Army_EITaaS_Statement_Of_Objectives_29JULY2019_-_Amendment_0006.pdf

Army – Enterprise Information

Technology as a Service (EITaaS)

Statement of Objectives

Solicitation Number: W15QKN-19-R-06JL

Version 1.2, 29 July 2019

Change Key:

YELLOW = Version 1.1, 16 July 2019 BLUE = Version 1.2, 29 July 2019

Army – Enterprise Information Technology as a Service (EITaaS) Statement of Objectives (SOO)

Version 1.2, 2019-07-29 Page | 1

1. Overview 2 Today’s Army installation/administrative enterprise information technology is identified 3 as a weapons platform which enables the entire force to perform the Army’s 4 administrative and power projection tasks. Army installation operations depend on 5 timely, secure, and reliable delivery and transmission of data. Today, the Army owns 6 and operates its entire information technology (IT) and long-distance communications. 7 This current own/operate model produces slow rates of changes and technology 8 adoption that diverges from similar commercial offerings. 9

The Army is exploring a new approach for delivering the enterprise network and core 10 IT services: Enterprise IT as a Service (EITaaS). The EITaaS Pilot effort will assess 11 the achievability and feasibility for deployment of commercial solutions for data 12 transport, end-user device provision, and cloud services for selected Army 13 installations. 14

The EITaaS Pilot assessments will permit the Army to maximize the value of the 15 enterprise IT investments while still allowing the users to retain the ability to tailor their 16 services and service levels. The Army seeks to partner with commercial IT Service 17 Provider(s) to deliver innovative and modernized Solutions to transform IT services, 18 improve cyber readiness, and allow re-missioning of personnel to cyber warfighting 19 missions. 20

2. Purpose 21 The specific purpose of this EITaaS Pilot is to partner with industry to reform existing 22 and future Army EITaaS operations and services delivery through commercial services 23 in order to increase mission effectiveness, increase IT user efficiencies, and establish 24 standardized, innovative IT services. This Pilot will address the outcomes sought in 25 the approved and current “Enterprise Information Technology as a Service (EITaaS) 26 Initial Requirements Document”, provided separately. The Pilot focus is on the end 27 users’ and installation organizations’ mission needs, with outcomes that improve IT 28 availability, resiliency, security, and affordability while improving the end users’ 29 experience. 30

3. Scope 31 EITaaS will provide commercial delivery and management of Non-classified Internet 32 Protocol (IP) Router Network (NIPRNet) and Secret Level Secure Internet Protocol 33 Router Network (SIPRNet) IT services from the enterprise to the point of need (user) 34 securely. The EITaaS Solution will adhere to applicable Federal Government Laws and 35 Cybersecurity regulations and policies, until any submitted waiver(s) are approved by 36 the Government. During this pilot, the EITaaS Provider will deliver an EITaaS Solution 37 as a parallel/non-interfering network and devices. The EITaaS Provider is responsible 38 to provide its EITaaS Solution for enterprise use up to three (3) designated Army Pilot 39 Sites (one each Small, Medium and Large, grouped in a “Set”) included in the 40 Agreement Award. (See Figures 1, 2, 3 and paragraph 12, Place of Performance) 41

Version 1.2, 2019-07-29 Page | 2

Prototype EITaaS Solutions shall connect, protect, store, and compute, with common 42 IT services, hardware, software, and networking infrastructure. The EITaaS Provider 43 shall demonstrate the ability to establish a parallel IT network and services while 44 demonstrating the capability to transition existing IT services to a commercial EITaaS 45 Solution offering. Any co-use (ex, the Army has unused capacity on Switches, Routers 46 and Underground Fiber Lines.) of Government equipment must be documented in the 47 assessment and approved by the Government. The Government projects that only 48 non-interference co-use will be approved. 49

Additionally, the EITaaS Provider will demonstrate the ability to support joint cyber 50 security operations including (but not limited to) the sharing of security log, event 51 and incident data, and cooperative work with the Army designated Cyber Security 52 Service Providers (CSSPs) and Regional Cyber Centers. The EITaaS Solution will 53 demonstrate the capability to encrypt Army Data at Rest, Data in Transit/in Motion 54 and Data in Use throughout the network environment. The EITaaS Solution will 55 demonstrate the use of a Government approved encryption solution Commercial 56 Solution for Classified (CSfC). Any EITaaS Cross Domain Solution (CDS) to 57 transfer data between the classified and unclassified environments (low to high or 58 high to low) must be pre-approved by the Government. 59

The EITaaS Solution Identity and Access Management (IdAM) must integrate with 60 Enterprise Access Management Service-Army (EAMS-A). The EITaaS Provider is 61 responsible to protect against unauthorized user lateral movement within the EITaaS 62 Solution (e.g., control user communications across the environment he/she is set up 63 in). The EITaaS solution shall include a data centric protection solution by 64 leveraging existing Identity Access Management (IdAM) to grant secure access to 65 network assets. 66

Finally, the EITaaS Solution must interoperate with and as appropriate, integrate 67 with existing Government IT infrastructure applications and services to include: 68

Any Government activity determined to be outside of EITaaS (e.g., Morale 69 Welfare and Recreation (MWR) activities) 70

Information Technology Service Management (ITSM) processes including 71 Army Enterprise Service Desk (AESD). (e.g., sharing incident ticket 72 information with AESD while resolving all EITaaS Solution internal tickets.) 73

The EITaaS Pilot schedule, as defined by Phases I – V, include dependent sequential 74 tasks that are non-severable for the entire period of performance. Phase V is projected 75 as (up to) 60-Day transition Phase and will be initiated only after a determination from 76 the Government to Transition Out (Pilot ends) or Transition to Production/Sustainment 77 on the Sites where the Pilot is successful. Should the Government direct a Transition 78 Out, the Government will collaborate with the EITaaS Provider to plan in detail that 79 transition and to assess the actual time-line required. 80

Nine EITaaS Pilot Site Sets planned for FY19 – FY21, depicted in Figure 1 below, were 81 selected by a deliberate decision process as representative of the entire Army owned 82

Version 1.2, 2019-07-29 Page | 3 inventory of 288 real property locations/installations worldwide. The groupings of Pilot 83 Site Sets by row provide a similar scope of installations classified as Small, Medium 84 and Large with unique challenges within each and therefore will be kept as grouped by 85 row and by Fiscal Year order. Any resulting Agreement for Pilot Site Set (row) A – C 86 will be assigned by the Government through a deliberate decision process. The map 87 of the Continental United States is included to depict that the EITaaS Solution pilot 88 must demonstrate an ability to scale across any geo-political boundary. 89

Figure 1 - Planned EITaaS Pilot Site Sets 91

4. EITaaS Pilot Key Goals/Success Metrics and Production: 92 All of the EITaaS Pilot Sites (awarded by Set) will be assessed for demonstrated 93 performance with six metrics that will be used by the Government to measure success 94 of the Pilots by Phase and the readiness to move to Production. Specific Metric 95 Objectives are listed, followed by the definition of Production and the detailed Metric 96 Performance Thresholds: 97

4.1 Available: The EITaaS Solution (network, compute/store) is available to the end 98 user 24/7/365 and interoperable with non-EITaaS installations and the Joint Forces. 99

Version 1.2, 2019-07-29 Page | 4

4.2 Resilient: The EITaaS Solution provides multiple methods for users to transmit and 100 access data in addition to restoration, continuity of operations and disaster 101 recovery. 102

4.3 Secure: The EITaaS Solution provides security Solutions that meet or exceed 103 current Department of Defense (DoD) and Army standards. EITaaS Solutions for 104 NIPRNet and SIPRNet Installation Campus Area Networks (ICANs) within the 105 EITaaS Pilot will follow the Committee on National Security Systems (CNSSI) No. 106 1253 for system categorization of Confidentiality, Integrity, and Availability. 107

Reference Applicable Document: Committee on National Security Systems 108 (CNSSI) No. 1253, dated 27 Mar 2014, “Security Categorization and Control 109 Selection for National Security Systems”, available at: 110 https://www.cnss.gov/CNSS/issuances/Instructions.cfm 111

4.3.a Acceptable Cybersecurity Risk – The commercial Risk Assessment of the 112 EITaaS Solution must result in an acceptable level of risk and obtain Government 113 approval before implementation. 114

4.3.b Approved Technologies – The EITaaS Provider will follow Government 115 direction to only employ technologies within the EITaaS Solution that are either on 116 the Approved Product List or a candidate for consideration for approval (that improve 117 national security). 118

4.4 End User Experience: The EITaaS Solution increases readiness through 119 enhanced End User experience and productivity as measured by a comparison of 120 the performance measured in the assessment and Government independent 121 assessment of the “as is” status. Two key measurements are: EITaaS Solution 122 Latency and Customer Satisfaction. 123

“End User” or “User” for this purpose of the EITaaS Pilot includes: All personnel 124 identified as “US Government Authorized Users” for the Department of the Army or 125 DoD network. This is further clarified as any individual authorized a DoD Common 126 Access Card (CAC) and includes but not limited to Uniformed Military, Government 127 Civilians and Government Contractors at pilot sites and geographically separated 128 units. Any individual possessing a CAC but not directly affiliated with the 129 Department of Defense will be provisioned for access to the EITaaS Pilot networks 130 as a "Guest". 131

The user’s “End User Experience” with the EITaaS Solution will be dependent on 132 the position/role that the individual holds with the range spanning from a “user” that 133 is direct recipient of an issued EITaaS End User Device and the EITaaS applications 134 to a “user” with a “bring-your-own-device” connecting to an EITaaS provided wire-135 less internet connection in a customer service area. The “End User Experience” 136 incorporates the resolution of incident and service requests. 137

Version 1.2, 2019-07-29 Page | 5

“Incident” for this purpose of the EITaaS Pilot is defined as an unplanned 138 interruption to an IT service or reduction in the quality of an IT service (i.e. ‘WiFi not 139 working’). 140

“Service Request” for the purpose of the EITaaS Pilot is defined as a formal 141 request from a user for something to be provided (i.e. ‘upgrading to a higher version 142 of a software’). 143

4.5 Ability to Scale: The EITaaS Solution can scale to provide support to up to all of 145 the Army Installations within the Continental United States (CONUS) and Outside 146 CONUS (OCONUS) (up to 288 locations). This includes designated geographically 147 separated facilities (owned or leased) and support to uniformed military, Government 148 civilian and Government on-site support contractors at those facilities. 149

4.6 Affordable: The EITaaS Solution is efficient in its utilization of resources and 150 equipment to provide increased performance to users and organizations as 151 measured by the application of the EITaaS Provider cost model (working EITaaS 152 Solution Cost Model delivered in Phase 1) and as compared to the current 153 capabilities and Army IT investment (budget). 154

Version 1.2, 2019-07-29 Page | 6

4.7 Production Defined: 156

10 U.S.C. § 2371b(f) authorizes the Department of Defense (DoD) to structure OT 157 prototype agreements with the potential to award a follow-on production contract or 158 transaction to the participants in the transaction, without further competition. In order 159 to do so, two criteria must be met: 1) competitive procedures must be used to select 160 the performer and 2) the participants must have successfully completed the 161 prototype project provided for in the transaction. Any production award(s) will be the 162 result of competitive procedures through Prototype Project Opportunity Notice 163

(PPON) W15QKN-19-R-06JL. 164

In accordance with 10 U.S.C. § 2371b(f), this competitively awarded Agreement may 165 lead to follow-on production activities if the Key Technical Goals, as defined above in 166 paragraph 4. EITaaS Pilot Key Goals/Success Metrics (Available, Resilient, Secure, 167 End User Experience, and Ability to Scale) are met; or in the event that a particularly 168 favorable or unexpected result is accomplished that justifies transition to production. 169

The anticipated scale of a production follow-on is within the metric 4.5 Ability to 170 Scale - to provide support to up to all of the Army Installations within the Continental 171 United States (CONUS) and Outside CONUS (OCONUS) (up to 288 locations). 172 This includes designated geographically separated facilities (owned or leased) and 173 support to uniformed military, Government civilian and Government on-site support 174 contractors at those facilities. 175

4.8 Success Metrics and Performance Thresholds: The success metrics are 176 assigned definitions and minimum performance thresholds measurements in table 1 177 below: 178

Table 1 Success Metrics, Definitions and Performance Thresholds 180

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

1. Availability Amount of time the system or service is available to the user.

WAN: 99.99%

LAN: 99.99%

End User Services / Applications:

99.99%

Services, Storage, Collaboration Environments:

99.99%

2. a. Resilience Redundancy or failover to sustain high levels of availability.

Services:

Multiple, redundant communication paths must be greater than one.

Services: Multiple instances of services to ensure no single point of failure.

Devices:

Replacement devices or restoration of device functionality.

Services:

Multiple instances of services or storage to ensure no single point of failure.

Version 1.2, 2019-07-29 Page | 7

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

2. b.

Restoration

For this Metric:

Each Incident will be assessed in terms of its Impact upon the Customer and the Urgency with which the Customer requires the Incident to be Resolved.

EITaaS Providers are encouraged to improve this metric, the definitions of Impact Levels and Priority as documented in the Service Level Agreement.

Restoration Defined:

Restore from service outages due to complete or partial failures of hardware and/or software components within any segment of the end-to-end network solution.

Catastrophic Incident, Severity 1: < 15 Minutes per Event (Expected Service Level 98% of the time)

Catastrophic Incident, Severity 1: Same as LOE 1.1

Catastrophic Incident, Severity 1:

Same as LOE

Catastrophic Incident: Complete, sudden, unexpected breakdown in enterprise IT hardware or services resulting in total or near total loss of confidentiality, integrity, or availability of the operations, assets or individuals for one or more organizations or installations. A catastrophic incident results in the loss of mission capability to an extent that the organization(s) cannot perform one or more of its primary functions.

Critical Incident, Priority 2: < 1 Hours per Event (Expected Service Level 98% of the time)

Critical Incident, Priority 2: Same as LOE 1.1

Critical Incident, Priority 2:

Same as LOE

Critical Incident: Significant degradation in enterprise IT hardware or services resulting in the major loss of confidentiality, integrity, or availability of the operations, assets or individuals for one or more organizations. A critical incident results in the loss of one or more mission capabilities to an extent that the organization ability to effectively and efficiently accomplish one or more primary functions is significantly impaired.

Major Incident, Priority 3: < 4 Hours per Event (Expected Service Level 96% of the time)

Major Incident, Priority 3: Same

Major Incident, Priority 3: Same

Major Incident: Major degradation in enterprise IT hardware or services resulting in the loss of confidentiality, integrity, or availability of the operations, assets or individuals for a specific mission capability for one or more organizations. A major incident results in the loss of specific mission capabilities to an extent that the organization ability to effectively and efficiently accomplish one or more primary functions is cannot be performed or require manually intensive, inefficient, and time-consuming work-arounds.

Normal Incident, Priority 4: < 2 Days per Event (Expected Service Level 94% of the time)

Normal Incident, Priority 4: Same as LOE 1.1

Normal Incident, Priority 4: Same as LOE 1.1

Normal Incident: Degradation in enterprise IT hardware or services resulting in the impaired confidentiality, integrity, or availability of the operations, assets or individuals for the mission capability for one or more organizations, departments or work centers. A normal incident impairs specific mission capabilities to an extent that the organization's ability to effectively and efficiently accomplish one or more primary functions can be performed with difficulty, requiring manually intensive, inefficient, time-consuming work-arounds.

Version 1.2, 2019-07-29 Page | 8

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

3. Secure Security of end-to-end network and services solution in accordance with applicable Government policy and Industry best practices.

Includes all necessary means to achieve a security posture where all vulnerability and risks are identified, assessed, mitigated, prevented, and remediated.

Monitoring, Detection, and Prevention of Vulnerabilities:

24 Hours Per Day, 365 Days Per Year

Vulnerability Incident Containment and remediation:

< 4 Hours per Event

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

Monitoring, Detection, and Prevention of Vulnerabilities:

Same as LOE 1.1

Vulnerability Incident Containment and remediation:

Same as LOE 1.1

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

Monitoring, Detection, and Prevention of Vulnerabilities:

Same as LOE 1.1

Vulnerability Incident Containment and remediation:

Same as LOE 1.1

Vulnerability Patching:

Completed Daily

(Expected Service Level 98% of the time)

4.a.

End User Experience - Latency

End User Experience as measured through EITaaS Solution Latency. Maximum amount of elapsed time / round trip network transit delay from the end device ingress point to its intended egress point within the overall network solution.

WAN: < 180 ms LAN: < 50 ms

Maximum End-to-End Latency (From the Service Delivery Point to the End Device): < 250 ms

End User Access to Services, Device Response Time:

< 180 ms < 50 ms

Maximum End-to- End Latency:

Same as LOE 1.1

Access to Storage or Applications:

< 180 ms < 50 ms

Maximum End-to-End Latency:

Same as LOE 1.1

4.b.

End User Experience - Customer Satisfaction

End User Experience which includes service requests and ticket responses as measured through Customer Satisfaction (Government) surveys collected with results aggregated.

Govt Surveys collected.

Expected service level 4.3 of 5.0 or 86% of aggregated survey results for the time period.

Surveys – Same as LOE 1.1

Surveys – Same

Version 1.2, 2019-07-29 Page | 9

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

Survey Scale:

5: Very Satisfied 4: Satisfied 3: Neither satisfied nor dissatisfied 2: Dissatisfied 1: Very Dissatisfied

Benchmark: 4.3 (86%) against daily, monthly survey results.

Survey Questions Structured to Determine customer productivity in accomplishing their mission, responsiveness to customer needs, and usability of the EITaaS Solution(s).

5. Ability to Scale

Ability to Scale measured by the performance of the first Pilot Site (against the Metrics 1 – 4) as the EITaaS Solution is implemented and users/organizations are added at that site.

Additionally, if/when a second and/or third Pilot Sites are added, the metrics from the first Site will be the baseline for comparison of performance to the second and third Pilot Site after the increase in numbers of users, geographic locations, and capabilities.

Measurement of the performance of any centralized capabilities in the EITaaS Solution are spread across a broader user and geographic locations, allowing for the deployment of additional capabilities.

NaaS: Maintain high levels of network capacity and availability as the user base increases.

EUD, EUS:

Maintaining high levels of user satisfaction while expanding user base, geographical, with additional capabilities.

C&S: Maintain high levels of performance (responsive, latency, availability, resilience) as user base, and capabilities scale to additional sites.

Version 1.2, 2019-07-29 Page | 10

Metric Definition Performance Thresholds

LOE 1.1 (NaaS) LOE 1.2 (EUS) LOE 1.3 (C&S)

6. Affordability Resource strategy that optimizes investments, while costs are controlled with the addition of Scaling (Metric 5), increases in performance (Metrics 1, 2, 3) and retires underperforming legacy infrastructure.

Costs equal to industry standards for a as a service model.

Same as LOE 1.1 Same as LOE 1.1

5. EITaaS Pilot Lines of Effort (LOEs) Objectives 182 There are three (3) Lines of Effort (LOEs) in this EITaaS Pilot that will be implemented 183 at each of the designated Pilot Site locations at the same time (See Figure 1 above). 184 To achieve performance as an enterprise the EITaaS Solution must support all three 185 simultaneously at one or more designated Pilot Site(s). 186

The EITaaS Lines of Effort (LOEs) are: 187

LOE 1.1: Network as a Service (NaaS) 188

LOE 1.2: End User Services (EUS) 189

LOE 1.3: Compute and Store (C/S) 190

Figure 2 - Army EITaaS Lines of Effort (LOE) 193

Version 1.2, 2019-07-29 Page | 11

As an enterprise Solution, Identity and Access Management (IdAM), security with 194 Data Protection for: Data at Rest, in-Transit/in Motion and Data in Use along with 195 Data Recovery apply to all LOEs. 196

The first LOE 1.1, Network as a Service (NaaS), includes Wide Area Networks 197 (WAN), Installation-Campus Area Network (ICAN), Capability for Army Unit’s Tactical 198 Network to connect/interconnect to Pilot Site/Installation Network (Installation as a 199 Docking Station), Land Mobile Radio (LMR), Enterprise Defense, Data Recovery, and 200 NIPR/SIPR Cross Domain Solution(s). 201

The second LOE 1.2, End User Services (EUS), includes End User Devices, 202 Information Technology Service Management (ITSM), Video Collaboration, Endpoint 203 Device management, multi-function device(s), Video Collaboration, User Provisioning, 204 Telephony, Pilot Site Emergency Communications, Unified Communications, Service 205 Level Catalog (based on user profiles) and Mobility Management. 206

The third LOE 1.3, Compute and Store (C&S) includes the Collaborative Data 207 Environment, Global Access to Data, the Installation Data Center and export to 208 designated Army Data Analytic Solutions. 209

Managed at the Enterprise level, detailed objectives include the following: 210

5.1 WAN: Demonstrate that the EITaaS Solution will provide a connection to 211 the Internet and authorized cloud providers from local installation and 212 remote users to ensure that Army organizations can operate installation 213 mission functions over an EITaaS Solution Wide Area Network that is 214 interoperable with all DoD, Joint, and potential multi-national systems and 215 networks while improving throughput and minimizing latency. Connection to 216 authorized cloud providers and connect mission critical applications while 217 ensuring security of data. 218

5.2 ICAN: Demonstrate EITaaS Solution is capable of service and delivery to a 219 designated Pilot Site providing voice, data, wired and wireless, networking 220 functions and migrate those functions to a reliable and resilient commercial 221 service delivery model which meets or exceeds current delivery capabilities 222 and capacities. ICAN includes Data Recovery services, and capability for 223 Tactical Network connect/interconnect to Pilot Site/Installation Network 224 through their point of presence. 225

5.3 Network Performance: Demonstrate that the EITaaS Solution meets or 226 exceeds the availability threshold (Table 1, Metric 1), reduces logical and 227 physical bottlenecks, provides redundancy/failover through logical and 228 physical diversity (on and off installation). Through consistent, standardized 229 configurations and toolsets, the EITaaS Solution should reduce human 230 touch points with automated incident discovery and remediation. 231

5.4 Mission Effectiveness: Demonstrate that the EITaaS Solution provides 232 visibility and operational effectiveness to accomplish the Mission of the 233 designated Pilot Site(s), assigned units, organizations and end users. 234

Version 1.2, 2019-07-29 Page | 12

5.5 Commercial Innovation: Demonstrate ability to of the EITaaS Provider to 235 partner with the Army to enhance the agility and cyber security of Army IT 236 operations. 237

5.6 End User Devices and Services: Demonstrate the implementation and 238 maintenance of a user-centric approach to end user devices and services. 239 User personas will enable access to the data, applications and services 240 they need to accomplish their missions. Devices will be user conduits to 241 authorized data, applications and services, regardless of device type, 242 including organizational multi-function devices for print, scan capability 243 while at work. Enable the capability to support Bring Your Own Device 244 (BYOD) to extend user capability with secure access and protection of 245 enterprise data and applications. Included services are: 246

a) User devices (laptops, tablets, phones, smartphones) 247

b) Printers 248

c) Video and VTC systems 249

d) Telephony systems 250

e) Unified Communications systems 251

f) Mobility management systems and methods 252

g) Asset visibility (End Device Management) 253

h) ITSM processes and Standard Operating Procedures 254

i) Transition and Fielding management and support 255

j) Defense Enterprise Email and Defense Collaboration Services support 256

5.7 Account Management and Network Operations (NetOps): Demonstrate 257 that the EITaaS Solution can provide enterprise level account management 258 across networks, user accounts, applications, and system administrative 259 functions (e.g., authentication, account management, and request 260 fulfillment). 261

5.8 Identity and Access Management (IdAM): Demonstrate that the EITaaS 262 Solution shall reduce IdAM complexity (from user perspective, as compared 263 to the current process) while maintaining high levels of security with 264 solution(s) that rationalize multiple identities, personas, roles, while 265 factoring user "place" (e.g., Govt, public, home, domestic, foreign) to permit 266 seamless and secure access to the resources users need given their 267 situation. 268

5.9 Network Operations (NetOps) Collaboration: Demonstrate visibility of 269 assets and system performance through common toolkits, dashboards, and 270 analytics that provide a complete view for government and industry partners 271 that can be tiered and accessed based on organization, geography, 272 function, or capabilities. 273

Version 1.2, 2019-07-29 Page | 13

5.10 Commercial Solutions for Classified (CSfC): Demonstrate use of the 274 National Security Agency’s (NSA) CSfC program to identify, configure, 275 deploy and sustain NSA-certified products that provide commercial, 276 affordable solutions that use commercial products in layered solutions, 277 capable of protecting classified Defense/National Security Systems (NSS) 278 information. 279

5.11 Mobility: Demonstrate secure, mobile solutions (e.g. BYOD) that 280 optimizes the end user experience. Provide device/persona access to the 281 resources needed from anywhere, anytime. 282

5.12 Land Mobile Radio (LMR): Demonstrate solutions for integration of non-283 tactical LMR systems in support of installation public safety, training, 284 organizations and functions. Including first responders, force protection and 285 other installation management functions that require local, state and federal 286 mutual aid interoperability, advanced encryption standards and priority 287 queuing for life and safety communications, as well as increased spectrum 288 efficiency. The LMR solution requires logging and archiving for emergency 289 voice communications as well as the ability to program and recover over the 290 air. Additionally the solution must have the ability to maintain trunked 291 communications through Graceful Systems Degradation. Solution must 292 support provide compatibility with current and future LMR upgrades that 293 typically entail system management centers, repeaters, dispatch consoles, 294 handheld, mobile and desktop radios, and antennas. All acquired systems 295 meet Association of Public-Safety Communications Officials (APCO) P25 296 standards. 297

5.13 Compute and Store: Demonstrate that the EITaaS provider can 298 implement and manage cohesive, executable, and secure access to 299 applications, data, and compute and store infrastructure that optimizes 300 collaboration (team, organization, cross-organization), asset management, 301 and compute/store performance. To include: 302

a) Global data access and storage 303

b) Legacy data system and source support 304

c) Data centers and processing nodes 305

d) Definitive media library (DML) of all software in use 306

e) Data backup and recovery solutions 307

f) Collaborative data environment consisting of knowledge management, 308 workplace collaboration, document, individual storage, and workflow 309 management solutions 310

6. Schedule 312 The EITaaS Pilot schedule will cover up to 36 Months total, with five (5) defined 313 phases for each Pilot Site. Only the initial Pilot Site will have 36 Months of activity, 314 Pilot Site 2 and 3 will be shorter as determined by the staggered Fiscal Year Funded 315

Version 1.2, 2019-07-29 Page | 14 awards. Each phase will be assessed against the EITaaS Provider’s plan of action 316 and milestones. Success must be achieved at each phase to be given the opportunity 317 to move to the next phase. Each phase period of performance is defined as “up to” 318 number of days. Initiation of activity at the next designated phase and Pilot Site 319 requires both Government approval and funding. 320

The EITaaS Provider’s detailed integrated master schedule will be reviewed at the 321 Kick Off meeting, “baselined” and incrementally evolved per the EITaaS Provider’s 322 process, with changes submitted for Government approval. At a minimum, the 323 schedule shall identify major project capability milestones, dependencies, work 324 breakdown structure, resources required (Government and Provider) and activities 325 associated with the project at the level of detail appropriate. 326

Five (5) EITaaS Phases planned for each Pilot Site location (Sequential at each 327 Pilot Site, based on demonstrated performance and funding available) 328

Phase I – Assessment (Up to 30 Days) at each awarded Pilot Site 329

Phase II – Plan and Prepare (Up to 180 Days / 6 Months for FY19 Site 1 [AFC, Polk 330 or Roberts], 6 Months for FY20 Site 2 [Leavenworth, Dugway or Benning] and 4 331 Months for FY21 Site 3 [Gordon, Huachuca or Irwin]) 332

Phase III – Implement (Up to 365 Days / 12 Months for FY19 Site 1 & FY20 Site 2 333 and 9 Months for FY21 Site 3) 334

Phase IV – Operate (Up to 519 Days / 15 Months for FY19 Site 1, Up to 9 Months for 335 FY20 Site 2 and 7 Months for FY21 Site 3) 336

Phase V – Transition Out (End Support) or Transition to Production / Sustainment of 337 the approved Pilot Solution (Up to 60 Days). Any Transition to Production, will be in 338 parallel with Phase IV - Operate. 339

Version 1.2, 2019-07-29 Page | 15

Figure 3 - EITaaS Notional Schedule 340

6.1 Phase I – Assessment (Up to 30 Days). This Phase begins no earlier than one 341

(1) business day after agreement award. The assessment will include an 342 analysis of the Government infrastructure and its capacity to provide a parallel 343 capability that is logically separate from the Government network. This Phase is 344 complete with the submission and Government acceptance of the Assessment 345 Findings, a working EITaaS Solution Cost Model and all other relevant deliverable 346 items in Table 2 – EITaaS Data Deliverables List. The Assessment deliverable is 347 a report/data that provides the EITaaS Provider and the Government an up-to-348 date inventory and assessment of the quality of the current installation IT 349 resources, to include end user devices. 350

6.2 Phase II – Plan and Prepare (Up to 180 Days / 6 Months for Site 1 & 2 and 4 351 Months for Site 3). This Phase begins no earlier than one (1) business day after 352 Phase I initial Assessment findings are available and approved by the EITaaS 353 Provider and the Government. The Plan for Phase II will include: 354

a) Any planned use of Government infrastructure capacity, if that capacity is 355 included in the EITaaS Solution (not a Government requirement) 356

b) Any new EITaaS Solution infrastructure that will be provided. 357

c) The Plan of Action and Milestones (POAM) for migration and validation of the 358 EITaaS Solution before implementation 359

d) Update the data deliverables, specifically the IMS and Working EITaaS 360 Solution Cost Model 361

This phase is complete when all of the Hardware and Software needed to initiate 362 Phase III is on order or on-hand. The key deliverable is a resource loaded 363 integrated master schedule (IMS) that provides the detailed plan for implementing 364 the EITaaS Solution at the Pilot Site for the assigned organizations, units and 365 users. The IMS, or in a separate report, shall identify all of the Government 366 resources required. In addition to the IMS, the EITaaS Provider shall make 367 available all other Phase II relevant deliverable items in Table 2 – EITaaS Data 368 Deliverables List. Relevant to this phase are Network Architecture Diagrams that 369 depict the level of detail needed to inform the decisions to commit resources for 370 this Phase II and follow-on Phases and also the catalog of end user devices and 371 the distribution plan. 372

6.3 Phase III – Implement (Up to 365 Days / 12 Months for Site 1 & 2 and 9 Months 373 for Site 3). This Phase begins no earlier than when the EITaaS Provider is in 374 receipt of EITaaS hardware/software to be installed or configured to support the 375 designated Pilot Site with a parallel network as identified in the IMS. Initiation of 376 this phase with a partial inventory of resources is acceptable. The steps within 377 this phase include: 378

a) Build the EITaaS Solution 379

Version 1.2, 2019-07-29 Page | 16

b) Validate the EITaaS Solution 380

c) Migrate – All Government services and users (identified in Phase I) over time 381 to the EITaaS Solution 382

d) Update the data deliverables, specifically the IMS and Working EITaaS 383 Solution Cost Model 384

In addition, the EITaaS Provider shall make available all other Phase III relevant 385 deliverable items in Table 2 – EITaaS Data Deliverables List. 386

6.4 Phase IV – Operate (Up to 520 Days / 15 Months for Site 1, Up to 9 Months for 387 Site 2 and 7 Months for Site 3). This Phase begins no earlier than when the 388 EITaaS Provider determines all hardware/software is on-hand/installed/configured 389 and the assigned Army organizations have Full Operational Capability (FOC) to 390 perform their normal functions / support using the EITaaS Solution. FOC of the 391 EITaaS Solution will be measured against the Phase I assessment (“as is”) 392 results and any additions/deletions (of organizations/units/missions) to the Pilot 393 Site over the Pilot period of performance. FOC will be met when the EITaaS 394 Solution demonstrates the Success Metrics in paragraph 4. Key to demonstrating 395 success, the EITaaS Provider shall make available all other Phase IV relevant 396 deliverable items in Table 2 – EITaaS Data Deliverables List. At month 34 of the 397 Period of Performance, the Government will initiate the assessment to move to 398 Phase V as Transition Out or Transition to Production/Sustainment. Phase IV – 399 Operate may continue as continuity of service until month 36, the end of the 400 Period of Performance. 401

6.5 Phase V – Transition Out (End Support) or Transition to Production/Sustainment 402 of the approved Pilot Solution (Up to 60 Days). This Phase begins at any point in 403 time when the Government issues a written determination that the EITaaS 404 Provider has failed to meet the performance of this SOO (at any Phase) and so 405 directs a Transition Out, or no later than when the Government issues a 406 determination that Phase IV objectives have been met, and issues a directive to 407 Transition to Production/Sustainment. 408

6.5.a Transition Out – Should the Government direct a Transition Out, the EITaaS 409 Provider is tasked to return the IT service levels – including all Army data – at all 410 of the Pilot Sites designated in the Agreement Award impacted to the level of 411 operational capability prior to the initiation of the pilot activities or better. Data 412 transfers will be completed as required from the EITaaS Solution to a designated 413 Government location (e.g. Data Center). This includes the transfer of the EITaaS 414 Solution Phase I – IV relevant deliverable items in Table 2 – EITaaS Data 415 Deliverables List. The Government will collaborate with the EITaaS Provider to 416 plan in detail the tasks required for any Transition Out and the actual time-line 417 required. 418

Version 1.2, 2019-07-29 Page | 17

6.5.b Transition to Production – Should the Government direct a Transition to 419 Production, the EITaaS Provider is tasked prepare a plan and a Performance 420 Work Statement for a 36 month Production Period of Performance (commencing 421 after the Pilot concludes). Additional instructions and a list of deliverables will be 422 provided by the Government. The EITaaS Solution will remain in service under 423 the Phase IV Operate conditions with no break of service or support. 424

6.6 Schedule Constraints – Reference Figure 3, Notional EITaaS Schedule. The 425 initiation for each phase at each designated Pilot Site (e.g. Pilot Site 1, 2 & 3) is 426 dependent on Government funding and approval. Approval for Phase II – V is 427 also dependent on the EITaaS provider completing the tasks for the previous 428 phase. For the FY19 funded Pilot Sites, and for the planned Pilot Period of 429 Performance, the Internet Access Point (IAP) for all EITaaS Solutions will be 430 provided by the Government. Therefore, a commercial solution for IAP is not in 431 Scope of this SOO. 432

7. Data Deliverables and Delivery Schedule: 433 The EITaaS Provider shall deliver the data items listed in the table below as the 434 minimum (the Government and or the EITaaS Provider may define others) in the 435 EITaaS Provider’s commercial and Government approved format (approval will be after 436 award). Content shall also be defined by the EITaaS Provider with Government 437 approval. The EITaaS Provider may use any applicable Government Data Item 438 Description (DID) references only as a starting guide. 439

The Pilot Deliverable Data Items (Minimum list) shall be made available [delivered] to 440 the Government on a schedule that supports the activities of each of Phases I – V and 441 the requirement to demonstrate successful performance of the Phase before moving to 442 the next phase. Timing must support any required decisions and/or resource 443 allocations. 444

Table 2 – EITaaS Data Deliverables List, all numbered items to be submitted and/or 445 made available in a digital file format appropriate for the item (title) that is readable by 446 an End User on an End User Device (examples include Dashboards (depicting live 447 and/or historical data), flat files in Microsoft Office ® (2013) and/or Adobe®) by the 448 EITaaS Government Project Management Office and Functional Management Office. 449

Version 1.2, 2019-07-29 Page | 18

Table 2 – EITaaS Data Deliverables List 452

Line of Effort

**EITaaS Pilot Deliverable Data Items (Minimum list) Delivered with the following

Rights

All LOEs

1) Pilot Site Assessment/Survey Findings

2) Network & Security Logs

3) Network: Architecture Diagrams (All defined levels of detail), Configuration Data and Internet Protocol (IP) addressing schema

4) Network Availability, Performance & Latency

5) Cybersecurity Readiness/ Risk Status

6) Change Control Board Plan/Process/Workflow

7) Configuration Management

8) Quality of Service Status: Network, Devices, etc.

9) Future Technology Roadmap

10) Continuity of Operations, Data Recovery and Restoration (to include Recovery Point Objective) Asset Visibility/ Management

11) Service Interruption

12) Integrated Master Schedule, organized by Work Breakdown Structure (WBS), resource loaded with EITaaS Provider/Solution and Government resources (as appropriate), (continually updated during each Phase)

13) Usage Status of the Solution, Network, Device, Service or Platform

14) Working EITaaS Solution Cost Model, (updated at each Phase)

Government Purpose Rights

(GPR)

LOE 1.1

NaaS

1) Active Directory Diagram

2) Usage Status: Network & Bandwidth

3) Data Recovery Status

GPR

LOE 1.2

EUS

1) Asset Availability, Inventory and Provisioning

2) Service Desk Logs: By user type

3) End user device status report (availability, distribution)

4) End user services status report (availability, allocation)

GPR

LOE 1.3

C&S

1) Export of data (to Army Analytic Platforms)

2) Transmitted data (export report)

3) Usage Status: Storage and Processing

GPR

**NOTE: All EITaaS Solution Deliverable Data is to be delivered with at least Government 453 Purpose Rights. See Agreement Terms and Conditions. 454

Version 1.2, 2019-07-29 Page | 19

8. Government Furnished Material, Equipment and Information: 456 After agreement award, the Government will provide the EITaaS Provider access to 457 requisite program and technical information necessary to carry out the requirements of 458 this document. No access or surveys will be granted prior to award. 459

8.1 All Government generated data residing on or transmitting through the EITaaS 460 Solution will remain as “Government Data”. 461

8.2 The Government will provide access to facilities, equipment, software tools, and 462 technical information necessary for the performance of this Agreement (e.g., 463 information on EAMS-A and access for site surveys). Material items may also 464 include office space, desks, telephones, printers, access to electronic mail, and 465 computers, when deemed appropriate by the Government. 466

8.3 The Government will provide approvals of EITaaS Solution Software and 467 Hardware as needed for all LOEs. 468

8.4 EITaaS Provider personnel will not use Government resources in violation of any 469 federal, State, or Local statute, regulation or policy. 470

8.5 EITaaS Provider personnel identified to access Government networks must 471 possess the requisite training and clearances (e.g. favorable Single Scope 472 Background Investigation (SSBI), Security+, etc.) 473

9. EITaaS Provider Furnished Material and Equipment (as a Service): 475 The EITaaS Provider is responsible to furnish all of the material (hardware/software) 476 and the required Data Items to implement the EITaaS Solution. Any co-use of 477 Government materials and/or equipment will be determined after the Phase 1 478 assessment and must be mutually agreed to. 479

At the conclusion of the EITaaS Pilot, (see Phases IV & V above) the Government and 480 the EITaaS Provider will complete a joint inventory of the EITaaS Provider furnished 481 software and hardware material and equipment (by LOE) that is installed or in-service at 482 a Government designated Pilot Site, Government operated facility or under the control 483 of (in the possession of) Government end users. The joint inventory will include an 484 assessment and joint determination of the transfer of ownership to the Government. 485

a) If the EITaaS Pilot ends with a Transition Out and will not proceed to 486 Production/Sustainment, the Government intends to assume ownership of any 487 hardware material and equipment installed on a Government Installation or 488 Government operated facility or assigned to the end users. 489

b) If the Pilot ends with a transition to Production/Sustainment, the joint inventory 490 will support the assessment for the planning of a Production start. 491

Version 1.2, 2019-07-29 Page | 20

10. Travel Requirements: 494 The EITaaS Provider shall support Government directed meetings as needed. All travel 495 costs (Lodging, per diem, air fare, rental car etc.) shall be included in the proposed 496 price. The Government will reimburse travel in accordance with the General Services 497 Administration (GSA) published Per Diem rate(s) for the time period of the travel. 498 Transportation costs will be reimbursed at GSA Mileage rates, or economy/coach level 499 means of transportation (e.g., car/plane/train). EITaaS Provider personnel are 500 responsible for making their own travel and lodging arrangements as necessary to 501 support Pilot requirements. The EITaaS Provider will plan to support all the tasks at 502 the three (3) designated Pilot sites to implement the EITaaS Solution. 503

11. Period of Performance: 505 The Phases I – V are interdependent and non-severable for the entire period of 506 performance. The period of performance will conclude at the direction of the 507 Government or on completion of the full extent of the Pilot or 36 months, whichever 508 comes first. The Government will make a determination for Phase V Transition and the 509 Pilot will officially conclude with completion of the Transition to production/sustainment 510 or Transition Out. 511

12. Place of Performance: 513 The EITaaS Provider may utilize their own facilities when executing the work 514 associated with this SOO. The Government will select the three designated Pilot Sites 515 (and group them by Pilot Site Set, where each Set includes one site that is Small, 516 Medium and Large) through a deliberate decision process and include them in the 517 award agreement. The EITaaS Provider shall support meetings and tasks at the three 518 designated Pilot Sites during the period of performance. In addition, the EITaaS 519 Provider shall support meetings and coordination with the Program Management 520 Office and Functional Management Office at locations on Fort Belvoir, VA and at 521 designated locations in the National Capital Region. The Government reserves the 522 right to identify and assign additional EITaaS Installations and locations for the overall 523 EITaaS Pilot. 524

13. Security: 526 EITaaS will provide commercial delivery and management of NIPRNet and SIPRNet 527 services. Reference the EITaaS Pilot DD Form 254, Contract Security Classification 528 Specification. The nature of this Pilot requires access to, handling, receiving and 529 storing classified (Secret and Confidential) and Controlled Unclassified Information 530 (CUI), Personally Identifiable Information, Personal Health Information, unclassified 531 information, documents, hardware and software using the applicable standards of DoD 532 5220.22-M National Industrial Security Program (NISPOM). In addition, CNSSI No. 533 1253 applies and security control overlays identify additional factors (beyond impact) 534 that influence the initial selection of security controls. At a minimum, the overlays for 535

Version 1.2, 2019-07-29 Page | 21 applicable overlays are 1) the Classified overlay and 2) the Personally Identifiable 536 Information (PII) overlay. The Cross Domain Solution (CDS) overlay will also apply if 537 the vendor will propose a CDS solution (independent of CSfC), that will be verified 538 through CDS accreditation process. 539

The work performed by the EITaaS Provider will require access to Secret, (Sensitive 541 Compartmented Information Facilities (SCIF)), Controlled Unclassified Information 542 facilities and work spaces. The EITaaS Provider personnel will be required to attend 543 meetings at classified and unclassified levels. See Enclosure 0002 Army EITaaS 544 Personnel Security Requirements for details. 545

14. Milestone Payment Schedule: 546 The following table represents the payable Milestones: (instruction: prepopulated with 547 Example milestones and example dates, please tailor to your specific proposal timeline. 548 Ensure each description begins with the applicable Phase of performance. Note: the 549 CLIN structure will have a Parent CLIN i.e. 1001 to represent the total Phase value and 550 subCLINs to represent each payable milestone. Milestones must be measurable and 551 meaningful events. Milestone values and frequencies may be subject to negotiation: 552 examples include if they are unevenly distributed, too frequent, not considered 553 meaningful, not able to be measured. Delete this instruction prior to submission) 554

Table 3 – EITaaS Milestone Payment Schedule 555 Milestone Number

Milestone Description No Later Than Due Date

(Days after award)

Amount

01 Phase I – Assessment Completion 30 $ 02 Phase II – Acceptance of Draft ‘Plan’ 90 $ 03 Phase II – Purchase of Long Lead Items for

Phase III 120 $

04 Phase II – Acceptance of Final Phase II Reports 180 $ 05 Phase III –

Version 1.2, 2019-07-29 Page | 22

Enclosures 557

Enclosure 0001: Army EITaaS Initial Requirements…