140D0425Q0092_1.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

CODE 16. ADMINISTERED BYCODE

X

X

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORD14

REQUEST FOR

PROPOSAL

(RFP)

INVITATION

FOR BID (IFB)

10. THIS ACQUISITION ISCODE

REQUEST FOR

QUOTE (RFQ)

14. METHOD OF SOLICITATION

13b. RATING

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS):

SMALL BUSINESS

02/27/2025 1400 ES

02/13/2025

Tamara Meheux (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

140D0425Q0092

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 76 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

Herndon VA 20170 Suite 2000A 381 Elden Street Acquisition Services Directorate

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS

BLOCK IS MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS THIS CONTRACT IS A RATED

ORDER UNDER THE DEFENSE

PRIORITIES AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

8(A)

Interior Business Center, AQD

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

The Department of the Interior (DOI) Interior Business Center (IBC) Acquisition Services Directorate (AQD) is issuing this sole-source requirement on behalf of Office of Acquisition and Property Management, Interior Museum Program (IPM) for the purpose of entering into a sole-source follow-on contract for the continuation of comprehensive Operations and Maintenance (O&M) support services for the Museum Collection Management System (MCMS) application, FedRAMP approved cloud hosting and maintenance, (Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Government Use Only)

OFFER

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT: REFERENCE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 11/2021) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

and professional services to complete data migration and configuration. Submit any questions

NLT 2:00 pm ET on February 20, 2025. Quotes must be received on or before 2:00 pm ET on February

27, 2025.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

76 2 of

140D0425Q0092 Museum Collection Management System (MCMS)

SECTION 1 -INTRODUCTION

This requirement is being issued by the Department of the Interior (DOI) Interior Business Center (IBC) Acquisition Services Directorate (AQD) on behalf of the Department of Interior, Office of Acquisition and Property Management, Interior Museum Program (IPM), Museum Collection Management System (MCMS). The purpose of this contract is to provide comprehensive Operations and Maintenance (O&M) support services for the MCMS application, FedRAMP approved cloud hosting and maintenance, and professional services to complete data migration and configuration. AQD plans to enter into a sole-source Contract with Gallery Systems under FAR 6.302-1 -- Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements. See 41 U.S.C. 3304(a)(1).

1.2 Award Type

The anticipated award type is a Firm Fixed Price contract as a result of this RFQ, with the exception of any travel (if applicable).

1.3 PERIOD OF PERFORMANCE

The anticipated period of performance is for one 12-month base period with four twelve-month option periods.

Base: April 1, 2025, to March 31, 2026 OP1: April 1, 2026 to March 31, 2027 OP2: April 1, 2027, to March 31, 2028 OP3: April 1, 2028, to March 31, 2029 OP4: April 1, 2029 to March 31, 2030

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK]

SECTION 2 – DESCRIPTION / SPECIFICATIONS / STATEMENT OF WORK

1. Purpose

This Statement of Work (SOW) describes the goals the Interior Museum Program expects to achieve. The primary goal of this acquisition is to continue providing cloud hosting services, maintenance, and user support services for the current Gallery Systems Software as a Service (SaaS). The objective is to continue migrating data from the legacy system the Interior Collection Management System (ICMS) and other database systems into the MCMS to consolidate DOI’s Museum database.

2. Scope

This SOW addresses work associated with the following activities:

• Providing any necessary licenses, provisioning, and maintaining the cloud environment services to host the MCMS software, TMS Collections, and the MCMS database.

• FedRAMP Authorization must be maintained.

• Provide ongoing support and maintenance of the software.

• Provide live virtual training sessions for any new users.

• Execute data migration of data still stored in legacy system.

• Work with DOI to identify and provides estimates to implement additional functionality.

3. Place of Performance

Place of performance is vendor location.

4. Current Environment

DOI has deployed a cloud-based Gallery Systems SaaS called MCMS to replace the legacy system, ICMS. Current efforts are ongoing to continue the migration from ICMS and maintenance of Gallery Systems SaaS. DOI requires the Contractor to maintain and support the system and work with bureaus/offices to finish their data migration into the new database.

The proposed services will support desired outcomes, including:

● Successful and complete transition of museum data to the cloud.

● Maintain FedRAMP authorization and cloud hosting.

● Train new users in system operations.

● Software maintenance and support.

The proposed services include providing ongoing SaaS cloud services [cloud environment configuration, application support, continuous monitoring, user training,]. All cloud services provided will be required to meet contractor-offered, Government Approved Service Level Agreements (SLAs) as well as the performance criteria described below.

5. Objectives

The overall objective is to provide cloud hosting services, system support and maintenance, and professional services to maintain and fully implement MCMS. To achieve this, these cloud services must meet applicable business, technical, security, management, and administrative objectives. The outcome of cloud services should be aligned with the Departments’ enterprise service delivery model described below and support the agency’s ability to deliver future sustainable services.

Table 1: List of Milestones, Deliverables, and Submittals

Category Type Activity

Milestone Event Contract awarded

Milestone Event Kickoff

Submittal Document Project Management Plan

Submittal Document Integrated Master Schedule

Deliverable Product Completion of reports

Deliverable Product Completion of UI elements

Submittal Document Training plan

Deliverable Event Training classes completed

Submittal Document Migration plan

Deliverable Event Migration completed

Deliverable Product Technical support

Table 2: Performance Requirement Summary (PRS)

ID Reference Objective Standard Acceptable Quality Level

Inspection

Service Level Agreement (SLA)

All objectives in SLA meet standards

Confirmation by COR

Ease of use The system is easy to use with a modern interface

User surveys

Develop reports Approval by

COR

Develop UI elements

Approval by

COR

Training Training is conducted effectively and professionally

>70% of student reviews are positive

Short post-training surveys

Technical support Issues are addressed within 24 hours of receipt and resolved within 48 hours

<5% of issues exceed resolution timeframes

Review of support logs

User and system documentation

Up-to-date user and system documentation is provided

Any substantive updates to the documentation are completed within 1 month of being identified as necessary.

Review by

COR

Management Objectives

The Contractor shall meet the following management objectives:

1. Provision to allow maximum flexibility to innovatively manage program cost, schedule, performance, risks, warranties, contracts and subcontracts, vendors, and data required to deliver effective migration services.

2. Maintain clear government visibility into program cost, schedule, technical performance, and risk, including periodic reporting.

3. Provide meaningful reporting and analytics that provide the Program with up-to-date and comprehensive information regarding technical and management performance.

4. Produce a Project Management Plan (PMP) and Integrated Master Schedule that identifies key milestones and dependencies. The PMP shall also

4.1. Identify cost reduction strategies and constraints and inhibitors to cloud migration.

4.2. Provide a brief description on the management of any subcontractor relationships and contracts. Outline the roles and responsibilities per party involved in the service and where key responsibilities reside.

4.3. Identify all contractor employees who will need Government-Furnished Equipment (GFE) and/or DOI Active Directory accounts/PIV cards to perform tasks.

Business Objectives

The Contractor shall meet the following business objectives:

1. Migration Objectives:

1.1. Migrate remaining operational units from the legacy system to the MCMS cloud environment.

1.2. Work with DOI program staff to identify all units and all database backups (.baks) that need to be included.

1.3. Provide estimates in time and cost to migrate additional datasets from non-DOI data stores.

1.4. Existing data mapping documentation will provide a basis for the conversion of remaining databases.

1.5. Data landscape:

▪ Approximately 200 units.

▪ Approximately 750 SQL database backup files (.bak).

▪ Approximate size of data is 350GB.

▪ Units will also contain two zipped folders of multimedia files that link to records. The data to support the linkage is in the database files.

▪ There are 6 different database types:

• DBF: system database tables

• Imaging: rarely used; contains images when stored in database

• CR: Cultural resource disciplines database

• NH: Natural history disciplines database

• AR: Archives database; links to corresponding CR database records at the collection level

• IT: Item-level archives database; infrequently used

▪ Most data conform to a standard data dictionary and field structure.

▪ There are variations in the database types that utilize the same fields on the back-end (in SQL Server).

▪ There are customizations for specific bureaus and units.

1.6. There are additional non-DOI data stores of DOI data. The Contractor will work with DOI to identify and assess these data stores for migration, including providing time and cost estimates.

2. Cloud Hosting Objectives:

2.1. The MCMS cloud is hosted in Gallery Systems SaaS. Any changes to the current setup should minimize impact to end users.

2.2. The application is in the process of achieving their FedRAMP Authority to Operate.

This FedRAMP ATO is sponsored by DOI and must be maintained.

3. System configuration objectives:

3.1. Assist DOI in identifying and configuring the system to maximize useability and streamline workflows.

3.2. Deliver up to 12 different user interface elements (e.g., Data Views, Data Entry Views, List Views).

3.3. Write or update up to 12 reports to extract data from the system.

4. Software Operations and Maintenance

4.1. Provide operations and maintenance support to users

4.2. Technical support for cloud infrastructure and database operations

4.3. Develop and maintain technical system documentation and user resource documents needed to ensure users can locate necessary information on system operations and maintenance. This may include:

▪ User manuals

▪ White papers

▪ Standard operating procedures

▪ Database design documentation (e.g., Entity Relationship Diagram)

▪ Data dictionary

▪ Migration data map

5. Technical Objectives

The Contractor shall provide all technical and advisory services necessary to fully execute the SOW. The result should be a fully operational system with all DOI units fully migrated and all users trained in basic system navigation and use.

6. Security Objectives

The Contractor shall meet these security objectives as required for all DOI cloud-based contracts.

The following requirements are based upon The Federal Information Security Management Act (FISMA), which is the foundation of DOI cybersecurity policy. FISMA requires agencies to follow a series of processes to secure information systems created or used by the government.

The Office of Management and Budget (OMB) has issued memoranda on many security topics, in addition to the security standards created by the The National Institute of Standards and Technology (NIST). The Inspector General (IG) of an agency is also required by FISMA to assess the overall cybersecurity program on an annual basis.

https://digitalpolicy.us/laws/fisma/ https://digitalpolicy.us/laws/fisma/ https://digitalpolicy.us/info/policymaking-offices/#omb https://www.whitehouse.gov/omb/information-for-agencies/memoranda/ https://csrc.nist.gov/ https://digitalpolicy.us/info/policymaking-offices/#nist https://digitalpolicy.us/info/policymaking-offices/#nist

The following sections are based on ISO_IEC_19086 standards to include (1) accessibility, (2) availability, (3) performance, (4) service reliability, (5) data management, (6) information security, (7) service support, and (8) governance.

7. Assurances, Inspection, Penalties/Provisions

To baseline SLA commitments of cloud compute services, the government is requesting Contractor proposals include:

1. Assurance that vendor can meet the standard (default) levels as required in a monthly billing cycle; or propose alternative SLA standards, as applicable, and as appropriate for the cloud computing service and to achieve an agreed baseline between the government and Contractor; and

2. Identify the commercially reasonable inspection technique to measure SLA metric compliance, including self-test, no response, error message, % threshold, etc. as appropriate for that service; and

3. A penalty, provision, or remedy in the event of not meeting that service level, such as service credits.

8. Accessibility

Cloud Service Provider solutions shall support use by people who have disabilities that impede their ability to use Information and Communications Technology (ICT).

9. Section 508 of the Rehabilitation Act

The creation and maintenance of software applications and websites with content and links, shall comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C §794(d)) and Web Content Accessibility Guidelines (WCAG). IT solutions shall provide assistive technologies such as magnifiers, screen readers, braille readers and alternative input devices are available on client computing platforms to make the use of ICT, including cloud services, easier for people with disabilities.

10. Web Accessibility

When suppling, developing or modifying web and software ICT, the Contractor shall demonstrate Section 508 conformance by submitting the Voluntary Product Accessibility Template (VPAT) or provide Section 508 test results based on the versions of the DHS Trusted Tester Methodology currently approved for use, as defined at https://www.dhs.gov/compliance-test-processes.

The following standards and guidelines for Information and Communication Technology (ICT) services is available and shall be used to monitor compliance and provide cloud services to persons with disabilities including:

• W3C Web Content Accessibility Guidelines (WCAG) 2.0, Level A and AA Guidelines, also published as ISO/IEC 40500:2012,

• ISO/IEC TR 29138 (all parts) — Accessibility considerations for people with disabilities,

• ISO/IEC Guide 71 — Guide for addressing accessibility in standards,

• Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) in the United States of America

• Applicable ICT Accessibility Provisions from Information and Communication Technology (ICT) Standards and Guidelines (36 CFR Part 1194)

Training Media

Audio and visual media created for training and user support will meet DOI policy standards and guidelines. (See Department of the Interior Section 508 Policies)

11. Availability

Contractor The Contractor will use the agency’s approved identity and authentication protocols and services for authenticating users.

For internal users (those with agency issued credentials), the Contractor will propose an integration with the agency’s authoritative identity provider.

For external customers (those without agency issued credentials), the Contractor will propose an integration using the Federal Government’s login.gov identity and authentication provider (see:

Login.gov developer guide).

The Contractor shall describe in its proposal how the system’s registration, verification, and ongoing access validation processes will demonstrate the legitimacy of the authorized user’s https://www.dhs.gov/compliance-test-processes https://www.dhs.gov/compliance-test-processes https://www.doi.gov/ocio/policy-mgmt-support/information-and-records-management/section-508-policies https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdevelopers.login.gov%2F&data=05%7C01%7CAndrew_Havely%40ios.doi.gov%7C8264dd1038254a9caef508db61400149%7C0693b5ba4b184d7b9341f32f400a5494%7C0%7C0%7C638210699746802204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=V40e1x5VQlqnG82GZZfWimcqtkJYXwI4kJHjfFePz3g%3D&reserved=0%22%20%5Ct%20%22_blank identity, authentication method, and continued need to access account information without requiring agency Helpdesk Operator support or intervention.

Login.gov note: DOI has an established agreement with the General Services Administration (GSA) to provision Department-wide Login.gov. Vendors should expect the government to provide the Login.gov service and therefore, only include coordination support to configure, test, and implement Login.gov between the vendor’s cloud service and public.

Contractors authenticating into DOI’s instance of Gallery SaaS shall comply with Homeland Security Presidential Directive (HSPD-12) that require all federal entities and associated contractors have security background investigations equivalent to federal employees.

Background investigations will be performed by the Office of Personnel Management (OPM) for the standard – low risk level which requires a National Agency Check with written Inquiries (NACI) or equivalent investigation

Secure Software Development Framework (SSDF) - Supply Chain Security

On September 14, 2022, the Office of Management and Budget (OMB) issued the Memorandum for the Heads of Executive Departments and Agencies (M-22-18) requiring each federal agency to comply with the NIST Secure Software Development Framework when using third-party software on the agency’s information systems or otherwise affecting the agency’s information.

On June 9, 2023, OMB issued Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (M-23-16) which extended the timeline for collecting attestations and clarified the scope of M-22-18’s requirements.

If Gallery Systems SaaS secure software attestation is addressed and confirmed in the FedRAMP authorization package, DOI does not require a separate SSDF attestation form. If this isn’t the case, the Contractor shall coordinate with the DOI System/Program Official to comply with this requirement.

12. Systems Uptime - Downtime

Contractor shall ensure the cloud environment as it relates to this procurement shall be fully operational >= 99.90%, unless otherwise identified or negotiated.

Fully operational is the percentage of minutes/hours a month the resources shall be fully operational and available. Planned scheduled downtime and meet mean-time-to-recovery are counted as the system being fully operational.

https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf%22%20/t%20%22_blank https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf%22%20/t%20%22_blank https://csrc.nist.gov/pubs/sp/800/218/final%22%20/t%20%22_blank https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security-1.pdf%22%20/t%20%22_blank https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security-1.pdf%22%20/t%20%22_blank

Planned downtime shall be less than eight hours monthly and occur during non-peak timeframe or as alternate arrangements agreed upon by application system owner.

1. All software upgrades and patching shall be coordinated with the IT System customers.

2. The Contractor shall notify system administrators of routine patches and version control services at least 48 hours in advance.

13. Disaster Recovery Plan

Contractor shall provide backup, recovery and disaster recovery parameters in a Disaster Recovery Plan for the (1) Recovery Time Objective (RTO) and (2) Recovery Point Objective (RPO) and (3) Mean-Time-To-Recovery (MTTR). Combinations of compute services, storage, file systems, applications, programming interfaces, and data are defined as the minimum availability requirements.

The Contractor shall meet the minimum performance requirement or may propose one or more alternatives either a more robust service level for mission critical applications or less stringent service level to save on test/sandbox or similar services.

1. Recovery Time Objective (RTO) – ability to recover files within 48 hours of request and 24 hours for High Value Assets. Identifies how long it takes to restore. The maximum allowable downtime to restore the incident back to normal operations for both administrators and users.

2. Recovery Point Objective (RPO) – ability to recover files from a failure occurrence to the last valid backup, defaulting to the most recent. The RPO is set to guarantee that following a triggering event, systems will be reverted to a prior state no older than 24 hours old for any specific day within a rolling two (2) month period.

3. Mean Time To Recovery (MTTR) – the elapsed average time required to complete a recovery is set for eight (8) hours. Recovery time begins with time of failure and ends with system back to normal operations. Depending on the size of individual restore requests the calculated “Average” is from the aggregate of all restore requests over the timeline of 180 days.

14. Performance

Contractor shall provide on-demand services for the scale of basic resources that must be readily provisional. Contractors shall deliver their standards, defaults, suggestions and tiered options of provisional performance services including the speed the hosted system can respond to changes on demand and other measurable performance levels. Specified times shall be identified in proposals.

Resources shall be brought online and available for use within time. After a request has been made (either manually or automatically in response to configurable triggers), resources (e.g., storage, virtual machines) shall be available within time.

15. DOI Managed Hosting IaaS/PaaS Platforms

Administrators must be able to provision performance defaults through a cloud-based dashboard/portal. Authorized users shall be able to establish the resource scaling sequence most appropriate to their application when configuring automatic scaling. Contractor may propose alternative methods for meeting the automated, scalable objectives to streamline incremental provisioning for common, cost-effective configurations.

16. Adapt to Demand Fluctuations

Contractor shall ensure system infrastructure is able to accommodate on-demand fluctuations with minimal impact on system performance. Anticipated seasonality, minimum, peak, and average demand rates will be provided to facilitate resource planning.

Latency shall be managed, by the Contractor, to optimize IT System responsiveness to end users and ensure functionality of the hosted application. Contractor shall deploy Virtual Application Hosting as applicable to improve user experience.

17. Performance Metrics

Provision cloud services to permit visibility for monitoring and managing variations in performance metrics such as:

1. Provide clear access and visibility to ongoing performance and resources usage.

2. Provide role filtered self-management tools to support billing, monitoring, and reporting on service management function.

3. Provide visibility into usage metering using metrics and granularity appropriate to the type of service.

4. Provide a suite of reports, dashboards, and alarms to monitor and track operational and infrastructure performance (e.g., incidents, service usage, capacity, SLA adherence).

5. Provide automatic monitoring of resource utilization and other events such as failure of service, degraded service, etc. via service dashboard or other electronic mean.

6. Provide the ability to filter and view usage and invoicing by: Technical Service Line, bureau (and sub-bureau), program, IT System, IT System type, IT System Life-Cycle, Security Level, and other elements which may be identified by individual bureaus.

7. Provide access to all log files generated by the hosted application, associated middleware, operating system, and underlying virtual and physical infrastructure.

8. Provide online reporting metrics interface for all resource utilization including metrics such as: current utilization, historical average, and peak for a user defined window of time.

18. Continuous Monitoring

In accordance with FedRAMP and/or FISMA compliant requirements, Contractor shall deliver a Security Assessment Plan (SAP) and a Security Assessment Report (SAR) according to NIST Special Publication 800-53 (latest rev) on all applicable Cloud Services.

DOI requires all cloud service providers to perform continuous monitoring. Contractors shall provide and deliver a Continuous Monitoring Plan (CMP) consistent with NIST standards, including NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. The continuous monitoring program must address, at a minimum

1. the effectiveness of deployed security controls

2. changes to information systems and the environments in which the system operates

3. compliance to federal legislation, directives, policies, standards, and guidance with regard to information security and risk management.

Within the CMP, the Contractor shall develop and maintain a Plan of Action and Milestones (POA&M) report with all known IT security vulnerabilities and weaknesses and associated risk mitigation timelines for remediation. All corrective actions and related information shall be included in a monthly POA&M report and submitted according to SO/ISSO personnel according to FedRAMP or equivalent authorization requirements.

19. Contractor Awareness Training

Within a component of continuous monitoring, all users, including Contractor administrators who authenticate into cloud instances, must be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibility changes. This is in accordance with the Federal Title 5, Code of Federal Regulations, Part 930.301, Subpart C.

If no level is identified, Contractor shall be cleared at the standard low risk position.

1. Low Risk (Standard) position will require a National Agency Check with Written Inquiries (NACI) or equivalent investigation;

2. Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI) based on the CO’s determination; and,

3. High Risk position will require a Background Investigation (BI).

20. Service Reliability

Contractor shall deliver a Disaster Recovery Plan for each cloud provider that includes (at a minimum) customer data backup, restore, and retention services. Contractor shall identify whether the cloud service can provide automated on-demand ability for IT Systems to back up at current instance or as requested at alternate geographical location up to at least 250 miles away.

The Contractor may offer software and alternate backup process solutions within their proposals.

21. Backup Solutions

Administrators must be allowed to establish several backup solutions including:

1. Backup routines can be set through web-management console or file interface scripts.

2. Backup frequency including hourly, nightly, weekly based on automated schedule or on-demand

3. Backup components such as new, updated data only or full operating environment

4. Backup type including Full, Incremental, Differential, Mirror

5. Backup state including live readily available for automated recovery, data at rest, blob or cold archive storage

6. Backup key word searchability and filetype retention including documents, photos, videos, and associated metadata

7. Backup Length of Time and State that backup will be retained (how long to keep backups and the state they reside within that timeline); example 30 days readily available online and then convert to long term storage for up to 3 years

8. Backup method and tenancy including single or multi tenancy of public cloud-to-cloud (C2C), hybrid/private-to-cloud (P2C), mobile-to-cloud (M2C)

9. Backup encryption meets 256-bit AES encryption standards using a user-defined key that is not stored anywhere on servers

10. Backup meets FIPS 140-3 compliance and industry standards (e.g. HIPAA, PCI, Sarbanes-Oxley (SOX), CiscoIOS, Gramm-Leach-Bliley, and SEC / FINRA).

22. Retention

Contractor shall describe and ensure their default retention and restore settings.

For example:

1. Weekly retention, 15 minutes to restore

2. Monthly retention, 4 hours to restore

3. Yearly retention, 25 hours to restore

4. Ability to set a custom time period

23. Backup and Restore Service Levels

Contractor shall meet backup and restore service levels including the average time required to complete a restore request. Given that the size of a restore request will influence time required to restore it, these service levels are calculated as the average of all restore requests (both big and small) over a month. Unless otherwise noted, backup solutions must

1. Be an agentless architecture solution

2. Meet 100TB backup capacity in under 8 hours

3. Be scalable into the petabyte range of data

4. Must be able to test and verify without restoring to production

5. Ability to launch VM directly from de-duplicated compressed backup file located on backup repository

6. Provide end-to-end 256 AES Encryption

24. Data Management

Data security and availability requirement for Gallery Systems SaaS is based upon the IT Systems categorization as moderate.

The contractor shall summarize the Security Controls between the cloud service provider and government. This should be delivered within their proposal and/or FedRAMP Control Implementation Summary (CIS) worksheet and Customer Responsibility Matrix (CRM) spreadsheet.

25. Intellectual Property (IP)

The Contractor shall ensure the protection of government intellectual property (IP) and data ownership rights and those of any licensors.

1. Contractor shall identify Intellectual Property components owned and managed by them or the cloud service provider or by the Government.

2. Contractor shall identify in their proposal any expected additional Intellectual Property and licensing "buy-out" costs at end of life-cycle or Task Order termination.

26. Federal Information Processing Standard - FIPS 140-3

Contractor shall meet the following minimal Federal mandates of cloud security and boundary thresholds:

1. Cryptographic modules are consistently validated to FIPS 140-2 and 140-3 as applicable and aligned to the Cryptographic Module Validation Program (CMVP) requirements under NIST Special Publication 800-140 A-F and ISO/IEC 19790:2012 and ISO/IEC 24759:2017.

2. Systems fully support user authentication via Agency Common Access Card (CAC) or Personal Identity Verification (PIV) credentials as identified in OMB Memorandum M- 11-11;

3. Systems operate at Digital Identity Level 2 or higher;

4. Cloud Service Provider has ability to remediate High vulnerabilities with 30-days, Moderate vulnerabilities within 90 days, and Low vulnerabilities within 180 days;

5. Cloud Service Provider solutions can be provisioned to meet Federal Records Management Requirements, including ability to support record holds, National Archives and Records Administration (NARA) requirements, and Freedom of Information Act (FOIA) requirements;

6. Cloud Service Provider’s external DNS security (NDSSEC) provides origin authentication and integrity verification.

All Cloud Service Provider solutions shall meet FIPS 140-2 certification and provide the capability to encrypt all data, including backups. Environments shall employ appropriate levels of encryption including data in-transit between user endpoint and cloud services and at-rest sensitive data according to Federal Information Processing Standard Publication (FIPS) 140-2 a mandatory standard for the protection of sensitive or valuable data within Federal IT systems.

Additionally, FIPS 140-3 shall be used as an incremental advancement for compliant and validated cryptographic modules, algorithms, and conditional algorithm self-tests.

27. Continental United States (CONUS)

Contractor shall select cloud services that access, transmit, process, house, and store all sensitive agency information, including information subject to the Privacy Act and Personally Identifiable Information (PII), only within the sole jurisdiction of the United States Federal Government (i.e., within the continental United States, Hawaii, Alaska, Puerto Rico, Guam, and the Virgin Islands).

Contractor shall ensure all IaaS/PaaS cloud service providers have capacity to implement cloud service infrastructure and data storage redundancy in at least two facilities located within the sole jurisdiction of the United States Federal Government (i.e., within the continental United States, Hawaii, Alaska, Puerto Rico, Guam, and the Virgin Islands) with adequate geographical separation of at least 250 miles with one serving as the primary site and the other as an alternate backup Disaster Recovery (DR) site capable of restoration and resumption of IT services and complete preservation and reconstitution of all DOI data/information within 24 hours of failure of the services normally provided by the primary site.

28. Protection of PII - Privacy

The Contractor shall adhere to and comply with applicable Laws, Executive Orders and Executive Branch Policy regarding privacy during design, build, testing, operations and maintenance of the information system and the security controls designed to safeguard agency information. Privacy requirements are applicable when DOI information is generated, accessed, stored, processed, or exchanged with DOI or on behalf of DOI by a service provider or subcontracted service provider, regardless of whether the information resides on a DOI information system or a service provider/subcontracted service provider’s information system.

1. The service provider shall protect unauthorized disclosure and the confidentiality, integrity, and availability of Government electronic information and resources according to the categorization and NIST SP 800-53.

2. Contractor shall not remove PII or Privacy Act material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity.

3. When Privacy Act records, information, data, documentary material, and/or equipment is no longer required, it shall be returned to the Governments control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be securely mailed or electronically transmitted.

4. Contractor may be required to provide necessary support to assist the Government in meeting the requirements of the Privacy Act and related laws and shall cooperate to provide supporting documentation and access to information upon request by authorized agency officials. Support in this context includes:

• Requests for access or disclosure of records to individuals

• Subpoenas or other judicial process

• Discovery and litigation processes

• Accounting of disclosures of records to third parties when authorized

• Privacy impact assessments and related privacy artifacts

• System of records notices;

• Privacy complaints and incidents

• Audits or remedial activities related to oversight of PII and system of records

5. Contractor shall comply with applicable authorities to Federal CUI Systems: (1) EO 13556, Controlled Unclassified Information, November 4, 2010, (2) 32 CFR 2002 Controlled Unclassified Information (Implementing Directive), (3) The Federal CUI Registry, (4) Departmental standards.

29. Information Security

This section covers some of the most critical Contractor management requirements. The Contractor is expected to have an intricate knowledge of Federal Regulations identified below.

They shall facilitate the Assessment & Authorization process in order to achieve a full Authority to Operate (ATO).

30. Security Controls Administration

Assessing, monitoring, and documenting all aspects of security controls requires a cadre of experienced staffing resource. To recapture time and resources, the Department encourages Contractors and cloud service providers to adopt, standardize, and streamline security controls management. For example, using Open Security Controls Assessment Language (OSCAL) for compiling FedRAMP documentation. OSCAL is a framework (expressed in XML, JSON, YAML) to take FedRAMP documentation that is properly formatted with NIST OSCAL schemas and check the content for correctness.

https://www.fedramp.gov/templates/ https://pages.nist.gov/OSCAL/ https://pages.nist.gov/OSCAL/

FedRAMP's adoption of OSCAL allows providers to use this framework to perform logical validations, i.e. business rule checks, on documentation content. (See May 2022 FedRAMP Receives First OSCAL System Security Plan | FedRAMP.gov)

The Contractor services and associated solutions shall implement the following requirements:

1. Conduct annual penetration testing using a qualified and competent independent third-party assessor/evaluator subject to approval by the agency Authorizing Official.

2. For Infrastructure as a Service (moderate or higher) implementations provide storage redundancy in at least two facilities located at least 250 miles with one serving as the primary site and the other as an alternate backup Disaster Recovery (DR) site capable of restoration and resumption of services and complete preservation and reconstitution of all DOI data/information within 24 hours of failure of the services normally provided by the primary site.

3. Provide a Data Loss Prevention (DLP) capability to detect and prevent the potential loss, exposure, or confidentiality risks to DOI’s sensitive agency information, including information subject to the Privacy Act and Personally Identifiable Information (PII), resulting from intentional or unintentional disclosure to external entities.

4. Provide e-Discovery, a process in which electronic data is sought and located, capabilities that enable compliance with legal mandates and requests capabilities to support legal hold requests.

31. Security Plan

Contractor shall ensure and deliver Cloud Service Providers document and submit Security Plans (SP) identifying the risk impact rating for the IT Systems confidentiality, integrity, and availability according to the NIST Special Publication SP 800-37: Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach.

The objective is achieving all Cybersecurity & Infrastructure Security Agency (CISA) Binding Operational Directives (BOD) and applicable federal requirements for each environment. IT System contractors and government system owners and security officers will identify and assign security roles and coverage. Collectively they coordinate implementing the security controls and any required tailoring based upon the categorization level. To meet this objective, Contractors shall comply and meet thresholds set in the NIST SP 800-53 Risk Management Framework “Security and Privacy Controls for Federal Information Systems and Organizations.”

Supplemental guidelines include:

• NIST SP 800-39 Managing Information Security Risk: Organization, Mission, and Information System View and https://www.youtube.com/watch?v=WCPkt56vZ-s https://www.fedramp.gov/2022-05-19-first-oscal-system-security-plan/ https://www.fedramp.gov/2022-05-19-first-oscal-system-security-plan/ https://www.nist.gov/privacy-framework/nist-sp-800-37 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://csrc.nist.gov/publications/detail/sp/800-39/final

• NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems

• NIST SP 800-60 Mapping Types of Information and Information Systems to Security Categories

• NIST SP 800-34 Contingency Planning Guide for Federal Information Systems

Environments shall be configured for the ability to provide any application and operating system logs associated with an incident, as well as a file system timeline for potentially compromised hosts and any additional files referenced during forensic analysis. Allow for memory dumps and forensic images of any systems that were possibly compromised.

32. IdAAM

Seamlessly integrate with the Agency Identity, Authorization and Access Management (IdAAM) solution that consists of the Microsoft Active Directory (AD) and Public Key Infrastructure (PKI) architecture and associated Certificate Authority and DOI HSPD-12 PIV SmartCard-based credentials.

33. Government Configuration Baseline

Provide solutions that conform to the Federal Desktop Core Configuration (FDCC) and United States Government Configuration Baseline (USGCB) security configuration requirements; and that are compatible with end-user client computing devices, operating systems, and client software/interfaces (e.g., workstations, laptops, mobile/portable devices) that are configured in accordance with those specifications; and that do not alter, or require alteration of, those baseline standard security configurations

Incident Response

Upon any security or privacy breach, Cloud Service Provider(s) shall immediately (within 1 hour) report all incidents involving potential risks to the confidentiality, integrity, or availability of the IT System. Contractor shall submit an email to the following incumbents designated at time of task order initiation or when notified of personnel changes.

Contractor shall follow the Incident Response procedures for all privacy breaches and take immediate action (within 1 hour when identified) to contain and mitigate the impact of the breach and cooperate with Government officials to investigate the breach and determine remedial measures. Contractor shall document:

• Government programs and/or platforms

• Location of breach(es) https://csrc.nist.gov/publications/detail/sp/800-18/archive/1998-12-01 https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final

• Date and time breach was discovered

• Nature of event (loss, theft, unauthorized access)

• Description of summary of events

• Description of personally identifiable information PII) involved

• Number of potentially impacted individuals

• Estimated number of records, data sets, etc. exposed or compromised

This shall be reported regardless of day or time.

1. Department of the Interior - Computer Incident Response Center (DOI-CIRC) at doicirc@ios.doi.gov and 703-648-5655. For non-DOI agencies, submit to their equivalent Contracting Officer

2. Authorizing Official and/or System Owner

3. Information System Security Officer and/or Cloud Service Provider portal within max.gov

Note: Emails shall not contain Sensitive Information in the subject or body but instead encrypted within an attachment according to the NIST Federal Information Processing Standards (FIPS) 140-2 Security Requirements for Cryptographic Modules.

34. Prohibitions

Prohibitions describes various prohibitions within cloud services and contractors.

35. Adware: DOI requests contractors to refrain from and to actively prevent adware, spam, and remarketing of information. The Contractor shall not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the Agency. The Contractor and/or their agents shall not resell nor otherwise redistribute information gained from its access to contract users.

36. Non-Disclosure Agreements: Contractors shall require each of their administrative employees that interfaces with the cloud services customized applications and government data to sign non-disclosure agreements at onset of project implementation.

Non-disclosure agreements will be supplied by the Contracting Officer, or the Contractor may elect equivalent and approved alternative.

mailto:doicirc@ios.doi.gov

37. Government Banners: A government approved logon banner must be displayed on the first page of any public access web pages. Logon warning banners must be automatically incorporated into IT Systems initial logon process and require periodic credentialed acceptance for all (federal and contractor) personnel accessing the federal IT System.

38. Service Support

Contractor shall describe and deliver help desk and support services. These may include a variety of means in reaching their support teams including trouble ticketing system, Tier 0 support website, support email boxes, chat operators, on-demand videos, recurring group forums, etc.

Contractor shall describe their core (default) and optional (additional) support offerings. Type of support descriptions should include service 1) availability and 2) Time to Respond (acknowledge) requests and 3) Costs if not included.

Basic support ticketing, triage, and assignment will be accomplished through Bison Support System. Use of Government-Furnished Equipment and a DOI account will be necessary to access the support system, but issues can be addressed outside of the system.

39. Support Severity Levels

Contractor shall compare their support tiers and “mean-time-to” options based upon the Severity Levels below. Mean-time-to calculations should be based on a 180-day average of all restores and measured against the initial response time until satisfactory resolution or escalation occurs.

Table of Severity Levels

Severity 1: Emergency (Health and Safety) 15 minutes – 4 hours

Severity 2: Mission Priority (Bureau Director) 60 minutes – 8 hours

Severity 3: Routine 2 hours – 24 hours

40. Support Availability Times

Contractors shall provide their hours of availability the customer can expect to reach a live support or service person able to take down a request for service or log a trouble ticket, based upon available time zones in the Continental United States (CONUS).

41. Governance

Contractor shall provide support and services in compliance with the FedRAMP Authorization Act and alignment with Federal Risk Authorization Management Program (FedRAMP) standardized security assessment, authorization, and continuous monitoring practices.

42. National Institute of Standards Technology (NIST)

Contractor shall align and meet minimum NIST – Risk Management Framework security and privacy thresholds according to the Moderate IT System(s) categorization level.

Contractors shall be familiar and within compliance of applicable federal laws and orders. They shall identify barriers or incidences that do not meet NIST or other federal standards and thresholds, along with recommendations for closing elevated risk gaps.

Table of Applicable Laws and Executive Orders

Name and Link to Laws and Executive Orders Issuance Date

FedRAMP Authorization Act, FedRAMP Authorization Act January 2023

Privacy Act of 1974 (P.L. 93-579) December 1974

FOIA, Freedom of Information Act (FOIA), 5 U.S.C. § 552, As Amended By Public Law No. 104-231, 110 Stat. 3048, Electronic Freedom of Information Act

Amendments of

FISMA, Federal Information Security Modernization Act of 2014 (Public Law 113-283; December 18, 2014). Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., The original FISMA was Federal Information Security Management Act of 2002 (Public Law 107-347 (Title III);

December…