existing appliances are reaching their end of life and also cannot handle the current network monitoring load. Additionally, NIST does not have the option of adding additional memory to the existing system to extend its capability.

To maintain the necessary performance for the division's IT network security, the existing Check Point appliances must be upgraded. Also, in order to maintain the upgraded system, properly updated and current on the security definitions, a maintenance contract is required. The upgraded system must have larger memory and storage capacity to handle the increasing amounts of firewall rules and must also provide the faster network monitoring capacity.

It is Check Point’s practice to assign a User Center (UC) number to each customer’s system in order to provide support and service. MMSD’s current existing Check Point firewall system is UC 6603466 and consists of the following appliances:

The Contractor shall upgrade the existing Check Point UTM 1076 and Smart-1 5 to Check Point 4800 and

Smart-1 210 appliances. The Contractor shall provide license renewals, hardware maintenance, and software maintenance for a base period of one year plus three one year option periods, for all appliances, including the upgraded appliances after expiration of any commercial warranty, if an option is exercised.

Brand Name Justification

This is a brand name only requirement. The Contractor must provide the brand name of equipment required herein. No substitutions or equivalents will be considered.

Item # Existing NIST System Description Check Point Part # Quantity

1 Check Point UTM-1 1076 Security

Gateway Appliance

CPAP-SG1076 1

2 Check Point UTM-1 1076 Security

Gateway Appliance – HA (High

Availability)

CPAP-SG1076-HA 1

3 Check Point Smart-1 5 SmartEvent

Appliance

CPAP-SM503-EVNT 1

4 Check Point Smart-1 5 Security

Management Appliance

CPAP-SM504 1

5 Check Point Acceleration and

Clustering Blade

CPSB-ACCL 2

Check Point appliances are required because the MMSD’s firewall system is comprised solely of Check Point appliances and the upgrades are needed to maintain system effectiveness. Using appliances from any other manufacturer would result in system incompatibility in the MMSD firewall and result in downtime in the firewall which protects MMSD’s IT system. If the MMSD’s IT system is compromised via malware or unauthorized access, it could result in serious loss of data and NIST work product and, at a minimum, loss of productivity during the weeks of recovery effort while the data and instruments that rely on the IT system are not available for use.

SCOPE OF WORK

1. FIREWALL APPLIANCE UPGRADE WITH TRADE-IN

The Contractor shall upgrade the existing Check Point Firewall system comprising of the following new

Check Point items:

4800 Next Generation Threat Prevention Package (items 1-5) with the following specifications:

11 Gbps raw throughput

2 Gbps VPN AES-128 throughput

1.5 Gbps IPS throughput

3.3M concurrent connections

70000 connections per second

8 GB Memory

1 I/O expansion slot

1U enclosure

Redundant hot swap power supply

High availability configuration (2 nd firewall)

8 x 10/100/1000Base-T RJ45 ports

250GB hard drive

IPv4 and IPv6 support

1024 interfaces or VLANs persystem

Session failover for routing change

Device failure detection

Link failure detection

Active/Active – Layer 3 mode

Active/Passive – Layer 3 mode

Session synchronization for firewall and VPN

Item

System Description Check Point Part # Quantity

1 Check Point 4800 Next

Generation Threat Prevention

Appliance

CPAP-SG4800-

NGTP

2 4 GB Memory upgrade for 4800 and 12200 appliances

CPAC-RAM4GB-

INSTALL

3 Check Point 4800 Next CPAP-SG4800- 1

Generation Threat Prevention

Appliance for High Availability

(HA)

NGTP-HA

4 AC Power Supply for 4800 and

12200 appliances

CPAC-PSU-

4800/12200-

INSTALL

Smart-1 210 Appliance (items 6 & 7) with the following specification:

10 managed gateways

5000 indexed logs/sec

480 event logs/sec

6.5 GB of logs/day

1600 max. users

2TB hard drive storage

8GB RAM

4 x Copper Gb Ethernet interface

1 RJ45 management port

2 USB ports

Web-based administration

Backup and restore functionality

Software support for network policy management, endpoint policy management, logging and status, compliance, smart provisioning, SmartEvent, and SmartReporter

Item

System Description Check Point Part # Quantity

5 Smart-1 210 Appliance with

Policy, Log and Event Security

Management for 10 Security

Gateways

CPAP-SM210 1

TRADE-IN

The Government’s existing Check Point Firewall appliances listed below are available for trade-in credit under

UC 6603466.

Existing NIST System Description Check Point Part #

Check Point UTM-1 1076 Security

Gateway Appliance

CPAP-SG1076

Check Point UTM-1 1076 Security

Gateway Appliance – HA (High

Availability)

CPAP-SG1076-HA

Check Point Smart-1 5 SmartEvent CPAP-SM503-EVNT

The Government prefers, but does not require, that the Contractor accept these appliances in exchange for a trade-in credit. The appliances have been continuously covered under a Check Point support contract and are currently functioning in accordance with manufacturer’s specifications. If the Contractor accepts an offer from the Government inclusive of a trade-in credit, the Contractor shall be responsible for removal of all equipment being that is being accepted in exchange for the trade-in credit. The Contractor shall remove the equipment at the time of installation.

INSTALLATION

The Contractor shall provide existing system analysis based on the system configuration dump and provide verification and validation of existing Check Point architecture, including policies, to understand the current environment.

The Contractor shall provide the upgrade of the existing UTM-1 1076 and Smart-1 5 to 4800 and Smart-1 210 appliances including the transfer of the existing policies and configuration.

The Contractor shall provide the Check Point software upgrade from the existing software version to R77.30.

The Contractor shall provide the tuning and maintenance of Check Point security architecture for the logical system configuration.

TRAINING

The Contractor shall provide training to for up to two (2) NIST staff for basic configuration, policy update, trouble shooting and network traffic monitoring. The training can be combined with the installation process where the NIST staff is engaged during the system installation, troubleshooting, configuration and tuning process. Tasks such as the analysis and conversion of the existing firewall configuration files for the new hardware and the initial tuning and optimization of the new configuration files may be performed at the

Contractor’s facilities.

The Contractor shall provide a written report of the actions taken and actions recommended within one week of the completion of the installation and training.

OPTION LINE ITEMS - SUPPORT & ANNUAL LICENSES

The Contractor shall provide support and licenses for a one year base period plus three one year option periods, if all options are exercised, for support services for the upgraded UC 6603466. Support shall meet all of the following CheckPoint service plan levels for the one year base period and each of the three one year option periods:

Appliance

Check Point Smart-1 5 Security

Management Appliance

CPAP-SM504

Check Point Acceleration and

Clustering Blade

CPSB-ACCL

Base Period

Threat Prevention package licenses shall be included in the base period purchase so these are not included in the base year list items;

Premium Direct Enterprise Support for the Check Point 4800 and 4800-HA;

Premium Direct Enterprise Support for the Check Point Smart-1 210;

Option Periods 1-3

Threat Prevention package licenses need to be renewed each year.

Premium Direct Enterprise Support for the Check Point 4800 and 4800-HA

Premium Direct Enterprise Support for the Check Point Smart-1 210

Check Point Threat Prevention package license

Check Point Threat Prevention –high availability package license

Check Point Enterprise Premium Support for UC 6603466 shall include:

1. Check Point 4800, 4800-HA Appliance Maintenance for UC 6603466

a. Software subscription – access critical hot fixes, service packs and major updates to firewall software and hardware control software.

b. Unlimited comprehensive online, email, telephone support with 30 min response for issues impacting system security and 2 hour response time for issues degrading system performance.

c. 7 x 24 (7 days a week, 24 hours a day) online, email, telephone support.

d. Free use of Check Point support center tools to initiate, manage, collaborate upon and track

Service Requests online including active notifications via mail or SMS.

e. Access to SecureKnowledge knowledgebase.

f. Appliance Support must include:

i. New replacement units shipped by Next Flight-Out/Express Delivery in mainland US.

ii. Appliances shipped during normal business hours and could arrive during off hours.

iii. Hardware issue diagnosis via phone, email, and online form.

iv. Return Materials Authorization (RMA) process by Check Point Technical Assistance

Center Hardware experts

2. Check Point Smart-1 210 Appliance Maintenance for UC 6603466 shall include the following:

a. Software subscription – access critical hot fixes, service packs and major upgrades to firewall software and hardware control software.

b. Unlimited comprehensive online, email, telephone support with 30 min response for issues impacting system security and 2 hour response time for issues degrading system performance.

c. 7 x 24 (7 days a week, 24 hours a day) online, email, telephone support.

d. Free use of Check Point support center tools to initiate, manage, collaborate upon and track

Service Requests online including active notifications via mail or SMS.

e. Access to SecureKnowledge knowledgebase.

f. Appliance Support shall include:

i. New replacement units shipped by Next Flight-Out/Express Delivery in mainland US.

ii. Appliances shipped during normal business hours and could arrive during off hours.

iii. Hardware issue diagnosis via phone, email, and online form.

iv. Return Materials Authorization (RMA) process by Check Point Technical Assistance

Center Hardware experts.

3. Check Point Threat Prevention package license for 1 year for UC 6603466

a. For IPS, URL Filtering, Antivirus, Spam Filtering blades

4. Check Point Total Security package – high availability license for 1 year for UC 6603466

a. For IPS, URL Filtering, Antivirus, Spam Filtering blades

The contractor shall make available via online download for installation by NIST personnel, all software updates pertinent to the optimization of the system not later than one business day after any such update is released.

The Check Point firewall maintenance agreement shall include defective hardware part replacement for installation by NIST personnel. All parts shall be 100% compatible with the system and must meet Original

Equipment Manufacturer (OEM) specifications. The Contractor shall deliver hardware replacement items at no additional cost, within one business day. All on-site work such as installation of replacement parts shipped to

NIST, shall be done by NIST personnel.

PERIOD OF PERFORMANCE

Delivery, installation, training and acceptance shall occur not later than 14 weeks after receipt of order.

The base year of system support shall begin immediately upon award for all existing hardware and software, and upon expiration of any commercial warranty for all upgraded products.

The option years of maintenance and support shall begin upon the exercise of an option.

PLACE OF PERFORMANCE

Delivery, installation, training, and system support and maintenance shall occur at NIST Gaithersburg, MD and

2 days of the installation and training services will be provided from the contractor’s facilities

All premium enterprise support services provided under this agreement shall be provided from the contractor’s facilities.

DELIVERABLES

The system, comprised of all appliances and components, shall be shipped under FOB Destination delivery terms, to the National Institute of Standards and Technology at 100 Bureau Drive, Gaithersburg, MD 20899 in accordance with the following schedule:

Description Quantity Due date

Check Point 4800 Next Generation Threat

Prevention Appliance

1 8 weeks from award.

4 GB Memory upgrade for 4800 and 12200 appliances

2 8 weeks from award.

Check Point 4800 Next Generation Threat

Prevention Appliance for High Availability

(HA)

1 8 weeks from award.

AC Power Supply for 4800 and 12200 appliances

2 8 weeks from award.

Description Quantity Due date

Smart-1 210 Appliance with Policy, Log and Event Security Management for 10

Security Gateways

1 8 weeks from award.

Installation and Training as described in

Section II.2 of this SOW

5 days total (3 onsite and 2 remote)

Within 6 weeks from delivery.

Installation and training dates shall be coordinated with the NIST TPOC.

Check Point Services as described in Section

II.3 of this SOW

1 year initially, with three additional one year option years

Upon award and upon expiration of any warranty for upgraded products

Telephone Technical Support. 24 hours a day, 7 days per week.

Upon award.

Email Technical Support. 24 hours a day, 7 days per week.

Upon award.

Online Technical Support. 24 hours a day, 7 days per week.

Upon award.

Hardware replacement Unlimited as identified during trouble shooting.

Within one business day of identified need.