Q_A_10_14_2022_0004.pdf

Document (RFP, Attachment, etc.) Section (B, C, D, E, etc.) Clause/Paragraph Title Line Number(s) Comment/Recommendation/Question FINAL ANSWER/COMMENT

Cloud Hosting Solutions III_Industry Day_20220615.pdfSlide 18 Small business partnership goal of 45% 3

Can the Government please confirm that the small business partnership goal of 45% can be achieved through One or two Small Businesses with 3 or more qualifications such as SDB, WOSB, HubZone or does the Government recommend that the offeror achieve it through multiple small businessess(3 or more) that qualify ALL small business categories?

The correct overall small business goal is 44%. It's a cumulative total of 44% for overall small business meaning each category adds to the total.

We would like to see it spread across to achieve the goals of SDB=5%, WOSB=5%, SDVOSB=3%, HUBZone=3% but we are looking for a vendor's best effort to involve small businesses.

General N/A N/A N/A Will the contract have any small business or 8(a) set-aside percentage requirement included?

The correct overall small business goal is 44%. It's a cumulative total of 44% for overall small business meaning each category adds to the total.

We would like to see it spread across to achieve the goals of SDB=5%, WOSB=5%, SDVOSB=3%, HUBZone=3% but we are looking for a vendor's best effort to involve small businesses.

Draft RFQ E Subfactor E.2 – Small Business Subcontracting Plan (Other than Small Businesses Only)

4094 - 4101 Line 4097 states that the Total Small Business Subcontracting Plan goal for this solicitation in 43%, However, line 4617 states "The assigned USGS subcontracting goal for Fiscal Year 2021 is 43%. Plans shall reflect a small business subcontracting requirement of at least 20% of the total contract value." Can the Government clarify the requirements for this contract is 20% or 43%?

The correct overall small business goal is 44%. It's a cumulative total of 44% for overall small business meaning each category adds to the total.

We would like to see it spread across to achieve the goals of SDB=5%, WOSB=5%, SDVOSB=3%, HUBZone=3% but we are looking for a vendor's best effort to involve small businesses.

Draft RFQ E Subfactor E.2 – Small Business Subcontracting Plan (Other than Small Businesses Only)

4094 - 4101 Line 4097 states that the Total Small Business Subcontracting Plan goal for this solicitation in 43%, However, line 4617 states "The assigned USGS subcontracting goal for Fiscal Year 2021 is 43%. Plans shall reflect a small business subcontracting requirement of at least 20% of the total contract value." Please confirm that the 43% is against the subcontracted value.

The correct overall small business goal is 44%. It's a cumulative total of 44% for overall small business meaning each category adds to the total.

We would like to see it spread across to achieve the goals of SDB=5%, WOSB=5%, SDVOSB=3%, HUBZone=3% but we are looking for a vendor's best effort to involve small businesses.

Draft RFQ E Subfactor E.2 – Small Business Subcontracting Plan (Other than Small Businesses Only)

4094 - 4101 Please confirm that the subcontracting goals based are on labor only.

No. The goals are based on direct costs and ODCs.

Draft RFQ E.2 Small Business Subcontracting Plan 4097

The RFQ says that the Total Small Business goal is 43%, whereas the Industry Day presentation (slide 18) said 45%. Please clarify the correct percentage.

The correct overall small business goal is 44%. It's a cumulative total of 44% for overall small business meaning each category adds to the total.

We would like to see it spread across to achieve the goals of SDB=5%, WOSB=5%, SDVOSB=3%, HUBZone=3% but we are looking for a vendor's best effort to involve small businesses.

Draft RFQ E.2 Small Business Subcontracting Plan 4618

Are cloud resale and ODCs excluded from the overall small business subcontracting calculation? No. The goals are based on direct costs and ODCs.

140G0122 R0010 - CHS III

Questions and Answers 10/14/2022

DRAFT_RFQ_140G0122R0010_Clauses Section L and Section M Subfactor E.2 Small Business Subcontracting Plan

4093 - 4100 4615 - 4616

In Section L of the DRFQ the Government states, "The following breakout reflects the minimum Subcontracting Goals and shall be used in the development of the Offeror’s Small Business Subcontracting Plan". Whereas in Section M the Government states, "The assigned USGS subcontracting goal for Fiscal Year 2021 is 43%. Plans shall reflect a small business subcontracting requirement of at least 20% of the total contract value. "

As this subfactor will be evaluated on a pass/fail basis, please clarify what the minimum small business subcontracting and socio-economic goals are for this solicitation.

The correct overall small business goal is 44%. It's a cumulative total of 44% for overall small business meaning each category adds to the total.

We would like to see it spread across to achieve the goals of SDB=5%, WOSB=5%, SDVOSB=3%, HUBZone=3% but we are looking for a vendor's best effort to involve small businesses.

It is simply a vendor's best effort to involve small businesses.

Draft RFQ Section L-Instructions, Conditions, Notices

Subfactor E.2 – Small Business Subcontracting Plan (Other than Small Businesses Only) 4097

QUESTION: The draft RFP states “Small business target total 43%.”

Does the 43% apply to labor + ODCs? Can the government clarify in the RFQ?

The correct overall small business goal is 44%. It's a cumulative total of 44% for overall small business meaning each category adds to the total.

We would like to see it spread across to achieve the goals of SDB=5%, WOSB=5%, SDVOSB=3%, HUBZone=3% but we are looking for a vendor's best effort to involve small businesses. The goals are based on direct costs and ODCs.

General N/A N/A N/A

As a small business prime contractor within the USGS cloud "umbrella" we would like to know if the solicitation will involve conflict of interest instructions? I assume there is no precluding of those currently supporting USGS cloud but I would like to validate first as an OCI issue.

The US Government does not perceive this as a conflict of interest. See clause GS1310 for OCI direction.

Draft RFQ General To confirm, is this a standalone IDIQ or does USGS intend to leverage an existing contract vehicle (e.g., GSA MAS)? This is a single vendor, standalone IDIQ.

Are you working specifically with a partner/prime/lead integrator on this project?

No. The U.S. government seeks to award a contract to a prime integrator that has knowledge and experience with multiple cloud platform environments.

General N/A N/A N/A

DOI has recently released two draft cloud RFP’s, FCHS II and CHS III. Other than the number of awardees, there are more similarities than there are differences. Can DOI please explain the rationale and different objectives for each of the potential solicitations so the integrator community can make an informed decision as to which vehicle best aligns with their business model?

The two contracts represent different business models. The DOI FCHS II contract will be available for use by DOI customers as well as by other external Federal customers. The CHS III contract will only be available for use by internal DOI customers. The DOI FCHS II contract will be a multiple award contract where DOI CHS III is single award and seeking multiple industry partners to provide a variety of cloud service offerings to include professional services. USGS has developed an Enterprise Architecture with it current Cloud (CHS II) contract offering. USGS seeks to expand upon that business model and EA environment for the CHS III award.

140G0122 R0010 - CHS III

General N/A N/A N/A Are there current incumbents and <how does CHS III relate to

FCHS?>

Even though the new Cloud Hosting Solutions (CHS) III contract will share the same name as the current CHS program, we (USGS) are considering this a brand-new contract (not a follow-on) for a few important reasons. First, the current CHS program is a task order under another interagency contract, whereas CHS III will be a new contract of its own. Second, CHS III represents a vastly expanded scope from a single bureau (USGS) to the whole agency (DOI). In expanding the scope of who can use this contract, we need to ensure not only that CHS will be able to provide the cloud services required across varying missions, but also that there is scalability in supporting CHS customers. The naming convention used (CHS II vs. CHS III) is mainly for USGS and DOI in referencing the cloud program in USGS and for branding than for contract delineation. For these reasons, this is considered a new contract solicitation (not a follow-on). Therefore, there is no incumbent.

The two contracts represent different business models. The DOI FCHS II contract will be available for use by DOI customers as well as by other external Federal customers. The CHS III contract will only be available for use by internal DOI customers. The DOI FCHS II contract will be a multiple award contract where DOI CHS III is single award and seeking multiple industry partners to provide a variety of cloud service offerings to include professional services. USGS has developed an Enterprise Architecture with its current Cloud (CHSII) contract offering. USGS seeks to expand upon that business model and EA environment for the CHSIII award.

Draft RFQ How will USGS CHSIII’s objectives and requirements overlap with FCHS2’s for DOI-wide program needs?

The two contracts represent different business models. The DOI FCHS II contract will be available for use by DOI customers as well as by other external Federal customers. The CHS III contract will only be available for use by internal DOI customers. The DOI FCHS II contract will be a multiple award contract where DOI CHS III is single award and seeking multiple industry partners to provide a variety of cloud service offerings to include professional services. USGS has developed an Enterprise Architecture with it current Cloud (CHSII) contract offering. USGS seeks to expand upon that business model and EA environment for the CHSIII award.

DRAFT_RFQ_140G0122R0010_Clauses 4.0 SCOPE 4.0, 2 379 For what services does the USGS / DOI anticipate using the USGS CHS3 contract versus the FCHS2 contract? The two contracts represent different business models. The DOI FCHS II contract will be available for use by DOI customers as well as by other external Federal customers. The CHS III contract will only be available for use by internal DOI customers. The DOI FCHS II contract will be a multiple award contract where DOI CHS III is single award and seeking multiple industry partners to provide a variety of cloud service offerings to include professional services. USGS has developed an Enterprise Architecture with it current Cloud (CHSII) contract offering. USGS seeks to expand upon that business model and EA environment for the CHSIII award.

140G0122 R0010 - CHS III

General N/A N/A N/A Will slides [from Industry Day] be made available later?

The slides have been posted to the Reading Room along with the recording of the Industry Day session.

General N/A N/A N/A Will a list of attendees [from Industry Day] be made available?

A list of attendees, other than those who have opted out, has been posted to the Reading Room.

General N/A N/A N/A

Would the Government provide a list of software applications (SAAS) you mentioned that they would like to be FEDRamp Authorized?

Current services and software applications (under CHS II) are listed in the slides presented on Industry Day. Any future software applications and potential FEDRamp requirements will be detailed in future task orders.

DRAFT_RFQ_140G0122R0010_Clauses

4.0 Scope

4.0, 2

Is there a 'current state' DOI "Service Catalog" listing detailed requirements and offerings and, if so, could the government provide it?

Current services and software applications (under CHS II) are listed in the slides presented on Industry Day. Any future software applications will be detailed in future task orders.

Draft RFQ 6.0 Statement of Objectives

(SOO)

514 In reference to "Provide a method to transition and/or migrate legacy applications to enterprise cloud solutions", Can the Government please provide the technologies/tools leveraged by these legacy applications?

Current services and software applications (under CHS II) are listed in the slides presented on Industry Day. Any future software applications will be detailed in future task orders.

Att D Section A-4.1 Requirements and Capabilities

Page #4 In reference to requirement "procure ‘third party’ services from vendors that provide services that are designed to enhance or complement the CSP environment associated with the award" Can Government provide list of current third party services and whether or not they are SaaS, PaaS services?

Current services and software applications (under CHS II) are listed in the slides presented on Industry Day. Any future software applications will be detailed in future task orders.

General N/A N/A N/A Will Multi-cloud environment be an option? Yes General N/A N/A N/A Will this be a single award? Yes

General N/A N/A N/A Is CHS III AWS only? Any Azure?

CHS II was AWS only, but CHS III may be a multi-cloud environment. The U.S. Government has requirements that could be optimized across multiple platforms/environments. The U.S. Government requests contractors to describe their experience and knowledge working in a multi cloud platform environment and how USGS can best utilize their experience and knowledge for requirements for USGS and other DOI Bureaus.

General N/A N/A N/A Can you put the reading room link in this chat [for Industry Day]?

https://www.usgs.gov/associate-chief-information-officer/usgs-cloud-hosting-solutions-reading-room

General N/A N/A N/A

Incumbency/Follow-on: Will transition efforts in the first Task Order be from the previous CHS contract, the Foundation Cloud Hosting contracts or both?

Transition efforts in the first task order will be only from the previous CHSII contract.

General N/A N/A N/A Interested in being a subcontractor for information management services, is this possible?

The list of vendors who registered for Industry Day (with the exception of those who opted out) is posted to the Reading Room for the purpose of sharing contact information for potential partnership opportunities among vendors.

140G0122 R0010 - CHS III

General N/A N/A N/A Please discuss any Small Business components to this Full & Open solicitation

This is a full and open competition. A Subcontracting Plan will be required for all other than small business offers. SubFactor E.2 Small Business Subcontracting Plan reflects the DOI Subcontracting Goals, in which Other than Small Businesses are to put forth their best effort in meeting those goals.

General Will there be security requirements for personnel working on this contract?

All scope of work under CHS III is sensitive, unclassified in nature.

Personnel working on this contract are required to pass a security investigation to obtain a PIV card for physical and network access.

Draft RFQ Appendix A. Service Level of Agreement 2. Performance Measures 1295

QUESTION: Are there any clearance requirements for build or support staff?

All scope of work under CHS III is sensitive, unclassified in nature.

Personnel working on this contract are required to pass a security investigation to obtain a PIV card for physical and network access.

General Will contractors be required to use existing DevOps tools at DOI?

If so, which tools are currently being used?

Contractors will be required to use approved tools at DOI. Currently, USGS uses Git-based repositories with CI/CD pipelines along with tools provided by the CSPs. Given the length of this contract, approved technologies may change over time.

General

Will the ability to provide, implement, and maintain technologies from a variety of different vendors with cloud related products be an important criteria for award?

This is a single integrator award that can leverage multi-cloud platform solutions to fit U.S. Government requirements. Given the length of this contract, approved technologies may change over time.

General

Considering the DOI’s intent to make a single award, is it anticipated that all CPSs will work directly with the single awarded integrator in support of CHS III objectives? Yes

DRAFT RFQ Clauses General Question

Will the DOI be supporting cloud access through bring your own device (BYOD)?

To maintain the federal security posture, bring your own device (BYOD) will not be allowed. USGS will provide appropriate government furnished equipment (GFE) for access.

DRAFT RFQ Clauses General Question

Will the DOI be looking to retrofit current applications using Microservices and containers? Yes, for applications that can be refactored or modernized to support these technologies.

DRAFT RFQ Clauses General Question

Is the DOI only looking for data-based solutions, or will they include voice and video services?

At this time, we have a separate EIS Voice and Telecom connectivity, as well as MSTeams contracts via DOI that are mandatory use, so this will be minimal for CHS III.

DRAFT RFQ Clauses General Question

Will the DOI be releasing detailed data center designs to the winning organization to assist in consolidation and optimized connectivity?

Yes, per future task orders following Day One completion, detailed data center designs may be shared as needed as the Data Center Consolidation plans dictate.

DRAFT RFQ Clauses General Question

Does the DOI currently use SDWAN infrastructure to support connectivity within its bureaus, offices, and data centers? No.

DRAFT RFQ Clauses General Question

Will the DOI be looking to support elastic services to scale and provide flexibility during peak usage periods? If so, will the billing be capped to meet predictive expenditures?

U. S. government will be looking to support elastic services that scale and provide flexibility during peak usage periods. Billing will need to be monitored and align to cost phasing in the task orders that meet predictive expenditures.

140G0122 R0010 - CHS III

DRAFT RFQ Clauses General Question

Will the DOI be looking to support RPA, AI, and Machine Learning initiatives? If so, does the DOI have a data scientist team or Center of Excellence?

U. S. government will want to continue development of RPA, AI, and Machine Learning initiatives. USGS has pockets of knowledge in these above areas of technology.

Draft RFQ N/A General N/A How many Internet Points of Presence are expected to be monitored? Five

Draft RFQ Section L-Instructions, Conditions, Notices

Sub Factor A-2 Information Technology Security and Access Controls 3618

QUESTION: How many source/end point devices (type/number) are currently being monitored/managed? This information will be added to the Sample Transition Task Order.

Draft RFQ N/A General N/A What are the support requirements needed by DOI (e.g. 24/7, Mon-Friday 9-6, etc.)

U. S. government standard support requirements are Monday through Friday, core business hours. Any additional support requirements, such as 24/7 (365 days per year), with automated monitoring triggers will be defined by individual task orders.

Draft RFQ N/A General NA Can DOI’s Single Sign-on Solution be leveraged for shared tool/technologies? Yes, as appropriate.

General NA NA NA

The RFQ refers to "cloud broker", "CSP", "Cloud Hosting Solutions Contractor" and "Provider". Will USGS consider providing definitions so offerors can better understand which requirements apply to specific players participating in the SOO?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

DRAFT_RFQ_140G0122R0010_Clauses C GS0335 1104 - 1234 Who is "Provider" under these provisions? Please clarify it is the awardee. Yes, it is the awardee, single prime contractor.

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 2.0 Executive Summary 188 How is a "Cloud Support Services Provider" differing from a Cloud Services Provider?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 2.0 Executive Summary 191 How is a "Cloud Hosting Provider" different from a Cloud Services Provider?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 4.0 Scope 353 How is CSP different from "Cloud Support Services Provider" or Cloud Hosting Provider?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 6.0 State of Objectives 614 How is the Cloud Hosting Services Provider differnt from Cloud Hosting Provider described at line 191?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 6.0 State of Objectives 621 Who is the CHS provider?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 8.0 Approach Overview 972 Does "cloud providers" mean Cloud Service Providers?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C GSO35 Information Technology 1165 Is "Provider" meant to be Cloud Service Provider?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

140G0122 R0010 - CHS III

DRAFT_RFQ_140G0122R0010_Clauses C 4.0 Scope Various

Multiple provider designations are used - Contractor, CSP, Cloud Support Provider, Broker. CHS Provider, Prime Integrator, cloud hosting services provider, cloud service contractors, and cloud hosting solutions contractors - Please provide definitions with contract accountability or simplify designations?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

Draft RFQ 6.0 (pg. 12) Statement of Objectives 458 Will the Government please clarify the cloud support services provider, cloud hosting provider (CHP), cloud service provider (CSP), and single integrator roles and the relationships between them?

All references to "cloud broker," "Cloud Hosting Solutions Contractor," "provider," etc., are according to the NIST (https://csrc.nist.gov/glossary?index=C).

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 4.0 Scope 205 Can you define "carriers"?

In this context, carriers refers to CSPs and service providers. This will be updated in the final solicitation.

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 4.0 Scope 209 Can you define "DOI VDC"? Department of the Interior Virtual Data Center

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 4.0 Scope 230 Can you define "current"? "Current" means staying up to date.

General/Industry Day Comment N/A

For low bandwidth areas, does DOI have specific minimum bandwidth requirements they could share along with any specific challenges that may lead to optimal solutions to address connectivity issues across locations and to better access shared services within data centers and cloud?

Any specific bandwidth requirements will be detailed in future task orders.

General General N/A N/A

CHSIII states the USGS wants to "...obtain a single VPC cloud service...", as well as, "The DOI seeks a single integrator and one or more Cloud Support Services Providers (CSPs)...". Question:

Can DOI confirm if CHSIII would like bidders to include "multiple CSPs" which would enable a true multi-cloud approach and hence true choice for your customers?

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

General General N/A N/A

In general, industry has seen the benefits and are migrating towards a multicloud approach both within Public Sector and Commercial. In addition, with ever increasing protest concerns around awarding large Cloud contracts to single CSP's (i.e. DoD's JEDI), does DOI see substantial additional risk, as well as, potentially elongating the procurement process for CHS3 by potentially constraining the contract to one CSP?

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 6.0 SOO 458-460

The SOO states: "The DOI seeks a single integrator and one or more Cloud Support Services Providers (CSPs) to assist with DOI leadership of data center consolidation and overall reduction of the DOI-owned and -managed data center footprint through vendor-managed cloud services." Question: Is DOI interested in a multicloud approach for CHSIII to better facilitate choice for USGS and other DOI Bureaus?

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

140G0122 R0010 - CHS III

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 4.0 Scope 182-183

The SOO states: "The USGS and OCIO are working together on a department-wide procurement effort to obtain a single Virtual Private Center (VPC) cloud services that will support cloud and managed service requirements." Question: One of the challenges with previous iterations of CHS is that unique cloud offerings that are only available by other CSP's are not made available and users are constrained on choice to best further their mission. If a single VPC Cloud Service is selected for CHSIII, how will USGS provide unique cloud services to USGS and/or other Bureaus who require cloud offerings that are only available by another CSP and, thereby, facilitating the choice that users want?

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 4.0 Scope 303-312

Line 303-312 states: "The overall objective is to perform as an enterprise cloud services provider or broker, and to continuously improve such performance based on lessons learned by execution of cloud brokerage responsibilities....Integrate diverse cloud services to meet the diverse science mission needs;"

Question: In speaking with various users across DOI, one of the lessons learned is that by providing choice and access to best of breed, unique solutions, this will best support and advance the science and mission for these users. With CHSIII, DOI has the opportunity to learn from their users and incorporate a multi-cloud offering which will not prevent users from leveraging the best solution available for their unique needs. With the expansion of CHSIII to include other DOI Bureaus, this becomes increasingly critical. How will USGS ensure that USGS and other Bureaus will be able to acquire unique solutions across different CSPs?

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 4.0 Scope 329 Does CSP mean a single CSP or is it intended to be plural to represent multiple CSPs?

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

Draft RFQ Section C- Description/Specifications

4.0 Scope, 5.0 Program and

Project Management 183, 309

QUESTION: Line 183 states that this is a ... "procurement effort to obtain a single Virtual Private Center (VPC) cloud services that will support cloud and managed service requirements." Line 309 states that "the objectives include to optimize selection of the most appropriate cloud provider for a given business requirement."

Can the government please clarify? Does this mean that the single VPC would encompass multiple CSP providers and

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

140G0122 R0010 - CHS III

Draft RFQ Section C 6.0 Statement of Objectives 458, 485

QUESTION: Line 458 states that "The DOI seeks a single integrator and one or more Cloud Support Services Providers (CSPs) to assist with DOI leadership of data center consolidation and overall reduction of the DOI-owned and -managed data center footprint." Line 485 states that the government plans to "Transition to commercial cloud" which implies one CSP.

Can the government clarify what it means when it references "a commercial cloud", "single VPC" and "more than one CSP?"

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

Draft RFQ Section C-Description/Specs 4.0 Scope N/A

COMMENT/RECOMMENDATION: In our experience, multi-cloud solutions have become a continuing trend in both Government and commercial sectors, removing vendor lock-in to a single CSP, leading to reduced operational, cost, and security risks.

Additionally, multi-cloud architectures enable organizations to take advantage of individual strengths of each CSP, including unique services that best meet mission goals and requirements for workloads.

As a result, we recommend the Government include language and requirements that reinforces a multi-cloud solution.

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

DRAFT_RFQ_140G0122R0010_Clauses Section H NEW SERVICES 1775 Does the government wish to transition to a new cloud service provider or does the government wish to remain with the current cloud service provider?

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach.

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 6.0 SOO 762

In addition to the "pay as you go" model, has USGS considered other innovative cloud models such as fixed price models which can substantially decrease risk and cost? Will USGS consider enabling bidders to respond with innovative pricing models as options for CHS3?

U.S. Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III. U.S. Government is open to a multi-cloud approach. Single prime integrator is responsible for the team make up and that team's pricing proposal.

General General N/A N/A

It has been stated that AWS is the current CSP. Who is the current CHS system integrator or integrators supporting the AWS contract? Sierra7, Inc.

General General N/A N/A Can USGS provide ROM totals for cloud services spend on the current iteration of CHS?

CHS II has a $49M ceiling. Please note that the scope of the CHS II is for USGS only. CHS III will be scoped for use by all of DOI.

General General N/A N/A Does USGS and/or DOI have an existing multicloud billing solution to track cloud costs?

Prime integrator has the responsibility to manage all subcontractor costs.

RFP What is the current cost management and reporting capability used/leveraged? (charge-back model, AWS Control Tower, AWS cost Reporting, AWS Billing, Third party tools etc.) USGS currently uses CloudCheckr and other internal processes.

140G0122 R0010 - CHS III

Draft RFQ - Clauses 7.1

Data Center Consolidation & Hosting (Current Environment) 855

This paragraph indicates extensive time has been spent developing a bill processing system that uses a monitoring dashboard tool. Please clarify if the Government expects to keep this billing processing system and monitoring dashboard tool or if alternatives are to be proposed. If the existing systems are to be used, provide information on these systems including a description of integration interfaces. The U.S. Government is interested in commercial-provided offerings.

Draft RFQ 140G0122R0010 Section C

7.1 Data Center

Consolidation and Hosting (Current Environment)

This paragraph describes the extensive work done by DOI and CHS program to develop a bill processing system and monitoring dash-board tool that contractors should consider as part of their approach. Please identify this bill processing and monitoring dashboard toolset so that offerors can plan for integration/work with this toolset (ie as outlined in Section 8.5 Administrative approach) The U.S. Government is interested in commercial-provided offerings.

Draft RFQ 140G0122R0010 Section C 8.5 Administrative Approach 996-999 and 1007-1017

These requirements outline the monitoring, reporting planning tool required by CHS3. Please clarify what tool CHS is currently using for its cloud environment. Also, as DOI seeks to transition to cloud but understands that some workloads may remain on premises, please clarify whether DOI CHS3 desires a tool that can provide this administrative capability across both on premises infrastructure AND the cloud service infrastructure.

The CHS II program is not currently using a tool/dashboard. This is a new requirement for CHS III as the scope is expanding for all of DOI, and the U.S. Government is interested in commercial options. For the near-term/foreseeable future, our focus will be on the cloud service infrastructure. However, in the long-term, this may be expanded to include both on premises infrastructure and the cloud service infrastructure.

RFP Can the Government provide additional information about the Mainframe if there are Mainframe HW/SW based applications? U. S. Government mainframe applications would be described in future statement of objectives, not included as part of the RFP acquisition package.

DRAFT_RFQ_140G0122R0010_Clauses B NA 3-21

What will the CLIN Structure be for this procurement, i.e., will USGS seek pricing for (a) CSP IaaS and PaaS services on a pass-through basis (like a resale distribution), or (b) managed services provided by the winning offeror, which may incorporate CSP cloud services?

Specific requirements and pricing shall be set forth under individual task orders.

DRAFT_RFQ_140G0122R0010_Clauses B NA 3-21

What tenant(s) will be provisioned in CSP cloud services? Will usage of the cloud services be limited to DOI or made available by DOI as a hosted service to other agencies or entities?

The tenant(s) will be determined by the program requirements. U.S.

Government seeks a single integrator vendor to manage one or more CSPs in support of CHS III, and is open to a multi-cloud approach. All work will be owned and managed within the DOI and bureaus.

Draft RFQ - Clauses C 4.0 Scope 191 What level of FedRAMP is required: Low, Medium, High or a combination of them?

We are currently FedRAMP Moderate, but considering the length and scope of the CHS III contract, there may be a future need for FedRAMP High requirements.

C

Will USGS accept a CSPs FedRAMP High Authorization + any ATO issued by USGS for a CSP’s cloud services as fulfilling the RFQ’s security requirements (reference RFQ GS0335 Paragraphs 12 – 17)

We are currently FedRAMP Moderate, but considering the length and scope of the CHS III contract, there may be a future need for FedRAMP High requirements.

Att D Section A-4.1 A-4.1 Day One Task Order:

CHS II Transition

Current CHS Environment

For CHS2 workloads running in AWS, what is the current AWS VDC FedRAMP classification - Low, Moderate, High?

We are currently FedRAMP Moderate, but considering the length and scope of the CHS III contract, there may be a future need for FedRAMP High requirements.

140G0122 R0010 - CHS III

Draft RFQ - Clauses C 4.0 Scope 224

Design, enginer, Install, and integration of hardware and software are required skills. At the task order level, please specify which hardware and software costs are borne by the contractor as opposed to being Government provided. Also, specify if there are specific software or hardware products that are to be used.

The requirements should be specified at the task order level, including software or hardware products.

Draft RFQ - Clauses C 4.0 Scope 268

Scope includes personnel that will complement staff on the DOI CHS team. At the task order level, it is recommended that roles and responsibilities be clearly articulated to differentiate prime contractor responsibilites as opposed to DOI CHS team responsibilities.

The requirements should be specified at the task order level, including contractor responsibilities, deliverables, and due dates.

Draft RFQ - Clauses C 4.0 Scope 285

Please specify whether hyperscaler commercial clouds are sufficient or if Government instances from the hyperscalers are required.

The commercial hyperscaler solutions must have FedRAMP accreditation.

Draft RFQ - Clauses C 4.0 Scope 285 Please specify if the prime contractor will be a reseller of cloud services or if this is a Government responsibility.

The prime contractor (or partner subcontractor) will be a reseller of cloud services.

Draft RFQ - Clauses C 4.0 Scope 324 Please clarify the "no charge" support services being referred to.

If there are support services that are typically delivered at "no charge" from the CSP, the Government expects that the prime contractor will not add a pass-through fee.

DRAFT_RFQ_140G0122R0010_Clauses.pdfSection C 9.0 Assumptions and Constraints 1044 What does "be consistent" mean? Does this imply that a planned year-over-year price increase meets this requirement?

Specific requirements and pricing shall be set forth under individual task orders. The pricing shall reflect the highest negotiated rate the U.S.

Government will pay for the services. If prices decrease, as rates may fluctuate over time, the U.S. Government expects the prime vendor to lower the rate.

DRAFT_RFQ_140G0122R0010_Clauses.p df, Page 9

Section 4.0 Scope 321 "Provide access to all support services directly from the CSP that are typically offered in their normal commercial practice at no charge to the DOI;"

Can you please identify the desired CSPs that DOI desires to connect to?

CSPs will vary depending upon services and requirements that are desired by Bureaus.

Draft RFQ - Clauses C 4.0 Scope 324 At a task order level, please clarify the minimum CSP support levels required.

The requirements should be specified at the task order level, including minimum CSP support levels.

DRAFT_RFQ_140G0122R0010_Clauses C 6.2 613-619

Please confirm that a CSPs obligations to DOI shall be as set forth in the CSP's commercial cloud services terms, FedRAMP Authorization, and DOI ATO?

A CSP's security obligations to DOI will be set forth in the CSP's commercial cloud services terms, FedRAMP authorization, and DOI ATO.

DRAFT_RFQ_140G0122R0010_Clauses C GS0335 1139-1148

Please confirm and revise to clarify that a CSPs obligations to DOI shall be as set forth in the CSP's commercial cloud services terms, FedRAMP Authorization, and DOI ATO, and CSP shall not be required to assure blanket compliance with "all" other unidentified, unnamed standards.

A CSP's obligation is to address changes to Federal laws covering data protection and privacy by using the mutually agreed on Change Management Process. All Federal laws will be identified and named in applicable standards. There will be no unidentified or unnamed standards.

140G0122 R0010 - CHS III

DRAFT_RFQ_140G0122R0010_Clauses C 8.3 945 - 950

Please confirm and revise to clarify that a CSPs obligations to DOI shall be as set forth in the CSP's commercial cloud services terms, FedRAMP Authorization, and DOI ATO, and CSP shall not be required to assure "full compliance and accountability" for "all" other unidentified, unnamed standards. Likewise, CSPs cannot be held to "security control procedures must be equivalent to the procedures used to DOI systems", however CSPs will work with DOI to obtain a satisfactory ATO for the CSP's FedRAMP-authorized cloud services.

A CSP's obligation is to address changes to Federal laws covering data protection and privacy by using the mutually agreed on Change Management Process. All Federal laws will be identified and named in applicable standards. There will be no unidentified or unnamed standards.

DRAFT_RFQ_140G0122R0010_Clauses C GS0335 1164-1174

Please advise (1) will DOI provide an independent ATO? (2) Will CSP's FedRAMP authorization qualify CSP for a DOI ATO? (3) Will any agency ATO happen at the IDIQ-level, or per Task Order?

Yes, DOI will provide an independent ATO. A CSP's FedRAMP authorization will support the granting of a DOI ATO. The ATO will happen at the IDIQ-level.

DRAFT_RFQ_140G0122R0010_Clauses C GS0335 1200 - 1210

Each CSP will have its own FedRAMP-audited incident reporting procedures. Please confirm DOI will accept the CSP's FedRAMP-audited procedure in satisfaction of this paragraph.

If the CSP's FedRAMP-audited incident reporting procedures are based on Federal guidelines and NIST, then yes it will be accepted. If not, DOI will need to review and approve.

DRAFT_RFQ_140G0122R0010_Clauses C GS0335 1217 - 1223

CSPs will scan in accordance with their cloud hosting and delivery policies, which have been audited as a prerequisite to FedRAMP-authorization.

If the CSP's FedRAMP-authorization scanning procedures are based on Federal guidelines and NIST, then yes it will be accepted. If not, DOI will need to review and approve.

DRAFT_RFQ_140G0122R0010_Clauses C GS0335 1224 - 1231

This is overly broad. CSPs are not responsible for "all" non-government-owned" systems. CSPs will provide security controls for that CSP's cloud services; those controls will have been audited as a prerequisite to FedRAMP-authorization.

U. S. Government expects the single prime integrator and their contracting team are responsible for all systems within their VDC including all non government owned and provided assets.

DRAFT RFQ Clauses 6.2 615 Can you provide the FedRamp impact levels that are required within this scope?

We are currently FedRAMP Moderate, but considering the length and scope of the CHS III contract, there may be a future need for FedRAMP High requirements.

6.0 SOO // 6.2 Provide Cloud Hosting

Services

615, and 928-930 (subsection 8.3 Security

Approach) Is the Government looking for FedRAMP Gov Cloud or FedRAMP accredited Public Cloud?

We are currently FedRAMP Moderate public cloud, but considering the length and scope of the CHS III contract, there may be a future need for FedRAMP High requirements.

6.0 SOO 491

Does the Government have one or many continuous monitoring tools and teams? Additionally, is the Government expecting to consolidate continuous diagnostic, performance, and security monitoring into a single centralized model provided by the CSP?

We have many continuous monitoring tools and teams. The U.S.

Government expects the CSPs to support federally managed continuous diagnostic, performance, and security monitoring by providing requested services.

15. Vulnerability Analysis 1217, 3596 (Section L)

Does the Government have one or many vulnerability assessment tools and teams? Additionally, is the Government expecting to consolidate this function into a single centralized model provided by the CSP?

We have many vulnerability assessment tools and teams. The U.S.

Government expects the CSPs to support federally managed vulnerability assessments by providing requested services.

6.0 SOO // 8.3 Security Approach 945 - 949

Will the Government provide an estimate of the number of system boundaries requiring compliance and authorization?

Yes, there is currently one ATO in USGS for CHS II. Further information will be provided to the awardee.

7. Security Categorization 1149 Will the Government provide the list of FIPS 199 Moderate categorized in-scope information systems and data types?

Yes, there is currently one ATO in USGS for CHS II. Further information will be provided to the awardee.

DRAFT_RFQ_140G0122R0010_Clauses C 13. Quality Control 1211-1213

Please provide details on what procedure or attestation will be accepted for contractual validation that software and hardware are free from malicious code?

Please refer to:

https://nvlpubs.nist.gov/nistpubs/ir/2021/NIST.IR.8397.pdf

140G0122 R0010 - CHS III

DRAFT_RFQ_140G0122R0010_Clauses 4.0 Scope "Assist the DOI in creating solutions that allow…and other security monitoring requirements."

402-404 Please provide specifics on which "other security monitoring requirements" apply to this requirement?

"Other security monitoring requirements" can be the result of new and enacted Federal law governing cybersecurity. The CSP will work with DOI to establish a timeframe for implementation. The specific requirements should be specified at the task order level.

DRAFT_RFQ_140G0122R0010_Clauses 6.0 SOO Platform IT Security Plan 587 Is this Security Plan deliverable to be based on NIST 800-series special publications listed in Section C.10 - Security Assessment and Authorization of the DRFQ and FedRAMP, or are there other standards and/or DOI-specific guidance?

Yes, it is based on the NIST 800-series special publications. Other DOI-specific guidance is based on NIST.

DRAFT_RFQ_140G0122R0010_Clauses 6.0 SOO "Provide secure connectivity infrastructure.."

708-709 Can the Government provide specific references (e.g., NIST SP 800-53 Rev 5, 800-114) for applicable U.S. Government information security and privacy regulatory requirements?

Our requirements are based on the NIST 800-series special publications.

Other DOI-specific guidance is based on NIST.

DRAFT_RFQ_140G0122R0010_Clauses 6.0 SOO "Provide access logs for all transactions.."

718 What is the DOI data retention policy for access logs?

60 days

DRAFT_RFQ_140G0122R0010_Clauses 6.0 SOO "Support encryption for…" 719 With regards to industry standard algorithms, is the Government referring to FIPS 140-2 requirements? Yes

DRAFT_RFQ_140G0122R0010_Clauses 6.0 SOO "Support multi-factor authentication…"

723 Does the Government require PIV card based authentication be supported? Yes

DRAFT_RFQ_140G0122R0010_Clauses 6.0 SOO "Demonstrate familiarity…" 770 Site can not be reached as a result of copying the specified URL (https://support.chs.usgs.gov/display/CHSKB/Security). Can the DOI Network and IT security regulations document be uploaded to the USGS reading room? DOI Information Assurance program information can be found at https://www.doi.gov/ocio/customers/information-assurance.

Draft RFQ Section C- Description/Specifications 6.3 Partnering Objectives 708

QUESTION: "Provide secure connectivity infrastructure that conforms to U.S. Government information security and privacy regulatory requirements."

What are the specific privacy regulatory requirements referenced here?

The Privacy Act of 1974, as amended (5 U.S.C. 552a); E-Government Act of 2002, 44 U.S.C. 3501; OMB Circular A-130, Managing Information as a Strategic Resource; OMB Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act; Office of Personnel Management Memorandum, Guidance on Protecting Federal Employee Social Security Numbers and Combating Identity Theft (June 18, 2007); OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (January 3, 2017)

DRAFT_RFQ_140G0122R0010_Clauses 8.3 Security Approach "Prove a draft security plan.."

934 When is the Contractor required to submit a draft security plan to DOI management?

Within 90 days after contract award date.

Draft RFQ Section C- Description/Specifications 6.0 Statement of Objectives 539

QUESTION: Is Zero Trust a requirement or recommendation and will it need to comply with the NIST (SP) 800-207 Zero Trust Architecture standard?

It is a requirement that does need to comply with the NIST (SP) 800-207 Zero Trust Architecture standard.

Draft RFQ Section C- Description/Specifications 8.3 Security Approach 926

QUESTION: If Personally Identifiable Information (PII) and Patient Medical Information (PMI) data resides in the DOI environment, is there a PCI, MARS-E 2.x or IRS 1075 requirement?

Once data is defined using the FIPS-199 process, it will be determined what Federal regulations will need to be applied.

140G0122 R0010 - CHS III

DRAFT_RFQ_140G0122R0010_Clauses.p df, Page 17

Section 6.3 Partnering Objectives 712 USGS states: "In addition to meeting the objectives described herein, the U.S. Government expects the contractor to: 16.

Provide interconnection solutions that meet the latest Government Trusted Internet Connection (TIC) requirements. The reseller may propose optional services that allow the government to utilize a “TIC in the Cloud” in which the vendor provides MTIPS capabilities as part of the cloud option."

From a TIC 3.0 perspective, is DOI looking for a Policy Enforcement Point (PEP) to be built at the cloud or a Cloud based inspection service like Secure Access Service Edge (SASE) to front end the services? Or, is DOI looking for Traditional TIC/MTIPS (TIC

3.0 use case) to inspect and have an ability to route to cloud services via dedicated connection? Reverse Proxy setup? Type of inspection (i.e. FWS, IDPS, AV, DLP)? For the traffic that requires TIC protection, where are the source and destination services and applications located (Internal/External/Both)?

The U.S. Government expects the single prime integrator to provide advisory services for technologies like TIC 3.0 and other evolving architecture. Technical design and architectures will be determined once the contract is awarded.

DRAFT_RFQ_140G0122R0010_Clauses Appendix A 5 1337 - 1356

Please revise to clarify that audits of CSP services, including related hardware and facilities, shall be in accordance with the CSPs commercial cloud services terms and policies. CSPs generally cannot provide "full and free" access to the systems, hardware infrastructure, facilities and installations underpinning the commercial cloud services, however, CSPs do afford reasonable limited access.