DRAFT_Army_EITaaS_Statement_Of_Objectives_2019_05_22.pdf

DRAFT Army – Enterprise Information

Technology as a Service (EITaaS)

Statement of Objectives

Solicitation Number: W15QKN-19-R-06JL

22 May 2019

COLOR KEY:

Yellow = Text & Info that may change

Army – Enterprise Information Technology as a Service (EITaaS) Statement of Objectives (SOO)

Version 2019-05-22 Page | 2

1. Overview1 Today’s Army installation/administrative enterprise information technology is identified 2 as a weapons platform which enables the entire force to perform it administrative and 3 power projection tasks. Army installation operations depend on timely, secure, and 4 reliable delivery and transmission of data. Today, the Army owns and operates its 5 entire information technology (IT) and long-distance communications. This current 6 own/operate model produces slow rates of changes and technology adoption that 7 diverges from similar commercial offerings. 8

With the assumption that the current wholly service-owned and service-operated 9 model sub-optimizes Army operational readiness, the Army is exploring a new 10 approach for delivering the enterprise network and core IT services: Enterprise IT as a 11 Service (EITaaS). The EITaaS Pilot effort will assess the achievability and feasibility 12 for deployment of commercial solutions for data transport, end-user device provision, 13 and cloud services for selected Army installations. 14

The EITaaS Pilot assessments will permit the Army to maximize the value of the 15 enterprise IT investments while still allowing the users to retain the ability to tailor their 16 services and service levels. The Army seeks to partner with commercial IT Service 17 Provider(s) to deliver innovative and modernized Solutions to transform IT services, 18 improve cyber readiness, and allow re-missioning of personnel to cyber warfighting 19 missions. 20

2. Purpose21 The specific purpose of this EITaaS Pilot is to partner with industry to reform Army 22 EITaaS operations and services delivery through commercial services in order to 23 increase mission effectiveness, increase IT user efficiencies, and establish 24 standardized, innovative IT services. This Pilot will address the outcomes sought in 25 the approved “Enterprise Information Technology as a Service (EITaaS) Initial 26 Requirements Document”, provided separately. The Pilot focus is on the end users’ 27 and installation organizations’ mission needs, with outcomes that improve IT 28 availability, security, resiliency, security, and affordability while improving the end 29 users’ experience. 30

3. Scope31 EITaaS will provide commercial delivery and management of protected IT services from 32 the enterprise to the point of need (user). The EITaaS Solution will adhere to 33 applicable Federal Government Laws and Cybersecurity regulations and policies, until 34 any submitted waiver(s) are approved by the Government. The EITaaS Provider is 35 responsible to provide its EITaaS Solution for enterprise use at the three designated 36 Army locations/installations (one each Small, Medium and Large) included in the 37 Agreement Award. (See paragraph 12. Place of Performance.) 38

EITaaS will connect, protect, store, and compute, with common IT services, hardware, 39 software, and networking infrastructure. The EITaaS Provider shall demonstrate the 40 ability to establish a parallel IT network and services while demonstrating the capability 41

Version 2019-05-22 Page | 3 to transition existing IT services to a commercial EITaaS Solution offering. Any co-use 42 (ex, switch that is co-used by the EITaaS Provider and Government) of Government 43 equipment must be documented in the assessment/survey and approved by the 44 Government. The Government projects that only non-interference co-use to be 45 approved. 46

Additionally, the EITaaS Provider will demonstrate the ability to support joint cyber 47 security operations including (but not limited to) the sharing of security log, event 48 and incident data, and cooperative work with the Army designated Cyber Security 49 Service Providers (CSSPs) and Regional Cyber Centers. The EITaaS Provider will 50 demonstrate the capability to encrypt Army data at rest on end user devices and in 51 transit through the network environment. The EITaaS Provider will demonstrate a 52 Commercial Solution for Classified (CSfC) for the classified domain. Any EITaaS 53 Cross Domain Solution (CDS) to transfer data between the classified and 54 unclassified environments (low to high or high to low) must be pre-approved by the 55 Government. 56

The EITaaS Solution Identity and Access Management (IdAM) must integrate with 57 Enterprise Access Management Service-Army (EAMS-A). 58

Finally, the EITaaS Provider must demonstrate the ability to integrate with 59 existing IT Service Management (ITSM) processes including Army Enterprise 60 Service Desk (AESD). The EITaaS Provider shall share incident ticket 61 information with AESD while resolving all EITaaS Solution internal tickets. 62

The EITaaS Pilot schedule as defined by Phases I – V are non-severable for the entire 63 period of performance. Phase V is projected as (up to) 30-Day transition Phase and will 64 be initiated only after a determination from the Government to Transition Out (Pilot 65 ends) or Transition to Production/Sustainment on the installations where the Pilot is 66 successful. Should the Government direct a Transition Out, the Government will 67 collaborate with the EITaaS Provider to plan in detail that transition and to assess the 68 actual time-line required. 69

Twelve (12) EITaaS Pilot planned locations/installations, depicted in Figure 1 below, 70 were selected by a deliberate decision process as representative of the entire Army 71 owned inventory of 288 real property locations/installations worldwide. The groupings 72 by row provide a similar scope of installations classified as Small, Medium and Large 73 with unique challenges within each and therefore will be kept as grouped by row and 74 by Fiscal Year order. Any resulting Agreement for row A – D will be assigned by the 75 Government through a random draw. The map of the Continental United States is 76 included to depict that the EITaaS Solution pilot must demonstrate an ability to scale 77 across any geo-political boundary. 78

Version 2019-05-22 Page | 4

Figure 1 - Planned EITaaS Locations/Installations 80

4. EITaaS Pilot Goals/Success Metrics: 81 All of the EITaaS Pilots will be assessed for demonstrated performance of the following 82 eight metrics: 83

4.1 Available – The EITaaS Solution (network, compute/store and end user devices) is 84 available to the end user 24/7/365 and interoperable with non-EITaaS installations 85 and the Joint Forces. 86

4.2 Resilient – The EITaaS Solution provides multiple methods for users to transmit 87 and access data in addition to continuity of operations and disaster recovery. 88

4.3 Secure – The EITaaS Solution provides security Solutions that meet or exceed 89 current Department of Defense (DoD) and Army standards. 90

4.4 Affordable – The EITaaS Solution is efficient in its utilization of resources and 91 equipment to provide increased performance to users and organizations as 92 measured by the application of the EITaaS Provider cost model. 93

4.5 End User Experience – The EITaaS Solution increases readiness through 94 enhanced End User experience and productivity as measured by a comparison of 95

Version 2019-05-22 Page | 5 the performance measured in the assessment/survey and Government independent 96 assessment of the “as is” status. 97

“End User” or “User” for this purpose of the EITaaS Pilot includes: All personnel 98 identified as “US Government Authorized Users” for the Department of the Army or 99 DoD network. This includes uniformed military, Government civilians and 100 Government Contractors and DoD/Army Government benefit recipients (ex. those 101 registered in the Defense Enrollment Eligibility Reporting System (DEERS) to 102 include family members, students, retirees and those enrolled in the Veterans 103 Administration and approved guest(s) / visitors) on and off the designated Pilot 104 locations. The “users” End User Experience with the EITaaS Solution will be 105 dependent on the position/role that the individual holds with the range spanning from 106 a “user” that is direct recipient of an issued EITaaS End User Device and the 107 EITaaS applications to a “user” with a “bring-your-own-device” connecting to an 108 EITaaS provided wire-less internet connection in a customer service area. 109

4.6 Ability to Scale – The EITaaS Solution can scale to provide support to up to all of 110 the Army Installations within the Continental United States (CONUS) and Outside 111 CONUS (OCONUS) (up to 288 locations). This includes designated geographically 112 separated facilities and support to uniformed military, Government civilian and 113 Government on-site support contractors at those facilities. 114

4.7 Acceptable Cybersecurity Risk – The Risk Assessment of the EITaaS Solution 115 must result in an acceptable level of risk and obtain Government approval before 116 implementation. 117

4.8 Approved Technologies – The EITaaS Provider will follow Government direction 118 to refrain from acquiring technologies deemed to threaten (negatively impact) 119 national security. 120

5. Production Defined 121 An EITaaS Solution that meets the success metrics at all three (3) designated pilot 122 installations. (In accordance with 10 USC 2371b: Authority of the Department of 123 Defense to carry out certain prototype projects, sub paragraph (f) Follow-on 124 Production Contracts or Transactions.) 125

6. EITaaS Pilot Lines of Effort (LOEs) Objectives 126 There are three (3) Lines of Effort (LOEs) in this EITaaS Pilot that will be implemented 127 at each of the three (3) designated Pilot locations. To achieve performance as an 128 enterprise the EITaaS Solution must support all three simultaneously at one location: 129

EITaaS Lines of Effort (LOEs) are: 130

• LOE 1: Network as a Service (NaaS) 131

• LOE 2: End User Services(EUS) 132

• LOE 3: Compute and Store (C/S) 133

Version 2019-05-22 Page | 6

Figure 2 - Army EITaaS Lines of Effort (LOE) 136

As an enterprise Solution, the first LOE, Network as a Service (NaaS), includes Wide 137 Area Networks (WAN), Installation-Campus Area Network (ICAN), Telephony, 138 Installation as a Docking Station and Land Mobile Radio (LMR). The second LOE 139 End User Services (EUS), includes End User Devices, Video Collaboration, Endpoint 140 Device management, multi-function device(s), multi-function devices, Information 141 Technology Service Management (ITSM) and Base Emergency Communications. 142 The third LOE, Compute and Store includes the Collaborative Data Environment, 143 Global Access to Data and linkage to Legacy Data Analytic Solutions. Managed at 144 the Enterprise level, detailed objectives include the following: 145

6.1 WAN: Demonstrate that Army organizations can operate installation 146 mission functions over an EITaaS Solution and secure Wide Area Network 147 that is interoperable with all DOD, Joint, and potential multi-national 148 systems and networks. This objective supports LOE 1.1. 149

6.2 ICAN: Demonstrate EITaaS Solution can provide take over a designated 150 location/installation voice, data, wired and wireless, networking functions and 151 migrate those functions to a commercial service delivery model. This objective 152 supports LOE 1.1 153

Version 2019-05-22 Page | 7

6.3 Cloud Viability: Demonstrate that an EITaaS Provider can provide a secure 154 connection to authorized cloud providers and connect mission critical applications. 155 This objective supports LOE 1.3. 156

6.4 Internet Service Provider (ISP) Services: Demonstrate that an EITaaS 157 Provider can provide a secure and improved connection to the Internet. This 158 objective supports LOE 1.1, 1.2, and 1.3. 159

6.5 Network Performance: Demonstrate that an EITaaS Provider network functions 160 demonstrate an improvement in network performance. This objective supports LOE 161 1.1, 1.2. 162

6.6 Mission Effectiveness: Demonstrate the commercially provided services 163 provide improved visibility and operational effectiveness for cyber operations. 164 This objective supports LOE 1.3. 165

6.7 Commercial Innovation: Demonstrate innovation can accelerate using a 166 commercial provider for network services. This objective supports LOE 1.1,1.2, 167 and 1.3. 168

6.8 Scalability: Demonstrate the commercially provided services can scale across 169 both geography and mission requirements. This objective supports LOE 1.3. 170

6.9 Convergence: Demonstrate that Army data and applications can be converged 171 within an approved and secure cloud environment. This objective supports LOE 1.3 172 and overarching goal of virtual capabilities. 173

6.10 Personal Computing (Desktop/Laptop/Tablet/Mobile): Demonstrate that an 174 enterprise desktop approach is scalable and manageable across Army locations. 175 This objective supports LOE 1.2 and 1.3. 176

6.11 Management and Network Operations (NetOps): Demonstrate that commercial 177 providers are capable of providing real time network, application, and security 178 status and operating pictures to government NetOps centers. Prove that 179 commercial Solutions provide increased effectiveness in managing network, user 180 account, identity management (IdAM), application, and system administrative 181 functions such as active directory, DoD Public Key Infrastructure (PKI) and Public 182 Key Enabling (PKE), account management, and request fulfillment. This objective 183 supports all LOEs. 184

6.12 Network Operations (NetOps) Collaboration: Demonstrate that the EITaaS 185 Providers can work effectively as partners across regions, locations, or missions. 186 This objective supports all LOEs. 187

6.13 Security: Demonstrate that commercial services adequately protect data through 188 effective encryption, traffic management, and separation Solutions. This objective 189 supports all LOEs. 190

6.14 Policy: Identify any Government policies inhibiting the EITaaS Solution 191 effectiveness and recommend a replacement with a commercial standard or 192 practice. 193

Version 2019-05-22 Page | 8

7. Schedule 194 The EITaaS Pilot schedule will cover up to 36 Months total, with five (5) defined 195 phases for each location. Each phase will be assessed against the EITaaS Provider’s 196 plan of action and milestones. Success must be achieved at each phase to be given 197 the opportunity move the next phase. Each phase period of performance is defined 198 as “up to” number of days. Initiation of activity at the next designated phase and 199 location/installation requires both Government approval and funding. 200

The EITaaS Provider’s detailed integrated master schedule will be reviewed at the 201 Kick Off meeting, “baselined” and incrementally evolved per the EITaaS Provider’s 202 recommended process. At a minimum, the schedule shall identify major project 203 capability milestones, dependencies, communication and learning activities 204 associated with the project. 205

Five (5) EITaaS Phases for each Pilot location (Sequential, based on 206 demonstrated performance and funding available) 207

Phase I – Assess/Survey (Up to 30 Days) 208

Phase II – Plan and Prepare (Up to 180 Days / 6 Months) 209

Phase III – Implement (Up to 365 Days / 12 Months) 210

Phase IV – Operate (Up to 519 Days / 17 Months) 211

Phase V – Transition Out (End Support) or Transition to Production / Sustainment of the 212 approved Pilot Solution (Up to 30 Days) 213

Figure 3 - EITaaS Notional Schedule 215

7.1 Phase I – Assess/Survey (Up to 30 Days). This Phase begins no earlier than 216 one (1) business day after agreement award. This Phase is complete with the 217 submission and Government acceptance of the Survey Findings. The deliverable 218

Version 2019-05-22 Page | 9 is data/report that provides the EITaaS Provider and the Government an up-to-219 date inventory and assessment of the quality of the current installation IT 220 resources. 221

7.2 Phase II – Plan and Prepare (Up to 180 Days / 6 Months). This Phase begins no 222 earlier than one (1) business day after Phase I initial Assess/Survey findings are 223 available to EITaaS Provider and the Government. This phase is complete when 224 all of the Hardware and Software needed to initiate Phase III is on order or on-225 hand. The deliverable is a resource loaded integrated master schedule (IMS) that 226 provides the detailed plan for implementing the EITaaS Solution on the 227 installation. Included in the IMS, or in a separate report identify all of the 228 Government resources required. 229

7.3 Phase III – Implement (Up to 365 Days / 12 Months). This Phase begins no 230 earlier than when the EITaaS Provider is in receipt of EITaaS hardware/software 231 to be installed or configured to support the designated Army installation with a 232 parallel network as identified in the IMS. Initiation of this phase with a partial 233 inventory of resources is acceptable. 234

7.4 Phase IV – Operate (Up to 520 Days / 17 Months). This Phase begins no earlier 235 than when the EITaaS Provider determines all hardware/software is on-236 hand/installed/configured and the assigned Army organizations have Full 237 Operational Capability to perform their normal functions / support using the 238 EITaaS Solution. 239

7.5 Phase V – Transition Out (End Support) or Transition to Production/Sustainment 240 of the approved Pilot Solution (Up to 30 Days). This Phase begins at any point in 241 time when the Government issues a written determination that the EITaaS 242 Provider has failed to meet the performance of this SOO (at any Phase) and so 243 directs a Transition Out, or no later than when the Government issues a 244 determination that Phase IV is complete, with a directive to Transition to 245 Production/Sustainment. Should the Government direct a Transition Out, the 246 EITaaS Provider is tasked to return the IT service levels at all of the 247 locations/installations designated in the Agreement Award impacted to the 248 operational capability prior to the initiation of the pilot activities. The Government 249 will collaborate with the EITaaS Provider to plan in detail the tasks required for 250 any Transition Out and the actual time-line required. 251

8. Deliverables and Delivery Schedule 252 The EITaaS Provider shall deliver the items listed in the table below in the EITaaS 253 Provider’s commercial and Government approved format (approval will be after award). 254 Content shall also be defined by the EITaaS Provider with Government approval. The 255 EITaaS Provider may use any applicable Government Data Item Description (DID) 256 references only as a starting guide. 257

Table 1 - Deliverable List, to be submitted and/or made available in a digital file format 258 appropriate for the item (title) that is readable by an End User Device (examples include 259

Version 2019-05-22 Page | 10

Dashboards, flat files in Microsoft Office ® (2013) and/or Adobe®) by the EITaaS 260 Government Project Management Office and Functional Management Office. 261

Table 1 - Deliverable List 262 Level of Effort (LOE) Pilot Deliverable/Data Accessible to Government

ALL LOEs

● Network Utilization status

● Network Diagrams

● Local carrier diversity diagrams

● Security Impact Analysis study

● WAN/ICAN Network Management

● WAN/CAN Managed Security

● Test and Acceptance workflow/process

● Cyber Readiness Status

● WAN/ICAN Performance Status

● EITaaS Pilot Assessment Survey Findings

LOE 1.2

EUS

● Customer Satisfaction Survey Results

● Cyber Security Status

● Device / Service Performance Status

● Device/service catalogue items

● EITaaS Pilot Findings

● Completed Agile Test and Acceptance Plan

● Usage Status

LOE 1.2 and 1.3 Cloud Viability

● Application Rationalization

● Trusted Internet Connection (TIC) and Service Level Agreement (SLA) status

● TIC Key Performance Indicator (KPI) status

● Move/add/change/delete Status

● Legacy Performance Comparison Test/Status

LOE 1.1 and 1.2 ISP Services

● Completed Test and Acceptance Plan

● EITaaS Pilot Findings

● Availability Status

Version 2019-05-22 Page | 11

● Mean Time to Repair (MTTR) status

● Network performance SLA status

● Quality of Service status

LOE 1.1

Network Performance

● Service Desk data

● Daily/Weekly/Monthly Service ticket data

LOE 1.2

Mission Effectiveness

● Network Operation Centers/Security Operation Centers (NOC/SOC) interactions data

● Log Feeds

● Networking Flow Data

● Cyber Security status

● Governance workflow model

● Change Control Board Plan/Process/Workflow

● IMS showing scaled transition timelines

LOE 1.3

Scalability

● Primary, Alternate, Contingency, Emergency (PACE) services Roadmap

● Develop/test of Bandwidth demand as options for some sites for more agile services in Service Catalogue

● Scale to any designated EITaaS Pilot site or non-pilot site

All LOEs Commercial Innovation

● Future Technology Roadmap

● EITaaS Pilot Government Policy findings

● Application migration Roadmap

Migrations and Convergence

● Data Center migration Roadmap

● Desktop Environment Implementation

● EITaaS Assessment/Survey results

Pilot Management

● EITaaS Solution Integrated Master Schedule

● EITaaS Solution Network Diagrams

● EITaaS Solution workflows

● User Account and IdAM workflow and status

Version 2019-05-22 Page | 12

● Active Directory Diagram

● PKI workflow

● User request fulfillment process workflow map

● Joint management plan and processes between EITaaS Providers

Collaboration and Interoperability

● Interoperability roadmaps for all services and Solutions (DoD, Joint, non-Pilot Army Sites)

● Data encryption at rest and in transit status

All LOEs Security

● Internet Access Point (IAP) and Joint Regional Security Stack (JRSS) interoperability or capability status

● Transition workflow/process – (IMS Events)

General Items

● Configuration Management workflow/process

• Change Management workflow/process

● Event Management workflow/process

9. Government Furnished Material and Equipment 267 After agreement award, the Government will provide the EITaaS Provider access to 268 requisite program and technical information necessary to carry out the requirements of 269 this document. No access or surveys will be granted prior to award. 270

9.1 The Government will provide access to facilities, equipment, software tools, and 271 technical information necessary for the performance of this Agreement. Items may 272 include office space, desks, telephones, printers, access to electronic mail, and 273 computers, when deemed appropriate by the Government. 274

9.2 The Government will provide approvals of EITaaS Solution Software and 275 Hardware as needed for all LOEs. 276

9.3 EITaaS Provider personnel will not use Government resources in violation of any 277 federal, State, or Local statute, regulation or policy. 278

9.4 EITaaS Provider personnel identified to access Government networks must 279 possess the requisite training and clearances (e.g. favorable Single Scope 280 Background Investigation (SSBI), Security+, etc.) 281

10. EITaaS Provider Provided Material and Equipment (as a Service) 282 At the conclusion of the EITaaS Pilot, the Government and the EITaaS Provider will 283 complete a joint inventory of the EITaaS Provider provided software and hardware 284 material and equipment (by LOE) that will include an assessment and joint 285 determination of the transfer of ownership to the Government. The Government intends 286

Version 2019-05-22 Page | 13 to assume ownership of any hardware material and equipment installed on a 287 Government Installation or Government operated facility or assigned to the end users. 288

11. Travel Requirements 289 The EITaaS Provider shall support Government directed meetings as needed. All travel 290 costs (Lodging, per diem, air fare, rental car etc.) shall be included in the proposed 291 price. All travel shall be in accordance with the Joint Travel Regulations. EITaaS 292 Provider personnel are responsible for making their own travel and lodging 293 arrangements as necessary to support Pilot requirements. The EITaaS Provider will 294 plan to support all the tasks at the three (3) designated Pilot sites to implement the 295 EITaaS Solution. 296

12. Place of Performance 297 The EITaaS Provider may utilize their own facilities when executing the work 298 associated with this SOO. The Government will select the three locations/installations 299 (one each Small, Medium and Large) through a random draw process and include 300 them in the award agreement. The EITaaS Provider shall support meetings and tasks 301 at the three designated locations/installations during the period of performance. In 302 addition, the EITaaS Provider shall support meetings and coordination with the 303 Program Management Office and Functional Management Office at locations on Fort 304 Belvoir, VA and at designated locations in the National Capital Region. The 305 Government reserves the right to identify and assign additional EITaaS Installations 306 and locations for the overall EITaaS Pilot. 307

13. Period of Performance 308 The Phases I – V are non-severable for the period of performance. The period of 309 performance will conclude at the direction of the Government or on completion of the 310 full extent of the Pilot or 36 months, whichever comes first. The Government will make 311 a determination for Phase V Transition and the Pilot will officially conclude with the 312 Transition to production/sustainment or Transition Out. 313

14. Security 314 Reference the EITaaS Pilot DD Form 254, Contract Security Classification 315 Specification. The nature of this Pilot requires access to, handling, receiving and 316 storing classified and unclassified information, documents, hardware and software using 317 the applicable standards of DoD 5220.22-M National Industrial Security Program 318 (NISPOM). The work performed by the EITaaS Provider will include access to Secret, 319 Controlled Unclassified Information data, facilities and work spaces. The EITaaS 320 Provider will be required to attend meetings at classified and unclassified levels. 321

Version 2019-05-22 Page | 14

APPENDIX 1 322

Service Level Agreement (SLA) Standards 323

Line of Effort (LOE) 1.1 Network as a Service 324

• To be provided by the EITaaS Provider and agreed to by the Government. 325

LOE 1.2 End User Service (EUS) 328

• To be provided by the EITaaS Provider and agreed to by the Government. 329

LOE 1.3 Compute and Store 332

• To be provided by the EITaaS Provider and agreed to by the Government. 333

Across All LOEs 336

• To be provided by the EITaaS Provider and agreed to by the Government. 337