STANDARD FEATURES
milCloud Plus includes a standard set of support services. The services include the following:
- System administration labor to monitor and manage the mission partner's operating system.
- Security administration labor, including risk management support, certification, accreditation, security technical implementation guide (STIG) compliance, compliance management support, continuous monitoring, and physical security.
- Level 2 service desk support – mission partner administrator to DISA service desk.
- Enterprise systems management (ESM) hardware and software used to monitor and manage the data center environment, including core infrastructure, local view builders, development, integration, and sustainment tools, technical support tools, and knowledge management.
- Database security labor and tools to ensure a database service is compliant with DoD security guidelines. (Database security is applied on all database servers when database administration is not selected as an optional service).
- Robust communication infrastructure (network hardware and software) and communication administration labor, including the physical infrastructure, special purpose gateways, DOD Demilitarized Zone (DMZ) Extensions, data center boundary security stack, and Consolidated Communications Centers (CCCs).
- Backups of every virtual machine (VM) image in each VDC are performed on a daily basis. The images are 'snapshots' of the VM at the time the backup executes, which can be any time during the day. The snapshot images are 'crash consistent,' meaning they represent the state of the VM on disk at the time the backup is taken. Backups occur at the storage area network (SAN) level on a daily incremental and weekly full cycle. Daily backups are retained for 14 days and full backups are retained for 30 days. The recovery time objective (RTO) is 5 business days with a recovery point objective (RPO) of 24 hours.
- Secure remote access to servers in the VDC over a DISA-managed virtual private network (VPN).
- User account management to include the labor and tools for managing mission partner administrator operating system accounts on the servers. All accounts require an approved System Authorization Access Request (SAAR), DD Form 2875.
miCloud Plus is available on the Non-secure Internet Protocol Router Network (NIPRNet) and the Secure Internet Protocol Router Network (SIPRNet). The details of the support services provided with milCloud Plus are listed below.
The labor and services provided by default for milCloud Plus include the following system administration and service desk features:
System Administration Services
- Tune the OS kernel.
- Monitor system logs.
- Install software and associated patches.
- Perform OS server administration.
- Provide after-hours support for incidents and authorized service interruptions as per service level agreements (SLAs).
- Monitor console messages and system logs.
- Configure and manage replication and/or cluster environment software.
- Assist vendor during troubleshooting/hardware repair.
- Schedule backup for file systems.
- Coordinate with application/database administration.
- Review backup reports daily.
- Change disk space allocations.
- Update technical leads and management.
Service Desk Support
- Incident Management
- Open incident tickets.
- Attempt first contact resolution of incident.
- Review known error database/knowledge management cases for solutions.
- Perform break/fix actions.
- Review ticket management system (IT Service Management [ITSM]/Global Trouble Management System [GTMS]).
- Review initiated tickets and update as necessary.
- Coordinate/monitor DISA Command Center up-channeled incident tickets.
- Close resolved/fixed tickets.
- Service Request
- Open service request ticket.
- Complete service request, if able.
- Assign ticket, if needed.
- Close ticket.
Problem Management
- Relate incidents to known problems.
- Perform root cause analysis.
- Develop workarounds and publish to the Known Error Database.
- Update assigned tickets.
- Coordinate problem management incidents.
Change Management
- Provide system and component information.
- Add all new systems to the configuration management database.
- Remove all decommissioned systems or components.
- Document all changes to include a Continuity of Operations (COOP) per SLA.
- Coordinate with application, database, and web administrators.
- Interact with mission partners regarding authorized service interruptions (ASIs).
- Open and manage change requests.
- Initiate change management process, as required.
Operational Enterprise System Management (ESM) Tools
- Ensure ESM tools are installed and functioning including, but not limited to, McAfee Host-Based Security System (HBSS) Agent and Assured Compliance Assessment Solution.
- Monitor the operations status of production systems.
- Ensure system management software and agents are configured and installed.
OS Server Security
- Ensure HBSS is installed and functioning.
- Verify Communications Tasking Order/Fragmentary Order /Information Operations Condition requirements.
- Resolve vulnerability scan results.
- Validate all applicable postures within Continuous Monitoring and Risk Scoring.
- Ensure timely updates to findings for assigned systems.
- Perform annual Security Readiness Reviews
- Apply all approved patches.
- Adhere to U.S .Cyber Command Information Assurance (IA) Vulnerability Alerts/bulletins/technical advisories.
- Participate in audits for mission partner/site accreditation.
- Create plan of action and milestones (POAM).
- Ensure anti-virus software is installed/configured.
- Schedule anti-virus scans and definition updates.
Account Management
- Manage user accounts at the OS level.
- Ensure administrative/root passwords are changed/maintained.
Project/Workloads
- Keep mission partners informed regarding ticket status and updates.
- Monitor backup jobs, processes, and platforms.
- Manage ticket queues.
- Monitor system backups.
- Perform limited restart/recovery using on-line instructions.
- Transmit files between systems.
Security Services
DISA's Defense Enterprise Computing Centers (DECCs) benefit from the high level of physical security afforded by their location on military installations. DISA also provides a superior IA environment. DISA has accepted Inherited Controls for a wide range of IA responsibilities and functions.
- Specific labor tasks include:
- Audit user accounts at the OS level.
- Audit executive software, application software, and associated patches.
- Audit compliance with STIGs and IA Vulnerability Alerts (IAVAs) (both a system administration and security task).
- Monitor the environment for any changes that might affect production schedules.
Some mission cyber network defense services are available with milCloud Plus. The milCloud Plus provides vulnerability analysis and assessment support, information operations condition compliance/network operations awareness (system administration functions only), IA vulnerability management (system administration functions only), network security monitoring/intrusion detection at the boundary cyber network defense monitoring point, attack sensing and warning (boundary cyber network defense monitoring point), sensor sustainment and configuration management - host level, and annual renewal of sensor maintenance and licensing.
OPTIONAL FEATURES
Optional support services are available with milCloud Plus in a fee-for-service model. These services include the following:
- Application support that provides the labor support for the software running above the OS.
- Database administration that provides labor support for the mission partner's database.
- COOP.
All milCloud Plus and optional fee-for-service support services are provided during the normal 8x5 business hours. On-call support is provided for after normal business hours as needed.
Optional Software
In addition to milCloud Plus services, the mission partner has the opportunity to purchase the below standard software from DISA.
- Apache Tomcat.
- Tectia Server.
- Tectia Client.
- Microsoft SharePoint Enterprise.
- Microsoft Internet Information Server.
- Microsoft Active Directory.
- Oracle Database Enterprise Edition.
- Oracle Diagnostic Pack.
- Oracle Tuning Pack.
- Oracle Database Lifecycle Management Pack.
- Oracle WebLogic Server Enterprise Edition.
- Oracle WebLogic Server Enterprise Edition Management Pack.
- Oracle MySQL Enterprise Edition Subscription (1-4 servers).
- Red Hat Directory Server.
- IBM Security Access Manager.
In addition to the software identified above, DISA can also procure additional licenses on behalf of the mission partner by the partner contacting their engagement executive.
Application Support Services
The optional application support provides the labor and services for software installed and running above the operating system. When application support services are ordered, DISA assumes operational control of the application and all configuration changes must be coordinated through DISA.
For increased agility through an application’s lifecycle, it may be advantageous to only order application support services for production environments, giving mission partners the necessary freedom to install, configure, and secure their application during the development and test phases.
The application support labor and services available for milCloud Plus include the following:
Project/Workloads
- Perform application tuning or modifications.
- Monitor application logs.
- Install application software and patches .
- Monitor performance metrics.
- Assist application designers and mission partner developers.
- Change disk space allocation layout.
- Build, maintain, and monitor job schedules.
- Resolve job aborts and other application errors.
- Coordinate with database and OS administrators.
- Mitigate contention and/or improve application performance.
Application Security
- Audit executive software, application software, and associated patches.
- Monitor the environment for any changes that might affect production schedules.
- Verify STIGs, U.S. Cyber Command tasking orders, and information operations condition requirements.
- Perform annual security requirements reviews.
- Apply all required patches.
- Adhere to U.S. Cyber Command IAVAs/bulletins/technical advisories.
- Participate in audits for mission partner/site accreditation.
- Associate security profiles to jobs in accordance with IA requirements.
Account Management
- Manage application user accounts for workload support.
- Ensure privileged passwords are changed/maintained.
- Coordinate with storage administrators.
Database Administration Services
The optional database administration provides the labor and services for all database administration functions. When database administration services are ordered, DISA assumes operational control of the database and all configuration changes must be coordinated through DISA.
The details of the optional database administration labor and services available for milCloud Plus include the following:
Project/Workloads
- Monitor database logs.
- Install database, mission partner applications, and patches.
- Provide after-hours support for incidents and ASIs.
- Configure and manage replication and/or cluster environment software.
- Monitor performance metrics, hardware load, and disk usage.
- Analyze data usage and project data capacity
- Assist application designers and mission partner developers.
- Configure and provide input on database structures
- Allocate table spaces for database requirements.
- Create/modify database instances.
- Manage data file backups.
- Coordinate with OS administrators.
Enterprise System Management (ESM) Tools
- Install and configure database management software.
Security
- Verify STIGs, U.S. Cyber Command tasking orders, and information operations condition requirements.
- Perform annual secure readiness reviews.
- Apply all required patches.
- Adhere to U.S. Cyber Command IAVAs/bulletins/technical advisories.
- Participate in audits for mission partner/site accreditation.
- Create and update POAMs.
Account Management
- Manage user accounts for workload/database support.
- Ensure privileged passwords are changed/maintained.
- Coordinate with storage administrators.
COOP
Mission partners can engineer their own COOP solution by ordering a separate milCloud Plus VDC at a different milCloud site and implementing host-based replication. DISA-provided COOP services are not available for milCloud Plus. Mission partners will need to test the failover capabilities and perform their own annual COOP exercises to meet IA requirements.