Attachment_0001_Amended_SOO_14_Nov_2016.pdf

Unified Capabilities Soft Client Subscription Service Statement of Objectives (inclusive Amendment 0001through 0006)

Unified Capabilities Soft Client

Subscription Service

Statement of Objectives (SOO)

Product Lead Enterprise Content Collaboration and Messaging

(PL EC2M)

14 Nov 2016

Statement of Objectives (inclusive Amendment 0001through 0006)

Table of Contents 1 Overview

1.1 Background

1.2 Scope

1.3 Period and Place of Performance ........................................ Error! Bookmark not defined.6

1.4 Data Storage, Data Rights, and Data Ownership

2 UC Soft Client Service Objectives and Requirements

2.1 UC Soft Client Service Hosting Objectives

2.1.1 On Premise Hosting

2.1.2 Off Premise Hosting

2.2 UC Soft Client Service Requirements

2.2.1 Voice Requirements at IOC

2.2.2 Voice Requirements at FOC

2.2.3 Video Requirements at IOC

2.2.4 Video Requirements at FOC

2.2.5 IM/Chat Requirements at IOC

2.2.6 IM/Chat Requirements at FOC

2.2.7 Presence Requirements at IOC

2.2.8 Presence Requirements at FOC

2.2.9 Desktop (Screen) Sharing Requirements at IOC

2.2.10 General Requirements at IOC

2.2.11 General Requirements at FOC

2.3 Cybersecurity Requirements

2.4 Fielding Objectives

2.5 Management Objectives

2.6 Help Desk Support Objective

2.7 Contractor Service Level Agreement (SLA) and Reporting Objectives

2.8 Service Reporting

2.9 Training Objective

2.10 Change Management Objective

2.11 Test and Evaluation (T&E) Objective

2.12 Accessibility - Section 508

Statement of Objectives (inclusive Amendment 0001 through 0006)

2.13 Identity Management and Synchronization Objective

2.14 XMPP Gateway Objective

2.15 Client Software Deployment Objective

2.16 Client Hardware Specification Requirement

2.17 Licensing Approach Objective

3 System Interfaces

3.1 Network Interfaces

3.1.1 Cloud Access Point (CAP)

3.1.2 Joint Regional Security Stacks (JRSS)

3.2 DoD Identity and Authentication Services

3.2.1 Enterprise Directory Services (EDS) and Identity Management

3.2.2 Synchronization Options

3.2.3 Third Party Application Integration

3.2.4 DISA Authentication Gateway Services (AGS)

3.3 DISA DSN and Voice ISP Interface

3.4 XMPP Interface

3.4.1 Tactical

3.4.2 Other

3.5 Client Software Deployment Objective

Appendix A. References

Appendix B. CDRL Summary

Appendix C. Acronym List

Appendix D. Additional Cybersecurity and General Security Requirements

D-1. Personnel Security

D-2. Access and General Protection Security Policy and Procedures

D-3. Antiterrorism

D-3.1. Antiterrorism Level I Training

D-3.2. Threat Awareness and Reporting Program (TARP) Training

D-3.3. iWATCH

D-3.4. Emergencies and Force Protection Conditions

D-4. Use of Subcontractors or Other Service Providers

D-5. Organizational Conflict of Interest (OCI)

D-6. Facility Inspections

D-7. Notification

D-8. Installation Cybersecurity Program

D-8.1 Computing Environment (CE) Certification

D-8.1 Security Clearances

D-8.2. Training Requirement for SIPRNet Access

D-8.3. Operations Security (OPSEC)

D-8.4. Non-Disclosure Agreement (NDA)

D-8.5. Infrastructure System Security

D-8.6. Data Security Requirements

D-8.7. Limitations on Access To, Use, And Disclosure Of, Government Data and

Government-Related Data

D-8.8. Government Records

D-8.9. Records

D-9. Information Security (INFOSEC) Guidance and Certification and Accreditation

D-10. Cybersecurity Reporting

D-11. Security Compliance Checks

D-12. Password Control Management

D-13. Communications Security (COMSEC) Service

D-14. Compliance

D-15. Indemnification

D-16. Insurance

D-17. Jurisdiction

D-18. Law Enforcement

D-19. Defense Federal Acquisition Regulation Supplement (DFARS)

D-20. Right of Termination

D-21. Return of data

1 Overview

This document describes the Army’s objectives and requirements to provide worldwide accessible Unified Capabilities (UC) Subscription services, which includes voice, video, instant messaging/chat, presence and desktop sharing capabilities delivered from a

Contractor Owned and Contractor Operated (COCO), on premise or off premise, cSoftware-as-a-Service (SaaS) service solution. U.S. Army Business users will access the UC Services from a standardized application on the user’s end-user devices, such as desktop computer, laptop, or mobile device.

1.1 Background

The Army provides voice, video, and data services to over 1 million personnel on bases, camps, posts, and stations (B/C/P/S) world-wide. The current architecture is a mixture of new and old technologies. Disparate and de-centralized communication and collaboration services limit Army operational effectiveness, create cost inefficiencies, and do not leverage information technology advances.

The older networks are comprised of stove-piped infrastructure that separates data, voice and video into duplicative infrastructures and separate local systems. Local commands provide capabilities such as Time Division Multiplexing (TDM) switches, Asynchronous Transport Mode (ATM) switches, Integrated Services Digital Network

(ISDN) circuits, and Primary Rate Interfaces (PRI) via legacy circuit switched infrastructure. Legacy systems and services consist of separate applications for IM/chat, presence, awareness, and screen sharing, all using disparate services and incongruent

TDM voice switches, Voice over Internet Protocol (VoIP) switches, telephone firewalls, Public Switched Telephone Network (PSTN) circuits, and secure telephones. Video teleconference (VTC) end points, circuits, and multiple control units (MCUs) complicate and negate interoperability and integration for communications across the Defense

Information Systems Network (DISN). Transitioning to the UC Soft Client Subscription

Service will enable the Army to move towards modernized IP-based services, move away from legacy infrastructure, and allow for circuit decommissioning.

1.2 Scope

UC Soft Client Subscription Services will provide integrated voice, video, instant messaging / chat, presence, and screen sharing. UC Soft Client Subscription Services enables non-assured synchronous collaboration for up to 900,000 Non-classified

Internet Protocol Router Network (NIPRNet) and up to 100,000 Secret Internet Protocol

Router Network (SIPRNet) Army business users worldwide on any approved desktop or mobile device. Separate instances of the UC Soft Client Subscription Services must be provided for the NIPR and SIPR. Assured voice subscription services and extension of the subscription services to coalition networks are not within scope of this effort.

Specialized users, missions and locations that cannot be supported by this subscription services may be supported by other solutions outside the scope of this effort. End-user headsets and cameras are outside the scope of this effort. NIPRNet UC Soft Client

Service will connect to PSTN, DSN, or other Voice Systems. SIPRNET UC Soft Client service will integrate with the classified DISA voice network via an AS-SIP, i.e. SIP-TLS, trunk. This integration will allow access to ECVoIP and DRSN users.

1.3 Period and Place of Performance

The base Period of Performance will be one (1) year from date of award with four (4) one (1) year options.

Place of performance may be on premise at Army or other Government owned facilities or off premise at Contractor provided facilities. Cloud Service Providers (CSP)s may maintain all government data not physically located on DoD premises within the 50

States, the District of Columbia, and outlying areas of the US (as defined at FAR

2.10145), unless otherwise authorized by the responsible Authorizing Official (AO) as described in DoDI 8510.01.

For more information on hosting COCO Cloud requirements refer to Section 5.2, Legal

Considerations, in the DoD Cloud Computing Security Reference Guide (SRG) v1r2.

1.4 Data Storage, Data Rights, and Data Ownership

All data, including but not limited to documents, administrative data, support data, and billing data, transmitted via the system or maintained in the system shall reside at all times in servers located in the United States or in servers of which the operation and maintenance are subject only to the laws of the United States. The system will be used to store and transmit sensitive Government and private entity data. Data transmitted must only be subject to disclosure pursuant to U.S. Federal law and not the laws of any other jurisdiction or foreign nation. All DoD information/data placed or created by DoD users in a Cloud Service Provider’s (CSP) Cloud Service Offering (CSO) is owned by the DoD, the Mission Owner, and/or their Information Owner. The CSP has no rights to the DoD’s information/data. For more information on data storage, data rights, and data ownership requirements refer to Section 5.2, Legal Considerations, in the DoD Cloud

Computing Security Reference Guide (SRG) v1r2.

2 UC Soft Client Service Objectives and Requirements

The following sections specify UC Soft Client Service Objectives and Requirements.

2.1 UC Soft Client Service Hosting Objectives

The objective is to procure a COCO, cloud-based UC Soft Client Subscription Service, however hybrid or non-cloud based solutions may be considered. Contiguous United

States (CONUS) NIPRNet UC Soft Client Subscription Services may be hosted in an on premise or off premise cloud-based environment. CONUS for purposes of this acquisition is defined as the 48 contiguous states, including the District of Columbia, Alaska, Hawaii, and US Territories. OCONUS is defined as outside the CONUS (as defined above). If the solution is hosted in an OCONUS data center, it must be on premise. SIPRNet UC Soft Client Subscription Services must be hosted on premise.

The following sections describe different hosting options.

2.1.1 On Premise Hosting

On premises includes DoD data centers or other facilities located on a DoD Base/Camp

/Post/Station (B/C/P/S) under the direct control of DoD personnel and DoD security policies. This option requires the contractor to obtain and maintain a DoD Provisional

Authorization (PA) at level 5 (NIPRNet) and level 6 (SIPRNet). If a non cloud on-premise solution is proposed, the infrastructure must meet security standards and controls within DoDI 8500.01 and 8510.01 Risk Management Framework (RMF). If a hybrid solution is proposed (cloud and non cloud), any part of the solution which is cloud based must meet the IL 5 and IL 6 requirements; any portion that is non-cloud will have to meet DoDI 8500.01 and 8510.01 RMF. If an on premise hosting solution is proposed, the contractor must specify the number of distributed Data Centers (DC) and provide each DC requirement, such as:

HVAC (tons) - include high density compute/cooling requirements

Per-rack Power requirements (single phase, 3-phase, amperage, voltage, etc.)

Floor (Rack) Space (Sq. ft.)

Bandwidth (Mbps)

Physical Security/Separation requirements

Physical access requirements

Remote management requirements

Networking environment (IP addressing, sub netting, Computer Network

Defense (CND)

For on-premise hosting, candidate data center locations are:

Fort Bragg, North Carolina

Fort Knox, Kentucky

Fort Carson, Colorado, Redstone Arsenal, Alabama

Camp Humphreys, Korea

Camp Walker, Korea

Kaiserslautern, Germany

Grafenwoehr, Germany

Camp Zama, Japan

Fort Shafter, Hawaii

Southwest Asia location has not been determined.

The facilities provided for any on premise solutions will be considered Government

Furnished Equipment and/or Property (GFE or GFP). For Cloud solutions, all other infrastructure shall be provided by the CSP.

For on premise solutions, the contractor shall address in its PWS how it will handle and account for the GFE provided.

The offeror will be afforded the opportunity to conduct a site survey at the locations identified in the offerors solution. The site survey will be attended by the USG and the offeror. The site survey shall be conducted no later than 30 days after award.

2.1.2 Off Premise Hosting

Off premise hosting refers to commercial data centers, systems, and Cloud Service

Provider (CSPs) operating within facilities that are not under the direct control of the

DoD. This option requires the contractor to obtain and maintain a DoD Provisional

Authorization (PA) at level 5 (NIPRNet) and level 6 (SIPRNet).

2.1.3 Army Local Session Controllers

Offerors may propose to leverage Internet Protocol based infrastructure (Army local session controllers, or LSCs) in the delivery of this service. If choosing to leverage the service from LSCs, the objective is for a standardized enterprise service which includes portability of licenses and a technical refreash which alleviates the investment in new equipment by the Army. If a non cloud on-premise solution is proposed, the infrastructure must meet security standards and controls within DoDI 8500.01 and

8510.01 Risk Management Framework (RMF).

2.2 UC Soft Client Service Requirements

The contractor shall achieve two sets of requirements: one at Initial Operation Capability

(IOC) and one at Final Operating Capability (FOC). The proposed solution shall be a proposed design and comprised of products pursuant to the DoD Unified Capabilities

Requirements 2013 (UCR 2013) Change 1 dated June 2015 and on the DoD UC

Approved Products List (UC APL). The contractor shall provide the latest version of its solution in contract performance, if it has been tested and certified and is on the

UCAPL.

2.2.1 Voice Requirements at IOC

Users shall have the ability access voice services via a software client

(softphone) on any Army approved End User Device (EUD) (e.g., desktop, laptop, and tablet computers; Army mobile devices such as smart phones).

Voice Conferencing shall provide the ability to link together multiple point-to-point calls in a multi-party conference using a conference bridge or initiated from a telephony end instrument (EI).

Voice conference session hosts shall have the ability to allow/disallow access to the session through the UC Soft Client Service user interface.

The Voice Conference capability shall have the ability to display a participant list for a Voice Conference which includes a visual indicator of which participants are currently speaking.

The Voice service capability shall have the ability to provide microphone control features (example: the ability to mute/unmute at the user's discretion).

The Voice service shall provide the ability for Bridges to be developed to include access for VoIP or PSTN telephone users once PSTN/VoIP integration is implemented.

The Voice service shall provide the ability to add or remove a voice call in an existing collaboration session.

The Voice service shall provide the ability to enable a Call Forwarding Variable (redirection to another Directory Number).

The Voice service shall provide the ability to enable call forwarding for a busy line.

The Voice service shall provide the ability to enable call forwarding for "no answer" (redirection after specified number of ring cycles).

The Voice service shall support the following audio standards for audio-only conferencing: G.711; G.722; G.729/G.729A.

2.2.2 Voice Requirements at FOC

The Voice service shall provide the ability to define voice conferencing groups from contact lists or conference participants for planned or ad-hoc meetings.

The NIPRNET Solution shall be fully interoperable with the Public Switched Telephone Network and the Defense Switched Network to enable Non-Assured Voice and Video for DoD and Commercial access.

The NIPRNET Voice service shall consume Direct Inward Dialing (DID) numbers which will be provided by the USG.

The SIPRNET Voice service shall integrate to the classified DISA voice network via an AS-SIP, i.e. SIP-TLS, trunk.

2.2.3 Video Requirements at IOC

Video conference session hosts shall have the ability to allow/disallow access to the session through the UC Soft Client Subscription Service user interface.

The Video service shall have the ability to accommodate users on the same conference at different video rates, resolutions, and frame rates according to EI capability and not at the lowest common denominator level.

The Video service shall provide the ability to make changes to Active Conferences or sessions without interrupting the continual video.

The Video service shall have the ability to allow user preference update during active sessions.

The Voice service shall provide the ability to add or remove a video call in an existing collaboration session.

2.2.4 Video Requirements at FOC

The Video service shall provide the ability to select video display arrangements.

The Video service shall provide the ability to limit a view to a single video or data source, with the option to enable video source switching to the current speaker.

Commercial Video Access shall have the ability and provides interoperability with external VTC services and/or video enabled web conference services outside the

DoD.

2.2.5 IM/Chat Requirements at IOC

The IM/Chat service shall provide the ability to incorporate plain text, rich text, and active hyperlinks in a session.

The IM/Chat service shall provide the ability for users to turn on or off history log.

The default setting shall be turned on.

The IM/Chat service shall provide the ability to insert a timestamp Instant Message when the user sends an IM or initiates another type of session.

The IM/Chat service shall provide the ability to conduct Persistent and Non- Persistent Chat sessions that can be uniquely named by the session owner.

The IM/Chat service shall provide the ability to review the entire chat history for all persons entering a chat session.

The IM/Chat service shall provide the ability to conduct multiple IM/Chat sessions at the same time.

The IM/Chat service shall provide the ability for users to store and retrieve history logs both locally and remotely from the service provider.

The IM/Chat service shall provide the ability for a participant in a two-party or multi-user chat to invite one or more additional users into a multi-user chat session.

2.2.6 IM/Chat Requirements at FOC

The IM/Chat service shall provide the creator and participant the ability to forward an Instant Message transcript to another user.

2.2.7 Presence Requirements at IOC

The Presence service shall permit end users to update their presence (e.g., Availability Status), and the host server shall in turn broadcast the updated presence information to all the user’s contacts who have an active subscription to that user’s presence information. By default, presence will automatically update based on active, idle, or locked state of the EI.

The Presence service shall provide the user the ability to edit their own Availability Status message to add further description to the standard status categories of: Available, Away, In a Meeting, and Do Not Disturb.

The Presence service shall provide the ability for end users to subscribe to another user’s presence (i.e., end user availability status) and to be notified when that state changes.

The solution shall provide the ability for an authorized user to grant any other authorized user access to their presence data.

The Solution shall provide the ability for a user to view Presence status and information whenever a contact (IETF RFC 6121) name is displayed.

The Presence service shall provide the end user the ability to place themselves into a Do Not Disturb availability and thus preclude other users from opening a UC session with them.

The Presence service shall automatically change the user's status to away when the EI is locked (example: remove the CAC). However, the user will remain logged into the Solution and automatically return to their previous presence status upon unlocking the EI.

The Solution shall provide the ability for a user to organize the presence indicators for other users into groups that can be edited or deleted by the user as needed.

2.2.8 Presence Requirements at FOC

The Presence service shall provide user ability to interface UC with their Defense

Enterprise Email client for Email/Calendaring publishing of free/busy presence information to Rich Presence.

2.2.9 Desktop (Screen) Sharing Requirements at IOC

The Desktop Sharing service shall provide the ability for the host/presenter, or any authorized user designated by the host/presenter to share the entire desktop, a section of the desktop, or an application window.

The Desktop Sharing service shall provide the ability for users to permit or deny control of a shared application or desktop.

The Desktop Sharing service shall provide the ability for any user to accept or deny desktop sharing session.

The Desktop Sharing service shall provide the ability for session host/presenter to determine whether to share the entire desktop, a screen section, or a specific application.

2.2.10 General Requirements at IOC

The Solution shall enable users the ability to conduct UC sessions which include Voice, Video, Desktop Sharing and IM/Chat sessions.

The Solution shall provide a common, device-specific user interface to access all UC functionality.

The Solution shall provide the ability to initiate a Voice, Video, Desktop Sharing and IM/Chat session when a user name is selected. (Example: for voice and video, user can select a contact from local directory whereas with IM user would select name from subscribed contacts).

The Solution shall provide the ability to initiate an EMAIL via the EI native EMAIL application when another user name is selected.

The Solution shall provide the ability to save a recording of UC sessions to an industry-standard File type before closing. Recordings will be ready for users to retrieve anytime for a period of 30 days after completion of the conference.

The Solution shall provide the ability to notify UC session participants when a session is being recorded.

The Solution shall provide the ability to display user name and Persona for session participants.

The Solution shall allow a user the ability to look up the Name, Telephone Number, and E-Mail address of other users.

The Solution shall enable any session or conference to show active or connected users.

The Solution shall provide the ability to add multiple users to a UC session.

The Solution shall provide the ability to view dialogues that have been saved to a File.

The Solution shall provide the ability to create, import and export address books, individual contact lists, and organizational contact lists in the DoD Global Access List (GAL).

The Solution shall provide a connection to the DoD Enterprise Directory Service to access user information for all Army users.

The Solution shall provide the ability for a user to change its session capabilities from any combination of web, audio and video to any other combination of web, audio or video, before or during a Conference.

The Solution shall be fully functional on existing Army end user devices.

The Solution shall enable Voice and Video Quality of Service (QoS) consistent with Non-Assured services as described in the DoD UCR.

The Solution shall be compliant with the mandatory requirements described in applicable sections of the DoD UCR 2013 Change 1 and UC XMPP Change 1 (or latest revisions).

The Solution shall be available on Army EIs and Computing Environments (CEs) that are both fixed and mobile. (Examples: Army desktop, laptop, and tablet computers; Army mobile devices such as smart phones).

The Solution shall provide the ability to perform all UC functions in a virtual desktop (thin/zero client) environment.

The Solution shall require the use of Public Key Infrastructure (PKI) for authentication through hard tokens (such as Common Access Card (CAC), SIPRNet token, alternate logon Token (ALT) token, or derived certificates).

The Solution shall provide the ability to automatically or manually configure the UC client codec and associated bit rate.

The Solution shall store and log security classification markings for active and recorded sessions.

The Solution shall display the security classification banner.

The Solution shall ensure all users are aware, notified, and acknowledge notification when 911 calling and emergency services are not supported or available.

The Solution shall enable USG Administrators to install, operate and troubleshoot the system correctly on the first attempt 90% of the time as measured by the number of service desk tickets resolved by Tier III (service provider).

The Solution shall have a product availability state of 99.9% (0.999) with Recovery Point Objective of 8 hours and Recovery Time Objective of 24 hours (Mission Assurance Category (MAC) II, high availability local).

The solution shall support a Security Categorization and Control Selection for National Security Systems (CNSSI) 1253 categorization of Moderate Confidentiality, Moderate Integrity, and High Availability (M, M, and H).

The Solution shall have no single point of failure that could cause an outage of more than 0.1% of users.

2.2.11 General Requirements at FOC

The Solution shall provide the ability to provide a meeting invite for active or future UC sessions.

The Solution shall have the ability to initiate a service from any of the other services (Chat, IM, Voice, Video, Desktop sharing).

The Solution shall allow users the ability to view network performance indicators for a Voice or Video session, at minimum endpoint latency and established bitrate.

The Solution shall provide an availability model for the service, showing all availability calculations and showing how the overall availability will be met.

The Solution shall provide a web client as an alternative to a locally installed UC client.

2.3 Cybersecurity Requirements

The Contractor shall maintain administrative, technical, and physical safeguards and controls required for the security level and services being provided in accordance with(IAW) the Cloud Computing Security Requirements Guide (SRG) Version 1 Release

2 found at http://iase.disa.mil/cloud_security/Pages/index.aspx. For non-cloud on DOD premise solutions, the solution must meet security standards and controls specified in

DoDI 8500.01 and 8510.01 (RMF). For hybrid on premise solutions, any part of the solution which is cloud based, must satisfy requirements IAW SRG v1r2; any portion of the hybrid solution that is non-cloud will have to meet DoDI 8500.01 and 8510.01 RMF.

The proposed solution shall possess an approved DoD Provisional Authorization

(PA) for Impact level(IL) 5 (NIPRNet) 180 days after contract award and IL 6

(SIPRNet) no later than 440 days after contract award.

The contractor will be responsible for generating and providing RMF required accreditation related documentation and artifacts to the Army UC Soft Client

Service Information System Security Manager (ISSM). RMF artifacts must be submitted for IL 5 systems Authority to Operate (ATO) NLT 180 days after contract award. IL 6 RMF artifact submission shall be done in a timeframe to allow the Offeror to achieve IL 6 no later than 440 days after contract award.

If the PSTN/DSN FOC is optioned by the Government, the contractor will have

90 days after date of option to update its PA IL-5 accreditiation to encompass the security controls required for FOC NIPRNet requirements.

If the DRSN/ECVOIP FOC is optioned by the Government, the contractor will have 90 days after date of option to update its PA IL-6 accreditiation to encompass the security controls required for FOC SIPRNet requirements.

The contractor will support the Assessment & Authorization (A&A) process for

Army UC Soft Client Service

The contractor will be responsible for performing Cybersecurity vulnerability scans http://iase.disa.mil/cloud_security/Pages/index.aspx

The contractor will conduct Information Assurance Vulnerability Management

(IAVM) Monitoring and Response activities, to include development and production of all necessary documentation to support these activities

The contractor should refer to Appendix D for additional security requirements

2.4 Fielding Objectives

Fielding is in two increments: Initial Operating Capability (IOC) and Final Operating

Capability (FOC). IOC shall be complete no later than contract award (C) + 440 days;

FOC shall be completde no later than 270 days after an FOC CLIN (NIPRNET and

SIPRNET) is optioned (provided FOC options are exercised). IOC will consist of all IOC requirements being fielded to 150K NIPR in the CONUS Southwest (SW) region. FOC will consist of all IOC and FOC requirements to a total of 900K NIPR users/100K SIPR users world-wide. Users shall be on-boarded over time as noted in the table below:

Network Timeline No. of Users Location

NIPR C+440 150 K SW

SIPR C+500 15 K HSMCC+SW

NIPR Option YR 1 300 K CONUS/EUR

SIPR Option YR 1 85 K World-wide

NIPR Option YR 2 275 K EUR

NIPR Option YR 3 145 K PAC

NIPR Option YR 4 30 K SWA

Fielding should follow Post/Camp/Station modernization, Joint Regional Security Stack

(JRSS) and Multiprotocol Label Switching (MPLS) implementation.

2.5 Management Objectives

The Contractor shall provide the overall program management and personnel in order to successfully provide UC Soft Client Subscription services to the Army at the required performance level.

2.5.1 Service Management Objective.

The contractor shall have a single point of contact for coordination with the Government

Program Management Office; successfully integrate and coordinate all activity needed to provide the UC Soft Client Subscription Service; provide corrective action plans, timely identification of issues, and effective management of subcontractors; ensure it provides the appropriate management and resources to ensure overall success of the program is achieved, including maintaining schedule, program reviews, test events, training, deployment to designated locations, sustainment, quality, program management, and risk management; maintain professional and ethical behavior of all contractor personnel.

2.5.2 Contract Administration Objective

The contractor shall establish processes and assign appropriate resources to effectively administer the UC Soft Client Subscription Service and its associated deliverables. The contractor shall respond or acknowledge Government queries or requests for contract action within 24 hours.

2.5.3 Subcontract Management Objective

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime contractor will manage work to ensure no Organizational Conflict of Interest (OCI) considerations. Contractor shall ensure its personnel and all subcontractors it employs in this effort have the appropriate clearances.

2.5.4 Operations Management Objective

The contractor will provide an operations management team that provides the periodic and real time reporting, and oversight of help desk functions specified in this SOO. The operations management team shall be staffed 24 hours a day, seven days a week.

2.6 Help Desk Support Objective

The Army has established the Army Enterprise Service Desk (AESD) and a tiered support structure for the UC Soft Client Service effort.

Tier 0 - self-service via web portal with UC Soft Client knowledge available to users

Tier 1 - initial incident handling, resolution, escalations when required, and dispositioning

Tier 2 - dedicated UC Soft Client problem resolution in coordination with UC Soft

Client service owner/service manager

The contractor shall establish a Tier 3 support desk for UC Soft Client problem resolution provided by the UC Soft Client software provider and UC Soft Client -based application service providers. Contractor shall supply 24/7/365 Tier 3 support via dedicated solution experts. The contractor shall propose the workflow and key interface processes to take advantage of the AESD Business to Business (B2B) relationship. The contractor shall coordinate a B2B interface with the AESD during the first 90 days of contract execution.

2.7 Contractor Service Level Agreement (SLA) and Reporting Objectives

The contractor shall propose a Service Level Agreement (SLA) to cover support, services, reporting, maintenance, licenses, backups, recovery procedures, security levels, cybersecurity controls, accreditation and certification, performance metrics, demarcation points, and service continuity.

2.8 Service Reporting

The service provider shall report security events and technical outages to the Regional

Cyber Center (RCC) within 1 hour.

2.9 Training Objective

The contractor shall provide training and access to training materials/user manuals to assist personnel with use, administration, and management of the service. The contractor shall provide all lesson plans and training material to the Government.

2.10 Change Management Objective

The contractor shall follow the Change Control process as referenced in Section 5.3.2

Change Control, in the DoD Cloud Computing SRG v1r2. Within 90 days of contract award, the contractor shall develop a change management process and submit it to the

Government for approval.

2.11 Test and Evaluation (T&E) Objective

Within 45 days of contract award, the Contractor shall develop a test plan which demonstrates that the system meets the requirements identified in this SOO. The

Government must approve the test plan prior to test execution. Using the approved Test

Plan, the Contractor shall verify the functionality of UC Soft Client Service with USG oversight.

2.12 Accessibility - Section 508

All Electronic and Information Technology (EIT) products and services proposed shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998

Amendments, 29 United States Code (U.S.C.) 794d, and the Architectural and

Transportation Barriers Compliance Board's Electronic and Information Technology

Accessibility Standards at 36 Code of Federal Regulations (CFR) 1194. The contractor shall identify all EIT products and services provided, identify the technical standards applicable to all products and services provided, and state the degree of compliance with the applicable standards. Additionally, the contractor shall clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., contractors or other vendor’s exact web page location). The contractor must state tasks to meet section 508 accessibility in the PWS.

2.13 Identity Management and Synchronization Objective

In response to this RFP, the contractor shall describe the proposed solution’s identity management and authentication approach. The contractor shall include all directory source information and PKI authentication service required from the Government.

Paragraph 3.2 below describes DoD Identity and Authentication Services.

2.14 XMPP Gateway Objective

Contractor shall provide an Extensible Messaging and Presence Protocol (XMPP)

Gateway/Boundary or XMPP compliant solution. The solution shall be XMPP compliant with the mandatory requirements described in applicable sections of the DoD UCR 2013

Change 1 and Department of Defense Unified Capabilities (UC) Extensible Messaging and Presence Protocol (XMPP) 2013 (UC XMPP 2013) Change 1, dated June 2015 (or latest revisions). At a minimum the XMPP Gateway must be able to provide IM/Chat and Presence capabilities for up to 3 different Tactical Interfaces. See para 3.4 for the

XMPP interface description.

2.15 Client Software Deployment Objective

Within 90 days of contract award, the contractor shall provide the following items:

a. Both the Desktop and Mobile Software Client versions of their UC soft-client software to NETCOM

b. Additional configuration settings, Registry Settings, or any other changes that are required for the target client system to utilize the UC Soft Client Service.

2.16 Client Hardware Specification Requirement

In response to this RFP, the contractor shall provide the following items:

a. A list of minimum hardware and software requirements that Army End User

Devices must meet to install the client software and use the UC Soft Client

Services.

b. A list of compatible headsets and camera hardware that interoperates with the proposed system.

c. A list of compatible Virtual Desktop Infrastructure (VDI) client and server systems.

2.17 Licensing Approach and Objective

In response to this RFP, the contractor shall identify their proposed solution’s licensing requirements and identify its approach to leverage existing Army Purchased Licensing and Joint Enterprise License Agreements/Enterprise Licensing Agreements (JELA/ELA) or cost savings based on economies of scale/bulk purchasing.

The contractor shall identify how it will transfer ownership of any licenses purchased under this contract to the U.S. Government at contract completion.

3 System Interfaces (Informational)

3.1 Network Interfaces

3.1.1 Cloud Access Point (CAP)

A DoD CAP is a system of network boundary protection and monitoring devices, otherwise known as an IA stack, through which CSP infrastructure will connect to a DoD

Information Network (DoDIN) service: the NIPRNet or SIPRNet. At a minimum, the

CAP will provide the following protections:

Protects the DoDIN and its network services

Protects other DoD missions from incidents that affect a particular CSP’s supported missions

Provides perimeter defenses and sensing for applications hosted in the commercial cloud service

Extends the DoD demilitarized zone (DMZ) architecture to external facing mission systems and applications

The CAP and CSP will provide the end users with the connectivity necessary to draw services allowing the UC Soft Client Software to connect to UC Soft Client Services hosted in CSP Data Centers (DCs).

3.1.2 Joint Regional Security Stacks (JRSS)

The UC Soft Client Service end user traffic will traverse the Joint Regional Security

Stacks (JRSS) and SBCs within the DISN core for all traffic that flows between the installation through the CAP and out to the CSP hosting facility.

3.2 DoD Identity and Authentication Services

3.2.1 Enterprise Directory Services (EDS) and Identity Management

Enterprise Directory Services (EDS) is DISA’s Identity Management capability that consolidates each of the Service’s identity data from Defense Manpower Data Center

(DMDC), Human Resources and other sources and provides a single interface to locate, access, and securely share identity data. EDS also provides synchronization capabilities by way of provisioning to support account lifecycle (add, remove, changes) management.

DISA will host the EDS Service and associated synchronization and provisioning tools necessary to replicate identity data, along with changes, based on downstream receivers.

Details about the DISA Enterprise Directory Services (EDS) can be found in Section 2.2.5, Enterprise Directory Services (EDS), of the Department of Defense Unified Capabilities Framework 2013 (UC Framework 2013). Specific EDS requirements can be found in Section 2.12.2.2.6, Enterprise Directory Services, of the DoD UCR 2013 Change 1.

The Identity Synchronization Service (IdSS) is a part of the DISA Enterprise Directory

Services (EDS). IdSS connects to authoritative identity data sources, including the

DMDC and the Global Directory Service (GDS) to collect and groom identity data and to provision and maintain persona-based user objects in LDAP directories such as the

Enterprise Applications Services Forest (EASF).

3.2.2 Synchronization Options

The EDS Service is a LDAP schema (LDAP directory structure, LDAP directory records, and LDAP directory record attributes) of the remote DEE GAL, DMDC and other feeds into a single database. IdMI supports the following sync options:

IdMI Forefront Identity Manager (FIM) Sync push to IdMI customer AD

Lightweight Directory Services (LDS)

Sync from IdMI AD LDS to component synchronization service instance (specify push or pull)

AD LDS Replica partnership between IdMI AD LDS and component AD LDS

Replica Partner. AD Replication is a dynamic network-sensitive latency-tolerant connection

NETCOM will contact the DISA EDS Helpdesk to work through the process to set up an

IdMI feed as required and agreed upon.

3.2.3 Third Party Application Integration

E-mail users currently access e-mail services via their MS Outlook and Outlook Web

Access (OWA) clients. UC Soft Client end users currently have access to Local

Directory Services on the DISA LSCs and ESCs where the Local Directory only contains information for other users served by that LSC or ESC. EDS Integration will provide UC end users with the same Enterprise Directory information that is available to

Enterprise E-mail users and will also support automatic updates of the UC user’s address data (DSN and COM numbers, SIP Usernames, IM Addresses) from UC ESCs to the DMDC and the DEE GAL.

3.2.4 DISA Authentication Gateway Services (AGS)

The Authentication Gateway Services (AGS) is a Government deployed Commercial

Off-the-Shelf (COTS) authentication middleware that provides a centralized endpoint for user authentication and propagates that authentication to applications it protects. AGS allows customers to meet the requirements of USCYBERCOM Communication Task

Order (CTO) 07-15. It is currently deploying on NIPR and SIPR to perform authentication and identity translation for applications inside DISA DECCs. AGS provides the following services for relaying CAC authentication information to relying party back-ends:

• Header Injection - authenticates user and provides authentication information in a

HTTP/S Header to relying party (RP) application

• Security Assertion Markup Language (SAML) assertion - authenticates user and provides authentication information in a signed SAML assertion to the

• RP application or cloud provider

• Username/Password support - (Under Evaluation) authenticates user based on username and password against a pre-populated directory service provided by the RP (LDAP, AD, and Relational DB)

• Kerberos ticket service on user's behalf, then provides service ticket to the RP application

3.3 DISA DSN and Voice ISP Interface

Unless the contractor proposes another acceptable solution, the Army intends to utilize

DISA DSN and Voice ISP services. The Voice ISP provides connectivity to the PSTN and E911. The CSP shall provide Session Initiation Protocol (SIP) Trunks from the

CSP Session Border Controller (SBC) to DISA managed Enterprise SBCs. Details about the DISA Voice Service Provider are located at the following URL:

http://www.disa.mil/Network-Services/Voice/Voice-ISP-PSTN. Based on contractor requirements the Army will coordinate with DISA and provide services to the contractor as Government Furnished Property (GFP).

3.4 XMPP Interface

To meet the XMPP compliant (IM/Chat and Presence services) interoperability objective, XMPP must support server-to-server federation (i.e., server-to-server interoperability) via Extensible Markup Language (XML) in support of near real-time, text-based messaging (including instant messaging, group chat, and the exchange of presence information). UC XMPP functionality and requirements can be located in the

Department of Defense Unified Capabilities (UC) Extensible Messaging and Presence

Protocol (XMPP) 2013 (UC XMPP 2013) Change 1, dated June 2015.

3.4.1 Tactical

The Army operates roughly 3 different Tactical XMPP systems on both NIPRNet and

SIPRNet; Cisco Unified Communications Manager, Microsoft Lync Server, and Jive’s

OpenFire XMPP Server

If the Army executes a Tactical Integration Option, the responsible tactical representative will initiate a connectivity request via the Army Enterprise Helpdesk which would then be passed to the contractor to begin defining the XMPP interface as required.

Tactical Enclave migration to the Contractor XMPP Gateway will be executed as

Individual XMPP Interface CLINs due to the specific configurations and testing needed for each of the different tactical configurations.

3.4.2 Other

a. There may be additional XMPP interfaces that will require integration.

3.5 Client Software Deployment

NETCOM will include the Desktop version of the software package and configuration settings in the AGM baseline as well as packaging and deployment using Systems

Center Configuration Manager (SCCM). NETCOM will be responsible for ensuring the client software is installed on all systems prior to site-specific implementation.

http://www.disa.mil/Network-Services/Voice/Voice-ISP-PSTN

NETCOM will submit the Mobile Client software and settings through the DoD

Application Vetting Environment (D.A.V.E.) process.

Appendix A. References

The guidance versions listed below shall be used, unless superseded by a current version or unless otherwise stated. The following publications are applicable to the implementation and management of this project. The Contractor shall be responsible for ensuring complete knowledge of the applicable documents listed in this section necessary to execute this project successfully. In the event of a conflict between the documents referenced herein and the contents of this SOO, the following applies in a descending hierarchal order of precedence: RFP, SOO; Exhibit A, CDRL. If conflicts do exist between the documents, the Contractor shall report any perceived or actual documentation conflict without delay to the USG.

Document Link

AR 190-13, The Army Physical Security Program, 30 October 1993 http://www.apd.army.mil/ProductMaps/Ad ministrative/ArmyRegulation.aspx

AR 25-2, Information Assurance, 13 November 2007 http://www.apd.army.mil/ProductMaps/Ad ministrative/ArmyRegulation.aspx

AR 381-12, Threat Awareness and Reporting Program, 4, October 2010 http://www.apd.army.mil/ProductMaps/Ad ministrative/ArmyRegulation.aspx

AR 530-1, Operations Security, 26 September 2014 http://www.apd.army.mil/ProductMaps/Ad ministrative/ArmyRegulation.aspx

AR Regulation (AR) 25-1, Army Information Technology, 25 June 2013 http://www.apd.army.mil/ProductMaps/Ad ministrative/ArmyRegulation.aspx

Army Chief Information Officer (CIO)/G- 6, “Guidance for Migration to, and Use of, Commercial Cloud Service Providers” 10 August 2015 http://ciog6.army.mil/Portals/1/CloudStrat egy07312015.pdf

Army Chief Information Officer/G-6, Army Cloud Computing Strategy, March http://ciog6.army.mil/Portals/1/20150424_ Army_Cloud_Computing_Strategy.pdf

Army Cloud Computing Strategy, March http://ciog6.army.mil/Portals/1/Army_Clou d_Computing_Strategy%20Final_v1_0.pdf

Army Enterprise Cloud Computing Reference Architecture http://ciog6.army.mil/Architecture/tabid/14 6/Default.aspx

Army Regulation 500-3, US Army COOP Policy and Planning http://www.apd.army.mil/pdffiles/r500_3.pd f

Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, Cyber Incident Handling Program, 18 December 2014 http://dtic.mil/cjcs_directives/cdata/unlimit/ m651001.pdf

CNSSI 1253, Security Categorization and Control Selection for National Security Systems https://www.cnss.gov/CNSS/issuances/Ins tructions.cfm http://ciog6.army.mil/Portals/1/Army_Cloud_Computing_Strategy%20Final_v1_0.pdf http://ciog6.army.mil/Portals/1/Army_Cloud_Computing_Strategy%20Final_v1_0.pdf http://ciog6.army.mil/Architecture/tabid/146/Default.aspx http://ciog6.army.mil/Architecture/tabid/146/Default.aspx http://www.apd.army.mil/pdffiles/r500_3.pdf http://www.apd.army.mil/pdffiles/r500_3.pdf https://www.cnss.gov/CNSS/issuances/Instructions.cfm https://www.cnss.gov/CNSS/issuances/Instructions.cfm

CNSSI 4009, Committee on National Security Systems (CNSS) Glossary, April 6, 2015 https://www.cnss.gov/CNSS/openDoc.cfm ?KA4kqjuFjin+DeThLkDLHg==

Committee on National Security Systems Instruction (CNSSI) 1253, Security Categorization and Control Selection for National Security Systems, March 27, https://www.cnss.gov/CNSS/openDoc.cfm ?uJ66fkQZZOcPGO/3q8o4fQ==

Department of Defense (DoD) Cloud Computing Security Requirements Guide, Version1.2, Release 1, 12 January 2015 http://iasecontent.disa.mil/cloud/Downloa ds/Cloud_Computing_SRG_v1r2.pdf

Differentiating COOP and DR http://csrc.nist.gov/publications/nistpubs/8 00-34-rev1/sp800-34-rev1_errata-Nov11- 2010.pdf

DISAI 240-110-36, Personnel Security.

https://disa.deps.mil/ext/resource/disa_pu blications_issuances/DISA%20Instructions 1/Forms/Site%20View.aspx

DISA Cloud Connection Process Guide http://iasecontent.disa.mil/stigs/pdf/CCPG _v1.01.pdf

DoD 5200.01-R, DoD Information Security Program, February 24, 2012.

http://dtic.mil/whs/directives/corres/pdf/52 0001_vol1.pdf

DOD 5200.2-R, DOD Personnel Security Program.

http://www.dtic.mil/whs/directives/corres/p df/520002r.pdf

DoD 8570.01, Certifications Requirements, August 15, 2004 http://www.prim.osd.mil/Documents/DoD D_857001_IA_Training_CA_Workforce%2 0Management.pdf

DoD 8570.01-M, Information Assurance Workforce Improvement Program, January 24, 2012 http://www.dtic.mil/whs/directives/corres/p df/857001m.pdf

DoD Cloud Security Requirements Guide http://iase.disa.mil/cloud_security/pages/in dex.aspx

DOD Concept of Operations (CONOPS) for Cloud Computer Network Defense (CND) Draft v1 http://iasecontent.disa.mil/stigs/pdf/U- Cloud_CND_Conops_v1_DRAFT_v4.pdf

DoD Federal Acquisition Regulation Supplement http://farsite.hill.af.mil/

DoD Instruction 8510.01, Risk Management Framework for DoD IT http://www.dtic.mil/whs/directives/corres/p df/851001_2014.pdf

DODI 8500.01, Cybersecurity, March 14, http://dtic.mil/whs/directives/corres/pdf/85 0001_2014.pdf

DODI 8500.2, Information Assurance Implementation, February 06, 2003 http://www.dtic.mil/dtic/tr/fulltext/u2/a5739 56.pdf

DODI 8520.03, Identity Authentication for Individuals, May 13, 2011 http://www.dtic.mil/whs/directives/corres/p df/852003p.pdf http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf http://iase.disa.mil/cloud_security/pages/index.aspx http://iase.disa.mil/cloud_security/pages/index.aspx http://farsite.hill.af.mil/ http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

DODI 8530.01, Cybersecurity Activities Support to DoD Information Network Operations http://www.dtic.mil/whs/directives/corres/pdf/85 3001p.pdf

Federal Acquisition Regulation http://farsite.hill.af.mil/

Federal Data Center Consolidation Initiative (FDCCI) http://www.cio.gov/pages.cfm/page/FDCCI

FedRAMP http://www.fedramp.gov/

National Industrial Security Program Operating Manual and Supplement, February 2006…