![](media/image1.jpeg){width="1.5in" height="1.1770833333333333in"}

**MEMORANDUM OF AGREEMENT**

**For**

**APPLICATION HOSTING ENVIRONMENT**

**DOECOE SERVICES**

**(Customer)**

**1. Introduction**

The Office of the Chief Information Officer (OCIO), Department of Energy
Common Operating Environment (DOECOE), Application Hosting Environment
provided services will be governed by this Memorandum of Agreement (MOA)
and attached document.

The document describes DOECOE Application Hosting Environment (AHE)
services and service levels that are agreed to by the (Customer) and the
Office of the Chief Information Officer.

2.  **Scope**

The document details the DOECOE AHE services to be provided for the
period of October 1, 200x through September 30, 200x. Refer to Appendix
F for a detailed listing of application(s) being hosted/housed and their
associated cost.

**3. Summary**

The OCIO will be constantly monitoring contractor performance. New or
changing business requirements may affect services as described in the
SLA section of the document (Section 7). Each party must notify the
other, in writing, thirty (30) days prior to any changes or
modifications to the services described that require renegotiation.

The OCIO and the customer will review AHE Services and/or all other
related documents based on these changes and renegotiate any changes to
the document(s) as well as changes to the related task and/or costs.
Each responsible party must mutually agree to any modifications to costs
that may result from such changes.

Approval Signatures:

**[Customer]{.underline} [Office of the Chief Information
Officer]{.underline}**

Michael W. Boblitt

Director, Corporate Systems Division

Associate CIO for Operations Chief Information Office

**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**

Signature Signature

**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**

Date Date

**TABLE OF CONTENTS**

[**1.0** **Introduction** 1](#__RefHeading___Toc132531779)

[**1.1** **Goals and Objectives** 1](#__RefHeading___Toc132531780)

[**2.0** **Point of Contact** 2](#__RefHeading___Toc132531782)

[**3.0** **Scope** 2](#__RefHeading___Toc132531783)

[**4.0** **Roles and Responsibilities** 2](#__RefHeading___Toc132531784)

[**5.0** **AHE Services** 2](#__RefHeading___Toc132531785)

[**6.0** **Application Owner Responsibilities**
3](#__RefHeading___Toc132531786)

[**7.0** **Service Level Agreement (SLA)**
4](#__RefHeading___Toc132531787)

[**7.1** **Definitions** 4](#__RefHeading___Toc132531788)

[**7.2** **Response Time** 4](#__RefHeading___Toc132531789)

[**7.3** **System Uptimes** 5](#__RefHeading___Toc132531790)

[**7.4** **Exceptions to System Uptimes**
5](#__RefHeading___Toc132531791)

[**7.5** **Reports** 5](#__RefHeading___Toc132531792)

[**7.6** **Test/Pre-Production to Production Moves**
5](#__RefHeading___Toc132531793)

[**8.0** **Transition Strategy** 6](#__RefHeading___Toc132531794)

[**8.1** **Problem/Issue Notification and Resolution**
6](#__RefHeading___Toc132531795)

[**8.2** **Steps for Transitioning** 6](#__RefHeading___Toc132531796)

[**8.2.1** **Testing of Components During and After Transition**
6](#__RefHeading___Toc132531797)

[**8.2.2** **Test Plans** 6](#__RefHeading___Toc132531798)

[**8.2.3** **Acceptance of Transfer** 6](#__RefHeading___Toc132531799)

[**8.2.4** **Retirement of Hardware** 7](#__RefHeading___Toc132531800)

[**8.2.5** **Cost of Services** 7](#__RefHeading___Toc132531801)

[**APPENDIX A - Transition Strategy** 8](#__RefHeading___Toc132531802)

[**APPENDIX B - AHE Services** 11](#__RefHeading___Toc132531803)

[**APPENDIX C - Request for Hosting Form**
18](#__RefHeading___Toc132531804)

[**APPENDIX D -- Benefits of Hosting/Housing in AHE**
24](#__RefHeading___Toc132531805)

[**APPENDIX E - Application Specific Requirement(s)**
25](#__RefHeading___Toc132531806)

[**APPENDIX F -- AHE Summary of Charges**
26](#__RefHeading___Toc132531807)

[**APPENDIX G -- POAM and Worksheets** 27](#__RefHeading___Toc132531808)

![](media/image1.jpeg){width="1.5in" height="1.1770833333333333in"}

![](media/image3.png){width="1.21875in" height="0.7659722222222223in"}

**Department of Energy Common Operating Environment**

**(DOECOE)**

**Application Hosting Environment Services**

1.  []{#__RefHeading___Toc132531779 .anchor}**Introduction**

The Application Hosting Environment (AHE) is the service to consolidate,
automate, and manage the IT lifecycle of servers and applications within
the Department of Energy, Headquarters (DOE HQ) to include provisioning,
deploying, changing, scaling, securing, recovering, consolidating and
reallocating. This document defines the policies and procedures for
transitioning DOE applications to the AHE, the types of services and the
associated costs. The provisions of this document constitute the basis
for agreements between Office of the Chief Information Officer (OCIO)
and customers accepting AHE services. Services provided by the AHE
include:

-   Hosting of applications on customer equipment that will transition
    to AHE ownership

-   Hosting of new applications on equipment managed and maintained by
    AHE

-   Optional housing of customer servers

-   Optional application maintenance and development

-   Optional Citrix remote access services

Key Stakeholders for the transition to the AHE include:

-   The Customer's

```{=html}
<!-- -->
```
-   Application Owner

-   Application Developer

```{=html}
<!-- -->
```
-   The Application Hosting Environment's

```{=html}
<!-- -->
```
-   Business Manager

-   Project Manager

-   System Administrator

    []{#__RefHeading___Toc132531780 .anchor}**1.1 Goals and Objectives**

The goals and objectives of the AHE are to establish a service for the
consolidation and central management of application servers and other IT
services through an infrastructure designed for the provision of
operating systems and applications. This will reduce the time and labor
required to manage a large number of servers while at the same time
providing improved infrastructure consistency and security management.

2.  []{#__RefHeading___Toc132531782 .anchor}**Point of Contact**

The point of contact for this document is:

Florence Arnold, Business Manager for AHE

Corporate Systems Division

Office of the Associate CIO for Operations

GTN/CA-326

Telephone: (301) 903-5965

> Facsimile: (301) 903-6223

Florence.arnold@hq.doe.gov

[]{#__RefHeading___Toc132531783 .anchor}**3.0 Scope**

This document describes the services, processes and costs by which the
transition and implementation may take place. The key criterion for this
effort is to identify specific applications and their associated
hardware and software owned and operated by the customer and how each
system can be best transferred to the AHE. The transition strategy is
found in Appendix A.

Application maintenance and development; unless otherwise specified in
this agreement, is not provided by the AHE, but will be retained by the
customer. Each customer agrees to provide risk assessments for retained
functions for potential inclusion in a risk statement for the
Headquarters site.

[]{#__RefHeading___Toc132531784 .anchor}**4.0 Roles and
Responsibilities**

Stakeholder titles have been identified for the project in order to
provide key input into the transfer process. The AHE identifies the AHE
Business Manager, the AHE System Administrator and the AHE Project
Manager.

[]{#__RefHeading___Toc132531785 .anchor}**5.0 AHE Services**

AHE hosting services address operating system provisioning, hardware
setup, management and maintenance, physical security and management for
the computer facility, cyber security for the AHE infrastructure,
systems level data base administration, facilities management and
coordination, data control, infrastructure operations, backup and
recovery and off-site vaulting, disaster recovery and Continuity of
Operations Planning (COOP), and access administration. These services
are outlined in detail in Appendix B:

AHE services are:

-   Delivery, Installation and Configuration of Equipment

-   Environmental Resources Management

-   Physical Security of Equipment

-   Maintenance of Equipment

-   System Software Support Services

-   Data Base Management and Administration

-   Network Support Services

-   Cyber-Security Services

-   Backup and Recovery

-   Continuity of Operations

-   Capacity Planning and Tuning

-   System Availability

-   Monitoring and Notification

-   Help Desk Coverage

-   Ongoing Technical and Managerial Support

-   Configuration Control Process

-   Facilities Management

In addition to the above standard hosting services, the following
optional AHE services may be provided:

-   **Server housing:** Housing is an optional service to provide for
    datacenter space and utilities for housed servers. The customer is
    responsible for system administration, management and maintenance of
    the housed server.

-   **Application development and maintenance**: These services may be
    provided on a case-by-case basis and contingent upon a negotiated
    agreement.

-   **Citrix:** a service that provides a terminal server system that
    allows access to Windows-based applications from remote locations
    via a Web client (Netscape or Internet Explorer). With Citrix,
    employees have the convenient ability to reach a familiar desktop,
    computing resources, and documents from any location.

    []{#__RefHeading___Toc132531786 .anchor}**6.0 Application Owner
    Responsibilities**

The application owner will:

-   Ensure that any existing hardware/software/infrastructure tools
    currently used by the application will transition with the
    application to the AHE. This includes software licenses, hardware
    and maintenance agreements, as appropriate. The servers and their
    characteristics must be placed in a deliverable inventory list. It
    is important to adequately document the information describing the
    server, application and warranty.

-   Provide own development environment.

-   Write the application cyber security plan (CSP).

-   Provide system software that is at the current release and supported
    by the AHE.

-   Be responsible for the cost to upgrade system software for
    transition to AHE.

-   Bear costs to purchase and maintain any non-standard infrastructure
    used by the application.

-   Complete the Application Hosting request form for inclusion in the
    AHE.

-   Pay for any initial set up costs (special software/hardware
    requirements).

-   Provide application help desk contacts.

-   Be responsible for all application documentation.

-   Be responsible for all payments for services in advance.

-   Incorporate a change control process that involves a development
    environment, AHE test/pre-production environment and AHE production
    environment.

-   Ensure that Configuration Change Proposal (CCP) is submitted prior
    to any infrastructure changes.

-   Notify AHE Project Manager in writing 30 days in advance of any
    critical events, major upgrades or changes.

-   Provide test plans.

-   Ensure that application software maintains currency with the current
    AHE OS and tools releases. The Application owner will be given 6
    months notice that their application software will no longer be
    supported and will have 6 months from this notification to upgrade
    their application software to the current release of AHE OS and
    tools.

-   Complete successful testing of the application (upgrades and major
    releases) prior to implementation into production to insure
    application code is efficient.

7.  []{#__RefHeading___Toc132531787 .anchor}**Service Level Agreement
    (SLA)**

    []{#__RefHeading___Toc132531788 .anchor}**7.1 Definitions**

> "Business Hours" are defined as 6:00 AM to 6:00 PM EST/EDT on normal
> federal workdays.
>
> "AHE Managed Software" is defined as the operating system (OS), OS
> utilities, infrastructure tools, database management system,
> application server and web server systems.
>
> "Server Uptime" is defined as the percentage of time the server
> hardware and AHE managed software are fully functional over a time
> interval of a calendar year. Uptime does not include outages due to
> failures external to the server, e.g., network. Exceptions to the
> uptime calculation may include:

-   Scheduled downtime for hardware or software maintenance (scheduled
    downtime will be scheduled for non-business hours)

-   Scheduled backup windows

-   Customer requested outages

    []{#__RefHeading___Toc132531789 .anchor}**7.2 Response Time**

> In the event of a problem affecting an application, whether a complete
> outage, partial outage, or serious performance degradation,

-   AHE will respond to a problem reported to the Help Desk (3-2500)
    within 2 hours during business hours, within 4 hours during
    non-business hours

-   AHE will provide an Incident Report to the Help Desk within 48 hours
    after the incident is closed. The report will detail the problem,
    its cause, repair, scope and duration of impact, and any future
    actions deemed necessary to avoid a similar problem as appropriate.

    []{#__RefHeading___Toc132531790 .anchor}**7.3 System Uptimes**

> All platforms: AHE will maintain 99.9% uptime. This does not include
> scheduled outages (i.e., OS upgrades, patches, networks, facilities).
> The AHE will strive for 100% availability.

[]{#__RefHeading___Toc132531791 .anchor}**7.4 Exceptions to System
Uptimes**

Customer shall not receive any credits under this SLA in connection with
any failure or deficiency of Web Site availability cause by or
associated with:

-   Circumstances beyond the AHE's reasonable control, including,
    without limitation, acts of any governmental body, war,
    insurrection, sabotage, armed conflict, embargo, fire, flood, strike
    or other labor disturbance, interruption of or delay in third party
    services, virus attacks or hackers, failure of third party software,
    or inability to obtain raw materials, supplies, or power used in or
    equipment needed for provision of this SLA;

-   Failure of access circuits to the AHE, unless such failure is caused
    solely by AHE;

-   Schedule maintenance and emergency maintenance and upgrades;

-   DNS issues outside the direct control of AHE;

-   Issues with customer access to various file transfer mechanisms such
    as FTP, SMTP, Secure Copy, etc.;

-   False SLA breaches reported as a result of outage or errors of any
    AHE measurement system. For example, planned outages, measurement
    tools working incorrectly.

-   Customer's acts or omissions (or acts or omissions of other engaged
    or authorized by customer), including, without limitation, custom
    scripting or coding (e.g., CGI, Perl, HTML, ASP, Java, etc), any
    negligence, willful misconduct, or use of the Services in breach of
    AHE terms and conditions and acceptable use policy;

-   E-mail or webmail delivery and transmission;

-   DNS (Domain Name Server) Propagation;

-   Outages elsewhere on the Internet that hinder access to your
    account, AHE is not responsible for browser or DNS caching that may
    make your site appear inaccessible when others can still access it.
    AHE will guarantee only those areas considered under the control of
    AHE: AHE server links to the Internet, AHE's routes, and AHE's
    servers.

    []{#__RefHeading___Toc132531792 .anchor}**7.5 Reports**

A report can be provided to the customer monthly that gives statistics
that describe the availability of application servers over the previous
month that will be due 1^st^ of each month. (Note: Reporting is
available on z/OS and HP. It is not available on any other platforms at
this time).

[]{#__RefHeading___Toc132531793 .anchor}**7.6 Test/Pre-Production to
Production Moves**

Moving an application from "Test/Pre-Production to Production" occurs
when customer testing has concluded and the application owner has
provided written approval. When the application owner notifies the AHE
of his/her approval, the AHE will move the application into production
within 7 days.

[]{#__RefHeading___Toc132531794 .anchor}**8.0 Transition Strategy**

The planning for an AHE transition (Appendix A) is a joint
responsibility that encompasses requirements collection, environment
assessment, a cost assessment (found in Appendix C), this MOA and the
development of a project plan which is located in Appendix E.

Servers slated for transition should have all finalized project plans
(Appendix E) in place at least one week prior to the time they are
slated to proceed.

All transition activities will occur during normal business hours. When
this is not possible due to customer requirements, AHE contractor staff
will receive overtime pay and this amount will be included in the setup
costs.

All established stakeholders will be formally reminded prior to the
start of transition activities. This will ensure all parties involved in
the transition are aware of the schedule and know each individuals
particular role throughout the transition.

[]{#__RefHeading___Toc132531795 .anchor}**8.1 Problem/Issue Notification
and Resolution**

Problems and issues related to this project will be addressed to the CSC
Help Desk (3-2500). The AHE Project Manager will become involved, if
necessary. Specific issues that could arise are identified below and
include the actions planned in those events.

[]{#__RefHeading___Toc132531796 .anchor}**8.2 Steps for Transitioning**

[]{#__RefHeading___Toc132531797 .anchor}**8.2.1 Testing of Components
During and After Transition**

Each component must be tested during transition for any given server,
application or service. This is a joint test. Once a transition is
complete, confirmation of the systems availability and performance will
be determined from test runs locally and, where appropriate, from at
least one off site location. This testing is a joint effort between the
AHE and the customer.

[]{#__RefHeading___Toc132531798 .anchor}**8.2.2 Test Plans**

Application owners must develop test plan(s) for use when applications
transition into the AHE and when infrastructure changes are made.

[]{#__RefHeading___Toc132531799 .anchor}**8.2.3 Acceptance of Transfer**

Once a system has been confirmed operational, the customer and the AHE
Business Manager need to sign off on the transfer.

[]{#__RefHeading___Toc132531800 .anchor}**8.2.4 Retirement of Hardware**

Utilization of outdated servers released from service will comply with
all DOE regulations.

[]{#__RefHeading___Toc132531801 .anchor}**8.2.5 Cost of Services**

There is an initial setup cost as well as any additional costs related
to purchasing and/or maintaining of any approved non-standard software
required by the application. See Appendix C for a schedule of service
rates. Payment due will be determined as part of the transition
schedule. At that time, the customers will provide the memorandum along
with a completed cost form to OCIO through the Sub-Task Monitor.
(Subsequent costs must be provided prior to service.)

The total cost for each customer will be based on the selected levels of
service and the identified inventory of hardware/software on the
effective date of the MOA. As new hardware and/or applications are
brought under the AHE for a customer that has been transitioned; service
rates will be reviewed and adjusted accordingly with mutual agreement
between OCIO and the customer. See Appendix E for a invoice template.

All transition activities will occur during normal business hours. When
this is not possible due to customer requirements, AHE contractor staff
will receive overtime pay and this amount will be included in the setup
costs.

[]{#__RefHeading___Toc132531802 .anchor}**APPENDIX A - Transition
Strategy**

**Overview**

The planning for an AHE transition is a joint customer and AHE
responsibility that encompasses requirements collection, a cost
assessment, a Memorandum of Agreement (MOA) and the development of a
Plan of Action and Milestones (POAM).

**Requirements Collection**

When a requirement for an organization to transition an application into
the AHE presents itself, the application owner should contact the
following AHE representative within the Corporate Systems Division of
the Office of the Associate CIO of Operations, IM-44.

  ------------------------- ------------------- -------------------------
  **Representative**        **Location**        **Telephone Number**

  Flo Arnold                CA -- 326/GTN       301-903-5965
  ------------------------- ------------------- -------------------------

The application owner will be directed to the AHE web site
([http://ahe.doe.gov](http://ahe.doe.gov/)) so a copy of this Memorandum
of Agreement can be downloaded and reviewed. Also the "Request for
Application Hosting" form (Appendix C) must be completed and returned to
the AHE representative. This form can also be found and downloaded from
[http://ahe.doe.gov](http://ahe.doe.gov/).

Upon receipt and review of the form, a meeting will be scheduled with
the following parties to further refine requirements and conduct an
environment assessment:

-   Application Owner (DOE federal)

-   Application Developer

-   System Administrator for the required platform(s)

-   Project Manager

-   AHE federal management

-   Facilities personnel

-   Other appropriate personnel as required (i.e., software personnel of
    specific products (i.e., Oracle, JRun, Crystal Reports)

As a result of the meeting a POAM (Appendix G) will be developed.
Appendix G also contains worksheets to accompany the POAM should special
software licenses and/or server(s) be transferring into AHE along with
the Application. Also, a meeting will be scheduled to review and sign
the MOA. The attendees for this meeting will consist of the Application
Owner, AHE federal management and the Project Manager.

At this point, the process is handed to the platform(s) and/or
features(s) specific system administrator(s) and/or data base
administrator to coordinate. The system administrator(s) will prepare
the necessary CCP for approval with regard to the electrical
requirements, server and feature requirements, but the applications
layer will be handled by the application owner/application
administrator.

Consideration must be given to IP addresses whether the application is
internal/external of the network to include DOENET. This must be
considered in order to propagate the application. In order to implement
the application and allow user access, the following information must be
provided to the network engineering group so they can make the
appropriate changes:

Internal/External DNS requirements require the submission of a CCP.
CCP(s) must be coordinated with the AHE system administrator and
submitted by Monday of the week the change needs to occur. New CCPs are
reviewed and approved/denied during the Control Change Board (CCB)
meetings which are held every Tuesday and Thursday mornings.
Coordination with the AHE system administrator is imperative in the
event the administrator needs to address concerns that are presented by
OCIO management at the CCB meeting.

Firewall requirements/modifications are made after hours and require a
CCP prior to any change(s) occurring.

Before an application can be placed in the AHE, the server that the
application will reside on requires the following software be in place
and operating, if appropriate to the platform and operating system:

-   Opsware which encapsulates the Operating system software and server
    patches

-   Tivoli monitoring software (Tivoli endpoint agent) (monitoring
    hardware and software)

-   Tivoli Storage Manager (TSM) (backup/restore)

-   MCAfee (virus scanning for Windows platform only)

-   Cisco Security Agent (CSA) (security software for servers)

-   RSA Security Agent (two-factor authentication)

-   BigFix (pushes software patches; inventories software on servers)

-   Snare (takes event logs and places them in central repository)

-   Point of contact sheet (Note: Under NO circumstance will a server
    become operational without the sheet attached and filled out
    completely.)

Additionally, IM-44 must approve the production mode of the
application/server before the application can become operational. A
technical review is done by AHE and Application personnel to ensure the
server(s) meet Certification and Accreditation and DOE architecture
standards.

**Cost Assessment**

An assessment will be made of the servers and services to be
transitioned based on the table in Appendix C in order to determine the
cost associated with housing or hosting servers. Once a determination is
made as to whether servers are small, medium, large or complex, a cost
per month charge can be determined based on the Billing Rates table in
Appendix C. An invoice template is provided at Appendix F.

**Project Plan**

The POAM documents the start and finish dates, resources and
responsibilities for specific tasks among stakeholders.

A finalized POAM will be in place at least one week prior to the time
any work is to commence. The Project Plan will be reviewed and agreed to
by the Customer and the AHE Project Manager. The POAM includes:

-   Exact dates the responsibility shifts to AHE,

-   Dates and times any physical hardware and/or software are moved,

-   A detailed listing of the assets being transitioned,

-   A determination of individual names/phone numbers and notification
    requirements of all stakeholders involved before, during and after
    the transition takes place, and

-   Setup costs and annual maintenance fees

    []{#__RefHeading___Toc132531803 .anchor}**APPENDIX B - AHE
    Services**

**Hosting and Housing Comparison**

  ----------------------------------------------- ------------- --------------
  **AHE Services**                                **Hosting**   **Housing**

  Uninterrupted Power Supply                      X             X

  Generator Backup                                Gtn only      Gtn only

  Fire Suppression                                X             X

  Secure Facility with Badge Reader Controlled    X             X
  Access                                                        

  Air Conditioning and Humidity Control           X             X

  Configuration Control Plan (CCP)                X             Initial setup
                                                                only

  Operating System Installation and Configuration X             

  Operating System Maintenance                    X             

  Operating System Upgrades                       X             

  Database Management and Administration          X             

  Network Support Services                        X             

  Capacity Planning and Tuning                    X             

  Help Desk Coverage                              X             

  Ongoing Technical and Managerial Support        X             

  Virus Protection                                X             

  Infrastructure Certification and Accreditation  X             

  Backup and Recovery                             X             

  Weekly Offsite Disaster Recovery Back Tape      X             
  Vaulting                                                      

  24x7 System Monitoring                          X             

  2 hour Response time                            X             

  Hardware Refresh                                X             

  Cyber Security Services                         X             

  Hardware Maintenance                            X             

  Q Cleared System Administrators and Operations  X             
  Staff                                                         
  ----------------------------------------------- ------------- --------------

**The AHE provides the following services:**

-   Meet and coordinate with the vendor(s) to insure the proper
    installation of the hardware including determination of requirements
    for:

    -   Power (UPS/Generator)

    -   Floor space

    -   Determination of cooling and humidity requirements

    -   Determination of connectivity requirements

    -   Coordination for delivery including notification of Security

-   Delivery, installation and configuration of equipment

    -   Meet carrier at delivery dock and accept shipment.

    -   Move equipment to AHE facility.

    -   Unpack and inventory equipment, compare to bill of lading and
        original order(s) to insure completeness.

    -   Coordinate with DOE Property Management to have all equipment
        inventoried and tagged.

    -   Provide appropriate security escort for any required vendor
        staff necessary to complete initial installation and
        configuration. Note that all vendor staff, requiring access to
        DOE facilities, must be US Citizens.

    -   Provide personnel necessary to assure successful physical setup
        of the equipment including power and network connection.

    -   "Burn in" and test equipment

    -   Perform technical review of equipment prior to final acceptance
        notification to vendor.

    -   Document and maintain warranty and maintenance information.

-   Environmental Resources provided

    -   Raised, computer-room floor space.

    -   Humidity and temperature control, including backup/emergency air
        handlers.

    -   AC power required for operating equipment. Power is seamlessly
        provided by a filtered/conditioned UPS. In the event of
        short-term power grid failure, battery backup is used, and
        onsite generators (Germantown facility only) in case of a
        long-term power grid failure.

-   Physical Security of Equipment

    -   Controlled access via DOE Badging system and automated cipher
        locks.

    -   Management of access list for computer center facilities.

    -   Over/under floor Motion Detection.

    -   Under floor flood detectors.

    -   Automated Fire suppression.

    ```{=html}
    <!-- -->
    ```
    -   Adherence to the guidelines established in the Germantown
        Computer Center Cyber-Security Program Plan (CSPP).

    -   Provide annual security and escort training.

-   Maintenance of Equipment

```{=html}
<!-- -->
```
-   Scheduled preventative maintenance.

-   Ensure maintenance personnel are properly cleared or escorted during
    access to the equipment.

-   Notification to vendor of equipment failures and coordination of
    corrective actions.

-   Repair and/or replacement of equipment under warranty

-   24x7 hardware maintenance.

-   Documentation, administration and management of annual vendor
    hardware maintenance agreements.

-   Negotiation of maintenance agreements with vendors.

-   Document and maintain warranty and maintenance information.

```{=html}
<!-- -->
```
-   System Software Support Services

```{=html}
<!-- -->
```
-   System software maintenance and management -- Operating system (OS)
    management and maintenance are the responsibility of the AHE staff.
    AHE staff will do all operating system and shared tools patches,
    upgrades and configuration. AHE staff will resolve all security
    vulnerabilities.

-   24x7 system software support coverage.

-   Documentation, administration and management of annual system
    software support agreements.

-   Provide regular reports to Customer on system software maintenance
    completed and planned future maintenance.

-   Database Management System (DBMS)

-   Vendor-supplied Software Tools

-   Intrusion Detection System (IDS)

-   Cisco Security Agent (CSA) (security software for servers)

-   RSA Security Agent (two-factor authentication)

-   BigFix (pushes software patches; inventories software on servers)

-   Virus Detection and Eradication Software, where feasible

-   Other host-based system software as required by Customer

```{=html}
<!-- -->
```
-   Data Base Management and Administration

```{=html}
<!-- -->
```
-   Coordinate with application development and maintenance teams on all
    DBMS-related issues.

-   Review database applications, their suitability, logical designs and
    physical designs prior to implementation.

-   Assist with database sizing estimates and storage requirements.

-   Create tablespaces, schema accounts and other system-level objects
    necessary for development and implementation of application
    databases.

-   Provide guidance and assistance on creation of application-level
    objects stored in the DBMS.

-   Monitor DBMS/Application interaction and performance.

-   Monitor DBMS space utilization and trends.

```{=html}
<!-- -->
```
-   Proactively adjust DBMS storage availability to accommodate data
    base growth.

-   Assist with tuning application databases as appropriate.

-   Problem resolution and error correction, testing assistance in
    resolving performance problems or investigating unexpected results.

-   First-level technical support for all DBMS-related issues and
    problems.

-   Technical and economic evaluation of DBMS software and tools.

-   Coordinate user account creation standards and automation with
    Access Administration team.

```{=html}
<!-- -->
```
-   Network Support Services

```{=html}
<!-- -->
```
-   Interface with network management staff (IM-41) to assure proper
    connectivity, support and maintenance for the Headquarters LAN,
    DOEnet WAN and connectivity to the public network is provided by the
    IM-41 Network Engineering team in accordance with OCIO Configuration
    Management guidelines.

-   Assure adequate fault-tolerant connectivity and bandwidth into
    DOENet and the public network as agreed to by customer.

```{=html}
<!-- -->
```
-   Cyber-Security Services

> All of AHE servers are considered Zone 1 in the Cyber security arena.
> All Zone 1 identified vulnerabilities must be corrected within 24
> hours or the server has the potential for being removed from the DOE
> network. Vulnerabilities identified within AHE managed software or
> hardware will be corrected by AHE staff. If the vulnerability
> resolution requires a major patch to the operating system, AHE will
> test the patch on a test server before implementing the patch into
> production. This will be coordinated with Cyber Security. Corrections
> to vulnerabilities identified within a customer's application are the
> responsibility of the customer and must also be resolved within 24
> hours.

-   Intrusion detection and reporting.

-   Ensure compliance to DOE security guidelines and practices
    including, but not limited to:

> DOE N205.3 Password Generation, Protection, and Use
>
> DOE N205.3-1 Password Standards

-   User Account naming conventions

-   Daily review of server logs to identify security issues.

-   Develop and maintain Cyber-Security Program Plans (CSPP) for
    corporate servers.

-   Provide limited assistance to customer in developing Application
    Cyber-Security Program Plans.

-   User account management (OS and DBMS) by Access Administration team
    using Web-based account requests that are authenticated by the
    Customer or a designated representative(s).

-   Audits of all user accounts.

-   The IM-44 Network Security Team follows OCIO network Cyber-Security
    guidelines, and provides monthly scanning of corporate systems to
    identify risks to ensure compliance.

-   Notification of security incidents to the Cyber-Security Team and
    Customer, and coordination of corrective actions.

```{=html}
<!-- -->
```
-   Backup and Recovery

```{=html}
<!-- -->
```
-   Backup and Recovery are standard functions within the AHE
    environment. Data backups for non-mainframe servers are accomplished
    using Tivoli Storage Manager (TSM). TSM incremental backups are
    scheduled daily, and may occur at any time except for the period of
    time between 6PM each Saturday and 6AM each Sunday (EST/EDT).
    Recovery from media failure(s) is provided by incremental backups.
    This is because data is recoverable to the point in time at which
    the last successful incremental backup ran for a given machine's
    file system(s). Recovery from incidents involving sabotage,
    tampering, hacking, and other malicious behavior, and recovery from
    any inadvertent data loss is enabled by maintaining extra versions
    of each "currently active" file. The four (4) most recent extra
    versions of each "currently active" file are maintained for up to 30
    days, in addition to the current version which is maintained
    indefinitely. In addition, the most recent version of a deleted file
    is kept for 90 days. An extra copy of all data is maintained in an
    off-site vault to provide for recovery of wide-scale disasters. If
    special backup requirements are needed, AHE can honor these
    requests.

-   In addition to backup and recovery services, archive services are
    also available (at additional cost). Archive operations differ from
    backup operations in that they offer long-term (7 years, for
    example), point-in-time recovery of a specific "set" of data.
    Archive operations provide the long-term retention required for some
    data, such as when records management or historical preservation is
    required.

-   Backups for the IBM mainframe are done daily (incremental) and
    weekly (full volume & Disaster Recovery). Disaster Recovery volumes
    are rotated to an off-site vault, each week. In addition to primary
    disk volumes, data on Migration Level 2 (less active long term data)
    is also copied and kept at the off-site vaulting facility.

-   Regular System and Application backups tailored to application
    requirements

-   Recovery of backed up files and data bases.

-   Provide for managed off-site storage of backup media to ensure
    recoverability in compliance with the Continuity of Operations Plan
    (COOP).

-   If a specific application has requirements outside the normal cycle
    of TSM, they need to be outlined in Appendix E and communicated to
    the TSM technical team for inclusion into the TSM cycle.

```{=html}
<!-- -->
```
-   Continuity of Operations (currently the only funded Disaster
    Recovery is for the Mainframe and CF financial systems)

```{=html}
<!-- -->
```
-   Develop and maintain a COOP for the corporate servers.

-   The COOP shall include problem escalation and resolution procedures.

-   Perform annual testing of the COOP, including an off site Disaster
    Recovery (DR) exercise. Provide assistance to the Customer in
    developing and testing application DR plans.

-   Offsite recovery of operations to a DR site in the event of a
    declared disaster at the primary operations site. This is only in
    place, currently for the mainframe.

-   Re-establish operations at AHE upon conclusion of disaster.

```{=html}
<!-- -->
```
-   Capacity Planning and Tuning

```{=html}
<!-- -->
```
-   Monitor ongoing server/application performance and capacity against
    established metrics and take corrective action where required. These
    metrics include, but are not limited to:

    -   CPU utilization

    -   Memory utilization

    -   Disk storage utilization and I/O performance

    -   Network utilization

-   Performance tuning will be conducted based on established
    performance and capacity profile metrics.

-   Provide regular reports on performance and capacity.

-   Plan for anticipated capacity/resource growth using monitoring
    statistics and input from Customer (e.g. planned application
    expansion, improvements).

```{=html}
<!-- -->
```
-   System availability:

```{=html}
<!-- -->
```
-   Operations support -- On-site operations support and data control is
    available Monday through Friday from 6 a.m. to 6 p.m.

-   System monitoring and notification -- Using Tivoli management tools
    and the Attention Server, AHE staff is notified of any problems
    experienced by AHE servers. This allows for quick response to any
    problems that may impact availability. AHE servers are monitored 24
    hours a day

-   System availability during scheduled hours of operation will be
    maintained at no less than 99.9%. This availability applies to all
    causes determined to be within the scope of AHE support. Every
    effort will be made to minimize scheduled interruptions of service.

```{=html}
<!-- -->
```
-   Monitoring and Notification:

```{=html}
<!-- -->
```
-   Provide 24x7 monitoring of servers.

-   Provide 24x7 notifications of server failures with a minimum 2 hour
    response time.

-   Provide 24x7 on-call system support.

```{=html}
<!-- -->
```
-   Hours of Operation:

```{=html}
<!-- -->
```
-   Attended hours of operation for the AHE are from 6:00AM to 6:00PM
    Monday through Friday.

-   Standard hours for nightly backup operations will be established for
    servers within the AHE.

-   Normal hardware and software maintenance activities will be
    scheduled for the first and third weekends of the month, as
    required.

```{=html}
<!-- -->
```
-   Help Desk Coverage:

```{=html}
<!-- -->
```
-   The OCIO CSC Help Desk will provide customer assistance for the AHE.
    Customers are expected to provide their own application specific
    help desk support.

-   Help desk support will be provided via the (301) 903-2500
    Consolidated Service Center. The help desk staff will provide
    initial problem determination and route the trouble ticket to the
    appropriate source for resolution. AHE staff will respond to all
    infrastructure issues, and the application owner will designate
    contacts for application related issues.

```{=html}
<!-- -->
```
-   Ongoing Technical and Managerial Support

```{=html}
<!-- -->
```
-   Provide technical guidance and support related to current and future
    applications in the AHE. This support includes, but is not limited
    to:

    -   Meeting with current and potential vendors to discuss facility
        services, hardware /software configurations, and
        policies/procedures.

    -   Facilitate peer-level interaction between Customers of the AHE.

```{=html}
<!-- -->
```
-   Configuration Control Process

```{=html}
<!-- -->
```
-   Compliance with all Configuration Change Proposal (CCP) guidelines
    in use by the Office of the Chief Information Officer (OCIO) for
    software and hardware changes.

-   Active participation in all phases of the Configuration Control
    Process to insure that customer requirements and milestones are
    achieved.

-   Establish a customer council to foster cooperation and coordination
    of activities related to participation in the AHE. This council is
    the analytic and deliberative arm of the Configuration Management
    process. The council represents the wider DOECOE community impacted
    by any changes (including changes in the project scope), budget
    allocations, and implementation. It reviews proposed CCP's in detail
    and reports findings and recommendations to the Configuration
    Control Board (CCB). The CCB meets every Tuesday and Thursday to
    review and approve/disapprove CCPs.

```{=html}
<!-- -->
```
-   Facilities Management

```{=html}
<!-- -->
```
-   Provide infrastructure support to the computer center. This
    includes, but is not limited to:

    -   Electricity

    -   UPS

    -   Generator

    -   Personnel to support computer center

    -   Access administration -- creation and deletion of userids

    -   Physical security -- i.e., controlled access; fire suppression

        []{#__RefHeading___Toc132531804 .anchor}**APPENDIX C - Request
        for Hosting Form**

**(includes costs for services/billing rates)**

**Request for Application Hosting**

We look forward to hosting your application in our secure environment.
Please provide contact information and application specifications. This
will allow initiation of the administrative and security tasks
associated with application hosting.

+--------------------------+---+---+-----------------+-----------------+
| **System Application     |   |   |                 |                 |
| Request Identifier       |   |   |                 |                 |
| (Official Use Only):**   |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Application Name\      |   |   | Request Date:   |                 |
| (include Acronym if      |   |   | \_\_\_          |                 |
| applicable):**           |   |   | /               |                 |
|                          |   |   | \_\_\_/\_\_\_\_ |                 |
|                          |   |   |                 |                 |
|                          |   |   | MM / DD/YYYY    |                 |
+--------------------------+---+---+-----------------+-----------------+
|                          |   |   | Production Date |                 |
|                          |   |   | Requested:\     |                 |
|                          |   |   | \_\_\_          |                 |
|                          |   |   | /               |                 |
|                          |   |   | \_\_\_/\_\_\_\_ |                 |
|                          |   |   |                 |                 |
|                          |   |   | MM / DD/YYYY    |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Application            |   |   |                 |                 |
| Description (include     |   |   |                 |                 |
| purpose, users and       |   |   |                 |                 |
| production cycle):**     |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Application            |   |   |                 |                 |
| Owner/Federal Point of   |   |   |                 |                 |
| Contact:**               |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Name:**                | * |   |                 | **Work Phone:** |
|                          | * |   |                 |                 |
|                          | E |   |                 |                 |
|                          | m |   |                 |                 |
|                          | a |   |                 |                 |
|                          | i |   |                 |                 |
|                          | l |   |                 |                 |
|                          | : |   |                 |                 |
|                          | * |   |                 |                 |
|                          | * |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Backup Name:**         | * |   |                 | **Work Phone:** |
|                          | * |   |                 |                 |
|                          | E |   |                 |                 |
|                          | m |   |                 |                 |
|                          | a |   |                 |                 |
|                          | i |   |                 |                 |
|                          | l |   |                 |                 |
|                          | : |   |                 |                 |
|                          | * |   |                 |                 |
|                          | * |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Routing Symbol:**      |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Primary Technical      |   |   |                 |                 |
| Point of Contact:**      |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Name:**                |   | * |                 | **Work Phone:** |
|                          |   | * |                 |                 |
|                          |   | E |                 |                 |
|                          |   | m |                 |                 |
|                          |   | a |                 |                 |
|                          |   | i |                 |                 |
|                          |   | l |                 |                 |
|                          |   | : |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Backup Name:**         |   | > |                 | > **Work        |
|                          |   |   |                 | > Phone:**      |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
|                          |   | E |                 |                 |
|                          |   | m |                 |                 |
|                          |   | a |                 |                 |
|                          |   | i |                 |                 |
|                          |   | l |                 |                 |
|                          |   | : |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Will the application   |   |   |                 |                 |
| be available:**          |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) External --** Open |   |   |                 |                 |
| to the public **( )      |   |   |                 |                 |
| Specific IP Addresses**  |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) Headquarters --**  |   |   |                 |                 |
| DOE HQ users only        |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_       |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_\_\_ |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_\_\_ |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) DOENet --**        |   |   |                 |                 |
| internal to DOE          |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_       |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_\_\_ |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_\_\_ |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) Non-DOENet sites** |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Do you require         |   |   |                 |                 |
| Application Development  |   |   |                 |                 |
| Services: ( ) Yes ( )    |   |   |                 |                 |
| No**                     |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Operating Environment  |   | * |                 |                 |
| required:**              |   | * |                 |                 |
|                          |   | A |                 |                 |
| **( ) Linux ( ) Unix**   |   | p |                 |                 |
|                          |   | p |                 |                 |
| **( ) Windows 2003 ( )   |   | l |                 |                 |
| undecided**              |   | i |                 |                 |
|                          |   | c |                 |                 |
|                          |   | a |                 |                 |
|                          |   | t |                 |                 |
|                          |   | i |                 |                 |
|                          |   | o |                 |                 |
|                          |   | n |                 |                 |
|                          |   | s |                 |                 |
|                          |   | t |                 |                 |
|                          |   | a |                 |                 |
|                          |   | t |                 |                 |
|                          |   | u |                 |                 |
|                          |   | s |                 |                 |
|                          |   | : |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
|                          |   |   |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
|                          |   | ( |                 |                 |
|                          |   | ) |                 |                 |
|                          |   | p |                 |                 |
|                          |   | l |                 |                 |
|                          |   | a |                 |                 |
|                          |   | n |                 |                 |
|                          |   | n |                 |                 |
|                          |   | e |                 |                 |
|                          |   | d |                 |                 |
|                          |   | ( |                 |                 |
|                          |   | ) |                 |                 |
|                          |   | i |                 |                 |
|                          |   | n |                 |                 |
|                          |   | d |                 |                 |
|                          |   | e |                 |                 |
|                          |   | v |                 |                 |
|                          |   | e |                 |                 |
|                          |   | l |                 |                 |
|                          |   | o |                 |                 |
|                          |   | p |                 |                 |
|                          |   | m |                 |                 |
|                          |   | e |                 |                 |
|                          |   | n |                 |                 |
|                          |   | t |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
|                          |   |   |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
|                          |   | ( |                 |                 |
|                          |   | ) |                 |                 |
|                          |   | e |                 |                 |
|                          |   | x |                 |                 |
|                          |   | i |                 |                 |
|                          |   | s |                 |                 |
|                          |   | t |                 |                 |
|                          |   | i |                 |                 |
|                          |   | n |                 |                 |
|                          |   | g |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
|                          |   | - |                 |                 |
|                          |   | h |                 |                 |
|                          |   | o |                 |                 |
|                          |   | s |                 |                 |
|                          |   | t |                 |                 |
|                          |   | e |                 |                 |
|                          |   | d |                 |                 |
|                          |   | e |                 |                 |
|                          |   | l |                 |                 |
|                          |   | s |                 |                 |
|                          |   | e |                 |                 |
|                          |   | w |                 |                 |
|                          |   | h |                 |                 |
|                          |   | e |                 |                 |
|                          |   | r |                 |                 |
|                          |   | e |                 |                 |
|                          |   |   |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
|                          |   | ( |                 |                 |
|                          |   | ) |                 |                 |
|                          |   | C |                 |                 |
|                          |   | O |                 |                 |
|                          |   | T |                 |                 |
|                          |   | S |                 |                 |
|                          |   | - |                 |                 |
|                          |   | - |                 |                 |
|                          |   | * |                 |                 |
|                          |   | * |                 |                 |
|                          |   | C |                 |                 |
|                          |   | o |                 |                 |
|                          |   | m |                 |                 |
|                          |   | m |                 |                 |
|                          |   | e |                 |                 |
|                          |   | r |                 |                 |
|                          |   | c |                 |                 |
|                          |   | i |                 |                 |
|                          |   | a |                 |                 |
|                          |   | l |                 |                 |
|                          |   | - |                 |                 |
|                          |   | O |                 |                 |
|                          |   | f |                 |                 |
|                          |   | f |                 |                 |
|                          |   | - |                 |                 |
|                          |   | T |                 |                 |
|                          |   | h |                 |                 |
|                          |   | e |                 |                 |
|                          |   | - |                 |                 |
|                          |   | S |                 |                 |
|                          |   | h |                 |                 |
|                          |   | e |                 |                 |
|                          |   | l |                 |                 |
|                          |   | f |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **What is the purpose of |   |   |                 |                 |
| the application?**       |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Is this application    |   |   |                 |                 |
| Mission Critical? ( )    |   |   |                 |                 |
| Y/N**                    |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Is this a corporate    |   |   |                 |                 |
| application? ( ) Y/N**   |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **How much disk space is |   |   |                 |                 |
| required for the         |   |   |                 |                 |
| application source       |   |   |                 |                 |
| code?**                  |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **How much disk space    |   |   |                 |                 |
| required for the         |   |   |                 |                 |
| Database?**              |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **What is your records   |   |   |                 |                 |
| retention requirement?** |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **How often is the       |   |   |                 |                 |
| application accessed?    |   |   |                 |                 |
| Daily\_\_ Weekly \_\_    |   |   |                 |                 |
| Monthly\_\_**            |   |   |                 |                 |
|                          |   |   |                 |                 |
| **Are there times when   |   |   |                 |                 |
| the application will     |   |   |                 |                 |
| have heavy usage (i.e.,  |   |   |                 |                 |
| end of month             |   |   |                 |                 |
| reporting)?\             |   |   |                 |                 |
| ( ) Y/N If yes, when?    |   |   |                 |                 |
| \_\_\_\_\_               |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_\_\_ |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_\_** |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Estimated number of    |   |   |                 |                 |
| total users              |   |   |                 |                 |
| (local/national):        |   |   |                 |                 |
| \_\_\_\_\_\_ /           |   |   |                 |                 |
| \_\_\_\_\_\_**           |   |   |                 |                 |
|                          |   |   |                 |                 |
| **Estimated number of    |   |   |                 |                 |
| daily concurrent users:  |   |   |                 |                 |
| \_\_\_\_\_\_\_**         |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Is this a "thin" or    |   |   |                 |                 |
| "fat" client             |   |   |                 |                 |
| application?             |   |   |                 |                 |
| \_                       |   |   |                 |                 |
| \_\_\_\_\_\_(thin/fat)** |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Required Development   |   |   |                 |                 |
| Environment:**           |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) None ( ) HTML ( )  |   |   |                 |                 |
| ASP/ASP.Net**            |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) JSP ( ) PHP ( )    |   |   |                 |                 |
| ColdFusion/ColdFusion    |   |   |                 |                 |
| MX**                     |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) Undecided ( )      |   |   |                 |                 |
| Other (please specify)   |   |   |                 |                 |
| \_\_\_\                  |   |   |                 |                 |
| _\_\_\_\_\_\_\_\_\_\_\_\ |   |   |                 |                 |
| _\_\_\_\_\_\_\_\_\_\_\_\ |   |   |                 |                 |
| **                       |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Type of                |   |   |                 |                 |
| Web/Application Server   |   |   |                 |                 |
| needed:**                |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) Oracle 9ias ( )    |   |   |                 |                 |
| Apache ( ) Microsoft     |   |   |                 |                 |
| IIS**                    |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) Plumtree ( )       |   |   |                 |                 |
| WebLogic ( ) None**      |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) Websphere ( )      |   |   |                 |                 |
| Other (please specify)   |   |   |                 |                 |
| \_\_\_\_                 |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_\_\_ |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_\_** |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Secure Socket Layers   |   |   | **Need a URL?** |                 |
| (SSL) required:**        |   |   |                 |                 |
|                          |   |   | **( ) Yes, if   |                 |
| **( ) Yes**              |   |   | yes what URL    |                 |
|                          |   |   | \               |                 |
| **( ) No**               |   |   | _\_\_\_\_\_\_\_ |                 |
|                          |   |   | \_\_\_\_\_\_\_\ |                 |
|                          |   |   | ( ) No**        |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Database required:**   |   |   |                 |                 |
|                          |   |   |                 |                 |
| **( ) Oracle ( ) MySQL ( |   |   |                 |                 |
| ) SQL Server ( ) Other   |   |   |                 |                 |
| \_\_\_\_\_\_\_\_\_\_**   |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| Describe Database        |   |   |                 |                 |
| requirements:            |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Print Volume:**        |   |   | I/O Volume:     |                 |
+--------------------------+---+---+-----------------+-----------------+
| Reporting software       |   |   |                 |                 |
| requirements (e.g.       |   |   |                 |                 |
| Crystal Reports):        |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| Describe Backup and      |   |   |                 |                 |
| Recovery needs:          |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **List any 3rd party     |   |   |                 |                 |
| and/or custom software   |   |   |                 |                 |
| used:**                  |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **For Official Use       |   |   |                 |                 |
| Only**                   |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| System Application       |   |   | **Scheduled     |                 |
| Identifier:              |   |   | kickoff meeting |                 |
|                          |   |   | date:**         |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Kickoff meeting        |   |   |                 |                 |
| invitees:**              |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+
| **Comments:**            |   |   |                 |                 |
+--------------------------+---+---+-----------------+-----------------+

+-----------------------------------------------------------------------+
| **Instructions**                                                      |
|                                                                       |
| -   **Federal POC:** The name, email and phone number for the Federal |
|     Point of Contact for the requested application and that person\'s |
|     backup.                                                           |
|                                                                       |
| -   **Primary Technical POC:** The name, email, and phone number of   |
|     the Primary Technical point of contact for the requested          |
|     application and that person\'s backup.                            |
|                                                                       |
| -   **Application status:** What is the current development status of |
|     the application.                                                  |
|                                                                       |
| -   **Application Development Services needed:** Are you requesting   |
|     development help from the Application Hosting staff?              |
|                                                                       |
| -   **Application Name:** The name of the requested application.      |
|                                                                       |
| -   **Application Description:** (include purpose, users and          |
|     production cycle).                                                |
|                                                                       |
| -   **Public or Private (internal or external to DOE):** Delineate    |
|     whether the application will serve the internal DOE community     |
|     only or if it will be available for the general public as well.   |
|                                                                       |
| -   **How much Disk space required for the Application source code:** |
|     Anticipated amount of disk space the application code occupies in |
|     Megabytes (MB).                                                   |
|                                                                       |
| -   **Is this a \"thin\" or \"fat\" client application?** Thin client |
|     would be browser based html only or telnet access of an           |
|     application operating on a host server. Fat client would be a     |
|     client/server application or any software that runs on the        |
|     workstations.                                                     |
|                                                                       |
| -   **Mission Critical Application:** Is the requested application    |
|     one of the DOEs mission critical applications?                    |
|                                                                       |
| -   **Corporate Application:** Is the requested application one of    |
|     the DOEs corporate applications?                                  |
|                                                                       |
| -   **Secure Socket Layers (SSL) required**: Does the application     |
|     need to be connected to or utilize Secure Socket Layers for       |
|     information encryption purposes?                                  |
|                                                                       |
| -   **Need a URL:** Does this application need to be assigned a       |
|     Universal Resource Locator (URL) i.e., http://theApp.doe.gov?     |
|                                                                       |
| -   **Type of Web/Application server needed:** Choose the web server  |
|     type the application will be hosted on.                           |
|                                                                       |
| -   **Required Development Environment:** What technologies will the  |
|     development server need to support.                               |
|                                                                       |
| -   **Operating Environment Needed:** The Operating System (OS)       |
|     required to run the application.                                  |
|                                                                       |
| -   **Database required:** Type of database the application will be   |
|     utilizing.                                                        |
|                                                                       |
| -   **How much space required for the Database?** Disk space in       |
|     megabytes (MB) required to host the applications\' database.      |
|                                                                       |
| -   **Describe Database requirements.**                               |
|                                                                       |
| -   **Print volume:** How much printer network traffic is your        |
|     application expected to generate daily?                           |
|                                                                       |
| -   **I/O volum**e: Daily input/Output volume for your application.   |
|                                                                       |
| -   **Reporting requirements:** What type of application statistics   |
|     or status information, etc, do you require reports on? How        |
|     frequently?                                                       |
|                                                                       |
| -   **Describe Backup and Recovery needs:** A description of the type |
|     of backups necessary to recover the application should that       |
|     become necessary, and how often the application needs to be       |
|     backed up.                                                        |
|                                                                       |
| -   **List any 3rd party and/or custom software used:** List any      |
|     software or tools the application requestor will provide to       |
|     support the application.                                          |
|                                                                       |
| -   **Describe any special requirements or conditions**               |
+-----------------------------------------------------------------------+

**Rates for AHE Services**

**Use this work sheet to determine the cost of hosting an application by
adding up the point value for each requirement in the "Total Points"
column.**

+-------------------------------+------------+------------------------+
| **Application Requirements**  | **Point    | **Total Points**       |
|                               | Value**    |                        |
+-------------------------------+------------+------------------------+
| Application Mission Critical? | 3 -- Yes   |                        |
|                               |            |                        |
|                               | 0 -- No    |                        |
+-------------------------------+------------+------------------------+
| Web Site:                     | 1          |                        |
|                               |            |                        |
| Internal (on DOENET)          | 3          |                        |
|                               |            |                        |
| External                      | 3          |                        |
|                               |            |                        |
| Content Management            |            |                        |
+-------------------------------+------------+------------------------+
| Operating System:             | 3          |                        |
|                               |            |                        |
| Windows                       | 3          |                        |
|                               |            |                        |
| Unix                          | 4          |                        |
|                               |            |                        |
| OS/390                        | 4          |                        |
|                               |            |                        |
| VM                            | 4          |                        |
|                               |            |                        |
| Linux                         |            |                        |
+-------------------------------+------------+------------------------+
| Number of Users:              | 1          |                        |
|                               |            |                        |
| 1-10                          | 2          |                        |
|                               |            |                        |
| 11-50                         | 3          |                        |
|                               |            |                        |
| 50-100                        | 4          |                        |
|                               |            |                        |
| 100-plus                      |            |                        |
+-------------------------------+------------+------------------------+
| Disk Space:                   | 1          |                        |
|                               |            |                        |
| 1-20MB                        | 2          |                        |
|                               |            |                        |
| 20-50MB                       | 3          |                        |
|                               |            |                        |
| 50-100MB                      | 4          |                        |
|                               |            |                        |
| \> 100MB                      |            |                        |
+-------------------------------+------------+------------------------+
| Crystal Reports               | 2          |                        |
+-------------------------------+------------+------------------------+
| Database:                     | 3          |                        |
|                               |            |                        |
| ORACLE                        | 2          |                        |
|                               |            |                        |
| SQLSERVER                     |            |                        |
+-------------------------------+------------+------------------------+
| Special Software              | 3          |                        |
| (Non-Standard or not current  |            |                        |
| release)                      | 4          |                        |
|                               |            |                        |
| Multiple Special Software     |            |                        |
+-------------------------------+------------+------------------------+
| Access Administration         | 3          |                        |
| Management by AHE             |            |                        |
+-------------------------------+------------+------------------------+
| **TOTAL**                     |            |                        |
+-------------------------------+------------+------------------------+

**Score**

1- 9 Small/simple

10-15 Medium

16-20 Large

21-25 Complex

26+ Very Complex

**Hosting Billing Rates:**

  ----------------------------- ------------- ------------ ----------------
  **Type of Application**       **Cost Per    **Cost Per   **Installation
                                Month**       Year**       Fee**

  **Hosting**                                              

  Listserv                      \$50          \$600        

                                                           

  Small/Simple                  \$1,000       \$12,000     

                                                           

  Medium                        \$1,500       \$18,000     

                                                           

  Large                         \$3,000       \$36,000     

                                                           

  Complex                       \$4,000       \$48,000     

                                                           

  Very Complex                  Negotiable                 

                                                           

  **Setup Cost per hour**                                  \$100.00

                                                           

  **Citrix (non-DOECOE)**       \$20/user     \$240.00     

                                                           

  **Application                 Negotiable                 
  Development/Maintenance**                                
  ----------------------------- ------------- ------------ ----------------

**Housing Billing Rates**

  -------------------------------- -------------- ------------ -----------
  **Housing\***                    Cost per month Cost per     Percent
                                                  year per     savings
                                                  unit         

  Per Rack Unit(RU)\*\*            \$100          \$1,200      \-

  Per Server\*\*\*                 \$400          \$4,800      \-

  Per Rack (1-5 racks)\*\*\*\*     \$2,000        \$24,000     \-

  Per Racks (6-10 racks)           \$1700         \$20,400     15%

  Per Racks (11 plus)              \$1500         \$18,000     25%

                                                               
  -------------------------------- -------------- ------------ -----------

\* Customer pays for the LAN drops used thru the Working Capital Fund

> \*\* RU = 1.75\" high. The average 7\' x 19\" rack provides 42 RU. A
> standard mid-tower server turned on its side and mounted in a rack is
> 4RU in height.
>
> \*\*\* Mini servers housing costs will be determined by how many RU's
> they occupy.

\*\*\*\* Customer pays for the cost of the racks

[]{#__RefHeading___Toc132531805 .anchor}**APPENDIX D -- Benefits of
Hosting/Housing in AHE**

[Some key features of hosting/housing in the Germantown Computer
Facility]{.underline}:

Computer Facility is located on federal property in Germantown, MD.

Physical security of equipment. This includes:

-   Controlled access to computer center using badge card readers.

-   Automated fire suppression

-   Over/under floor motion detection

Environmental resources provided. This includes:

-   Humidity and temperature control

-   Electrical backup -- UPS for short-term power failure and generators
    for long-term power failure

Foreign nationals are restricted from entering the computer facility.

Germantown campus has a large armed guard force with law enforcement
capabilities.

Campus layout -- ample parking, no vehicles permitted close to the
buildings, vehicle inspections, etc.

24x7 Security & Network Operations staff: Managed Firewall, Intrusion
Detection, and Vulnerability Scanning services.

Interlocking cyber security plans for OCIO-managed functions.

Equipment is installed, configured and maintained by Q-cleared
personnel.

Hosted equipment has "alert notification" software which notifies AHE
personnel in the event a server has a problem.

[]{#__RefHeading___Toc132531806 .anchor}**APPENDIX E - Application
Specific Requirement(s)**

Any application-specific requirements are listed here. If there aren't
any, please state "None."

[]{#__RefHeading___Toc132531807 .anchor}**APPENDIX F -- AHE Summary of
Charges**

Customer:

Billing Period: October 1, 2005 -- September 30, 2006

**Application(s) Hosted:**

  ------------------------------------------------------------------------------
  **Organization**   **System Name**     **System     **Monthly     **Annual
                                         Size**       Cost**        Cost**
  ------------------ ------------------- ------------ ------------- ------------
                                                                    

                                                                    

                                                                    

                                                                    

  **Total:**                                                        
  ------------------------------------------------------------------------------

**Server(s) Housed:**

+----------+------------+-------------+--------+---------+-----------+
| **Organi | **         | **Equipment | **DOE  | **      | **Annual  |
| zation** | Location** | De          | Tag**  | Monthly | Cost**    |
|          |            | scription** |        | Cost**  |           |
|          | **Room     |             |        |         |           |
|          | ,Row,Pos** |             |        |         |           |
+==========+============+=============+========+=========+===========+
|          |            |             |        |         |           |
+----------+------------+-------------+--------+---------+-----------+
|          |            |             |        |         |           |
+----------+------------+-------------+--------+---------+-----------+
|          |            |             |        |         |           |
+----------+------------+-------------+--------+---------+-----------+
|          |            |             | *      |         |           |
|          |            |             | *Subto |         |           |
|          |            |             | tal:** |         |           |
+----------+------------+-------------+--------+---------+-----------+

**Application Programming Support:**

  ----------------------------------------------------------------------------------
  **Organization**   **System Name**       **System      **Monthly       **Annual
                                           Size**        Cost**          Cost**
  ------------------ --------------------- ------------- --------------- -----------
                                                                         

                                                                         

                                                                         

                                                         **Subtotal:**   
  ----------------------------------------------------------------------------------

**Portal Infrastructure Fees:**

  --------------------------------------------------------------------------------
  **Organization**   **Number of     **Charge per    **Monthly       **Annual
                     users**         user**          Cost**          Cost**
  ------------------ --------------- --------------- --------------- -------------
                                                                     

                                                                     

                                                     **Subtotal:**   
  --------------------------------------------------------------------------------

**TOTAL DUE:**

[]{#__RefHeading___Toc132531808 .anchor}**APPENDIX G -- POAM and
Worksheets**

**(Sample) Plan of Action and Milestones (POAM)**

(Sample) POAM

  ---------------- ------------------------- ------------ ------------------ --------
  **(Application                                                             
  Name) Plan of                                                              
  Action and                                                                 
  Milestones**                                                               

  Task \#          Task Description          Owner(s)     Status             Target
                                                                             Date

                                                                             

                                                                             

                                                                             

                                                                             

                                                                             

                                                                             

                                                                             

                                                                             

                                                                             

                                                                             

                                                                             

                                                                             
  ---------------- ------------------------- ------------ ------------------ --------