Army_EITaaS_Statement_Of_Objectives_15JULY2019-Amendment_0003.pdf

Army – Enterprise Information

Technology as a Service (EITaaS)

Statement of Objectives

Solicitation Number: W15QKN-19-R-06JL

Version 1.1, 16 July 2019

Army – Enterprise Information Technology as a Service (EITaaS) Statement of Objectives (SOO)

Version 1.1, 2019-07-16 Page | 1

1. Overview 1 Today’s Army installation/administrative enterprise information technology is identified 2 as a weapons platform which enables the entire force to perform the Army’s 3 administrative and power projection tasks. Army installation operations depend on 4 timely, secure, and reliable delivery and transmission of data. Today, the Army owns 5 and operates its entire information technology (IT) and long-distance communications. 6 This current own/operate model produces slow rates of changes and technology 7 adoption that diverges from similar commercial offerings. 8

The Army is exploring a new approach for delivering the enterprise network and core 9 IT services: Enterprise IT as a Service (EITaaS). The EITaaS Pilot effort will assess 10 the achievability and feasibility for deployment of commercial solutions for data 11 transport, end-user device provision, and cloud services for selected Army 12 installations. 13

The EITaaS Pilot assessments will permit the Army to maximize the value of the 14 enterprise IT investments while still allowing the users to retain the ability to tailor their 15 services and service levels. The Army seeks to partner with commercial IT Service 16 Provider(s) to deliver innovative and modernized Solutions to transform IT services, 17 improve cyber readiness, and allow re-missioning of personnel to cyber warfighting 18 missions. 19

2. Purpose 20 The specific purpose of this EITaaS Pilot is to partner with industry to reform existing 21 and future Army EITaaS operations and services delivery through commercial services 22 in order to increase mission effectiveness, increase IT user efficiencies, and establish 23 standardized, innovative IT services. This Pilot will address the outcomes sought in 24 the approved and current “Enterprise Information Technology as a Service (EITaaS) 25 Initial Requirements Document”, provided separately. The Pilot focus is on the end 26 users’ and installation organizations’ mission needs, with outcomes that improve IT 27 availability, resiliency, security, and affordability while improving the end users’ 28 experience. 29

3. Scope 30 EITaaS will provide commercial delivery and management of IT services from the 31 enterprise to the point of need (user) securely. The EITaaS Solution will adhere to 32 applicable Federal Government Laws and Cybersecurity regulations and policies, until 33 any submitted waiver(s) are approved by the Government. During this pilot, the 34 EITaaS Provider will deliver an EITaaS Solution as a parallel/non-interfering network 35 and devices. The EITaaS Provider is responsible to provide its EITaaS Solution for 36 enterprise use up to three (3) designated Army Pilot Sites (one each Small, Medium 37 and Large, grouped in a “Set”) included in the Agreement Award. (See Figures 1, 2, 3 38 and paragraph 12, Place of Performance) 39

Prototype EITaaS Solutions shall connect, protect, store, and compute, with common 40 IT services, hardware, software, and networking infrastructure. The EITaaS Provider 41

Version 1.1, 2019-07-16 Page | 2 shall demonstrate the ability to establish a parallel IT network and services while 42 demonstrating the capability to transition existing IT services to a commercial EITaaS 43 Solution offering. Any co-use (ex, the Army has unused capacity on Switches, Routers 44 and Underground Fiber Lines.) of Government equipment must be documented in the 45 assessment and approved by the Government. The Government projects that only 46 non-interference co-use will be approved. 47

Additionally, the EITaaS Provider will demonstrate the ability to support joint cyber 48 security operations including (but not limited to) the sharing of security log, event 49 and incident data, and cooperative work with the Army designated Cyber Security 50 Service Providers (CSSPs) and Regional Cyber Centers. The EITaaS Solution will 51 demonstrate the capability to encrypt Army Data at Rest, Data in Transit/in Motion 52 and Data in Use throughout the network environment. The EITaaS Solution will 53 demonstrate the use of a Government approved encryption solution Commercial 54 Solution for Classified (CSfC). Any EITaaS Cross Domain Solution (CDS) to 55 transfer data between the classified and unclassified environments (low to high or 56 high to low) must be pre-approved by the Government. 57

The EITaaS Solution Identity and Access Management (IdAM) must integrate with 58 Enterprise Access Management Service-Army (EAMS-A). The EITaaS Provider is 59 responsible to protect against unauthorized user lateral movement within the EITaaS 60 Solution (e.g., control user communications across the environment he/she is set up 61 in). The EITaaS solution shall include a data centric protection solution by 62 leveraging existing Identity Access Management (IdAM) to grant secure access to 63 network assets. 64

Finally, the EITaaS Solution must interoperate with and as appropriate, integrate 65 with existing Government IT infrastructure applications and services to include: 66

Any Government activity determined to be outside of EITaaS (e.g., Morale 67 Welfare and Recreation (MWR) activities) 68

Information Technology Service Management (ITSM) processes including 69 Army Enterprise Service Desk (AESD). (e.g., sharing incident ticket 70 information with AESD while resolving all EITaaS Solution internal tickets.) 71

The EITaaS Pilot schedule, as defined by Phases I – V, include dependent sequential 72 tasks that are non-severable for the entire period of performance. Phase V is projected 73 as (up to) 60-Day transition Phase and will be initiated only after a determination from 74 the Government to Transition Out (Pilot ends) or Transition to Production/Sustainment 75 on the Sites where the Pilot is successful. Should the Government direct a Transition 76 Out, the Government will collaborate with the EITaaS Provider to plan in detail that 77 transition and to assess the actual time-line required. 78

Nine EITaaS Pilot Site Sets planned for FY19 – FY21, depicted in Figure 1 below, were 79 selected by a deliberate decision process as representative of the entire Army owned 80 inventory of 288 real property locations/installations worldwide. The groupings of Pilot 81 Site Sets by row provide a similar scope of installations classified as Small, Medium 82

Version 1.1, 2019-07-16 Page | 3 and Large with unique challenges within each and therefore will be kept as grouped by 83 row and by Fiscal Year order. Any resulting Agreement for Pilot Site Set (row) A – C 84 will be assigned by the Government through a deliberate decision process. The map 85 of the Continental United States is included to depict that the EITaaS Solution pilot 86 must demonstrate an ability to scale across any geo-political boundary. 87

Figure 1 - Planned EITaaS Pilot Site Sets 89

4. EITaaS Pilot Key Goals/Success Metrics and Production: 90 All of the EITaaS Pilot Sites (awarded by Set) will be assessed for demonstrated 91 performance with six metrics that will be used by the Government to measure success 92 of the Pilots by Phase and the readiness to move to Production. Specific Metric 93 Objectives are listed, followed by the definition of Production and the detailed Metric 94 Performance Thresholds: 95

4.1 Available: The EITaaS Solution (network, compute/store) is available to the end 96 user 24/7/365 and interoperable with non-EITaaS installations and the Joint Forces. 97

4.2 Resilient: The EITaaS Solution provides multiple methods for users to transmit and 98 access data in addition to restoration, continuity of operations and disaster recovery 99

Version 1.1, 2019-07-16 Page | 4

4.3 Secure: The EITaaS Solution provides security Solutions that meet or exceed 101 current Department of Defense (DoD) and Army standards. 102

4.3.a Acceptable Cybersecurity Risk – The commercial Risk Assessment of the 103 EITaaS Solution must result in an acceptable level of risk and obtain Government 104 approval before implementation. 105

4.3.b Approved Technologies – The EITaaS Provider will follow Government 106 direction to only employ technologies within the EITaaS Solution that are either on 107 the Approved Product List or a candidate for consideration for approval (that improve 108 national security). 109

4.4 End User Experience: The EITaaS Solution increases readiness through 110 enhanced End User experience and productivity as measured by a comparison of 111 the performance measured in the assessment and Government independent 112 assessment of the “as is” status. Two key measurements are: EITaaS Solution Latency 113 and Customer Satisfaction. 114

“End User” or “User” for this purpose of the EITaaS Pilot includes: All personnel 115 identified as “US Government Authorized Users” for the Department of the Army or 116 DoD network. This includes uniformed military, Government civilians and 117 Government Contractors and DoD/Army Government benefit recipients (e.g., those 118 registered in the Defense Enrollment Eligibility Reporting System (DEERS) to 119 include family members, students, retirees and those enrolled in the Veterans 120 Administration and approved guest(s) / visitors) on and off the designated Pilot 121 locations. The user’s “End User Experience” with the EITaaS Solution will be 122 dependent on the position/role that the individual holds with the range spanning from 123 a “user” that is direct recipient of an issued EITaaS End User Device and the EITaaS 124 applications to a “user” with a “bring-your-own-device” connecting to an EITaaS 125 provided wire-less internet connection in a customer service area. The “End User 126 Experience” incorporates the resolution of incident and service requests. 127

“Incident” for this purpose of the EITaaS Pilot is defined as an unplanned 128 interruption to an IT service or reduction in the quality of an IT service (i.e. ‘WiFi not 129 working’). 130

“Service Request” for the purpose of the EITaaS Pilot is defined as a formal 131 request from a user for something to be provided (i.e. ‘upgrading to a higher version 132 of a software’). 133

4.5 Ability to Scale: The EITaaS Solution can scale to provide support to up to all of 135 the Army Installations within the Continental United States (CONUS) and Outside 136 CONUS (OCONUS) (up to 288 locations). This includes designated geographically 137

Version 1.1, 2019-07-16 Page | 5 separated facilities (owned or leased) and support to uniformed military, Government 138 civilian and Government on-site support contractors at those facilities. 139

4.6 Affordable: The EITaaS Solution is efficient in its utilization of resources and 140 equipment to provide increased performance to users and organizations as 141 measured by the application of the EITaaS Provider cost model (working EITaaS 142 Solution Cost Model delivered in Phase 1) and as compared to the current 143 capabilities and Army IT investment (budget). 144

Version 1.1, 2019-07-16 Page | 6

4.7 Production Defined: 146

10 U.S.C. § 2371b(f) authorizes the Department of Defense (DoD) to structure OT 147 prototype agreements with the potential to award a follow-on production contract or 148 transaction to the participants in the transaction, without further competition. In order 149 to do so, two criteria must be met: 1) competitive procedures must be used to select 150 the performer and 2) the participants must have successfully completed the 151 prototype project provided for in the transaction. Any production award(s) will be the 152 result of competitive procedures through Prototype Project Opportunity Notice 153

(PPON) W15QKN-19-R-06JL. 154

In accordance with 10 U.S.C. § 2371b(f), this competitively awarded Agreement may 155 lead to follow-on production activities if the Key Technical Goals, as defined above in 156 paragraph 4. EITaaS Pilot Key Goals/Success Metrics (Available, Resilient, Secure, 157 End User Experience, and Ability to Scale) are met; or in the event that a particularly 158 favorable or unexpected result is accomplished that justifies transition to production. 159

The anticipated scale of a production follow-on is within the metric 4.5 Ability to 160 Scale - to provide support to up to all of the Army Installations within the Continental 161 United States (CONUS) and Outside CONUS (OCONUS) (up to 288 locations). 162 This includes designated geographically separated facilities (owned or leased) and 163 support to uniformed military, Government civilian and Government on-site support 164 contractors at those facilities. 165

4.8 Success Metrics and Performance Thresholds: The success metrics are 166 assigned definitions and minimum performance thresholds measurements in table 1 167 below: 168

Table 1 Success Metrics, Definitions and Performance Thresholds 170

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S) 1.

Availability

Amount of time the system or service is available to the user.

WAN: 99.99%

LAN: 99.99%

End User Services / Applications:

99.99%

Services, Storage, Collaboration Environments:

99.99%

2. a.

Resilience

Redundancy or failover to sustain high levels of availability.

Services:

Multiple, redundant communication paths must be greater than one.

Services: Multiple instances of services to ensure no single point of failure.

Devices:

Replacement devices or restoration of device functionality.

Services: Multiple instances of services or storage to ensure no single point of failure.

Version 1.1, 2019-07-16 Page | 7

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

2. b.

Restoration

Restore from service outages due to complete or partial failures of hardware and/or software components within any segment of the end-to-end network solution.

Each Incident will be assessed in terms of its Impact upon the Customer and the Urgency with which the Customer requires the Incident to be Resolved.

EITaaS Provider’s specific rule set for definitions of Impact Levels and Priority as documented in the Service Level Agreement.

Catastrophic Incident, Severity 1: < 15 Minutes per Event (Expected Service Level 98% of the time) Critical Incident, Priority 2: < 1 Hours per Event (Expected Service Level 98% of the time) Major Incident, Priority 3: < 4 Hours per Event (Expected Service Level 96% of the time) Normal Incident, Priority 4: < 2 Days per Event (Expected Service Level 94% of the time)

Catastrophic Incident, Severity 1: Same as LOE 1.1

Critical Incident, Priority 2: Same as LOE 1.1

Major Incident, Priority 3: Same as LOE 1.1

Normal Incident, Priority 4: Same as LOE 1.1

Catastrophic Incident, Severity 1: Same as LOE 1.1

Critical Incident, Priority 2: Same as LOE 1.1

Major Incident, Priority 3: Same as LOE 1.1

Normal Incident, Priority 4: Same as LOE 1.1

3. Secure Security of end-to-end network and services solution in accordance with applicable Government policy and Industry best practices.

Includes all necessary means to achieve a security posture where all vulnerability and risks are identified, assessed, mitigated, prevented, and remediated.

Monitoring, Detection, and Prevention of Vulnerabilities: 24 Hours Per Day, 365 Days Per Year

Vulnerability Incident Containment and remediation: < 4 Hours per Event

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

Monitoring, Detection, and Prevention of Vulnerabilities:

Same as LOE 1.1

Vulnerability Incident Containment and remediation:

Same as LOE 1.1

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

Monitoring, Detection, and Prevention of Vulnerabilities:

Same as LOE 1.1

Vulnerability Incident Containment and remediation:

Same as LOE 1.1

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

Version 1.1, 2019-07-16 Page | 8

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S) 4.a.

End User Experience

- Latency

End User Experience as measured through EITaaS Solution Latency.

Maximum amount of elapsed time / round trip network transit delay from the end device ingress point to its intended egress point within the overall network solution.

WAN: < 180 ms LAN: < 50 ms

Maximum End-to- End Latency (From the Service Delivery Point to the End Device): < 250 ms

End User Access to Services, Device Response Time:

< 180 ms < 50 ms

Maximum End-to- End Latency:

Same as LOE 1.1

Access to Storage or Applications:

< 180 ms < 50 ms

Maximum End-to- End Latency:

Same as LOE 1.1

4.b.

End User Experience

- Customer Satisfaction

End User Experience which includes service requests and ticket responses as measured through Customer Satisfaction (Government) surveys collected with results aggregated.

Survey Scale:

5: Very Satisfied 4: Satisfied 3: Neither satisfied nor dissatisfied 2: Dissatisfied 1: Very Dissatisfied

Benchmark: 4.3 (86%) against daily, monthly survey results.

Govt Surveys collected.

Expected service level 4.3 of 5.0 or 86% of aggregated survey results for the time period.

Survey Questions Structured to Determine customer productivity in accomplishing their mission, responsiveness to customer needs, and usability of the EITaaS Solution(s).

Surveys – Same as LOE 1.1

Surveys – Same as LOE 1.1

5. Ability to Scale

Ability to Scale measured by the performance of the first Pilot Site (against the Metrics 1 – 4) as the EITaaS Solution is implemented and users/organizations are added at that site.

Additionally, if/when a second and/or third Pilot Sites are added, the metrics from the first Site will be the baseline for comparison of performance to the second and third Pilot Site after the increase in numbers of users, geographic locations, and capabilities.

NaaS: Maintain high levels of network capacity and availability as the user base increases.

EUD, EUS:

Maintaining high levels of user satisfaction while expanding user base, geographical, with additional capabilities.

C&S: Maintain high levels of performance (responsive, latency, availability, resilience) as user base, and capabilities scale to additional sites.

Version 1.1, 2019-07-16 Page | 9

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

Measurement of the performance of any centralized capabilities in the EITaaS Solution are spread across a broader user and geographic locations, allowing for the deployment of additional capabilities.

6.

Affordability

Resource strategy that optimizes investments, while costs are controlled with the addition of Scaling (Metric 5), increases in performance (Metrics 1, 2, 3) and retires underperforming legacy infrastructure.

Costs equal to industry standards for a as a service model.

Same as LOE 1.1 Same as LOE 1.1

5. EITaaS Pilot Lines of Effort (LOEs) Objectives 172 There are three (3) Lines of Effort (LOEs) in this EITaaS Pilot that will be implemented 173 at each of the designated Pilot Site locations at the same time (See Figure 1 above). 174 To achieve performance as an enterprise the EITaaS Solution must support all three 175 simultaneously at one or more designated Pilot Site(s). 176

The EITaaS Lines of Effort (LOEs) are: 177

LOE 1: Network as a Service (NaaS) 178

LOE 2: End User Services (EUS) 179

LOE 3: Compute and Store (C/S) 180

Version 1.1, 2019-07-16 Page | 10

Figure 2 - Army EITaaS Lines of Effort (LOE) 183

As an enterprise Solution, Identity and Access Management (IdAM) and security with 184 Data Protection at Rest and In-Transit apply to all LOEs. 185

The first LOE 1.1, Network as a Service (NaaS), includes Wide Area Networks 186 (WAN), Installation-Campus Area Network (ICAN), Capability for Army Unit’s Tactical 187 Network to connect/interconnect to Pilot Site/Installation Network (Installation as a 188 Docking Station), Land Mobile Radio (LMR), Enterprise Defense, Data Recovery, and 189 NIPR/SIPR Cross Domain Solution(s). 190

The second LOE 1.2, End User Services (EUS), includes End User Devices, 191 Information Technology Service Management (ITSM), Video Collaboration, Endpoint 192 Device management, multi-function device(s), Video Collaboration, User Provisioning, 193 Telephony, Pilot Site Emergency Communications, Unified Communications, Service 194 Level Catalog (based on user profiles) and Mobility Management. 195

The third LOE 1.3, Compute and Store (C&S) includes the Collaborative Data 196 Environment, Global Access to Data, the Installation Data Center and export to 197 designated Army Data Analytic Solutions. 198

Managed at the Enterprise level, detailed objectives include the following: 199

5.1 WAN: Demonstrate that the EITaaS Solution will provide a connection to 200 the Internet and authorized cloud providers from local installation and 201 remote users to ensure that Army organizations can operate installation 202 mission functions over an EITaaS Solution Wide Area Network that is 203 interoperable with all DoD, Joint, and potential multi-national systems and 204

Version 1.1, 2019-07-16 Page | 11 networks while improving throughput and minimizing latency. Connection to 205 authorized cloud providers and connect mission critical applications while 206 ensuring security of data. 207

5.2 ICAN: Demonstrate EITaaS Solution is capable of service and delivery to a 208 designated Pilot Site providing voice, data, wired and wireless, networking 209 functions and migrate those functions to a reliable and resilient commercial 210 service delivery model which meets or exceeds current delivery capabilities 211 and capacities. ICAN includes Data Recovery services, and capability for 212 Tactical Network connect/interconnect to Pilot Site/Installation Network 213 through their point of presence. 214

5.3 Network Performance: Demonstrate that the EITaaS Solution meets or 215 exceeds the availability threshold (Table 1, Metric 1), reduces logical and 216 physical bottlenecks, provides redundancy/failover through logical and 217 physical diversity (on and off installation). Through consistent, standardized 218 configurations and toolsets, the EITaaS Solution should reduce human 219 touch points with automated incident discovery and remediation. 220

5.4 Mission Effectiveness: Demonstrate that the EITaaS Solution provides 221 visibility and operational effectiveness to accomplish the Mission of the 222 designated Pilot Site(s), assigned units, organizations and end users. 223

5.5 Commercial Innovation: Demonstrate ability to of the EITaaS Provider to 224 partner with the Army to enhance the agility and cyber security of Army IT 225 operations. 226

5.6 End User Devices and Services: Demonstrate the implementation and 227 maintenance of a user-centric approach to end user devices and services. 228 User personas will enable access to the data, applications and services 229 they need to accomplish their missions. Devices will be user conduits to 230 authorized data, applications and services, regardless of device type, 231 including organizational multi-function devices for print, scan capability 232 while at work. Enable the capability to support Bring Your Own Device 233 (BYOD) to extend user capability with secure access and protection of 234 enterprise data and applications. Included services are: 235

a) User devices (laptops, tablets, phones, smartphones) 236

b) Printers 237

c) Video and VTC systems 238

d) Telephony systems 239

e) Unified Communications systems 240

f) Mobility management systems and methods 241

g) Asset visibility (End Device Management) 242

h) ITSM processes and Standard Operating Procedures 243

Version 1.1, 2019-07-16 Page | 12

i) Transition and Fielding management and support 244

j) Defense Enterprise Email and Defense Collaboration Services support 245

5.7 Account Management and Network Operations (NetOps): Demonstrate 246 that the EITaaS Solution can provide enterprise level account management 247 across networks, user accounts, applications, and system administrative 248 functions (e.g., authentication, account management, and request 249 fulfillment). 250

5.8 Identity and Access Management (IdAM): Demonstrate that the EITaaS 251 Solution shall reduce IdAM complexity (from user perspective, as compared 252 to the current process) while maintaining high levels of security with 253 solution(s) that rationalize multiple identities, personas, roles, while 254 factoring user "place" (e.g., Govt, public, home, domestic, foreign) to permit 255 seamless and secure access to the resources users need given their 256 situation. 257

5.9 Network Operations (NetOps) Collaboration: Demonstrate visibility of 258 assets and system performance through common toolkits, dashboards, and 259 analytics that provide a complete view for government and industry partners 260 that can be tiered and accessed based on organization, geography, 261 function, or capabilities. 262

5.10 Commercial Solutions for Classified (CSfC): Demonstrate use of the 263 National Security Agency’s (NSA) CSfC program to identify, configure, 264 deploy and sustain NSA-certified products that provide commercial, 265 affordable solutions that use commercial products in layered solutions, 266 capable of protecting classified Defense/National Security Systems (NSS) 267 information. 268

5.11 Mobility: Demonstrate secure, mobile solutions (e.g. BYOD) that 269 optimizes the end user experience. Provide device/persona access to the 270 resources needed from anywhere, anytime. 271

5.12 Land Mobile Radio (LMR): Demonstrate solutions for integration of non-272 tactical LMR systems in support of installation public safety, training, 273 organizations and functions. Including first responders, force protection and 274 other installation management functions that require local, state and federal 275 mutual aid interoperability, advanced encryption standards and priority 276 queuing for life and safety communications, as well as increased spectrum 277 efficiency. The LMR solution requires logging and archiving for emergency 278 voice communications as well as the ability to program and recover over the 279 air. Additionally the solution must have the ability to maintain trunked 280 communications through Graceful Systems Degradation. Solution must 281 support provide compatibility with current and future LMR upgrades that 282 typically entail system management centers, repeaters, dispatch consoles, 283 handheld, mobile and desktop radios, and antennas. All acquired systems 284 meet Association of Public-Safety Communications Officials (APCO) P25 285 standards. 286

Version 1.1, 2019-07-16 Page | 13

5.13 Compute and Store: Demonstrate that the EITaaS provider can 287 implement and manage cohesive, executable, and secure access to 288 applications, data, and compute and store infrastructure that optimizes 289 collaboration (team, organization, cross-organization), asset management, 290 and compute/store performance. To include: 291

a) Global data access and storage 292

b) Legacy data system and source support 293

c) Data centers and processing nodes 294

d) Definitive media library (DML) of all software in use 295

e) Data backup and recovery solutions 296

f) Collaborative data environment consisting of knowledge management, 297 workplace collaboration, document, individual storage, and workflow 298 management solutions 299

6. Schedule 301 The EITaaS Pilot schedule will cover up to 36 Months total, with five (5) defined 302 phases for each Pilot Site. Only the initial Pilot Site will have 36 Months of activity, 303 Pilot Site 2 and 3 will be shorter as determined by the staggered Fiscal Year Funded 304 awards. Each phase will be assessed against the EITaaS Provider’s plan of action 305 and milestones. Success must be achieved at each phase to be given the opportunity 306 to move to the next phase. Each phase period of performance is defined as “up to” 307 number of days. Initiation of activity at the next designated phase and Pilot Site 308 requires both Government approval and funding. 309

The EITaaS Provider’s detailed integrated master schedule will be reviewed at the 310 Kick Off meeting, “baselined” and incrementally evolved per the EITaaS Provider’s 311 process, with changes submitted for Government approval. At a minimum, the 312 schedule shall identify major project capability milestones, dependencies, work 313 breakdown structure, resources required (Government and Provider) and activities 314 associated with the project at the level of detail appropriate. 315

Five (5) EITaaS Phases planned for each Pilot Site location (Sequential at each 316 Pilot Site, based on demonstrated performance and funding available) 317

Phase I – Assessment (Up to 30 Days) at each awarded Pilot Site 318

Phase II – Plan and Prepare (Up to 180 Days / 6 Months for FY19 Site 1 [AFC, Polk 319 or Roberts], 6 Months for FY20 Site 2 [Leavenworth, Dugway or Benning] and 4 320 Months for FY21 Site 3 [Gordon, Huachuca or Irwin]) 321

Phase III – Implement (Up to 365 Days / 12 Months for FY19 Site 1 & FY20 Site 2 322 and 9 Months for FY21 Site 3) 323

Phase IV – Operate (Up to 519 Days / 15 Months for FY19 Site 1, Up to 9 Months for 324 FY20 Site 2 and 7 Months for FY21 Site 3) 325

Version 1.1, 2019-07-16 Page | 14

Phase V – Transition Out (End Support) or Transition to Production / Sustainment of 326 the approved Pilot Solution (Up to 60 Days). Any Transition to Production, will be in 327 parallel with Phase IV - Operate. 328

Figure 3 - EITaaS Notional Schedule 329

6.1 Phase I – Assessment (Up to 30 Days). This Phase begins no earlier than one 330

(1) business day after agreement award. The assessment will include an 331 analysis of the Government infrastructure and its capacity to provide a parallel 332 capability that is logically separate from the Government network. This Phase is 333 complete with the submission and Government acceptance of the Assessment 334 Findings, a working EITaaS Solution Cost Model and all other relevant deliverable 335 items in Table 2 – EITaaS Data Deliverables List. The Assessment deliverable is 336 a report/data that provides the EITaaS Provider and the Government an up-to-337 date inventory and assessment of the quality of the current installation IT 338 resources, to include end user devices. 339

6.2 Phase II – Plan and Prepare (Up to 180 Days / 6 Months for Site 1 & 2 and 4 340 Months for Site 3). This Phase begins no earlier than one (1) business day after 341 Phase I initial Assessment findings are available and approved by the EITaaS 342 Provider and the Government. The Plan for Phase II will include: 343

a) Any planned use of Government infrastructure capacity, if that capacity is 344 included in the EITaaS Solution (not a Government requirement) 345

b) Any new EITaaS Solution infrastructure that will be provided. 346

c) The Plan of Action and Milestones (POAM) for migration and validation of the 347 EITaaS Solution before implementation 348

d) Update the data deliverables, specifically the IMS and Working EITaaS 349 Solution Cost Model 350

Version 1.1, 2019-07-16 Page | 15

This phase is complete when all of the Hardware and Software needed to initiate 351 Phase III is on order or on-hand. The key deliverable is a resource loaded 352 integrated master schedule (IMS) that provides the detailed plan for implementing 353 the EITaaS Solution at the Pilot Site for the assigned organizations, units and 354 users. The IMS, or in a separate report, shall identify all of the Government 355 resources required. In addition to the IMS, the EITaaS Provider shall make 356 available all other Phase II relevant deliverable items in Table 2 – EITaaS Data 357 Deliverables List. Relevant to this phase are Network Architecture Diagrams that 358 depict the level of detail needed to inform the decisions to commit resources for 359 this Phase II and follow-on Phases and also the catalog of end user devices and 360 the distribution plan. 361

6.3 Phase III – Implement (Up to 365 Days / 12 Months for Site 1 & 2 and 9 Months 362 for Site 3). This Phase begins no earlier than when the EITaaS Provider is in 363 receipt of EITaaS hardware/software to be installed or configured to support the 364 designated Pilot Site with a parallel network as identified in the IMS. Initiation of 365 this phase with a partial inventory of resources is acceptable. The steps within 366 this phase include: 367

a) Build the EITaaS Solution 368

b) Validate the EITaaS Solution 369

c) Migrate – All Government services and users (identified in Phase I) over time 370 to the EITaaS Solution 371

d) Update the data deliverables, specifically the IMS and Working EITaaS 372 Solution Cost Model 373

In addition, the EITaaS Provider shall make available all other Phase III relevant 374 deliverable items in Table 2 – EITaaS Data Deliverables List. 375

6.4 Phase IV – Operate (Up to 520 Days / 15 Months for Site 1, Up to 9 Months for 376 Site 2 and 7 Months for Site 3). This Phase begins no earlier than when the 377 EITaaS Provider determines all hardware/software is on-hand/installed/configured 378 and the assigned Army organizations have Full Operational Capability (FOC) to 379 perform their normal functions / support using the EITaaS Solution. FOC of the 380 EITaaS Solution will be measured against the Phase I assessment (“as is”) 381 results and any additions/deletions (of organizations/units/missions) to the Pilot 382 Site over the Pilot period of performance. FOC will be met when the EITaaS 383 Solution demonstrates the Success Metrics in paragraph 4. Key to demonstrating 384 success, the EITaaS Provider shall make available all other Phase IV relevant 385 deliverable items in Table 2 – EITaaS Data Deliverables List. At month 34 of the 386 Period of Performance, the Government will initiate the assessment to move to 387 Phase V as Transition Out or Transition to Production/Sustainment. Phase IV – 388 Operate may continue as continuity of service until month 36, the end of the 389 Period of Performance. 390

Version 1.1, 2019-07-16 Page | 16

6.5 Phase V – Transition Out (End Support) or Transition to Production/Sustainment 391 of the approved Pilot Solution (Up to 60 Days). This Phase begins at any point in 392 time when the Government issues a written determination that the EITaaS 393 Provider has failed to meet the performance of this SOO (at any Phase) and so 394 directs a Transition Out, or no later than when the Government issues a 395 determination that Phase IV objectives have been met, and issues a directive to 396 Transition to Production/Sustainment. 397

6.5.a Transition Out – Should the Government direct a Transition Out, the EITaaS 398 Provider is tasked to return the IT service levels – including all Army data – at all 399 of the Pilot Sites designated in the Agreement Award impacted to the level of 400 operational capability prior to the initiation of the pilot activities or better. Data 401 transfers will be completed as required from the EITaaS Solution to a designated 402 Government location (e.g. Data Center). This includes the transfer of the EITaaS 403 Solution Phase I – IV relevant deliverable items in Table 2 – EITaaS Data 404 Deliverables List. The Government will collaborate with the EITaaS Provider to 405 plan in detail the tasks required for any Transition Out and the actual time-line 406 required. 407

6.5.b Transition to Production – Should the Government direct a Transition to 408 Production, the EITaaS Provider is tasked prepare a plan and a Performance 409 Work Statement for a 36 month Production Period of Performance (commencing 410 after the Pilot concludes). Additional instructions and a list of deliverables will be 411 provided by the Government. The EITaaS Solution will remain in service under 412 the Phase IV Operate conditions with no break of service or support. 413

6.6 Schedule Constraints – Reference Figure 3, Notional EITaaS Schedule. The 414 initiation for each phase at each designated Pilot Site (e.g. Pilot Site 1, 2 & 3) is 415 dependent on Government funding and approval. Approval for Phase II – V is 416 also dependent on the EITaaS provider completing the tasks for the previous 417 phase. For the FY19 funded Pilot Sites, and for the planned Pilot Period of 418 Performance, the Internet Access Point (IAP) for all EITaaS Solutions will be 419 provided by the Government. Therefore, a commercial solution for IAP is not in 420 Scope of this SOO. 421

7. Data Deliverables and Delivery Schedule: 422 The EITaaS Provider shall deliver the data items listed in the table below as the 423 minimum (the Government and or the EITaaS Provider may define others) in the 424 EITaaS Provider’s commercial and Government approved format (approval will be after 425 award). Content shall also be defined by the EITaaS Provider with Government 426 approval. The EITaaS Provider may use any applicable Government Data Item 427 Description (DID) references only as a starting guide. 428

The Pilot Deliverable Data Items (Minimum list) shall be made available [delivered] to 429 the Government on a schedule that supports the activities of each of Phases I – V and 430 the requirement to demonstrate successful performance of the Phase before moving to 431

Version 1.1, 2019-07-16 Page | 17 the next phase. Timing must support any required decisions and/or resource 432 allocations. 433

Table 2 – EITaaS Data Deliverables List, all numbered items to be submitted and/or 434 made available in a digital file format appropriate for the item (title) that is readable by 435 an End User on an End User Device (examples include Dashboards (depicting live 436 and/or historical data), flat files in Microsoft Office ® (2013) and/or Adobe®) by the 437 EITaaS Government Project Management Office and Functional Management Office. 438

Table 2 – EITaaS Data Deliverables List 439

Line of Effort

**EITaaS Pilot Deliverable Data Items (Minimum list) Delivered with the following

Rights

All LOEs

1) Network & Security Logs

2) Network: Architecture Diagrams (All defined levels of detail), Configuration Data and Internet Protocol (IP) addressing schema

3) Network Availability, Performance & Latency

4) Cybersecurity Readiness/ Risk Status

5) Change Control Board Plan/Process/Workflow

6) Configuration Management

7) Quality of Service Status: Network, Devices, etc.

8) Future Technology Roadmap

9) Continuity of Operations, Data Recovery and Restoration (to include Recovery Point Objective) Asset Visibility/ Management

10) Service Interruption

11) Integrated Master Schedule, organized by Work Breakdown Structure (WBS), resource loaded with EITaaS Provider/Solution and Government resources (as appropriate), (continually updated during each Phase)

12) Usage Status of the Solution, Network, Device, Service or Platform

13) Working EITaaS Solution Cost Model, (updated at each Phase)

Government Purpose Rights

(GPR)

LOE 1.1

NaaS

1) Active Directory Diagram

2) Usage Status: Network & Bandwidth

3) Data Recovery Status

GPR

LOE 1.2

EUS

1) Asset Availability, Inventory and Provisioning

2) Service Desk Logs: By user type

3) End user device status report (availability, distribution)

4) End user services status report (availability, allocation)

GPR

LOE 1.3

C&S

1) Export of data (to Army Analytic Platforms)

2) Transmitted data (export report)

3) Usage Status: Storage and Processing

GPR

**NOTE: All EITaaS Solution Deliverable Data is to be delivered with at least Government 440 Purpose Rights. See Agreement Terms and Conditions. 441

Version 1.1, 2019-07-16 Page | 18

8. Government Furnished Material, Equipment and Information: 443 After agreement award, the Government will provide the EITaaS Provider access to 444 requisite program and technical information necessary to carry out the requirements of 445 this document. No access or surveys will be granted prior to award. 446

8.1 All Government generated data residing on or transmitting through the EITaaS 447 Solution will remain as “Government Data”. 448

8.2 The Government will provide access to facilities, equipment, software tools, and 449 technical information necessary for the performance of this Agreement (e.g., 450 information on EAMS-A and access for site surveys). Material items may also 451 include office space, desks, telephones, printers, access to electronic mail, and 452 computers, when deemed appropriate by the Government. 453

8.3 The Government will provide approvals of EITaaS Solution Software and 454 Hardware as needed for all LOEs. 455

8.4 EITaaS Provider personnel will not use Government resources in violation of any 456 federal, State, or Local statute, regulation or policy. 457

8.5 EITaaS Provider personnel identified to access Government networks must 458 possess the requisite training and clearances (e.g. favorable Single Scope 459 Background Investigation (SSBI), Security+, etc.) 460

9. EITaaS Provider Furnished Material and Equipment (as a Service): 462 The EITaaS Provider is responsible to furnish all of the material (hardware/software) 463 and the required Data Items to implement the EITaaS Solution. Any co-use of 464 Government materials and/or equipment will be determined after the Phase 1 465 assessment and must be mutually agreed to. 466

At the conclusion of the EITaaS Pilot, (see Phases IV & V above) the Government and 467 the EITaaS Provider will complete a joint inventory of the EITaaS Provider furnished 468 software and hardware material and equipment (by LOE) that is installed or in-service at 469 a Government designated Pilot Site, Government operated facility or under the control 470 of (in the possession of) Government end users. The joint inventory will include an 471 assessment and joint determination of the transfer of ownership to the Government. 472

a) If the EITaaS Pilot ends with a Transition Out and will not proceed to 473 Production/Sustainment, the Government intends to assume ownership of any 474 hardware material and equipment installed on a Government Installation or 475 Government operated facility or assigned to the end users. 476

b) If the Pilot ends with a transition to Production/Sustainment, the joint inventory 477 will support the assessment for the planning of a Production start. 478

Version 1.1, 2019-07-16 Page | 19

10. Travel Requirements: 481 The EITaaS Provider shall support Government directed meetings as needed. All travel 482 costs (Lodging, per diem, air fare, rental car etc.) shall be included in the proposed 483 price. The Government will reimburse travel in accordance with the General Services 484 Administration (GSA) published Per Diem rate(s) for the time period of the travel. 485 Transportation costs will be reimbursed at GSA Mileage rates, or economy/coach level 486 means of transportation (e.g., car/plane/train). EITaaS Provider personnel are 487 responsible for making their own travel and lodging arrangements as necessary to 488 support Pilot requirements. The EITaaS Provider will plan to support all the tasks at 489 the three (3) designated Pilot sites to implement the EITaaS Solution. 490

11. Period of Performance: 492 The Phases I – V are interdependent and non-severable for the entire period of 493 performance. The period of performance will conclude at the direction of the 494 Government or on completion of the full extent of the Pilot or 36 months, whichever 495 comes first. The Government will make a determination for Phase V Transition and the 496 Pilot will officially conclude with completion of the Transition to production/sustainment 497 or Transition Out. 498

12. Place of Performance: 500 The EITaaS Provider may utilize their own facilities when executing the work 501 associated with this SOO. The Government will select the three designated Pilot Sites 502 (and group them by Pilot Site Set, where each Set includes one site that is Small, 503 Medium and Large) through a deliberate decision process and include them in the 504 award agreement. The EITaaS Provider shall support meetings and tasks at the three 505 designated Pilot Sites during the period of performance. In addition, the EITaaS 506 Provider shall support meetings and coordination with the Program Management 507 Office and Functional Management Office at locations on Fort Belvoir, VA and at 508 designated locations in the National Capital Region. The Government reserves the 509 right to identify and assign additional EITaaS Installations and locations for the overall 510 EITaaS Pilot. 511

13. Security: 513 Reference the EITaaS Pilot DD Form 254, Contract Security Classification 514 Specification. The nature of this Pilot requires access to, handling, receiving and 515 storing classified (Secret (to include Sensitive Compartmented Information (SCI)) and 516 Confidential) and Controlled Unclassified Information (CUI), Personally Identifiable 517 Information, Personal Health Information, unclassified information, documents, 518 hardware and software using the applicable standards of DoD 5220.22-M National 519 Industrial Security Program (NISPOM). The work performed by the EITaaS Provider 520 will require access to Secret, (Sensitive Compartmented Information Facilities (SCIF)), 521 Controlled Unclassified Information facilities and work spaces. The EITaaS Provider 522

Version 1.1, 2019-07-16 Page | 20 personnel will be required to attend meetings at classified and unclassified levels. See 523 Enclosure 0002 Army EITaaS Personnel Security Requirements for details. 524

14. Milestone Payment Schedule: 525 The following table represents the payable Milestones: (instruction: prepopulated with 526 Example milestones and example dates, please tailor to your specific proposal timeline. 527 Ensure each description begins with the applicable Phase of performance. Note: the 528 CLIN structure will have a Parent CLIN i.e. 1001 to represent the total Phase value and 529 subCLINs to represent each payable milestone. Milestones must be measurable and 530 meaningful events. Milestone values and frequencies may be subject to negotiation: 531 examples include if they are unevenly distributed, too frequent, not considered 532 meaningful, not able to be measured. Delete this instruction prior to submission) 533

Table 3 – EITaaS Milestone Payment Schedule 534 Milestone Number

Milestone Description No Later Than Due Date

(Days after award)

Amount

01 Phase I – Assessment Completion 30 $ 02 Phase II – Acceptance of Draft ‘Plan’ 90 $ 03 Phase II – Purchase of Long Lead Items for

Phase III 120 $

04 Phase II – Acceptance of Final Phase II Reports 180 $ 05 Phase III –

Version 1.1, 2019-07-16 Page | 21

Enclosures 536

Enclosure 0001: Army EITaaS Initial Requirements Document 537

Enclosure 0002: Army EITaaS Personnel Security Requirements 539

Enclosure 0003a1-4: Army EITaaS Fact Sheets Ft Benning (Marked FOUO; 541 Information for Initial Award) 542

Enclosure 0003b1-4: Army EITaaS Fact Sheets Ft Polk (Marked FOUO; Information 544 for Initial Award) 545

Enclosure 0003c: Army EITaaS AFC Fact Sheet-LOE (Marked FOUO; Information for 547 Initial Award) 548

Enclosure 0003d1-2: Army EITaaS Camp Roberts Fact Sheets (Marked FOUO, 550 Information for Initial Award) 551

Enclosures TBD: Service Level Agreement (SLA) Standards, to be added at/after 553 Agreement Award 554

TBD.a. SLA Across All LOEs 556 To be provided by the EITaaS Provider and agreed to by the Government. 557

TBD.b. SLA for Line of Effort (LOE) 1.1 Network as a Service 559 To be provided by the EITaaS Provider and agreed to by the Government. 560

TBD.c. SLA for LOE 1.2 End User Service (EUS) 562 To be provided by the EITaaS Provider and agreed to by the Government. 563

TBD.d. SLA for LOE 1.3 Compute and Store 565 To be provided by the EITaaS Provider and agreed to by the Government. 566