GMCA 267a GM One Network

Purpose The Integrator Service is critical to the vision and success of the GM One Network as a Service. It provides a single interface for the management, configuration and monitoring for all components of the GM One Network. Key Principles The Integrator Service is expected to: • Provide a portal for use by Partner Authorities; • Provide a single pain of glass for all aspects of the management, configuration and monitoring of the GM One Network; • Provide in depth insight and analytics capabilities; • Provide a simple and intuitive user interface for use by Partner Authorities; • Provide a programable (machine) interface; • Provide central network services (eg IPAM, DHCP, DNS etc), that can be consumed by the partner Authorities if required; • Provide lifecycle management; • Provide innovation throughout the life of the contract; • Use Artificial Intelligence and Machine Learning;

Purpose The Connectivity Service provides the foundation for the GM One Network over which all other services will be provided. It is primarily based upon the Local Full Fibre Network (LFFN) that connects all 34 core Fibre Services Nodes (FSNs) as well as the 1,600+ GM sites. Additionally, a Service Provider’s core (MPLS/Internet) network could also be considered as part of the GM One Connectivity Service (when connected via the WAN Access service). At the high level, the Connectivity service encompasses: • Connectivity Core – IP network connecting the 34 LFFN FSN Points of Presence • Connectivity Access – Provides the access aggregation point for LFFN connectivity from remote GM sites into the Connectivity Core • Connectivity Edge – CPE at GM sites facilitating the connection to the Connectivity Access service • Connectivity Connect – Network layer at GM sites that provides the wired or wireless connectivity from end users/devices to the GM One Connectivity Edge • Connectivity Cloud Edge – provides the connectivity to Cloud Access (including Internet access), Remote Access and WAN Access for the IP Network • Internet Access – provides secure connectivity to the Internet Key Principles The Connectivity Service is expected to: • Be of carrier-grade providing a secure, high-capacity, low latency, low jitter, highly resilient network platform; • Support both IPv4 and IPv6 simultaneously and provide connectivity to all services regardless of the IP version in use; • Support segmentation at the IP layer ensuring separation of Authority traffic; • Provide any-to-any connectivity between sites and always forward traffic over the “best” path; • Provide a secure gateway between Authority's GM One Networks; • Meet the (current and future) requirements for handling the transmission of information at the appropriate Security Classification as required by GMCA; • Support overlapping IP addressing between different Authorities; • Support end-to-end granular scheduling of traffic across the network; • Support access speeds from 1G up to 100G with upgrades/downgrades with minimal cost and disruption to service; • Support non-resilient and resilient GM Partner Authority site connectivity; • Support active/active load balancing at resilient sites; • Support zero touch deployment for Core, Access and Edge devices; • Provide secure access to high-capacity, highly resilient Internet access; • Integrate with existing LAN infrastructure at GM Partner Authority sites;

Purpose The Software Defined Network Service provides programmable, scalable, agile, secure access for GM users to all internal and external services. It adheres to Zero Trust Architecture principles facilitating seamless access across GM One Network regardless of location. The SDN provides the capability for a layered approach to segmenting the GM One Network at the appropriate level for individual Authorities and/or network services. The GM One SDN Service is an optional service for GM Partner Authorities. Key Principles The GM One Software Defined Network Service is expected to: • Seamlessly integrate with the GM One Connectivity Services; • Adhere to (NCSC) Zero Trust Architecture principles; • Provide secure access to internal and external service for GM users and citizens; • Be able to authenticate, authorise and enforce policy across all sites such that a user can securely access their Partner Authority's resources from anywhere on the GM One Software Defined Network; • Be able to create enforcement policy based on users or groups of users; • Ensure that each Partner Authority administrator can only create enforcement polices for its users, systems and resources It must not be possible for a Partner Authorities administrator to create enforcement polices allowing unauthorised access to another Partner Authorities resources; • Integrate with GM Partner Authorities Identity Management Services; • Provide end-to-end granular scheduling of traffic across the network; • Support overlapping IP addressing between different Authorities; • Provide both wireless (Wi-Fi 6) and wired access (for both new and existing devices) – with a wireless first principle;

Purpose Provides a mechanism for secure connectivity for remote users to GM One Network applications and services. Key Principles The GM One Remote Access service is expected to: • Provide secure, high-capacity, highly resilient remote access platform; • Adhere to (NCSC) Zero Trust Architecture principles; • Authenticate, authorise and enforce policy across all remote users such that a remote user can securely access their Partner Authority's resources; • Create enforcement policy based on users or groups of users; • Ensure that each Partner Authority administrator can only create enforcement polices for its remote users, systems and resources It must not be possible for a Partner Authorities administrator to create enforcement polices allowing unauthorised access to another Partner Authorities resources; • Integrate with GMCA’s Identity Management Services; • Provide secure access for GM users from anywhere on the Internet;

Purpose Provides optimised, secure connectivity from the GM One Network to Cloud services and Service Providers Key Principles The GM One Cloud Access service is expected to: • Provide secure, high-capacity, highly resilient Internet and Cloud Service Provider platform; • Provide RBAC for specific Cloud and Internet access on a per Partner Authority basis; • Provide secure access to Cloud services via the Internet; • Provide secure access to Cloud services via private network connectivity; • Provide guarantees of bandwidth for Cloud and Internet access on a per Partner Authority basis; • Provide the ability for Partner Authority Administrators to configure bandwidth allocation for Cloud and Internet services; • Provide the ability for Partner Authority Administrators to configure Security Policy Cloud and Internet access;