IAEA Specification

WAN and Internet Services

Dated 17 April 2015

STATEMENT OF WORK

Technical Requirements for

Managed Wide Area Network (WAN) and
Internet Services

Page 1 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

1. Scope
This Statement of Work describes the technical requirements for provision of managed
Wide Area Network (WAN) and Internet services for the International Atomic Energy
Agency (IAEA) offices at:

• Vienna, Austria
• Seibersdorf, Austria
• Monaco, Monaco
• Tokyo, Japan
• Toronto, Canada
• Rokkasho, Japan

The IAEA is seeking a three (3) year contract beginning 1st November 2015. The initial
three (3) year contract should include the option for an extension by an additional two
(2) years for maximum contract duration of five (5) years.

The contract will deliver:

• Managed Wide Area Network (WAN) services

• Managed Internet services
• A 24 x 7 Service desk and account management team to support the
managed services

The required network topology for Head Offices and Branch offices is:

Page 2 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

Diagram A: Required network topology

2. Definitions, Acronyms, and Abbreviations

The following definitions, acronyms, and abbreviations shall apply throughout this
Statement of Work:

BGP Border Gateway Protocol

DRI Disaster Recovery Infrastructure
DSCP Differentiated services code point
GLBP Global Load Balancing Protocol
HSRP Hot Standby Routing Protocol
IAEA International Atomic Energy Agency
IPSec Internet Protocol Security
ISP Internet Service Provider
MACSEC Media Access Control Security
MPLS Multi-Protocol Label Switching
QoS Quality of Service
RIPE Réseaux IP Européens
Safeguards Department of Safeguards
SLA Service Level Agreement
SPOC Single Point of Contact
VPN Virtual Private Network
WAN Wide Area Network

Page 3 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

3. Current environment
A description of the current WAN and Internet services environment is provided for
context.

The IAEA currently have multiple contracts to provide managed services for WAN and
Internet services. These contracts expire on 31 October 2015.

The current WAN and Internet services provide LAN-to-LAN communication based on:

• MPLS with IPSec encryption to connect IAEA branch offices Monaco, Tokyo,
Toronto, and Rokkasho to the IAEA headquarters in Vienna.

• Layer 2 Ethernet with Cisco MACSEC encryption to connect IAEA branch office
Seibersdorf to the IAEA headquarters in Vienna.

• Internet backup lines to connect IAEA branch offices to the IAEA headquarters in
Vienna with a site to site VPN between IAEA managed firewalls.

• Two internet lines from different ISP’s are used to connect the IAEA headquarters
in Vienna to the Internet.

The current environments bandwidth is:

Site WAN Internet Notes
Vienna - 400 Mbps Primary Internet – from ISP A
Vienna - 100 Mbps Secondary Internet – from ISP B
Vienna - 200 Mbps Guest Internet
Vienna 30 Mbps MPLS MTIT MPLS “head-end”
Vienna 60 Mbps MPLS SGIS MPLS “head-end”
Monaco 4 Mbps MPLS 60/15 Mbps Asymmetric MTIT
Tokyo 30 Mbps MPLS 10 Mbps symmetric SGIS
Toronto 10 Mbps MPLS 10 Mbps symmetric SGIS
Seibersdorf 1000 Mbps Ethernet 4 Mbps symmetric Shared by MTIT/SGIS, Layer 2 Ethernet
Seibersdorf - 100 Mbps symmetric DRI
Rokkasho 6 Mbps MPLS 10 Mbps symmetric SGIS

Page 4 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

4. Requirements
4.1 Internet backup lines and Agency Internet access
The Contractor shall supply internet bandwidth and internet line
characteristics as described:

4.1.1 Head Office (MTIT): 2 x internet lines (Line ID: A and B) for the Vienna office,
the lines are to be provided by dual ISP’s. These internet lines are to be used
for Internet access for all IAEA staff and for termination of VPN tunnels
between head office and MTIT branch offices. Lines to be terminated in C
Building Level -1.
4.1.2 Head Office (SGIS): 1 x internet line (Line ID: C) for Vienna office. This
internet line is to be used for termination of VPN tunnels between head office
and SGIS branch offices. Lines to be terminated in A Building Level 10 Room
A1004.
4.1.3 Branch office Seibersdorf (Line: D), this is a special case as the Seibersdorf
site is the Agency’s largest branch office (over 300 staff) servicing both
Safeguards and non-Safeguards staff, so there will be a single backup
Internet line to Seibersdorf which will be shared by MTIT and SGIS.
4.1.4 Branch Offices: 1 x internet line per branch office (Line ID: E, F, G, and H).
These lines are to be used for termination of backup VPN tunnels to the head
office in Vienna and breakout of internet for local Guest wireless. It is possible
in future that these lines would also be used for local breakout to “cloud”
services and the Agency’s ERP program (AIPS) based in Geneva.
4.1.5 Line speeds are to be symmetric (i.e. equal upload and download speeds),
line speeds required at start of contract and projected in 5 years are:

Site Line Initial Projected Note:

ID Speed Speed in 5
years
(Mbit per
second (Mbit per
Mbps) second
Mbps)
Vienna A 400 Mbps 4 000 Mbps Primary Internet
Vienna B 400 Mbps 4 000 Mbps Backup Internet, Guest Wi-Fi, MTIT
backup VPN termination
Vienna C 100 Mbps 1 000 Mbps SGIS backup VPN termination
Seibersdorf D 100 Mbps 1 000 Mbps Backup line for Seibersdorf
Monaco E 20 Mbps 200 Mbps Backup line for Monaco
Tokyo F 10 Mbps 20 Mbps Backup line for Tokyo
Rokkasho G 10 Mbps 20 Mbps Backup line for Rokkasho
Toronto H 10 Mbps 20 Mbps Backup line for Toronto

Table A: Internet line speeds

4.1.6 All internet lines are to have sufficient fixed IP addresses which can be used
by Agency equipment to terminate site to site VPN tunnels and allow for at
least two VPN gateways on the Seibersdorf backup line (line ID: D) shared by

Page 5 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

MTIT and SGIS (net mask /29). The backup lines for the other branch offices
(Line ID: E,F,G,H) has to allow for at least one customer VPN gateway (net
mask /30).
4.1.7 To allow for the end-to-end encryption the customer (MTIT/SGIS) may deploy
the encryption devices on the line. To allow for proper IPSEc channel setup
the IP addresses assigned to the customers (MTIT/SGIS) must be public,
static and routable (no NAT’ing of the customer device internet facing IP
address).

4.2 Internet Peering:

The Contractor shall supply internet peering as described:

4.2.1 Internet lines (Line ID: A and B) will be required to route the IAEA address
range 161.5.0.0/16 associated with AS (Autonomous System) number 12311
which currently have a peering with routers from A1 Telekom and Level 3
Communications. (http://bgp.he.net/AS12311)

4.2.2 The two internet lines (Line ID: A and B) will be required to provide
redundancy and load sharing of both incoming and outgoing traffic between
the two ISP access circuits via the use of Border Gateway Protocol (eBGP)
between the ISP routers. To achieve redundancy to the IAEA network the
Contractor’s routers will be required to peer with IAEA routers via Hot Standby
Routing Protocol (HSRP) or Global Load Balancing Protocol (GLBP) or similar
over the existing IAEA network.

4.3 Internet for Disaster Recovery

In case of an outage to the IAEA Vienna Data Centre an Internet line will be
used to provide access to the IAEA disaster recovery environment at
Seibersdorf, Austria.

The Contractor shall supply Internet for Disaster Recovery as described:

4.3.1 Line speeds are to be symmetric (i.e. equal upload and download speeds),
line speeds required at start of contract and projected in 5 years are:

Site Line Initial Projected Note:

ID Speed Speed in 5
years
(Mbit per
second (Mbit per
Mbps) second
Mbps)

Seibersdorf Z 100 Mbps 1 000 Mbps DRI

Table B: Internet line speeds

4.3.2 This internet line (Line ID: Z) is used to back up the two internet lines in
Vienna (Line ID: A and B). In case of an incident in Vienna, the Agency’s

Page 6 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

internet address space must be moved from (Line ID: A, B) to the line in
Seibersdorf (Line ID: Z). This movement (fail-over) requires the following:

4.3.2.1 In the event of a disaster the Agency’s Internet class B address space (Line
ID: A, B) will be pointed to the Seibersdorf internet line (Line ID: Z) with
exactly the same IP addresses as defined in Vienna. Note: The disaster
recovery environment at Seibersdorf is configured with the same IP
addresses as those in Vienna, hence relies on the Agency’s Internet IP
addresses (from Vienna) being routable to Seibersdorf.

4.3.2.2 Upon the request from the IAEA the Contractor will have to manually activate
BGP fail-over. The Contractor shall pre-configure their devices in Seibersdorf
so that it is capable of accepting the Agency’s address space within 2 hours of
request for failover.

4.3.2.3 The provider must provide a complete turnkey installation for the proposed
Internet failover solution including documentation, customization, knowledge
transfer and training and acceptance testing. Also the provider will verify
performance and data integrity by utilizing testing scenarios agreed upon with
the Agency staff to prove operability and acceptance of the installation.

4.3.2.4 The Agency requires the Contractor to be available by phone 24 by 7 in order

to request a fail-over of the address space in Seibersdorf within 2 hours.

4.3.2.5 Fail-over and fall back testing: The Contractor shall work with the Agency to
create documentation and test plan for the IP address space fail-over as well
as for the fall back plan. Testing will be conducted on an annual basis. i.e.
once per year.

4.4 WAN primary connectivity

The Contractor shall supply WAN bandwidth as described:
4.4.1 Head Office: 2 x “head end” WAN lines for Vienna office:
• One for SGIS to terminate their branch offices (Line ID: J)
• One for MTIT to terminate their branch offices. (Line ID: I)
4.4.2 Branch Office (L, M, N, O lines): These WAN lines are to be used to connect
branch offices to the Head Office for access to centralized applications e.g.
databases, email and video conferencing, etc. This WAN line will be the
“primary” line between branch office and head office. The Agency will use
their own encryption devices to encrypt data traversing this WAN line.
4.4.3 Seibersdorf (K line): This is a special case as the Seibersdorf site is the
Agency’s largest branch office (over 300 staff) servicing both SG and non-SG
staff, so there will be a single WAN line to Seibersdorf which will be shared. In
addition Seibersdorf is the Agency’s disaster recovery site, as such it requires
more bandwidth than the other smaller branch offices. It may make sense for
the Contractor to provide a “point to point” WAN line between Vienna and
Seibersdorf using a different technology to the other small branch offices.
4.4.4 As the IAEA may need to route traffic directly between all the locations the
network configuration has to allow for a direct connectivity (mesh) between

Page 7 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

any given sites (e.g. Tokyo shall need to communicate directly to Rokkasho,
Vienna, Seibersdorf and Toronto).

4.4.5 Line speeds:

Site Line Initial Projected Note:
ID Speed Speed (Mb)
(Mb)
5 years
Vienna – MTIT I 10 Mbps 100 Mbps Services “L”
Vienna – SGIS J 60 Mbps 200 Mbps Services “M,N,O”
Seibersdorf K 1 000 Mbps 10 000 Mb -
Monaco L 10 Mbps 100 Mbps -
Tokyo M 30 Mbps 50 Mbps -
Rokkasho N 10 Mbps 30 Mbps -
Toronto O 10 Mbps 30 Mbps -

Table B: WAN line speeds

4.5 Geographic diversity

In order to reduce single points of failure the Contractor’s solution should
include geographic diversity. The Agency is open to Contractor’s solutions
using wireless 4G technology (or similar) for the internet backup lines to
provide geographic diversity to terrestrial land based lines, as long as the
proposed solution meets the technical performance requirements.
The Contractor shall supply geographic diversity as described:
4.5.1 The Contractor shall supply two lines per site (WAN and Internet); these lines
should be delivered geographically diverse where possible, such that they do
not cross or rely on common infrastructure (e.g. Exchanges, building entry
conduits) for the end to end journey of the transmission media. If geographic
diversity is not possible, it should be described in the Contractor’s solution
which sites will not have geographic diversity.
4.6 Latency
The latency of the WAN primary connectivity has substantial impact on the
WAN deployed applications. Because of this, the requirement for low latency
links is of paramount importance.
The Contractor shall supply WAN lines with maximum latency as described:
4.6.1 Round Trip Times from Vienna to the branches offices via WAN must be less
than or equal to:
Site Line ID Maximum latency
(milliseconds)
Seibersdorf - Vienna K to I/J 5
Monaco – Vienna MTIT L to I 25
(Tokyo – Vienna SGIS) M to J 280
(Rokkasho – Vienna N to J 310

Page 8 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

SGIS)
(Toronto – Vienna SGIS) O to J 150
Table C: Maximum latency

4.7 Encryption
The Contractor shall confirm their solution supports use of encryption as
described:

4.7.1 For data confidentiality all communication across the WAN and Internet IAEA
applications require IP based secured transmission. This is achieved via
(Layer 3) VPN with IPSec or (Layer 2) Cisco MACSEC and is currently done
by the network hardware which is property of the IAEA (back-to-back to the
provider’s hardware).

4.8 Quality of Service

The Contractor shall confirm their solution supports use of Quality of Service
(QoS) as described:

4.8.1 For time sensitive communication across the WAN and Internet IAEA
applications require QoS. This is achieved via Cisco DSCP QoS settings on
network hardware which is property of the IAEA (back-to-back to the
provider’s hardware). It is required that the Contractor’s solution honours the
IAEA’s QOS settings throughout the Contractor’s network, thus ensuring End-
to-End QOS

4.9 SLA
The Contractor shall supply WAN and Internet lines with SLA as described:

4.9.1 WAN, Headquarters and Disaster Recovery Internet lines

Line ID: I, J, K, L, M, N, O, A, B, Z

Availability 99.90 %,
Packet loss < 0.05 %

Incident response times

o Helpdesk: 24 hours x 7 days with 15 minute phone response
o Onsite engineer: 24 hours x 7 days with 2 hour onsite response
o Service restoration within 4 hours

4.9.2 Internet at branch offices

Line ID: C, D, E, F, G, H

Availability 99.5 %
Packet loss < 0.05 %

Page 9 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

Incident response times

o Helpdesk: 24 hours x 7 days with 15 minute phone response
o Onsite engineer: 9 hours x 5 days (local business hours) with 4 hour
onsite response
o Service restoration within 24 hours
4.10 Monitoring
The Contractor shall supply monitoring of Internet and WAN services as
described:

• 24 hours x 7 days - Line monitoring

• 24 hours x 7 days – Service desk
• 24 hours x 7 days - Technical support (faults) and escalation path

4.11 Reporting
The Contractor shall provide reporting as described:

4.11.1 Monthly report on WAN and Internet statistics e.g. utilisation, latency, errors,
uptime, etc. This report is to be provided monthly by the 10th business day of
the month. This report may also be provided via self-service whereby the
IAEA can access a web based portal
4.11.2 Monthly report on WAN and Internet incidents i.e. an incident report (if any)
with a description of the incident, total downtime, whether SLA was violated or
not, reasons for the incident and corrective actions to prevent from re-
occurring.

4.12 Transition-in Plan

The Contractor shall supply a “transition-in plan” as described:

4.12.1 At contract initiation a “transition-in plan” is required to ensure a smooth

migration from the current network to new network, including any workshops
and implementation steps with a time-schedule (not to exceed 12 weeks). The
implementation plan should describe the work to be done in by the Contractor
and IAEA.
4.12.2 The Contractor should supply the name and resume of the project manager
and engineering support who will manage the “transition-in” activities and
workshops to determine final design and migration plan.

4.13 Installation, Commissioning, Migration, Testing and

Acceptance
The Contractor shall supply Installation, Commissioning, Migration, Testing
and Acceptance” as described:

4.13.1 The Contractor shall provide an on-site engineer to “install” and “commission”
the Contractor’s termination equipment at all sites. The engineer will be
required to perform all tasks such as cabling, rack mount, labelling and any
other activities required to commission the Contractor’s service. To assist the

Page 10 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

IAEA will provide escorted site access to the technical rooms and provide rack
space for installation of the Contractor’s equipment.
4.13.2 The existing MPLS WAN links make use of RFC1918 private IP addresses at
the provider edge. To allow for a smooth migration the existing addressing
schema should to be reflected in the new topology (to avoid need for
customer VPN/routing/monitoring reconfiguration).
4.13.3 All services shall be labelled clearly identifying the service numbers and
owner of each type of equipment supplied.
4.13.4 During the “migration” to a new / upgraded transmission service the
Contractor’s engineers will provide free-of-charge support to the IAEA to get
the service running.
4.13.5 All services supplied shall be “tested” and include documents containing a
network diagram, part descriptions, part numbers, and serial numbers, as well
as test results for the service proving the minimum performance requirements
for bandwidth and latency are met.
4.13.6 After “installation” and “migration” the service shall be tested by the Contractor
together with the IAEA to demonstrate that the performance and capacity
meet the minimum requirements specified herein as determined by the IAEA.
4.13.7 The results of the “testing” of the Service shall be documented by the
Contractor in an “acceptance” protocol that shall be signed by the IAEA.
4.13.8 The Contractor will be required to install and support their equipment and
services at sites:
• Vienna, Austria
• Seibersdorf, Austria
• Monaco, Monaco
• Tokyo, Japan
• Toronto, Canada
• Rokkasho, Japan

4.14 Presentation and Demarcation

The Contractor shall ensure present and demark the lines as described:

4.14.1 Branch Offices: Contractor lines to be presented as Ethernet (either fibre or

copper cable to be determined at installation time) for connection to Agency
active equipment (routers or firewalls). The Agency equipment will have
physical interfaces of 100BASE-TX or 1000BASE-TX/SX. It is this cable that
will be the demarcation point between the Agency and Contractor’s
equipment. (Branch office lines M,N,O,F,G are limited to 100BASE-TX)
4.14.2 Head Offices: Contractor lines to be presented as Ethernet (either fibre or
copper cable to be determined at installation time) for connection to Agency
active equipment (routers or firewalls). The Agency equipment will have
physical interfaces of 100BASE-TX or 1000BASE-TX/SX. It is this cable that
will be the demarcation point between the Agency and Contractor’s equipment
However, in future the Agencies active equipment may upgrade to support
10Gbit Ethernet. In this case the Contractor’s equipment will be required to
support 10Gbit Ethernet (10GBASE-SR).

4.15 Service delivery times

Page 11 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

The Contractor shall meet service delivery times as described:

4.15.1 The Contractor shall notify IAEA of an estimated service commissioning date
for new and upgraded services 4 weeks beforehand within a deviation of +/- 1
week. Delivery of ordered services shall not exceed 8 weeks, unless
otherwise agreed with the Contractor and IAEA

4.16 Service Maintenance Times

The Contractor shall supply notification of Service Maintenance Times as
described:

4.16.1 The Contractor shall notify IAEA of service maintenance time and date a
minimum of 2 weeks prior to the maintenance being conducted. This is
required to allow the IAEA to observe change management practices and
advise the IAEA business of any impacts. Note: the type of systems impacted
by any particular service maintenance work and the time needed to complete
maintenance determines whether the work can be carried out during normal
business hours, beyond normal business hours, or takes place on Saturday,
Sunday or public holidays. Also note that the current normal maintenance
windows are scheduled every second Thursday from 19:30-22:00 and
Saturdays from 08:00-20:00, however times outside these windows may also
be requested.

4.17 Account Management Team

The Contractor shall supply an account management team as described:

4.17.1 The Contractor shall provide an account management structure, including:

• SPOC – 24 x 7 service desk
• SPOC – Account Manager (sales and billing)
• SPOC – Engineering Manager (technical support)
• Escalation team for incidents and IP address failover

All communication between the IAEA and the account management team
shall be in English language.

4.18 Account Management Meeting

The Contractor shall supply an account management meeting as described:

4.18.1 The Contractor shall schedule an account status meetings at the IAEA Vienna
office (unless agreed otherwise i.e. via telephone conference) at a minimum
interval of 6 months (i.e. Last Tuesday of every sixth month).

4.18.2 The required agenda is:

• Performance against contractual obligations, including discussion of
incident and SLA’s

Page 12 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

• Orders, their delivery dates and co-ordination of the installations

• Upcoming projects / activities status that may require network changes
• Contractor to provide analysis of line performance and utilization, with
recommendations for bandwidth change (upgrade or downgrade)
• Notification of planned line maintenance
• Billing and financials (with IAEA procurement)
• Other business

4.19 International safety and power standards

The Contractor shall supply equipment complying with international safety and
power standards as described

4.19.1 All goods supplied (e.g. termination equipment) shall comply with local safety
regulations for usage and fit for purpose,
4.19.2 All goods supplied shall comply with local power standards and cabling where
applicable

4.20 Deliverable Data Items

The Contractor shall deliver the following data items:

4.20.1.1 At the start of contract a “transition-in” plan and migration plan from existing
carrier to new carrier

4.20.1.2 Technical documentation for a standard setup and configuration of network

lines, including:
o List of all services e.g. line numbers
o Network diagrams – racks
o Network diagrams – WAN/Internet topology
o Network diagram - geographical diversity of lines
o IP addressing scheme
o Final hand-over report with commissioning and test results
o Disaster recovery Internet line failover procedure

4.20.1.3 Monthly reports:

o Online performance reporting
o Incident reports
o Notification of upcoming service maintenance

4.20.1.4 Contacts:
o List of names and numbers of all key personal and 24 x 7 service desk
o Incident escalation matrix and instructions in case of incident

4.20.1.5 Documents in English - The Contractor shall provide all documentation,

operation and servicing manuals and technical drawings in the English
language in Electronic format, such as “MS Office Suite” and/or PDF.

Page 13 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

4.21 Transition-out

The Contractor recognizes that the services under this contract are vital to the
IAEA and must be continued without interruption and that, upon contract
expiration or cessation of the Contractor’s services for any other reason, a
successor may continue them. The Contractor agrees to effect an orderly and
efficient transition to the successor(s).

The Contractor shall, upon the IAEA’s written notice, (a) furnish phase-in,
phase-out services for up to 90 days after this contract expires and (b) agree
on a plan with the successor(s) and the IAEA Project Manager to determine
the nature and extent of the phase-in, phase-out services required and the
personnel essential to the performance of these services. The Contractor
shall maintain essential personnel during the phase-in, phase-out period to
ensure that the services called for by this contract are maintained at the
required level of proficiency.

The Contractor shall be reimbursed for all reasonable costs incurred within
the agreed period in accordance with the existing contract rates.

Page 14 of 15
 IAEA Specification
WAN and Internet Services
Dated 17 April 2015

Appendix A: Site Addresses

Site addresses where WAN and Internet lines will need to be terminated by the Contractor:
City Country Office Type Street Address Computer Terminate
Room Line ID’s
Vienna MTIT Austria Head Office Wagramer Straße 5, 1220 C Building I,A,B
Level Minus 1
Vienna SGIS Austria Head Office Wagramer Straße 5, 1220 C Building J
Level Minus 1
Vienna SGIS Austria Head Office Wagramer Straße 5, 1220 A Building C
Level 10
Room A1004
Seibersdorf Austria Branch Office A-2444 Room LE04 K,Z,D
SGIS/MTIT
Monaco MTIT Monaco Branch Office 4, Quai Antoine 1er Room 363 E,L
B.P. 800, MC 98012 Monaco
Cedex
Tokyo SGIS Japan IAEA Seibunkan Building Level 10, F,M
Regional 5-9 Iidabashi 1 Chome Server room
Office Japan Chiyoda-Ku, Tokyo 102-0072
Japan
Toronto SGIS Canada IAEA Suite 1702/Box 20 Level 17 H,O
Regional 365 Bloor Street East
Office Canada Toronto, ONT M4W3L4 Canada

Rokkasho Japan IAEA SG at 4-108, Aza Okitsuke Server room G,N

SGIS RRP Oaza Obuchi
Rokkasho-Mura, Kamikita-Gun
Aomori-Ken

Page 15 of 15