DRAFT-for-SOO_EITaaS_Initial_Requirements_Document_2019_03_22.pdf

Enterprise Information Technology as a Service (EITaaS) Initial Requirements Document

22 March 2019 (Pilot)

DRAFT

for

Statement of Objectives

(SOO)

1. Operational Context 1 As the Army drives towards its 2028 Modernization Strategy and postures to the era of 2 great power competition put forth in the National Defense Strategy, we must operate 3 and defend our networks with operational ruthlessness. The Army’s communications 4 network is the foundational weapons platform for the entire force. All Army operations 5 depend on timely and reliable delivery and transmission of data. Today, the Army owns 6 and operates its entire information technology (IT) and long-distance communications, a 7 model that produces slow rates of changes and technology adoption that diverges from 8 similar commercial offerings. 9 With the assumption that a wholly service-owned and service-operated model could 11 sub-optimize Army operational readiness, the Army is exploring a new approach for 12 delivering enterprise network and core IT services: Enterprise IT as a Service (EITaaS). 13 The EITaaS pilot will assess feasibility and deploy commercial solutions for data 14 transport, end-user device provision, and cloud services for selected Army installations. 15 EITaaS pilot will allow the Army to evaluate commercial solutions and their ability to 17 strengthen enterprise IT service delivery, improve user experience and integrate with 18 existing government-only systems, architecture, processes and facilities, while 19 maintaining an aggressive cybersecurity posture. Navy (USN) and Air Force (USAF) 20 have already undertaken a similar EITaaS approach and several USAF pilot 21 installations are presently undergoing EITaaS implementations. The Army will leverage 22 USN lessons learned and USAF EITaaS efforts to shape its pilot implementation. 23

The goal of the pilot is to assess the feasibility of private sector IT infrastructure 25 investments, operations and best practices; and to implement process and policy 26 improvements to maximize value on the Army’s investment in the network. 27

2. Problem Statement 30 The Army’s Enterprise Network (Unclassified and Classified), at its current pace of 31 investment and pace of modernization, cannot meet the Army’s immediate and future 32 warfighting requirements to enable multi-domain operations by 2028. The Army has 288 33 bases and other operating locations throughout the world, each with unique hardware 34 configurations, data strategies and application architectures. 35 Due to these inconsistencies, the management and availability of data, hardware and 37 applications has become less effective for the user as well as inefficient and expensive. 38 The standard acquisition model of buying hardware/software has hindered agility and 39 has made integration, maintenance, and operations between hardware, data and 40 applications extremely difficult to manage. The Army’s data and applications are located 41 across government, tactical, commercial and hybrid cloud capabilities not in 42 collaborative environments. The Army seeks to partner with a Service Provider(s) to 43 provide innovative and modernized solutions to transform the Army’s Enterprise 44 Network. 45

3. EITaaS Definition 47 Commercial delivery and management of protected IT services from the enterprise 48 to the point of need (user) on the Department of Defense Information Network-Army 49 (DoDIN-A). Provides connect, protect, storage, computing, common IT services, 50 hardware, software, and networking infrastructure. 51

• Includes people, processes, and products to plan, secure/protect, prioritize, 52 acquire, operate, and continually improve information technology capabilities to meet 53 user needs 54 o Informed by enterprise acquisition, strategic resourcing, and category 55 management 56 o Controlled through governance, performance management, and 57 architecture management 58 o Augments and supports DoDIN-A Operations as specified in the 59 Enterprise Information Environment Mission Area 60 o Provides connectivity to all Army Mission Areas 61

• Does not include tactical network, business mission area, warfighting mission 62 area, offensive cyber operations, intelligence systems, weapon systems and 63 inherently government tasks 64

EITaaS Lines of Effort (LOEs) are: 66

• LOE 1: Network as a Service (NaaS) 67

• LOE 2: End User Services (EUS) 68

• LOE 3: Compute and Store (C/S) 69

Figure 1 - Army EITaaS Lines of Effort (LOEs) 72

4. Requirements 74 Army EITaaS Pilot requirements consists of near term efforts in FY19-20 and enduring 75 efforts in FY 21-23. The FY19 efforts include, but are not limited to, conducting site 76 assessment surveys at three Army installations and the implementation of assessable 77 services at Army Futures Command (AFC) Headquarters in Austin, Texas. 78 Additionally, pending resourcing and the successful implementation of the first pilot, 79 Army will expand the pilot up to two (2) additional bases in FY19. In FY20, the Army 80 intends on validating the scalability of the EITaaS Pilot with five (5) additional bases. 81

LOE: 1.1 NaaS 82 EITaaS Network as a Service (NaaS) includes deployment and operation of a 83 secure, reliable, measured, commercial data and voice network. This includes Wide 84 Area Network (WAN), Remote Access Services, ICAN/LAN, Telephony & Voice 85 Services, and Enterprise Network Defense in order to enable access to Department 86 of Defense (DoD) classified/unclassified data and applications from DoD facilities as 87 well as enable access for mobile and remotely located users. Potential solutions 88 could take advantage of existing DoD infrastructure and/or include installation of 89 new infrastructure. The Service Provider will provide Enterprise Core Services as a 90 standard IT capability for all users on DoDIN-A (Classified/Unclassified). 91 Enterprise Core Services support DoD Net-Centric strategies for data and services 93 by enabling users to guard, compile, catalogue, discover, cache, distribute, retrieve, 94 and share data in a collaborative environment across the Army and DoD 95 enterprises. 96 The Service Provider will operate Army enterprise services not provided by the DoD 98 and/or those DoD enterprise services being provided by the Army to all DoD 99 customers. Core network services must meet or exceed industry standards for 100 availability, be resilient and self-healing. Service Provider’s network must provide 101 core network services to pilot sites and associated Geographically Separated Units 102 (GSU) with resilient network infrastructure. 103

These services include but not limited to: 105

• Authentication Services for Hardware, Software and Personnel 106

• Network (Wired & Wireless) Management & Vulnerability Assessments 107

• Base Emergency System, AtHoc & E911 108

• Installation as a Docking Station (IaaDS) 109

• Disaster Recovery and Continuity of Operations (CooP) 110

• Identity & Access Management (IdaM) 111

• Land Mobile Radio (LMR) 112

Wide Area Network (WAN) 114 The Service Provider will provide secure access to the DODIN. Provide Army 115 Geographic Separated Units (GSU) connectivity to their serving 116 Camp/Base/Post/Stations. Connections must be designed to support all services 117

(Classified and Unclassified) required to accomplish its mission. Wide Area Network 118 must meet or exceed industry standards for availability, be resilient, and self-healing. 119 The Service Provider will provide, operate, maintain, and sustain Remote Access 121 Services (RAS) including the infrastructure and support services to logically extend 122 unclassified and classified information over the Internet via desktop or mobile device. 123 RAS will provide users the capability to access network resources including, but not 124 limited to: e-mail, web, file storage, voice and video services allowing a single end-user 125 to securely connect to classified and unclassified information globally. 126

Installation Campus Area Network (ICAN) 128 The Service Provider will provide, operate, maintain, and sustain wired and wireless 129 infrastructure for users to access Unclassified and Classified network resources, 130 which include, but are not limited to, e-mail, web, collaboration, file storage, unified 131 communications services and data center connectivity. Provides connectivity to local 132 and enterprise resources on Army bases or other designated sites. This service 133 must include the network devices, network systems integration support, network 134 infrastructure installation, and operations/maintenance support and processes 135 necessary to allow authorized endpoint devices and mission systems to securely 136 connect to Army networks. This service includes virtualized access to multiple 137 networks, both Classified and Unclassified data (i.e. Commercial Solutions for 138 Classified systems (CSfC)). ICAN must meet or exceed industry standards for 139 availability, be resilient and self-healing. 140

Telephony & Voice Services 142 The Service Provider will provide, operate, and maintain unclassified and classified 143 devices and telephony services. This includes the testing, integration, deployment, and 144 software patch maintenance for telephony devices. Develop and implement a plan to 145 replace and retire legacy systems by migrating to IP-based systems. The commercial 146 solution must integrate with Base Emergency Services (BES) and other non-IP 147 requirements (i.e.E911, AtHoc, DoD Land Mobile Radio (LMR)). 148 Enterprise Network Defense 150 The Service Provider will provide enterprise security and defense IAW DoD policies, 151 CYBERCOM policies, Risk Management Framework (RMF), and Army regulations 152 at a minimum. Focus its security efforts on the protection of the data both at rest 153 and in transit. Provide Enterprise Network Defense capabilities to include, but are 154 not limited to: Threat Detection and Prevention, Data Loss Prevention, Virtual and 155 Physical Forensic Analysis, Security Configuration and Event Management, 156 Automated Patch Management, Endpoint Device Security, Traceability, Application 157 Whitelisting, Network Cryptography, Authentication and Authorization, File Removal, 158 Network Access Control, and DoD DMZ extensions. 159 LOE 1.2 End User Services 161 End User services will include, but not limited to, end user devices (laptop, desktop, 162 and cellphone), multifunction devices, information technology service management 163

(ITSM), multi-function device/printer management, endpoint device security, video 164 collaboration systems, email, and local and regional service desks. 165 Collaboration Services 167 The Service Provider will provide, operate, maintain, and sustain Classified and 168 Unclassified Collaboration Services including file share service (e.g. SharePoint), audio, 169 video, presentation, cloud based office automation, single and group chat, instant 170 messaging, screen and desktop sharing capabilities for end users. Additionally, Service 171 Provider will provide, operate, maintain, and sustain DoD-mandated Client-Hosted 172 secure client and chat services. 173 Video Teleconferencing (VTC) Services 175 The Service Provider will provide, operate, maintain, and sustain VTC services to users 176 (Classified and Unclassified) and connect those users with internal or external VTC 177 participants. These services are comprised of the hardware, software, network, and 178 scheduling components necessary to deliver real-time video and audio communications 179 between end users at two or more locations. This includes the operation and 180 maintenance of the VTC service. 181 End User Image Services 183 The Service Provider will build, maintain, sustain, track and deploy the enterprise 184 approved Army Classified and Unclassified system images. This will consist of the end 185 user device’s Operating System and Core Applications, as well as hardware specific 186 configuration items and the associated configuration characteristics for a specific 187 platform. 188 Print Services 190 The Service Provider will provide, operate, maintain, sustain, and deploy multi-191 function devices (MFDs) for print, scan, copy, digitally send, and fax capabilities on 192 Classified and Unclassified. This includes the ability for end users to install drivers, 193 ability to map users to an MFD, testing and integration of MFDs, and the software 194 patch maintenance for all MFDs. Includes print servers to enable multiple clients to 195 share one or more print device. 196 Information Technology Service Management 198 The Service Provider will apply knowledge, skills, tools, and techniques to establish the 199 design of new or changed services under the Service Provider catalogue. Provide the 200 systems engineering and technical discipline capability required to design, model, test, 201 pilot, and deploy the infrastructure, systems, and hardware and software components 202 required to deliver all of the Army services across the DODIN-A. Provide management 203 support for all HW/SW enterprise-licensing requirements. Additionally, ensure services 204 perform to capability and capacity as agreed to in SLAs. The provider will develop 205 efficient and effective processes for the design, transition, operation and improvement 206 of IT services. 207 Multi-Provider Coordination 209 Multi-Provider Coordination (Seam Management) is the management, integration, 210 and coordination between multiple suppliers of IT services to ensure optimal 211 business value, encourage innovation, and promote consistent and seamless end-212 to-end services to Army users. The Service Provider will ensure coordination 213 between current base contract and transition to future contract activities. 214 Mobility Management 216 The Service Provider will provide, operate, maintain, and sustain secure mobility 217 services for end users to access Army data and applications from any authorized device 218 (both Government Issued and BYOD) on DoDIN-A, and Government issued device on 219 Classified systems. This includes the following: 220

• Mobile Device Management (MDM) - Provision and manage configuration of 222

• Government-issued mobile devices for security and policy enforcement 223

• Mobile Application Management (MAM) - Provision, operate, and maintain mobile 224 business application catalog and configurations 225

• Mobile Content Management (MCM) - Provide content distribution and 226 synchronization 227

• Mobile E-mail Management (MEM) - Provide secure mobile email while 228 supporting legacy DOD PKI encryption and signatures 229

LOE 1.3 Compute and Store 231 The Service Provider will provide compute and store services to include Collaborative 232 Data Environment, Global Access to Data & Application Hosting and Linked to Legacy 233 Data Analytic Solutions. Systems will be delivered through innovative private, public or 234 hybrid cloud deployment methods either in government data centers or in industry data 235 centers. 236 Information Technology Systems & Data Analytics 238 The Army requires the ability to capture, store, access and analyze all IT systems-239 related data in a Collaborative Data Environment. The solution must be cloud 240 agonistic. Once captured, the data will be aggregated and analyzed. The Army 241 Cyber Big Data Platform and the resulting information will be compared against 242 Government and Service Provider-identified metrics. The Collaborative Data 243 Environment must be interoperable any existing Army or joint logging and data 244 analytic solutions. 245

The data will meet the needs for reporting IT system health and performance as well 247 as cyberspace defensive activities to relevant stakeholders and commands. The 248 Collaborative Data Environment must meet or exceed all government standards and 249 regulations. The Service Provider will provide data to the Army Program of Record 250 responsible for providing situational understanding through cyber analytics. The 251 Service Provider will provide any data about the network or from installed sensors 252 necessary to support analytics. The use of the single Big Data Platform architecture 253 supports data correlation across disparate data sets and enables separate 254 organizations to develop mutually supporting analytics independently. 255 Application Hosting and Service Delivery Support 257

The Service Provider implements a standards-based common compute and storage 258 infrastructure (hardware, software, and hosting services) to support the storage, 259 access, and distribution of services and information across the network to the user 260 at the point of need in accordance with the technical requirements specified in 261 Section 4.0 of the Enterprise Computing Environment (ECE) Technical 262 Requirements Document. Services are delivered through private, public, or hybrid 263 cloud deployment methods either in Government data centers or in 264 industry/commercial data centers. The Service Provider will coordinate with 265 application and service owners to support on-premises compute and storage and/or 266 migration to government or commercial data centers. The Service Provider is 267 responsible for implementing a balanced approach to cloud and edge computing to 268 leverage commercial industry solutions, improve user experience, and maximize 269 performance and availability. All migrations will comply with DISA cloud approval 270 guidelines for system impact levels (up to Impact Level 6), the DISA Cloud Security 271 Requirements Guide, and/or any requisite Army cloud policies or exceptions. 272

5. SUMMARY 274

This document has defined the initial broad view of the requirements for EITaaS and 275 has set the stage for what the Army needs from a commercial industry partner to meet 276 its immediate and future warfighting requirements. This transformation requires 277 innovation, expertise, knowledge and experience along with proven business processes 278 and procedures. Key importance is the ability to provide connect, protect, storage, 279 computing, common IT services, hardware, software and networking infrastructure to 280 the point of need (user). While not limited to the above stated services, the commercial 281 industry partner will simultaneously adhere to the following principles: 282

• Modernize: IT commercial standard or better to enable Army modernization and 283 readiness 284

• Stabilize: Leverage advantages of cloud and industry best practices 285

• Defend: Optimize against Army networks, mission systems and data 286

• Maintain: Core government expertise and user experience responsibility 287

EITaaS will leverage industry best practices and capabilities from the private sector to 289 assess whether commercial solutions can provide standardized, innovative, and agile IT 290 services to the Army capable of increasing performance, security and user experience. 291 Upon successful implementation, EITaaS enables the transfer of government resources 292 to focus on core cyberspace operations, increase readiness and cyberspace 293 effectiveness while enhancing security to ensure successful completion of Army 294 missions. 295