Attachment_3_Service_Level_Agreements_Pick_List_2022-09-15_0001.xlsx
XLSX spreadsheet 54 KB Posted
- Attached to
- Solicitation of DAT Collections RFP
- Solicitation number
- 140D0423R0024
View the file
Other files
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SLA
| Title | Default Display Order | Service Level Agreement Category | Component | Service Level Objective | Service Level Agreement Metric (expression, unit, rules, parameters) | Type of Procurement. Jobaid for determining selections | Monitoring Tool to Measure, Guiding Law | All | SaaS | IaaS/PaaS | Optional | Contractor Managing | |
| 1 | 01a | Accessibility | Accessibilty Component | Accessibility Policies | Provision cloud services to comply with EN 301 549 Accessibility requirements for public procurement of ICT products and services in Europe | SaaS, all public facing websites | X | ||||||
| 2 | 01a | Accessibility | Accessibilty Component | Accessibility Policies | Provision cloud services to comply with Section 508 Amendment to the Rehabilitation Act of 1973, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) including all products, platforms, and services that use information and communication technology. | Include in all Standard DOI Policy | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | X | |||||
| 3 | 01a | Accessibility | Accessibilty Component | Accessibilty Standards | Provision cloud services to meet requirements for persons with disabilities including ISO/IEC Guide 71 — Guide for addressing accessibility in standards and ISO/IEC TR 29138 (all parts) — Accessibility considerations for people with disabilities | SaaS, all public facing websites | ISO/IEC TR 29138 | X | |||||
| 4 | 01a | Accessibility | Accessibilty Component | Accessibilty Standards | Provision cloud services to meet requirements for persons with disabilities including W3C Web Content Accessibility Guidelines (WCAG) 2.x (or later) by the Web Accessibility Initiative (WAI) of the World Wide Web Consortium (W3C) also published as ISO/IEC 40500:2012 | SaaS, all public facing websites | ISO/IEC 40500:2012 | X | |||||
| 5 | 02a | Availability | Availability | Authentication | Authentication includes both physical and logical security and certification | Include in all Standard DOI Policy | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.9.5 Authentication | ||||||
| C.5.1 Security Objectives. C.5.9.1 IdAAM Information Security | X | ||||||||||||
| 6 | 02a | Availability | Availability | Authentication | Provide a zero-trust security plan that includes proposed authentication types based on security classification (low, moderate, high) for all end-user integration points such as role-based LDAP, two-factor authentication (2FA0, single sign-on (SSO), multi-factor authentication (MFA), OpenID Connect Service. | Include in all Standard DOI Policy | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.9.5 Authentication | ||||||
| C.5.1 Security Objectives. C.5.9.1 IdAAM Information Security | X | ||||||||||||
| 7 | 02b | Availability | Availability | Authentication Personnel | Agency Personnel Authentication: Prior to going into production mode, Contractor shall coordinate a trusted security communication channel to support, at a minimum, the Government’s PIV Card authentication (dual factor method) of remote access (OMB M-11-11 HSPD-12 Policy for a Common Identification Standard for Federal Employees and Contractors). DOI utilizes SAML 2.0 Federated SSO and migrating to OpenID Connect (OIDC) CAC-less MFA authentication protocol | If they are required to manage authentication or coordinate with DOI Service Delivery to establish and configure environment to support. Include if not sure | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.9.5 Authentication | ||||||
| C.5.1 Security Objectives. C.5.9.1 IdAAM Information Security | X | ||||||||||||
| 8 | 02b | Availability | Availability | Authentication Personnel | Contractor Personnel: Homeland Security Presidential Directive-12 (HSPD-12) requires that all federal entities ensure that all Contractors gaining physical access to federally controlled facilities or logical access to federally controlled information systems have current and approved security background investigations that are equivalent to investigations performed on federal employees. Access to DOI information data and/or systems shall be cleared at appropriate levels as set forth: (1) Low Risk position will require a National Agency Check with Written Inquiries (NACI) or equivalent investigation. (2) Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI). (3) High Risk position will require a Background Investigation (BI) | Only if this contractor or subs need to log into this tenant/instance. Note: Bureau/Office COR will need to coordinate them processing their background check and PIV card (about 4-6 first weeks after award) so add this to the deliverables. | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.9.5 Authentication | ||||||
| C.5.1 Security Objectives. C.5.9.1 IdAAM Information Security | x | ||||||||||||
| 9 | 02b | Availability | Availability | Authentication Personnel | Public / Customer Authentication: DOI requires a phishing-resistant “Identity Authentication” single sign-on credentialling option configured for external facing customer services that meet the M-22-09 “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles” using OpenID Connect service | For all systems requiring login credentials for the general public. | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.9.5 Authentication | x | |||||
| 10 | 02c | Availability | Availability | Uptime | Availability should be calculated as the total time over a set of defined intervals less the total downtime during each interval, and may exclude allowable downtime | Include in all. | ISO/IEC 19086-2. | x | |||||
| 11 | 02c | Availability | Availability | Uptime | Uptime Band 1: Contractor shall ensure covered services are accessible and acceptable on-demand. Uptime shall be 99.99% - 100% according to calculating the amount or percentage of time in a given period that the cloud service is accessible and usable. Downtime restricted to <4 minutes/month. (ISO/EIC 17788) | This is Band 1 and allows up to 4 minutes/month downtime | high-level indicator that the covered services are responding to requests and fulfilling the functions in the service description at a point in time. being accessible1) and usable upon demand by an authorized entity (ISO/IEC 17788). | x | |||||
| 12 | 02c | Availability | Availability | Uptime | Uptime Band 2: Contractor shall ensure covered services are accessible and acceptable on-demand. Uptime shall be 99.90% - 99.99% according to calculating the amount or percentage of time in a given period that the cloud service is accessible and usable. Downtime restricted to <43 minutes/month (ISO/EIC 17788) | This is Band 2 and allows up to 43 minutes/month downtime | high-level indicator that the covered services are responding to requests and fulfilling the functions in the service description at a point in time. being accessible1) and usable upon demand by an authorized entity (ISO/IEC 17788). | x | |||||
| 13 | 02c | Availability | Availability | Uptime | Uptime Band 3: (Default) Contractor shall ensure covered services are accessible and acceptable on-demand. Uptime shall be 99.00 - 99.90% according to calculating the amount or percentage of time in a given period that the cloud service is accessible and usable. Downtime restricted to <7.2 hours/month (ISO/EIC 17788) | DEFAULT: This is Band 3 and allows up to 7.2 hours/month downtime | high-level indicator that the covered services are responding to requests and fulfilling the functions in the service description at a point in time. being accessible1) and usable upon demand by an authorized entity (ISO/IEC 17788). | x | |||||
| 14 | 02c | Availability | Availability | Uptime | Uptime Band 4: Contractor shall ensure covered services are accessible and acceptable on-demand. Uptime shall be 95% - 99%according to calculating the amount or percentage of time in a given period that the cloud service is accessible and usable. Downtime restricted to <36 hours/month (ISO/EIC 17788) | This is Band 4 and allows up to 36 hours/month downtime | high-level indicator that the covered services are responding to requests and fulfilling the functions in the service description at a point in time. being accessible1) and usable upon demand by an authorized entity (ISO/IEC 17788). | x | |||||
| 15 | 02c | Availability | Availability | Uptime | Uptime Band 5: Contractor shall ensure covered services are accessible and acceptable on-demand. Uptime shall be 93% - 95% according to calculating the amount or percentage of time in a given period that the cloud service is accessible and usable. Downtime restricted to <50 hours/month (ISO/EIC 17788) | This is Band 5 and allows up to 50 hours/month downtime | high-level indicator that the covered services are responding to requests and fulfilling the functions in the service description at a point in time | x | |||||
| 16 | 03a | Performance | Cloud Service Capacity Component | Cloud Service Bandwidth | Identify the amount of bandwidth that can be transferred over a period of time for the cloud service provider(s) | Optional Deliverable for high volume services. Good to compare CSPs proposals | The amount of data that can be transferred over a period of time. | x | |||||
| 17 | 03a | Performance | Cloud Service Capacity Component | Cloud Service Throughput | Identify the amount of traffic throughput that can be transferred over a period of time for the cloud service provider(s) | Optional Deliverable for high volume services. Good to compare CSPs proposals | The amount of data that can be transferred over a period of time. | x | |||||
| 18 | 03a | Performance | Cloud Service Capacity Component | Limit of Available Cloud Service Resources | Identify the maximum capacity of available resources as appropriate for the order, i.e. disk space, CPU power, memory size, page view, etc. | IaaS/PaaS. Optional Deliverable for high volume services. Good to compare CSPs proposals | Maximum capacity of available resources, i.e. disk space, CPU power, memory size, page view, etc. | x | |||||
| 19 | 03a | Performance | Cloud Service Capacity Component | Limit of Simultaneous Cloud Service Connections | Identify the maximum number of simultaneous connections supported by cloud service provider(s) | IaaS/PaaS. Optional Deliverable for high volume services. Good to compare CSPs proposals | Maximum number of simultaneous connections supported by the cloud service. | x | |||||
| 20 | 03b | Performance | Cloud Service Response Time | Adapt to Demand Fluctuations | Ensure system can adapt to fluctuations in demand with minimal impact on system performance. Latency shall be managed by the Contractor | Optional if the contractor is expected to assist with performance and demand fluctuations | x | ||||||
| 21 | 03b | Performance | Cloud Service Response Time | On-Demand Availability | Authorized users shall be able to establish the resource scaling sequence most appropriate for their application when configuring automatic scaling. Contractor shall provide defaults and recommendations | Optional if this type of service required. Good for IaaS, PaaS, large scale access and performance requirements | x | ||||||
| 22 | 03b | Performance | Cloud Service Response Time | Provisional Response | After a request has been made (either manually or automatically in response to configurable triggers), resources (e.g. storage, virtual machines) shall be available within time | Include in all orders where contractor is provisioning and/or managing disaster recovery | Cloud best practices | ||||||
| 23 | 03b | Performance | Cloud Service Response Time | Provisional Response | Deliver itemized list/chart of defaults, suggestions and tiered options of provisional performance services including the speed the hosted system can respon to changes on demand | Include in all orders where contractor is provisioning and/or managing disaster recovery | Cloud best practices | ||||||
| 24 | 03c | Performance | Cloud Service Response Time | Performance Metrics | Permit visibility to provide clear access and visibility to ongoing performance and resources usage | Include in all IaaS/PaaS | x | ||||||
| 25 | 03c | Performance | Cloud Service Response Time | Performance Metrics | Provide a suite of reports, dashboards, and alarms to monitor and track operational and infrastructure performance (e.g., incidents, service usage, capacity, SLA adherence) | Include in all IaaS/PaaS | x | ||||||
| 26 | 03c | Performance | Cloud Service Response Time | Performance Metrics | Provide access to all log files generated by the hosted application, associated middleware, operating system, and underlying virtual and physical infrastructure | Include in all IaaS/PaaS | x | ||||||
| 27 | 03c | Performance | Cloud Service Response Time | Performance Metrics | Provide automatic monitoring of resource utilization and other events such as failure of service, degraded service, etc. via service dashboard or other electronic mean | Include in all IaaS/PaaS | x | ||||||
| 28 | 03c | Performance | Cloud Service Response Time | Performance Metrics | Provide online reporting metrics interface for all resource utilization including metrics such as: current utilization, historical average, and peak for a user defined window of time | Include in all IaaS/PaaS | x | ||||||
| 29 | 03c | Performance | Cloud Service Response Time | Performance Metrics | Provide role filtered self-management tools to support billing, monitoring, and reporting on service management function | Include in all IaaS/PaaS | x | ||||||
| 30 | 03c | Performance | Cloud Service Response Time | Performance Metrics | Provide the ability to filter and view usage and invoicing by: Technical Service Line, bureau (and sub-bureau), program, IT System, IT System type, IT System Life-Cycle, Security Level, and other elements which may be identified in individual Task Orders | Include in all IaaS/PaaS | x | ||||||
| 31 | 03c | Performance | Cloud Service Response Time | Performance Metrics | Provide visibility into usage metering using metrics and granularity appropriate to the type of service | Include in all IaaS/PaaS | x | ||||||
| 32 | 03d | Performance | Cloud Service Response Time | Cloud Service Response Time Variance | Configure environment to meet the minimum performance requirements (RTO and RPO) and may propose alternative service bands to provide either a more robust service level for mission critical applications or less stringent service level to save on test/sandbox services | Include in all orders where contractor is provisioning and/or managing disaster recovery | Response time is the time between a stimulus to the cloud service and the response of the service to the stimulus. | ||||||
| 33 | 03d | Performance | Continuous Monitoring | System Reports | All Contractor-operated systems that input, store, process, output, and/or transmit DOI CUI shall meet or exceed the continuous monitoring requirements identified in the DOI Continuous Monitoring Plan or the Bureau or Office Continuous Monitoring Plan, whichever best fits mission, security, and risk management needs | Include in all Standard DOI Policy | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | ||||||
| 34 | 03d | Performance | Continuous Monitoring | System Reports | Contractor provide the following to aligne with the governments continuous monitoring strategy: 1) account management, 2) vulnerability management, 3) patch management, 4) antivirus, 5) malware detection, 6) event management, 7) configuration management, 8) license management, 9) incident management | For Contractor managed environments | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | ||||||
| 35 | 03d | Performance | Continuous Monitoring | System Reports | Contractor shall provide ongoing Plan of Action and Milestones (POA&M) report with all vulnerabilities, weaknesses, patches, and timelines for correction | Include in all. This may be through requesting the FedRAMP security authorization package and accessing through max.gov | |||||||
| 36 | 03d | Performance | Continuous Monitoring | System Reports | Contractor-managed systems are required to have an assigned Information System Security Officer (ISSO) and System Owner (SO) to support the processes described in the contract. While the procuring organization designates government personnel to serve in these roles, the contractor must provide functionally equivalent personnel to enable effective day-to-day operation, management, and monitoring of the system. The Contractor ISSO and SO resources are required to comply with DOI- or other-approved annual and Role Based Security Training (RBST) requirements | Include in all Standard DOI Policy | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | ||||||
| 37 | 03d | Performance | Continuous Monitoring | System Reports | Contractors managing systems on behalf of the Department are required to submit Continuous Monitoring Reports per the Continuous Monitoring Plan to the federal point of contact designated in the contract per the timelines prescribed in the Continuous Monitoring Plan. The Contractor-managed systems may be required to submit to a penetration test (at the discretion of the awarding program) in coordination with DOI cybersecurity personnel or approved contract officials | Include in all Standard DOI Policy | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | ||||||
| 38 | 03d | Performance | Continuous Monitoring | System Reports | Provide a Security Assessment Report (SAR) and a Security Assessment Plan (SAP) consistent with NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations | Include in all. This may be through requesting the FedRAMP security authorization package and accessing through max.gov | |||||||
| 39 | 03d | Performance | Elasticity Component | Elasticity Precision | Describe how the cloud service resource allocation meets the actual resource requirements at a given point in time | Include in all Standard DOI Policy | The elasticity precision quantity describes how precise the resource allocation meets the actual resource requirements at a given point in time. | ||||||
| 40 | 03d | Performance | Elasticity Component | Elasticity Speed | Describe how the cloud service is able to react to a resource request when (1) a resource re-allocation request is made and (2) workload changes take place | Include in all Standard DOI Policy | The elasticity speed quantity describes how fast a cloud service is able to react to a resource request when (1) the CSC makes a resource re-allocation request (in the case of manual elasticity), or (2) workload changes take place (in the case of automatic elasticity). | ||||||
| 41 | 03e | Performance | Cloud Service Response Time | Cloud Service Response Time Mean Time To Recovery | MTTR: Band 1 Time to Restore is set for 15 minutes elapsed recovery being the average time required to complete a recovery from failure. Mean time to restore is dependent on the size of individual restore requests the calculated “Average” from the aggregate of all restore requests over the timeline of ninety (90) days | Pick one MTTR Band | Statistical mean over a set of cloud service response time observations. | ||||||
| 42 | 03e | Performance | Cloud Service Response Time | Cloud Service Response Time Mean Time To Recovery | MTTR: Band 2 Time to Restore is set for 4 hours elapsed recovery being the average time required to complete a recovery from failure. Mean time to restore is dependent on the size of individual restore requests the calculated “Average” from the aggregate of all restore requests over the timeline of ninety (90) days | Pick one MTTR Band | Statistical mean over a set of cloud service response time observations. | ||||||
| 43 | 03e | Performance | Cloud Service Response Time | Cloud Service Response Time Mean Time To Recovery | MTTR: Band 3 (Default) Time to Restore is set for 8 hours elapsed recovery being the average time required to complete a recovery from failure. Mean time to restore is dependent on the size of individual restore requests the calculated “Average” from the aggregate of all restore requests over the timeline of ninety (90) days | Pick one MTTR Band, Default | Statistical mean over a set of cloud service response time observations. | ||||||
| 44 | 03e | Performance | Cloud Service Response Time | Cloud Service Response Time Mean Time To Recovery | MTTR: Band 4 Time to Restore is set for 24 hours elapsed recovery being the average time required to complete a recovery from failure. Mean time to restore is dependent on the size of individual restore requests the calculated “Average” from the aggregate of all restore requests over the timeline of ninety (90) days | Pick one MTTR Band | Statistical mean over a set of cloud service response time observations. | ||||||
| 45 | 03e | Performance | Cloud Service Response Time | Cloud Service Response Time Mean Time To Recovery | MTTR: Band 5 Time to Restore is set for 48 hours elapsed recovery being the average time required to complete a recovery from failure. Mean time to restore is dependent on the size of individual restore requests the calculated “Average” from the aggregate of all restore requests over the timeline of ninety (90) days | Pick one MTTR Band | Statistical mean over a set of cloud service response time observations. | ||||||
| 46 | 04a | Service Reliability | Disaster Recovery | Cloud Service Maximum Response Time Observation | Guarantee that, following a triggering event, systems will be reverted to a prior state no older than RPO (48 hours) old and have capacity to roll back for two (2) months and systems will be made operational within RTO (24) hours, but with an 90-day elapsed average for recovery set at MTTR (8 hours) | Use this single metric if going with all defaults of RPO, RTO, MTTR | |||||||
| 47 | 04a | Service Reliability | Disaster Recovery | Recovery Time Objective (RTO) | RTO: Band 1 Recovery Time Objective – ability to recover files from 0 minutes to 5 minutes. Identifies downtime and how long it takes to restore the incident until normal operations area available to both administrators and users | Pick one RTO Band Record: | |||||||
| Band 1 - Extreme recovery time. Will increase cost significantly, auto recovery redundancy | Response time is the time between a stimulus to the cloud service and the response of the service to the stimulus. | ||||||||||||
| 48 | 04a | Service Reliability | Disaster Recovery | Recovery Time Objective (RTO) | RTO: Band 2 Recovery Time Objective – ability to recover files from 5 minutes to 4 hours. Identifies downtime and how long it takes to restore the incident until normal operations area available to both administrators and users | Pick one RTO Band Record: | |||||||
| Band 2 - Extreme recovery time. Will increase cost. | Response time is the time between a stimulus to the cloud service and the response of the service to the stimulus. | ||||||||||||
| 49 | 04a | Service Reliability | Disaster Recovery | Recovery Time Objective (RTO) | RTO: Band 3 Recovery Time Objective – ability to recover files from 4 hours to 24 hours. Identifies downtime and how long it takes to restore the incident until normal operations area available to both administrators and users | Pick one RTO Band Record: | |||||||
| Band 3 Default for High Value Assets- Note that recovery most likely will be faster or can be slower, but this is the "Mean" time default | Response time is the time between a stimulus to the cloud service and the response of the service to the stimulus. | ||||||||||||
| 50 | 04a | Service Reliability | Disaster Recovery | Recovery Time Objective (RTO) | RTO: Band 4 (Default) Recovery Time Objective – ability to recover files from 24 hours to 48 hours. Identifies downtime and how long it takes to restore the incident until normal operations area available to both administrators and users. | Pick one RTO Band Record: | |||||||
| Band 4 - Default for Low and Moderate production | Response time is the time between a stimulus to the cloud service and the response of the service to the stimulus. | ||||||||||||
| 51 | 04a | Service Reliability | Disaster Recovery | Recovery Time Objective (RTO) | RTO: Band 5 Recovery Time Objective – ability to recover files from 48 hours to 7 days. Identifies downtime and how long it takes to restore the incident until normal operations area available to both administrators and users | Pick one RTO Band Record: | |||||||
| Band 5 - good for glacier, offline, non essential storage/systems, test, and devops recovery rates may save cost | Response time is the time between a stimulus to the cloud service and the response of the service to the stimulus. | ||||||||||||
| 52 | 04b | Service Reliability | Service Resilience/Fault Tolerance | Recovery Point Objective (RPO) | RPO Band 1: Contractor shall manage the ability to recover files from 0 to 5 minutes and any specific day within a rolling seven (7) day period. RPO identifies how far to roll back in time and defines the maximum allowable amount of lost data measured from a failure occurrence to the last valid backup. 5 minutes requires backup.redundancy every 5 minutes | RPO Band 1 is extreme and requires full automated redundancy | The maximum time between a defined stimulus or input to the cloud service and a defined point in the response. | ||||||
| 53 | 04b | Service Reliability | Service Resilience/Fault Tolerance | Recovery Point Objective (RPO) | RPO Band 2: Contractor shall manage the ability to recover files from 5 minutes to 4 hours and any specific day within a a rolling seven (7) day period. RPO identifies how far to roll back in time and defines the maximum allowable amount of lost data measured from a failure occurrence to the last valid backup. 4 hours requires backup.redundancy every 4 hours | RPO Band 2 is extreme and requires full automated redundancy | The maximum time between a defined stimulus or input to the cloud service and a defined point in the response. | ||||||
| 54 | 04b | Service Reliability | Service Resilience/Fault Tolerance | Recovery Point Objective (RPO) | RPO Band 3 (Default): Contractor shall manage the ability to recover files from 4 hours to 24 hours and any specific day within a rolling two (2) month period. RPO identifies how far to roll back in time and defines the maximum allowable amount of lost data measured from a failure occurrence to the last valid backup. 24 hours requires backup/redundancy every 24 hours | RPO Band 3 is Default and in the normal range and most recoverys can meet this requirement | The maximum time between a defined stimulus or input to the cloud service and a defined point in the response. | ||||||
| 55 | 04b | Service Reliability | Service Resilience/Fault Tolerance | Recovery Point Objective (RPO) | RPO Band 4: Contractor shall manage the ability to recover files from 24 hours to 48 hours and any specific day within a rolling two (2) month period. RPO identifies how far to roll back in time and defines the maximum allowable amount of lost data measured from a failure occurrence to the last valid backup. 48 hours requires backup.disaster recovery every 48 hours | RPO Band 4 is considered normal and reasonable, just under default. | The maximum time between a defined stimulus or input to the cloud service and a defined point in the response. | ||||||
| 56 | 04b | Service Reliability | Service Resilience/Fault Tolerance | Recovery Point Objective (RPO) | RPO Band 5: Contractor shall manage the ability to recover files from 48 hours to 7 days. RPO identifies how far to roll back in time and defines the maximum allowable amount of lost data measured from a failure occurrence to the last valid backup. 7 days requires backup.redundancy every 7 days | RPO Band 5 is good for archive, test, and devops | The maximum time between a defined stimulus or input to the cloud service and a defined point in the response. | ||||||
| 57 | 04c | Service Reliability | Disaster Recovery | Cloud Service Provider Disaster Recovery Plan | Provide backup, recovery and disaster recovery procedures and processes of the cloud environment for the target applications and services. Identify default metrics in a Disaster Recovery Plan and recommended differences from task order/contract requests | Include in all orders where contractor is provisioning and/or managing disaster recovery | NIST SP 800-34 Contingency Planning Guide for Federal Information Systems | ||||||
| 58 | 04d | Service Reliability | Customer Data Backup and Restore | Backup Agent | Provide backup solution that is scalable into the petabyte range | Option, backup | NIST SP 800-34 Contingency Planning Guide for Federal Information Systems | ||||||
| 59 | 04d | Service Reliability | Customer Data Backup and Restore | Backup Agent | Provide host-based agentless backup solution capable of meeting 100TB in under 8 hours | Option, backup | NIST SP 800-34 Contingency Planning Guide for Federal Information Systems | ||||||
| 60 | 04d | Service Reliability | Customer Data Backup and Restore | Backup Encryption | Provide backup encryption that meets 256-bit AES encryption standards using a user-defined key that is not stored anywhere on servers | Option, backup | NIST SP 800-34 Contingency Planning Guide for Federal Information Systems | ||||||
| 61 | 04d | Service Reliability | Customer Data Backup and Restore | Backup Interval | Provide backup frequency including hourly, nightly, weekly based on automated schedule or on-demand | Option, backup | NIST SP 800-34 Contingency Planning Guide for Federal Information Systems | ||||||
| 62 | 04d | Service Reliability | Customer Data Backup and Restore | Backup Method | Provide backup routines that can be set through either online-management console or file interface scripts | Option, backup | NIST SP 800-34 Contingency Planning Guide for Federal Information Systems | ||||||
| 63 | 04e | Service Reliability | Customer Data Backup and Restore | Backup Restoration Test Reporting | Backup meets FIPS 140-3 (or latest) compliance and industry standards (e.g. HIPAA, PCI, Sarbanes-Oxley (SOX), CiscoIOS, Gramm-Leach-Bliley, and SEC / FINRA). Compliance shall be monitored through the Network Configuration Manager and include Change management, Login attempt log, Enable secret password, Idle timeout, Routine (syslog/events trigger) backup | All orders where backup's applicable | The Federal Information Security Management Act (FISMA) of 2002/amendment 2014) does not include a statutory provision allowing federal agencies to waive the provisions of mandatory FIPS | ||||||
| 64 | 04e | Service Reliability | Customer Data Backup and Restore | Backup Restoration Test Reporting | Backup must be able to test and verify without restoring to production | Backup Options | Best Cloud Practices | ||||||
| 65 | 04e | Service Reliability | Customer Data Backup and Restore | Backup Restoration Test Reporting | Backup must have ability to launch VM directly from de-duplicated compressed backup file located on backup repository | Backup Options | Best Cloud Practices | ||||||
| 66 | 04f | Service Reliability | Customer Data Backup and Restore | Backup Number of Generations | Backups should allow components such as new, integrated, partial, updated data only or full operating environment | All orders where backup's applicable | |||||||
| 67 | 04f | Service Reliability | Customer Data Backup and Restore | Backup States and Storage Location | Backup state including live readily available for automated recovery, data at rest, blob or cold archive storage and alternate locations | All orders where backup's applicable | |||||||
| 68 | 04f | Service Reliability | Customer Data Backup and Restore | Backup Types and Alternate Methods for Recovery | Backup method and tenancy including single or multi tenancy of public cloud-to-cloud (C2C), hybrid/private-to-cloud (P2C), mobile-to-cloud (M2C). Backup type including Full, Incremental, Differential, Mirror | Backup Options | Best Cloud Practices | ||||||
| 69 | 04f | Service Reliability | Customer Data Backup and Restore | Backup Verification | Backup key word searchability and file type retention including documents, photos, videos, and associated metadata | Backup Options | Best Cloud Practices | ||||||
| 70 | 04f | Service Reliability | Customer Data Backup and Restore | Retention Period for Backup Data | Backup Length of Time and State retained is no less than 20 days. Example 20 days readily available online and then optionally convert to long term storage for up to 3 years | Backup Options. Adjust number of days/retention as needed. Note the more full backups there are, the greater the storage so do the math or ask the contractor to propose sufficient, but cost effective options | Best Cloud Practices | ||||||
| 71 | 04g | Service Reliability | Change Management | Minimum Service Change Notification Period | Contractor to provide information on available live forums, listservs, distributions, or other venue for customers to participate and be aprised of upcoming environment updates, patches, scheduled downtime, and other change management aspects | IaaS, PaaS, SaaS for Contractor managed orders | |||||||
| 72 | 04g | Service Reliability | Change Management | Minimum Time Before Feature/Function Deprecation | Contractor to provide deprecation information such as lead time notification or functions and services in the process of being eliminated and (possibly) replaced by newer ones relative to the order | IaaS, PaaS, SaaS (optional) Once the new order is placed, how often and/or when is the next new major version and/or upgraded features arriving | |||||||
| 73 | 04g | Service Reliability | Change Management | Service Change Notification Method | Provide method and process to begin receiving all service change notifications | Include in all Standard DOI Policy | |||||||
| 74 | 05a | Data Management | Account Data | POAMs | Provider must remediate High vulnerabilities with 30-days, Moderate vulnerabilities within 90 days, and Low vulnerabilities within 180 days | Include in all. Standard DOI Policy | NIST SP 800-53 | ||||||
| 75 | 05a | Data Management | Assurance | Data Loss Prevention | Provide a Data Loss Prevention (DLP) capability to detect and prevent the potential loss, exposure, or confidentiality risks to DOI’s sensitive agency information, including information subject to the Privacy Act and Personally Identifiable Information (PII), resulting from intentional or unintentional disclosure to external entities. | Include in all Standard DOI Policy | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | ||||||
| 76 | 05a | Data Management | Cloud Service Customer Data | Customer Data | Contractor shall offer capabilities that meet applicable Federal Records Management Requirements, including (1) e-Discovery such as litigation holds and preservation orders of data/meta-data, (2) National Archives and Records Administration (NARA), and (3) Freedom of Information Act (FOIA) requirements | SaaS, include on all. DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | |||||||
| 77 | 05a | Data Management | Cloud Service Customer Data | Customer Data | Contractor shall provide a Security Control Implementation Summary (CIS) worksheet and Customer Responsibility Matrix (CRM) or equivalent identifying which security controls are covered (inherited) by the service provider and which are shared and responsible for customers | Include in all. This may be through requesting the FedRAMP security authorization package and accessing through max.gov | |||||||
| 78 | 05a | Data Management | Cloud Service Customer Data | Customer Data | Service provides ability to set specified auditable events related to the applications or services | SaaS | |||||||
| 79 | 05a | Data Management | Cloud Service Customer Data | Customer Data Usage | Environment must be managed at the appropriate Low, Moderate, or High FISMA Information Technology security level to accept risks before Authority to Operate (ATO) will be granted | SaaS | |||||||
| 80 | 05a | Data Management | Cloud Service Customer Data | Data Transfers | Contractor shall provide security for non-standard data transfers both in transit and at rest resulting from the migration of the applications or services to the cloud | SaaS | |||||||
| 81 | 05a | Data Management | Cloud Service Provider Data | Provider Data | Data cryptographic modules are consistently validated to FIPS 140-2 and 140-3 as applicable and aligned to the Cryptographic Module Validation Program (CMVP) requirements under NIST Special Publication 800-140 A-F and ISO/IEC 19790:2012 and ISO/IEC 24759:2017 | SaaS | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | ||||||
| 82 | 05a | Data Management | Data Location | Data Location | Provide infrastructure and data storage redundancy in at least two facilities located within the sole jurisdiction of the United States Federal Government (i.e., within the continental United States, Hawaii, Alaska, Puerto Rico, Guam, and the Virgin Islands) with adequate geographical separation of at least 250 miles with one serving as the primary site and the other as an alternate backup Disaster Recovery (DR) site capable of restoration and resumption of IT services and complete preservation and reconstitution of all DOI data/information within 24 hours of failure of the services normally provided by the primary site. | SaaS, optional (required if system is Major or HVA application) | |||||||
| 83 | 05a | Data Management | Data Location | Location Policy | cloud services must access, transmit, process, house, and store all sensitive agency information, including information subject to the Privacy Act and Personally Identifiable Information (PII), only within the sole jurisdiction of the United States Federal Government (i.e., within the Continental United States, Hawaii, Alaska, Puerto Rico, Guam, and the Virgin Islands) | IaaS, PaaS, SaaS | |||||||
| 84 | 05a | Data Management | Data Location | Location Specification Capability | Contractor to provide options and information as to whether the Government can specify default and alternate cloud service location(s) | IaaS, PaaS, SaaS | |||||||
| 85 | 05a | Data Management | Data Portability | NDSSEC | Contractor to ensure external DNS security (NDSSEC) provides origin authentication and integrity verification | SaaS, Optional as relative. Mostly for customized applications | |||||||
| 86 | 05a | Data Management | Derived Data | Derived Data | Cloud service systems shall operate at Digital Identity Level 2 or higher (NIST SP 800-63A). |
IAL1 - self-asserted and no requirement to link;
IAL2 - evidence of real-world existence of claimed identity and can be completed remotely;
| IAL3 - physical presence required for identity proofing | SaaS, All | |||||||
| 87 | 05a | Data Management | Derived Data | Derived Data Access | Cloud service systems shall fully support the latest user authentication methodologies; e.g. Agency Common Access Card (CAC), Personal Identity Verification (PIV), OIDC Open ID Connect protocol | SaaS, All | ||
| 88 | 05a | Data Management | Derived Data | Derived Data Usage | Provide customer data limits of preservation, removal, snapshots, deletion, sanitizing and other associated requirements of government customized application, configured hosting services, compute instances, and government data storage on the last day (and timeline beyond) task order period of performance. | SaaS, All | ||
| 89 | 05a | Data Management | Intellectual Property Rights (IPR) | Intellectual Property Rights | Contractor shall identify in their proposal any expected additional IP and licensing "buy-out" costs at end of life-cycle or Task Order termination. | SaaS with data, databases, datasets, especially customized. | ||
| 90 | 05a | Data Management | Intellectual Property Rights (IPR) | Intellectual Property Rights | The Contractor shall ensure the protection of government intellectual property (IP) and data ownership rights and those of any licensors. Contractor shall identify IP components owned and managed by them or the cloud service provider or by the Government. | SaaS with data, databases, datasets, especially customized. | ||
| 91 | 05a | Data Management | Law Enforcement Access | Law Enforcement Requests | Cloud Service Provider may be expected to cooperate with Law Enforcement Requests and coordinated through Contracting Officer | SaaS, Optional as relative | ||
| 92 | 05b | Data Management | PII Applicable Laws | Privacy Act, Principles for protection of PII | Adhere to and comply with applicable Laws, Executive Orders and Executive Branch Policy regarding privacy during design, build, testing, operations and maintenance of the information system and the security controls designed to safeguard agency information according to the categorization and NIST SP 800-53 | Include in all. Standard Privacy Law | Principles for the protection of PII are set out in ISO/IEC 29100 | |
| 93 | 05b | Data Management | PII Applicable Laws | Privacy Act, Principles for protection of PII | Privacy requirements are applicable when information is generated, accessed, stored, processed, or exchanged with Agency or on behalf of Agency by a service provider or subcontracted service provider, regardless of whether the information resides on a Agency information system or a service provider/subcontracted service provider’s information system. | Include in all. Standard Privacy Law | application for public cloud services is described in ISO/IEC 27018. | |
| 94 | 05b | Data Management | PII Applicable Laws | Privacy Act, Principles for protection of PII | To ensure sufficient protection of individuals Privacy (PII), Contractor shall comply with Section 208 of the E-Government Act of 2002 accessible at https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf | Include in orders with PII | ||
| 95 | 05b | Data Management | PII Protection | Privacy Act | Contractor shall not remove PII or Privacy Act material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. | Include in all. Standard Privacy Law | Privacy Act 1974 | |
| 96 | 05b | Data Management | PII Protection | TIC | Provide the ability to control (including restricting) government access to the cloud service from government specified networks, in accordance with the Office of Management and Budget (OMB) Memorandum M-19-26 (previously M-08-05), “Implementation of Trusted Internet Connections (TIC),” and the Department of Homeland Security’s “Trusted Internet Connections (TIC) Reference Architecture Document Version 2.0 (or 3.0 as available).” If not currently able to provide this ability, the Contractor shall provide the Government with a statement regarding its plans to have such capability, including timeframe. (OMB M-19-26 Update to the Trusted Internet Connections (TIC) Initiative) https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf | Include in all. Standard Federal Modernization Initiative and DOI Policy | C.4.1 Regulation Adherence, NIST Compliance. DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | |
| 97 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Applicability | 1. Sensitive Information: - any information that warrants a degree of protection and administrative control as defined in law, regulation, governmentwide policy, or judicial opinion. | Include in all orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 98 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Applicability | 2. Controlled Unclassified Information (CUI) - information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law regulation or governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. Legacy materials may retain For Official Use Only (FOUO), Sensitive But Unclassified (SBU), or other markings until the artifact is no longer considered “data at rest;” it is revised, reused, or goes in motion. | Include in all orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 99 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Applicability | 3. Personally Identifiable Information (PII) - a subset of information designated as CUI. Information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. | Include in all orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 100 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Applicability | 4. Sensitive PII - subset of PII designated as "Sensitive PII" that requires additional controls and safeguards. If lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. SPII is CUI and requires additional controls and safeguards to protect the privacy of individuals. Sensitivity of PII may depend on specific PII elements, groupings of PII, context or use of PII, or requirements under applicable federal laws, regulations, and policy such as the Privacy Act of 1974 and the CUI Rule. SPII includes but is not limited to full or truncated Social Security Number (SSN), driver's license or state identification number; financial account number; date of birth; citizenship; ethnic or religious affiliation; biometric identifiers such as fingerprint, voiceprint, or iris scan; medical information; criminal history; and system authentication information such as passwords, personal identification numbers or mother's maiden name. | Include in all orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 101 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Authorities | Contractor shall comply with applicable authorities to Federal CUI Systems: (1) EO 13556, Controlled Unclassified Information, November 4, 2010, (2) 32 CFR 2002 Controlled Unclassified Information (Implementing Directive), (3) The Federal CUI Registry, (4) Departmental standards. | Include in all orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | |
| 102 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Requirements | Contractor controlled computer systems housing CUI must follow the NIST SP 800-171 Rev. 2 (or current Rev); SP 800-171A; and SP 800-172 (or current Rev). | Include in all Contractor Managed and Controlled orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 103 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Requirements | Contractor must identify, and safeguard controlled information from unauthorized release into public domain, or to unauthorized persons, organizations, or subcontractors. | Include in all orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 104 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Requirements | Contractor must not release to anyone outside the Contractor’s organization any sensitive information unless the CO has given prior written approval. This includes, but is not limited to, news releases, marketing promotions, articles, interviews, reports, social media posts, and any other media releases. Requests for approval must identify the specific information to be released, the medium to be used, the purpose for the release, and a description of the need-to-know. The Contractor must submit its request to the CO at minimum ten business days before the proposed date for release. Subcontractors must submit requests for authorization to release through the prime Contractor to the CO. | Include in All | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 105 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Requirements | Contractor or subcontractor must not disclose or release the materials provided to the Contractor to any individuals of the Contractor's organization not directly engaged in providing services under the contract or that do not have a valid need-to-know. All technical data provided to the Contractor by the government must be protected from public or private disclosure in accordance with the markings printed on them. | Include in All | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 106 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Requirements | If the Contractor believes that CUI information has been compromised, they will follow the incident response procedures in the DOI Incident Response Policy and Plan. | Include in all orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 107 | 05c | Data Management | Controlled Unclassified Information Requirements | CUI Training | Individuals originating or working with sensitive information must complete CUI training to become an authorized holder. CUI must only be disseminated to authorized holders in the furtherance of a lawful government purpose. | Include in all orders with CUI | DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines. C.5.1 Security Objectives | |
| 108 | 05c | Data Management | Governance Component | CUI, PII | Information shall comply with Executive Order 13556 regarding Controlled Unclassified Information (CUI), PII and Sensitive PII subsets that require additional controls and safeguards. (See also NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.) | C.4.1 Regulation Adherence, include in all | NIST Compliance. DOI Policy 2022-08-15. Information Technology Baseline Compliance Contract Guidelines | |
| 109 | 05d | Data Management | Termination of Service Component | Data and Log Retention Period | Environment shall support custom retention and restore settings e.g. weekly, monthly, yearly each with maximum minutes/hours to restore timeframes | Include in all as applicable | Cloud best practices | |
| 110 | 05d | Data Management | Termination of Service Component | Decommissioning Initiated | Upon notification of service termination, vendor shall provide technical advisory services necessary to fully decomission the services and application. They shall provide guidance on storage media options, data sanitization or destruction is consistent with NIST Special Publication 800-88 | Include in all |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .