Questions_and_Answers_Amendment_0011.xlsx

Q&A

The Government's response describes its intent regarding process, but has not addressed the issue of providing assessors for the non-cloud components of a contractor's UC SCSS solution. This has significant ramifications related to the contractor's costs and its dependencies related to Government-furnished resources.

Question 1: Is it the Government's intent to follow this structure for UC SCSS? If not, will the Government please clarify how and where assessors will be engaged for UC SCSS? Clarification: Question 1: Will the Government be supplying assessors for the non-cloud components that will undergo RMF authorization?

Question 2: Given eMASS registration may only occur after contract award, will the Government provide an alternate means of engaging RMF assessors to ensure they are available in time to meet the (C)+90 IATO date? Clarification: Question 2: Presuming the Government will be supplying assessors, will these be provided as Government-furnished resources, or will contractors be expected to reimburse the Government for the assessor's services? Question 1: In regards to cloud based solutions, obtaining a 3PAO assessor is the responsibility of the CSP. For non-cloud based solutions, obtaining a third party validator for RMF accreditation is the responsibility of the USG.

Question 2: For non-cloud based solutions, obtaining a third party validator for RMF accreditation is the responsibility of the USG. CSP's. Non-based cloud solutions must be accredited under RMF prior to IOC. RMF Authorization & Accreditation (A&A) activities are managed and conducted by USG, with assistance from the contractor. For non-cloud components of the UCSC solution, USG will conduct regular RMF actions post contract award.

5 Volume III Subfactor 2 Attachment 0001 Amended SOO 26 Oct 2016.pdf pg. 15 of 56 2.6 Help Desk Support Objective, et. al. Since the government is providing Tier 0-2 in support of UCaaS through the Army Enterprise Service Desk, the bidder requests the government provide the Army Enterprise Service Desk document that describes the concept of operations. Tier 0 Self Service - Tier 0 is defined as self-help requiring no direct contact between an End User and a Customer Service Agent. The user is able to access a web-based portal to consult frequently asked questions, reference material, knowledge bases, or other information to resolve an incident. If the user is not able to resolve their issue through use of the various knowledge tools, the user is able to initiate a ticket, which describes the incident, problem, or service request and is sent to a support organization to triage the incident for resolution activities.

Tier 1 - The support organization that has the initial contact with the user and initiates tickets as required for issues. Tier 1 Customer Service Agents are grouped into subordinate tiers of 1-1 and 1-2 as follows:

Tier 1-1 -Agents are call center-based and provide non-dispatched basic problem assistance for issue resolution delivered via telephone, e-mail, web form, or other online communication channel. Agents in this group usually do not have elevated privileges but may have basic skill sets to assist users in resolving issues, which could have otherwise been resolved by the user. This resolution may be accomplished using basic scripts describing the steps to resolve the basic issue. These agents are usually designated as General Users in the systems.

Tier 1-2 Agents are call center-based and provide non-dispatched advanced problem assistance for issue resolution for issues that cannot be resolved quickly (within 15 - 30 Min) and efficiently by Tier 1-1 agents delivered via telephone, e-mail, web form, or other online communication channels. These agents make the computing environment less vulnerable by correcting flaws and implementing controls in the hardware or software installed within their operational systems. These agents generally are required to have limited elevated privileges on local workstations to accomplish their tasks. These agents will be designated as Technical I (Tech I) users after completing required training above the General User level.

Tier 2 - The support organization that is responsible for further investigation and resolution of tickets unable to be resolved by Tier 1. This support organization is staffed with subject matter experts and more detailed reference materials. In the process of resolving incidents, this support organization may make substantial changes to ongoing operations in order to preclude future incidents of a similar nature from occurring.

Further it states, "Each CSP responding to an RFP that does not already have a DoD PA at the required information impact level will submit all required

All proposals will be evaluated equally based on the merits and information contained within the proposal, based upon the criteria outlined in the solicitation.

Microsoft_Word_Document1.docx GENBAND is pleased to offer the following response to the Army DRFP for Unified Capabilities Soft Client Subscription Service. Due to the extremely short timeframe given to evaluate the draft documents, our response is limited to a few high level conceptual comments that could provide the Army with huge benefits. As the manufacturer of the market leading “carrier grade” ESC/LSC solution for EVoIP and UC, our comments are focused around technology and deployment.

GENBAND’s Value Proposition for DoD

· Common infrastructure for all DoD users – C2, non-C2, mobile, NIPR/SIPR

· GENBAND commercial UC feature suite and applications available to DoD

· Leverage Army’s existing investment in EVoIP to support UC

· Over 1 million RTUs that can be upgraded to VoIP/UC at significantly lower cost

· DoD compliant, secure and highly reliable

· Flexibility to deploy UC client of choice-GENBAND soft client or Microsoft Lync

· Low risk implementation as GENBAND is currently majority of Voice installed base

For the most part, the Unified Capabilities requirements in the DRFP are clearly stated and very achievable today. However, the current approach is a significant compromise for the Army. The DRFP does not take advantage of the multiple certified solutions that are currently available on the JITC APL.

I think the real question for the Army is how to implement a SIP based Enterprise VoIP/UC solution that maximizes the investment that has already been made. There are two pieces to that question, what technology should the Army use and what deployment model should the Army operationalize? The size and scale of the Army migration from TDM to EVoIP/UC is only matched by the transition that is occurring with leading carriers globally. Given that many of the global carriers are using carrier grade technologies for similar transitions, it is imperative that the roadmap chosen be supported by a proven leader with a track record in executing transitions similar to what is being requested by the Army.

The Army is at a major crossroad in technology. Hundreds of millions of dollars has been invested in Voice, Data, and Desktop infrastructure. The current DRFP does not address preserving this investment. The data network is certainly being built out to support VoIP traffic and the PCs will be used to support UC soft clients. There is also significant investment in voice equipment and much of it is VoIP enabled. However, there is no incentive for the system integrators to leverage any of the existing voice infrastructure. The impression by the integrator community is the Army wants a “greenfield replacement” to replace the “tired iron”. The DRFP does not even suggest that reuse is even a welcomed value added solution. It is important to remember that none of the bidders will consider this approach unless it is mentioned by the Government in the requirements. In reality, the SL100/CS2100/AS5300 carrier grade voice platforms installed today have a VoIP/UC roadmap that allows the Army to achieve their goals with more functionality, less disruption, faster deployment and at a cheaper cost than any other vendor approach.

Additionally, the Army is going to be in for a potential surprise when the UC implementation starts. The voice feature requirements in the DRFP are nowhere close to what is being provided on the TDM switches today. Having supported the Army I3MP program for many years, I can attest to the significant customer dissatisfaction that will come from not having the voice features necessary to function in a day to day military environment. This does not have to be the case. Full featured JITC certified VoIP/UC application servers exist today that closely match the feature capabilities that the Army relies on to achieve their mission requirements.

· One infrastructure to meet the needs of all Army users, built upon GENBAND’s industry leading Experius Application Server.

· Benefit: Market-leading, competitively-driven features and capabilities

· Market-leading Enterprise UC services with certified, Assured C2 UC services, combined on a single platform

· Benefit: Simplified Enterprise architecture, lower TCO

· Build upon cloud architecture. Virtualization and survivability aligned with customer needs.

· Benefit: Aligned with ongoing DISA and MILDEP investments

· Open standards to integrate with the installed base and other vendors

· Benefit: Best-in-Breed solutions for the War fighter

· Preserve the value of the existing GENBAND installed base. Maximize reuse and migration credits toward VoIP/UC

· Benefit: Evolutionary migration based on mission requirements and budgetary constraints

It is also highly recommended that the Army reconsider their decision to separate UC from eVoIP necessitating parallel networks. As one of several JITC approved eVoIP/UC OEM vendors, GENBAND believes that deploying UC separate from VoIP creates an unnecessary discontinuity in the Army’s IT strategy. The Army should avoid overlapping communication infrastructures which increase deployment/operational complexities and the Army’s total cost of ownership (TCO). Our technical approach can provide a complete EVoIP/UC environment or if the Army prefers we can fit into a Microsoft environment where the GENBAND Application Server could voice enable the Lync Client providing a carrier grade single network for both C2 and non C2 users. This is very different than the Microsoft voice deployment. Our UC solution will provide the Army with a rich set of features on a common network with the highest reliability that offers real value.

GENBAND also believes that the Army should be seeking solutions that are compliant with DoD interoperability standards and JITC certification but also allow vendors to present their future JITC roadmap to include technologies that could be incorporated during the Initial Operating and Final Operating Capability. An example of that is GENBAND's SPiDR™ WebRTC Gateway that provides an intelligent bridge between traditional Voice over Internet Protocol (VoIP) networks and the open ecosystem of the Internet. SPiDR facilitates the deployment of universal applications, drastically reducing both the CAPEX and OPEX costs related to VoIP services. Designed using HTML5, CSS3 and Javascript, and leveraging SPiDR's REST APIs, our clients provide a multimedia user experience and allow subscribers to easily access their services from any web-capable device, or deeply integrate with the operating system via GENBAND's patent pending Omni Client Technology.

On the deployment side which would apply to any Integration Partner (since we do not sell direct), there are two areas of concern. FEDRAMP 5 and 6 certification and the contract format of 1 year with four 1 year options. REDRAMP in the 90 days after contract award remains a huge challenge for the system integrators as well as the required investment to build the UC application servers to support the user community with only a 1 year contact commitment. Two challenging items for any integrator

In summary, GENBAND believes that integrating the Army’s planned eVoIP C2 user network with non-C2 users is the most cost-effective and mission focused approach for delivering UC. The GENBAND technical solution offers several important advantages:

Single, simplified user experience. We can provide a single client and user experience by consolidating UC and mission critical voice and video avoiding the need to differentiate between C2 and non-C2 users, tools, and interfaces reducing operational complexity and confusion.

Carrier-grade performance. Army UC would take on the same carrier-grade reliability, scalability, and security characteristics as GENBAND eVoIP.

DoD APL Compliant, Open Standards Based Solutions. GENBAND is fully committed to standards and interoperability with DoD networks.

Less duplication, lower cost. A single, tightly integrated UC and VoIP solution, rather than two duplicative platforms, reduces enterprise-wide IT complexity, minimizes the system hardware footprint, reduces the IA accreditation burden, and lowers the cost of operational support/sustainment lowering Army’s TCO.

Expedites and simplifies migration to IP and UC. Integrating the UC solution with the legacy voice infrastructure and leveraging the VoIP/eVoIP architecture under current deployment offers the Army a means to rapidly deploy and enable UC across the enterprise with less risk.

Investment protection. GENBAND can provide investment protection by crediting existing TDM voice licenses, reusing phones and other assets, as appropriate.

Interoperability with current office applications. GENBAND can integrate with Microsoft Lync and other enterprise applications.

GENBAND would welcome the opportunity to meet with the Army to have a detailed discussion around your embedded base and the way forward. The Army has a tremendous investment in Nortel equipment and with the right upfront planning and execution you can migrate that investment to a very cost effective Enterprise VoIP/UC deployment at a cost far lower than many realize.

image1.emf

NETCOM/9TH ASC TECHCON

Implementation Memorandum

U.S. ARMY ENTERPRISE SYSTEMS TECHNOLOGY ACTIVITY

Fort Huachuca, AZ 85613-7070

NETCOM/9TH ASC TECHCON

Implementation Memorandum Number 2004-014

Enterprise Telephony Firewall Management (ETFM) System

Date of Issue: 28 Feb 2005

Date of Required Compliance:

Date of Expiration/Suppression:

1. Background. This Network Enterprise Technology Command (NETCOM) Technical Control (TECHCON) Implementation Memorandum provides the guidelines defining the NETCOM requirement to implement and use the Enterprise Telephony Firewall Management (ETFM) System. Implementation is accomplished through the Installation Information Infrastructure Modernization Program (I3MP) based on available funding. NETCOM is the proponent for technical integration and coordination in support of installation implementations.

Implementation was scheduled by installation based on Power Projection Platform/Power Support Platform (PPP/PSP) designation. This TECHCON is based on implementation guidelines developed in coordination with Regional Chief Information Officers (RCIOs) and on best practices derived from initial implementation of the Southwest Region.

a. Data and telecommunications networks are now clearly and irrevocably joined, and the junctions between the two infrastructures are increasing. Both infrastructures are now perceived as critical to the successful operation of the enterprise. The vulnerability of these conjoined networks is the increased risk of exposure and access to the enterprise’s sensitive information.

Each infrastructure contains inherent weaknesses that have been and continue to be exploited by insiders and outsiders to the detriment of the enterprise.

b. There are a variety of strategies for protecting the enterprise from the potential vulnerabilities of conjoined networks. These strategies include writing and enforcing policies that spell out the manner in which the two network infrastructures can be connected, redefining existing security solutions, and deploying enterprise telephony management and security solutions--a new class of solution designed to safeguard conjoined networks.

c. The fielding of the ETFM system platform significantly improves the management and security of the Army’s voice network. The ETFM platform consists of server hardware, appliance sensors, and three separate software applications. These are: TeleWall, a telecommunications firewall; TeleAudit, a call usage and reporting tool; and TeleView, an infrastructure management and monitoring tool. The ETFM platform will help detect (and if needed, stop) unauthorized modem connections and give commanders “real time” situational awareness into the voice network.

2. Authority. The Network Enterprise Technology Command/9th Army Signal Command (NETCOM/9th ASC) is the Army’s single authority to operate, manage and defend the enterprise level infostructure. NETCOM has technical command and control and configuration management authority for the Army’s critical networks and systems. NETCOM also has operational review/coordination authority for any standards, system, architecture, design, or device that impacts enterprise level Army infostructure and Network Operations (NETOPS).

This is in accordance with the NETCOM Concept of Operations (CONOPS) Version 1, 26 Nov 02 and the draft CONOPS for ETFM.

3. Operations. The Theater Network Operations and Security Centers (TNOSCs) are directly charged with establishing and enforcing the enterprise policy. Enterprise policy is based on a deny all, permit by exception template which enforces rules established in accordance with AR 25-1. Garrison Commanders determine which calls are deemed authorized and report this information through the Regional Chief Information Officers (RCIOs) to the TNOSCs. The RCIOs ensure adherence to this TECHCON and assist installations and NETCOM with initial coordination, identification and implementation of enterprise rules sets, and authorized telephone object numbers. Appendix A is the list of ETFM rules being applied. Application of a particular rule is tailored to the requirements of the supported installation. With some exceptions noted at Appendix A, the DOIM in coordination with the Garrison Commander determines their scope and applicability. Under the current SecureLogix software release being implemented, permissions to both establish enterprise rule sets and making telephone object changes reside within the same permission level. Based on this, the TNOSCs (or Regional (Battalion) NOSCs) are the only authorized organizations able to change the Enterprise policies, and therefore the permission levels. Future versions of software separate these permission levels and the TNOSCs will provide installations the permissions to change telephone numbers at their installations once the software is fielded. Fielding began in October 2004 for installations that have the ETFM System installed.

4. Conceptual Architecture and Reporting.

a. The ETFM System comprises expandable, managed appliances, which are deployed as a customer premise device on trunks. These appliances, which are controlled by remote servers, support a number of existing security and management applications and allow for expansion to support future applications. The ETFM System is managed from a remote client, which can be used to manage multiple servers and hundreds of appliances. The figure below provides a high level overview of these ETFM System components.

Reporting

•NETCROP

•RCIO

•DOIM

b. The ETFM system has been inserted into the existing Network Common Relevant Operating Picture (NETCROP) and situational awareness reporting process. This is the same process used for reporting other Enterprise data systems. Reporting requirements, in accordance with Army Signal Regulation (ASR) 25-6, are met by using Simple Network Management Protocol (SNMP) traps, which feed applicable TNOSC tools to compile NETCROP and situation reporting.

5. Summary. This TECHCON Implementation Memorandum ensures all installations are operating within the parameters of the NETOPS CONOPS and ETFM System Architecture.

This provides a secure telephony network, provides the mechanism for the TNOSCs to perform their required NETCROP and situational reporting to the Army NOSC, as well as provides an additional tool for installations to perform their telephone management functions.

APPENDIX A

Draft Enterprise Telephony Firewall Management (ETFM) System Policies

Rule 1. Permit all 911 calls in CONUS.

Rule 2. Terminate all modem calls except those identified as authorized by the Garrison Commander/DOIM.

Rule 3. Terminate all spam calls as identified by the Garrison Commander/DOIM.

Rule 4. Terminate all calls to known Internet Service Providers (ISPs) except those modem calls specified as authorized by the Garrison Commander/DOIM.

Rule 5. Terminate calls, which incur charges such as information calls, i.e., 411/555 unless authorized by the Garrison Commander/DOIM.

Rule 6. Terminate known porn numbers/suspected terrorists numbers, as identified by the G2 to the Garrison Commander/DOIM.

NOTE: More stringent policies may be identified and quickly enforced during FPCON levels as identified by the DOIM and coordinated with the TNOSCs.

image2.emf