Draft_PWS_ISE.docx

PERFORMANCE WORK STATEMENT (PWS)

FOR

Installation and Configuration of CISCO Identity Services Engine (ISE) Services

1.0 General:

1.1 Scope: The contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary to perform installation and configuration of CISCO ISE Services, as defined in this PWS.

1.2 Background: Florida Army National Guard (FLARNG) has acquired the CISCO ISE equipment and software for use on the FLARNG military network. The FLARNG wishes to migrate their current Access Control System (ACS) environment over to Cisco ISE as well as integrate dynamic authentication and authorization capabilities into their existing infrastructure, leveraging Cisco Identity Services Engine (ISE). This project will migrate the current ACS environment, initially install ISE into the environment for 802.1x in a proof of concept capacity, test and document the use cases developed with the FLARNG, and perform informal training on the as-built system for preparation of the FLARNG to install into the production network. The vendor will also assist the FLARNG with a limited scope test rollout moving into production. For the wired network, up to 96 ports on up to 2 switches will be configured for authentication, authorization, and profiling.

1.3 Period of Performance (PoP): It is anticipated that 30 days of direct work should be sufficient to accomplish PWS requirements. This will form the basis of awarded Period of Performance (PoP). However, the government will consider vendor recommendations on how long it will take to execute requirements, and may at its sole discretion update the PoP accordingly.

1.4 General Information:

1.4.1 Place and Performance of Services: The contractor shall provide services between the hours of 0730-1700hrs on Monday through Friday, except on recognized US holidays or when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings. Performance shall be at the G6 Data Center, at Camp Blanding Joint Training Center, 5629 SR 16 West, Starke, FL 32091. Currently there are no limiting security requirements for access onsite and no high level security clearance is required. Technicians working onsite must provide valid driver’s license or other form of government issued identification.

2.0 Requirements: The contractor shall:

2.1 Install and Configure the CISCO ISE on the FLARNG Network.

2.1.1 Train the FLARNG Network Staff on the operation and configuration of CISCO ISE software and equipment.

2.1.2 Ensure that the installation and configuration complies with all Command Cyber Readiness Inspection Security Technical Implementation Guide (STIG).

2.2 Deliverables:

2.2.1 Develop and brief deployment strategy.

2.2.2 Complete configuration of ISE equipment and software.

2.2.2.1 Ensure 802.1X wired/wireless NAC configured.

2.2.2.2 Integrate current TACACS into CISCO ISE

2.2.2.3 Configure use of SCCM to install ISE Client Install.

2.2.3 Train Staff on ISE equipment and software.

2.2.4 Pilot of ISE to ensure proper functionality prior to implementation.

2.2.5 Ensure system is functioning properly after 2 weeks of implementation.

2.2.6 Documentation will include:

2.2.6.1 Any required end computer changes.

2.2.6.2 ISE feature configuration, including authentication and profiling.

2.2.6.3 Cisco ISE Configuration

2.2.6.4 TACACS+

2.2.6.5 Provide knowledge transfer on a high-level overview of the designed architecture and orientation of the configured ISE.

2.2.6.6 As-Built Documentation

2.2.6.7 Provide a detailed test and verification plan for G6’s approval that will be used for system validation.

2.2.6.8 Perform and document the results of the system in accordance with an approved test and acceptance plan.

2.2.6.9 System operates and integrates within the enterprise as promised and meets all manufactures specifications.

3.0 Government Furnished Materials: The following will be provided to the contractor for review after award of order:

3.1 Wired 802.1X authentication requirements

3.2 TACACS+ migration requirements

3.3 ISE infrastructure requirements

3.4 Switch requirements, existing configuration, and new configuration requirements

3.5 Current client push roll-out of software and configuration changes

3.6 Network topology that will incorporate new solutions

3.7 Access layer equipment for ISE compatibility

3.8 Network Diagram of all endpoints

3.9 Certificate infrastructure and central user databases for authentication

4.0 Government Point of Contact is LTC Kevin Creech at 904-823-0190 or kevin.b.creech2.mil@mail.mil

5.0 Contractor Manpower Reporting Application (CMRA).

5.1 The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the ARMY via a secure data collection site.

5.1.2 The contractor shall completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs shall be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2018. Contractors may direct questions to the help desk at http://www.ecmra.mil.

6.0 Base of Materials / CLIN. Request vendor to provide professional services for:

6.1 CLIN 1: Install and Configure the CISCO ISE on the FLARNG Network.

6.1.1 CLIN 2: CMRA Costs (if proposed as a separate cost outside of base service)