DRAFT

Attachment 2

DRAFT Statement of Work (SOW)

U.S. Department of Homeland Security (DHS)

Cumulus Program

Enterprise Cloud Service Provider (CSP) Requirements

Office of the Chief Information Officer (OCIO)

6595 Springfield Center Drive Springfield, VA 22150

1 INTRODUCTION

Cloud Computing is defined by NIST SP 800-45 as “services delivered through a shared pool of configurable computing resources, such as networks, servers, storage, applications, and services, which can be rapidly provisioned and released with minimal management effort or interaction with the provider.” Cloud Service Providers (CSPs) offer cloud computing services to consumers. DHS and DHS Components hereafter referred to as “DHS” share a vision for leveraging cloud computing across the department to transform mission operations by enabling rapid application development, enhancing functionality and security, and expanding its portfolio of commercial and government CSP cloud computing services. DHS requires an integrated, interoperable, and secure multi-cloud ecosystem that supports reliable, dynamic, and innovative IT services accessible anytime, anywhere, and under all conditions. This ecosystem will facilitate workflows across multiple security fabrics, maximize data reuse and sharing, and support diverse consumers, including disconnected or edge operations. DHS aims to incorporate advanced technologies such as artificial intelligence (AI), machine learning (ML), and high-performance computing while ensuring unified security processes for quick adoption and portability of applications, data, and code. This SOW supports an indefinite-delivery, indefinite-quantity (IDIQ) contract award, allowing subsequent task orders for enterprise government and commercial CSP Anything as a Service (XaaS) cloud services, professional services, and training to be established under it. XaaS refers to the vast number of products, tools, technologies delivered to users as a service over the internet such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). It also allows for the flexibility to include new and emerging service models such as Functions as a Service (FaaS), Database as a Service (DBaaS), or Container as a Service (CaaS). DHS’ cloud portfolio is expected to evolve into a multi-cloud ecosystem leveraging heterogeneous architectures to capitalize on CSPs' unique investments, while diversifying offerings to promote competition, integrating cybersecurity best practices, and extend cloud services to disconnected and low-bandwidth environments. This SOW specifically defines the scope and requirements for Department-wide CSP solutions, providing maximum flexibility for vendors to support DHS's mission success.

2 BACKGROUND

DHS has requirements for secure, scalable, flexible, automated, and cost-effective cloud computing capabilities to support its over 600 cloud hosted systems including major, mission-critical, safety-critical, and life-critical systems hosted by commercial and government CSPs. This aligns with the federal strategy outlined in OMB Memoranda M-22-09 and M-21-31, which advances a zero trust cybersecurity approach for improving the Nation’s Cybersecurity. DHS systems serve diverse public and private stakeholders, requiring CSPs to provide on-demand access to hosting services via web Graphical User Interfaces (GUIs) and Application Programming Interfaces (APIs) for programmatic provisioning and de-provisioning. DHS employs hardened images, formation templates, auto-scaling infrastructure, scalable databases and storage, containerization, and automated configuration control to enable rapid provisioning of system environments within minutes, ensuring robust support for IT and operational technology systems critical to national safety and security.

3 SCOPE

The scope of this SOW allows for task order awards to be established which enable DHS to dynamically consume cloud services from CSPs in both commercial and government with established records for innovation (i.e., Technical Agility) and operational excellence in cloud service delivery (i.e., Cloud Maturity) in a utility consumption based computing model, supporting financial tracking and forecasting. Acquiring services from CSPs, rather than developing those services in-house, has been shown to scale faster to meet DHS compute needs, to facilitate the adoption of innovation occurring in the commercial marketplace, satisfy the rigorous performance and security requirements of DHS while allowing DHS consumers to focus on mission delivery. This IDIQ award and subsequent task orders will focus on modernizing and innovating DHS systems and software through cloud-based solutions, emphasizing microservices, API-driven frameworks, mobile extensibility, container strategies, and standardized, portable environments.

This IDIQ award will provide access to XaaS services, through Amazon Web Services (AWS).

XaaS options must meet DHS requirements with CSP marketplace offerings included. This IDIQ award and resulting task orders will focus exclusively on true on-demand commercial and government CSP provided XaaS and marketplace cloud services and enterprise support, professional services support, and training for these services. The IDIQ award and resulting task orders will exclude non CSP, third party resellers, Managed Service Providers (MSPs), or contractor Lead System Integrator (LSI) specific services such as system development, architecture, implementation, interoperability, and migration services that leverage CSP services. Decisions on CSP utilization for new and legacy systems will be based on mission requirements, technical architecture and cost-effectiveness analyses conducted by the Government. Administrative support for access, service outages, and technical discussions related to CSP services is also within scope of this IDIQ award.

4 REFERENCE AND POLICY DOCUMENTS

The following documents and corresponding successors shall be incorporated into this IDIQ award and apply to all resulting task orders:

• DHS Acquisition Management Directive 102-01 Handbook

• DHS Policy Directive (PD) 4300A – Information Technology System Security Program, Sensitive Systems

• DHS Management Directive (MD) 4300, IT Systems Security Publication

• DHS 4300A Sensitive Systems Handbook

• DHS Technical Reference Model

• National Institute of Standards and Technology (NIST) Computer Security Resources

Center (CSRC) standards, guidelines, and special publications

• NIST SP 800-145 - The NIST Definition of Cloud Computing

5 TECHNICAL REQUIREMENTS

5.1 Ownership, Management, Reporting, and Support

This section describes ownership of accounts and metadata, centralized account management capabilities, and unrestricted access to detailed billing, usage, and spend data. It specifies integration of cloud reporting tools for cost tracking, configuration management, and security compliance, as well as direct technical support access. Additionally, it details program management support, including recurring working groups, subject matter expertise, and monthly contract status reports with performance metrics, billing data, and security compliance deliverables. Additional in-scope requirements may be established at the order level based on order level requirements.

5.1.1 Ownership

• The awarded CSP shall provide DHS and Components full ownership of all root accounts, linked accounts and payer / master organization accounts which contain DHS data and processing systems. DHS and Components shall provide root accounts, linked accounts, and payer / master organization accounts at their discretion upon receipt from the CSPs.

All meta data is the sole ownership of DHS and cannot be used for any purpose without expressed permission from DHS.

5.1.2 Organization

• The awarded CSP shall provide DHS unrestricted ability to link and group accounts in a logical structure specified by DHS for centralized management of billing, secure configuration, account policies and identity management within a single CSP.

5.1.3 Billing, Usage and Spend Data

• The awarded CSP shall provide DHS unrestricted access to raw CSP usage and spend data in management billing accounts (AWS master payer account, Azure billing account, GCP billing account, OCI billing page) via CSP Graphical User Interface (GUI) consoles and other XaaS cost tracking and optimizing tools via Application Programming Interface (API) to include regular access to and generation of Cost and Usage (CUR) Reports.

• The awarded CSP shall provide exports of CUR data in FinOps Open Cost and Usage Specification (FOCUS) version 1.X format.

• The awarded CSP shall provide references to CSP developed product lists that include current and new products as they are added to the product list. This product list shall include all commercial, government, region specific products, as applicable, offered by the CSP. Any pricing discounts offered on the awarded CSP’s products shall be provided to the Government.

• Further billing, usage, and spend data requirements may be established at the task order award level.

5.1.4 Cloud Reporting Tool Integration

• The awarded CSP shall ensure that cloud reporting tools are able to integrate with the

CSPs cloud native fabric to report cost, configuration management, and security compliance.

• The awarded CSP shall provide tools that allow DHS to view performance and recommended optimization configurations for resources that are deployed in their cloud environments. These optimization recommendations should allow consumers to evaluate configurations for performance and/or price and allow consumers to target the tool at specific resources to determine optimizations and efficiencies for targeted infrastructure.

5.1.5 Technical Support Requests

• The awarded CSP shall provide the ability for DHS to submit technical support requests to the CSP and interface directly with the CSP support team as applicable without restriction or approval by the CSP.

• The awarded CSP shall provide evaluation of system and environmental architectures and implementation designs to ensure scalability over time through architectural reviews with solutions architects and engineers leveraging the CSP Well-Architected frameworks.

• The awarded CSP shall provide proactive services delivered by CSP support experts to assist DHS in reviewing the health of cloud operations, optimize costs, and scale workloads efficiently through workload reviews, best practices workshops, and deep dives.

5.1.6 Program Management Office (PMO) Support

• The awarded CSP shall support overarching (IDIQ award level) program management support to DHS including a dedicated Program Manager (PM) and support staff. Program Management Support will involve overseeing administration of all contract activities during the entire period of performance. Responsibilities include, but are not limited to program reviews, CSP management team roles and interactions, scheduling, documentation, and account billing as outlined in the Program Management Plan (PMP).

• The awarded CSP shall conduct monthly Program Management Reviews (PMRs) with DHS. The PMR presentation materials shall be delivered to DHS and include, at a minimum, updates on action items, contract and financial metrics (e.g., consumption/expenditures by Component, service usage, billing data, budget limits), key schedule updates (including the Integrated Master Schedule), capacity ahead of demand and operational metrics, clearance status, security-relevant updates, and service offering strategic plans and roadmaps.

• The awarded CSP shall support recurring, tactical level, joint working groups at a frequency directed by DHS. These working groups shall address focus topics (e.g., facilities, security, service roadmaps, capacity, operational metrics, new product availability, preview product availability, etc.) as directed by DHS. The CSPs shall provide subject matter experts with decision authority, to participate in these working groups.

• The awarded CSP shall ensure that all personnel with access to DHS information systems complete all applicable mandatory training requirements.

• Further in-scope PM requirements as reviewed and validated by DHS Contracting Officer and Contracting Officer’s Representative may be established at the task order level based on task order level requirements.

5.1.7 Ordering Guide Instructions

• The awarded CSP shall provide ordering guide instructions for Department-wide use providing any specific information or process that Department users need to understand in successfully ordering CSP services in accordance with CSP published, commercial pricing.

• The awarded CSP shall provide account request, provisioning, access, usage and FAQ information for Department-wide use detailing any specific information or process including required steps, timelines, procedures and requirements for users in successfully ordering CSP services in accordance with CSP published, commercial pricing.

• The awarded CSP shall provide main Point of Contact (POC) information including the name, title, email, and telephone information of the awarded CSP contracting office.

Referenced CSP POC shall be able to timely respond to any/all questions regarding CSP published, commercial pricing as well as technical questions related to the CSP’s offerings.

5.1.8 Marketplace Ordering Procedures

In-scope requirements established at the task order level may include in-scope Commercial Off the Shelf (COTS) solutions available through the CSP published, commercial marketplace pricing. In satisfying such requirements, the ability to procure in-scope marketplace solutions reviewed and validated by DHS Contracting Officer and Contracting Officer’s Representative under this IDIQ award and resulting task orders will be available. The IDIQ Contracting Officer’s Representative (COR) will review all requested in-scope marketplace solutions and provide a recommendation of approval to the IDIQ Contracting Officer (CO). All requests to purchase a marketplace solution must receive an official approval from the IDIQ CO. All requested marketplace solutions must be within scope of the IDIQ, within the not-to-exceed (NTE) marketplace ceiling value, for performance of only those solutions secured under task orders awarded against the IDIQ contract and offered at a fair and reasonable price. In providing fair and reasonable prices for marketplace solutions at the task order level, the awarded CSP shall utilize its represented published, commercial pricing list fully available to DHS. The Contractor shall provide a detailed description of the fair and reasonable nature of the proposed marketplace solution and its unit price. This detailed description shall include for example, clear references to already determined fair and reasonable unit prices available on offerings such as the Federal Supply Schedule, or other published price list for the same marketplace solution.

The CSP proposed discounts as contained within the IDIQ award will be applied to the documented published unit price to determine task order level price for that specific marketplace solution.

If a published, commercial price (or price list) is not available, then the awarded CSP shall follow the following steps:

1. Confirm there is no published price (or price list) commercially available.

2. Obtain, validate, and submit a minimum of three (3) quotes for the requested marketplace solutions from vendors or resellers of the product to demonstrate that competitive pricing was received. In the event three (3) quotes are not available as many quotes as are available shall be provided along with a justification as to why (3) quotes were not received.

3. Provide the minimum XX% discount to those items or a justification as to why the minimum XX% discount cannot be applied. When a justification is submitted, any discount that is available shall be applied to the specific marketplace solution.

The awarded CSP is encouraged to offer additional discounts beyond the discount represented within the IDIQ award. The Ownership of all marketplace solutions included on awarded task orders, for performance of in-scope IDIQ award requirements, will be defined at the task order level based on task order level requirements.

The awarded CSP shall document within its monthly IDIQ level award reporting all the marketplace purchases made.

ALL marketplace solutions considered shall be in full accordance with those terms and conditions included within this IDIQ award.

NO marketplace purchases shall be made under this IDIQ award and its resulting task orders without following and in fully documenting those requirements represented within this section 5.1.8.

5.2 CSP Service Requirements

This section describes requirements for cloud service providers, including access to commercially available and FedRAMP-authorized cloud services, unrestricted resource provisioning, and integration capabilities for multi-cloud ecosystems. It specifies technical criteria for scalability, reliability, and availability, as well as offerings for XaaS, serverless computing, and integration platforms. These services are designed to support mission-critical workloads, enable rapid deployment, and ensure high performance, resilience, and compliance across DHS operations. Additional in-scope requirements validated by DHS Contracting Officer and Contracting Officer’s Representative may be established at the task order level based on task order level requirements.

5.2.1 Access and Availability

• The awarded CSP shall comply with National Institute of Standards and Technology

(NIST) Special Publication 800-145, which describes cloud computing as:

o A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

• The awarded CSP shall provide the full breadth of the CSP's offered cloud services in commercial and government cloud regions as Commercial Off The Shelf (COTS) technology including CSP specific marketplaces. All currently emerging and future CSP service offerings are within the scope of the full breadth of the CSP’s offered cloud services.

• The awarded CSP shall offer GSA FedRAMP Low, Moderate and High authorized cloud services in addition to commercially available, non FEDRAMP authorized cloud services that support the storage and processing of data within an environment with restricted user access.

• The awarded CSP shall provide DHS unrestricted access to CSP Graphical User Interface (GUI) consoles and Application Programming Interface (API) endpoints required to create, provision, configure, and terminate all resource instances within 5 minutes of request using automated Infrastructure as Code (IaC), direct API calls, or manual GUI console workflows.

• The awarded CSP shall provide the functionality to integrate cloud services offerings through user-facing, self-service interfaces and service endpoints to enable system interoperability in a multi-cloud ecosystem through the exchange of information and identities.

• The awarded CSP shall maintain a large market presence in providing public cloud IaaS service offerings defined as a CSP that has more than three (3) years of market presence and demonstrates a minimum of $250 million in annual IaaS service revenue over the 12-month period reflected in the CSP’s most recent financial statement or records, excluding all managed and professional services, and a minimum of 100,000 virtual machines (VMs) currently in production, operating simultaneously, within its public commercial cloud. Referenced market presence directly aligns with current Department-wide mission requirements.

5.2.2 Systems Requirements

• The awarded CSP shall provide real-time hardware resources to support the

Governments virtual infrastructure without any need to estimate or procure those hardware resources. The hardware resources underlying the virtual infrastructure shall become available in near real time at the launch of the virtual instance and the virtual instances shall be billed in increments no larger than one hour.

• The awarded CSP shall provide infrastructure, platform, and software as a service cloud services and the hardware to operate those resources without any interaction between the CSP and the DHS teams. For example, there shall be no ticketing system to a third party to configure any resources.

5.2.2.1 Scalability

• The awarded CSP shall be both horizontally and vertically scalable to four thousand virtual instances in less than 10 minutes, support hundreds of petabytes of storage, support a minimum of six terabytes of storage for databases, and be able to scale across two or more data centers as a selectable option in the API or web console.

• The awarded CSP shall provide a Point of Presence at a co-location facility where a connection of 10GB or greater can be connected to the DHS network without a partner connection.

5.2.2.2 Reliability

• The awarded CSP shall provide redundancy across multiple data centers, geographically dispersed from each other, to prevent natural and man-made disasters from impacting operational status. All services shall be scaled over multiple data centers and provide for real-time automatic failover without interruption to the service the systems are supporting, should a disaster occur. Launching resources in multiple data centers shall be a selectable option within the API and web console.

5.2.2.3 Availability

• The awarded CSP shall provide a minimum availability level of 99.9% for each of their services unless otherwise stated and agreed to by the Government for a particular service in accordance with their commercially advertised Service Level Agreements (SLAs). Resources launched in multiple datacenters shall continue to operate and be available when one of the data centers is offline for 100% uptime redundancy.

5.2.3 Infrastructure as a Service (IaaS)

NIST SP 800-145 defines IaaS as the capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

• The awarded CSP shall provide foundational compute, storage, and network resources needed to produce any form of capability in the cloud. The CSP shall provide a vast range of compute configurations to run mission workloads; object storage capabilities to house mission data; and network to enable resilient, highly performant, connectivity to build and serve the organizations mission capabilities.

5.2.4 Platform as a Service (PaaS)

NIST SP 800-145 defines PaaS as the capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.

• The awarded CSP shall provide platforms in the form of managed compute, storage, database and container orchestrator offerings. These services enable the organization to build a plethora of custom applications that meet a varying range of enterprise and mission objectives without requiring the direct configuration of IaaS.

5.2.5 Software as a Service (SaaS)

NIST SP 800-145 defines SaaS as the capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

• The awarded CSP shall offer and provide access to commercially available and FedRAMP approved SaaS products available through CSP SaaS product offerings, CSP specific marketplaces and third party SaaS interfaces. These SaaS products shall utilize a software distribution model where a CSP hosts the applications (products) and makes them available to their customers, relieving the customer of the responsibility of managing the associated application, platform, or infrastructure.

• The awarded CSP shall ensure CSP SaaS offerings and CSP specific marketplace offerings comply with the CSP billing model and be available through the CSP console.

• The awarded CSP shall ensure all SaaS licenses follow either a "Bring Your Own License (BYOL) model or integrated with the CSP billing system such that there is no separate billing.

5.2.6 Serverless

• The awarded CSP shall provide capabilities that enable the organization to rapidly deploy low-cost, highly scalable, application architectures with minimal setup and administration requirements. These capabilities shall include, but not be limited to functions, API gateways serverless databases and integration platforms.

• The awarded CSPs shall provide platforms and services used to build resilient, highly distributed, and decoupled applications. The integration platforms shall include but are not limited to messaging, notification, queueing, and low / no code.

5.2.7 CSP Specific Marketplace Services

• The awarded CSP shall offer CSP marketplace approved services that meet or exceed

FedRAMP High, Moderate, and Low accreditation and cybersecurity protection requirements, as defined in NIST SP 800-53, Rev. 5, for sensitive government applications and systems.

• The awarded CSP shall provide DHS the unrestricted ability to procure and utilize in-scope marketplace products and services available directly supporting and complimenting existing service utilization and optimization available through CSP specific marketplaces.

• The awarded CSP shall provide DHS the unrestricted ability to procure and utilize in-scope CSP specific marketplace products and services including but not limited to Bring Your Own License (BYOL), SaaS and third party license agreements through centralized DHS procurement workflows with terms and conditions negotiated, executed, and enforceable solely between the Government and marketplace service providers governed by user based permissions and roles. The Government will ensure that prior to any marketplace purchase that it is thoroughly reviewed by the DHS Cumulus Program (Cumulus) governance team described in the Cumulus Ordering Guide to ensure compliance with all applicable IDIQ terms and conditions.

• The awarded CSP shall provide DHS capability to access, leverage and utilize in-scope, publicly available CSP marketplace capabilities such as operating system base images that vendors provide through CSP marketplaces.

• The awarded CSP shall provide DHS capability to publish capabilities to private CSP marketplace offerings for sharing of resources.

5.2.8 Bring Your Own License

• The awarded CSP shall provide DHS the capability to utilize COTS licenses procured from a variety of third party sources in all CSP services that natively support leveraging a third party license known as Bring Your Own License (BYOL). BYOL capabilities allow DHS users to reduce the costs of consumption based CSP services that leverage COTS licensed tools that the CSPs are required to pay directly to COTS vendors for their usage. BYOL promotes license portability and supportability across CSPs and service offerings to the greatest extent practicable.

5.3 CSP PaaS & SaaS Service Performance Requirements

This section describes technical requirements for CSP XaaS services to ensure robust security, operational efficiency, and compliance across DHS cloud environments to support DHS operations. These XaaS services do not comprise the finite amount of services the CSP shall provide to DHS. Additional requirements may be established at the task order level based on task order level requirements.

5.3.1 Relational Database Services (RDS)

• The awarded CSP shall provide a highly available relational database service for large scalable databases without DHS having to manage the servers or DBMS. This service must be geographically redundant over more than 500 miles. The database creation, modification, deletion and management on this service must be available via API’s and scale on demand to 20000 IOPS and 6 TB.

5.3.2 NoSQL Database Service (NSDS)

• The awarded CSP shall provide a fast and flexible NoSQL database service for applications that need consistent, single-digit millisecond latency at any scale. It shall be a fully managed cloud database that supports both document and key-value store models. It shall provide a flexible data model, reliable performance, and automatic scaling of throughput capacity, providing response times from milliseconds to microseconds up to millions of requests per second.

5.3.3 Artificial Intelligence Platforms

• The awarded CSP shall provide Artificial Intelligence (AI) platforms to support machine learning and artificial intelligence algorithm development and testing. These algorithms will allow DHS to parse data, find patterns, and learn from that data to make determinations/predictions.

5.3.4 Big Data

• The awarded CSP shall provide services necessary for processing and analyzing vast amounts of data amassing multiple petabytes of information. The CSP shall provide services that enable the organization to store, query, and derive insight from its data are critical to executing mission.

5.3.5 Data Warehouse Service (DWS)

• The awarded CSP shall provide a fully managed, gigabyte to petabyte-scale data warehouse service in the cloud, which allows for 100GB of data to scale to a petabyte or more. This service shall allow the user to run Business Intelligence (BI) tools against the data source to use the data to acquire new insights for the business. Complex query datasets shall be returned within minutes using SQL based tools to analyze the data.

5.3.6 Network

• The awarded CSP shall provide DHS complete control over the entire virtual networking environment, including selection of its own IP address range, creation of subnets, and configuration of route tables and network gateways.

• The awarded CSP shall support a minimum of 1000 Security / Firewalling rules and a minimum of 1000 Access Control Rules to control traffic flow.

• The awarded CSP shall provide the ability to perform logical separation of processing, data, and workloads, as well as providing and supporting isolation and boundary control for infrastructure, workloads, and internal and external networks.

• The awarded CSP shall provide a dedicated and secure network that supports secure encoding methods for data at rest and data in transit and end-to-end communication to support the deployment and administration of CSP services.

• The awarded CSP shall provide ability to bypass the public internet and provide a direct connection to the commercial or government CSP from the DHS Data Center over a secure scalable on-demand cloud interconnection, providing a secure connection over a private link that improves performance, reduces costs, increases security, and ensures consistent throughput at network speeds up to 10Gbps.

5.3.7 Desktop Virtualization Services

• The awarded CSP shall provide a XaaS capability to deliver virtual desktops to the entire

DHS organization. The number of desktops will be defined at the order level. The desktops shall support Government security standards, provide per user profiles, support Microsoft Windows Desktop and Linux Operating systems, and be capable of running any application that can run on these operating systems on a physical desktop.

5.3.8 Identity and Access Management

• The awarded CSP shall provide the ability for identity and access management cloud services to securely verify user identity using modern authentication protocols that work in all DHS environments, such as multi-factor authentication (MFA) and public key infrastructure (PKI).

5.3.9 Encryption and Key Management

• The awarded CSP shall provide platforms that facilitate the creation, deletion, and management of the cryptographic material used to encrypt the data that passes through the organizations network, applications, and systems is monumental to the organizations mission.

• The awarded CSP shall provide data encryption capabilities across all service offerings, hardware and software, including the ability to securely manage, back up, and recover encryption keys.

• The awarded CSP shall provide multiple encryption capabilities using diverse algorithms for all cloud service offerings and underlying infrastructure in compliance with commercially available standards for data at rest and data in transit, including but not limited to cipher strength, permitted algorithms, and encryption schemes. The algorithms and configurations of key standards shall be made available upon request by the DHS Contracting Officer and Contracting Officer’s Representative.

5.3.10 Secrets Management

• The awarded CSP shall provide the ability for the DHS to leverage a platform that aids developers in protecting sensitive information within the mission applications that serve

DHS.

5.3.11 Secure Environment Configuration

The awarded CSP shall provide the ability for DHS to implement cybersecurity controls and policies through IaC, API endpoints, or manual GUI configuration at a management account level that other accounts are able to leverage and inherit from to enforce secure environment baseline requirements and standard control compliance.

5.3.12 Monitoring and Logging

The awarded CSP shall provide the ability to continuously log, monitor, and audit infrastructure, cloud services, and administrative activity to support technology operations and insider threat programs.

5.3.13 Intrusion Detection

The awarded CSP shall provide automated intrusion detection and identification for all CSP service offerings and physical hardware.

5.4 Support, Training, SLAs & Professional Services

This section describes CSP requirements to deliver enterprise-level support, including dedicated subject matter experts for consultation on architecture, security, automation, and migration, as well as automated notifications for service changes. It outlines training provisions to enhance cloud platform expertise, adherence to high-performance Service Level Agreements (SLAs), and access to emerging technologies. Additionally, it includes professional services for planning, design, and implementation of cloud-based systems throughout the systems engineering lifecycle. Additional requirements may be established at the task order level based on task order level requirements.

5.4.1 Enterprise Support

• The awarded CSP shall provide DHS customers with Enterprise Support services. Vendor or third-party equivalents are not acceptable. The CSP shall provide automated mechanisms for notifications, including any change that may affect the security and functionality of provided services, environments, strategic plans, and service roadmaps.

• The awarded CS shall provide access to subject matter experts to comprise a dedicated cloud team for consultation. The consultation shall encompass areas including architecture, services recommendations, best practices, configurations, operational health, security, automation, and migration.

5.4.2 Enterprise Training

• The awarded CSP shall provide training to aid the maturity and understanding of how to build and deliver mission capabilities in the vendor’s cloud platform.

• The awarded CSP shall make at least fifteen (15) seats available per year per CSP. Topics for training shall include, but not be limited to: cloud security, cloud architecture, cloud systems operations & engineering, cloud development & DevOps, serverless solutions, data stewardship & compliance, AI/ML development in the cloud, and cloud project management.

5.4.3 Professional Services Support

• The awarded CSP shall provide cloud adoption accounts for the purposes of user orientation to CSP services and training.

• The awarded CSP shall provide professional and engineering services such as support for planning, design, development, acquisition, provisioning, cost optimization, and implementation of cloud-based systems and applications. Solutions architect and engineering services shall be furnished as needed during any phase of the systems engineering lifecycle.

5.4.4 CSP Service Level Agreements

• The awarded CSP shall ensure service offerings product, application, data availability, performance, and durability meet or exceed thresholds described by the CSP’s commercially published Service Level Agreement (SLA) to meet the highest levels of performance possible.

• The awarded CSP shall offer any new emerging technologies to DHS through their commercial and FedRAMP catalogs.

6 NON-TECHNICAL REQUIREMENTS

6.1 Government Furnished Property, Facilities, Services, and

Information (GFX) It is not anticipated that Government-furnished property (GFP), facilities (GFF), services (GFS), and information (GFI) will be provided at the IDIQ award level. Government-furnished property (GFP), facilities (GFF), services (GFS), and information (GFI) may be included at the task order level based on task order level requirements.

6.2 Contract Reporting

In addition to those IDIQ award reporting requirements established immediately below, further reporting may be established at the task order level based on task order level requirements

6.2.1 Usage Report

• The awarded CSP shall provide a monthly usage report submitted to the DHS IDIQ

CO,COR, and Program Manager using the below template. The report shall have at least two (2) tabs, one summary tab and one for each Component.

o Tab 1: IDIQ Summary Report

IDIQ ID

IDIQ Total Ceiling IDIQ Awarded CSP Name IDIQ Reporting Month IDIQ Reporting Year IDIQ Total Reporting Month List Cost IDIQ Total Reporting Month Invoiced Cost o Tab 2: IDIQ Task Order Summary Report Task Order ID Task Order Total Ceiling Task Order Awarded CSP Name Task Order Base Year PoP Start Date Task Order Base Year PoP End Date Task Order Base Year Ceiling Task Order Option Year X PoP Start Date Task Order Option Year X PoP End Date Task Order Option Year X Ceiling Task Order Reporting Month Task Order Reporting Year Task Order Total Reporting Month List Cost Task Order Total Reporting Month Invoiced Cost o Tab 3: Usage Detail Report Contract CLIN Component Name Component Reporting Month List Cost Component Reporting Month Invoiced Cost

6.3 508 Requirements Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05- 001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

When providing Platform as a Service (PaaS) or Software as a Service (SaaS), the contractor shall ensure services conform to the applicable Section 508 standards (including the requirements in Chapter 5 for software and WCAG Level A and AA Level 2.0 success criteria for web and software. When the requirements in Chapter 5 do not address one or more software functions, the Contractor shall ensure conformance to the Functional Performance Criteria specified in Chapter 3.) The agency reserves the right to request an Accessibility Conformance Report (ACR) for PaaS and SaaS offerings. The ACR should be created using the Voluntary Product Accessibility Template Version 2.2 508 (or later). The template can be located at https://www.itic.org/policy/accessibility/vpat

When providing cloud hosting services (Infrastructure as a Service, Platform as a Service, Software as a Service, etc.) the Contractor shall ensure user administrative screens, dashboards and portals used to configure and monitor cloud services conform to the Section 508 standards.

The Contractor shall ensure cloud hosting services shall not reduce the level of Section 508 conformance for ICT migrated by DHS to the cloud hosting environment.

https://uscode.house.gov/view.xhtml?req=(title:29%20section:794d%20edition:prelim)%20OR%20(granuleid:USC-prelim-title29-section794d)&f=treesort&edition=prelim&num=0&jumpTo=true https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.itic.org/policy/accessibility/vpat

The Contractor personnel shall possess the knowledge, skills and abilities necessary to address the accessibility requirements in this work statement.

For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

7 CONTRACT SPECIFICATIONS

7.1 Place of Performance

The place of performance shall be established at the task order level based on task order level requirements. Tasks shall be performed primarily at the CSP’s facility; with limited Government facility access as directed by the task order award and task order level CO and COR.

7.2 Period of Performance

The awarded IDIQ contract shall include a five year ordering period, including one (1) twelve

(12) month base ordering period and four (4) twelve (12) month optional ordering periods as reflected within the table immediately below.

Task order period of performance shall be established within the task order award based on task order level requirements.

Performance Period Performance Period Dates Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.3 Contract Type

The individual CSPs will be awarded a single award IDIQ contract, with Firm Fixed Price (FFP)/Fixed Unit Price task orders including consumption based and/or subscription-based pricing methodologies.

This IDIQ award will provide access to in-scope XaaS services initially through an AWS contract award. It is anticipated that additional referenced brand name CSP support shall be provided through additional IDIQ contracts awarded directly to other CSPs.

https://www.itic.org/policy/accessibility/vpat

7.4 Contract Management

To adapt to the speed of mission, this IDIQ award and subsequent task orders will streamline cloud procurement processes, implement consumption-based and/or subscription-based acquisition models to keep pace with rapidly changing technologies, leverage cloud flexibility, and ensure delivery of new capabilities at the speed of mission.

8 IDIQ DELIVERABLES AND DELIVERY SCHEDULE

The awarded CSPs shall submit all deliverables to the Contracting Officer’s Representative (COR), and other Government Representatives via DHS project SharePoint site established after contract award or by other means to be determined after contract award. Any deliverable that includes Personally Identified Information (PII) will not be submitted via DHS SharePoint (determination will be established after contract award). Unless otherwise noted, all days are calendar days.

Table 1 - Deliverables and Delivery Schedule

# SOW

Section

Deliverable Type Delivery Method(s) Delivery Date

Frequency

1 8.1 Post-Award Meeting Briefing Microsoft or Power Point

Within 10 calendar days after start of order’s Period of Performance (PoP)

2 8.2 Account/Enrollment Transfer Plan

Microsoft Word

Microsoft Word 60 calendar days prior to end of the overall order’s PoP;

or at a future date (as required)

3 8.3 Product List Set 1 and 2

Link to the CSP website

Website Provided at contract award and any updated website link

4 8.4 Notification of Usage Consumption Letter

Adobe PDF Adobe PDF When actual usage consumption exceeds 75%, 90% and 99% thresholds for the overall order

5 6.2.1 Usage Report Microsoft Excel Microsoft Excel The monthly orders report is due, in electronic format, # SOW

Section

Deliverable Type Delivery Method(s) Delivery Date

Frequency on the 15th day of each month for the term of the vehicle.

8.1 Post-Award Meeting

The awarded CSP shall present a post-award briefing slide presentation to include an overview of IDIQ-level tasks, deliverables, transition activities, communication approach, initial risks, and next steps.

8.2 Account/Enrollment Transfer Plan

The Awarded CSPs shall be responsible for providing an Account/Enrollment Transfer Plan.

This includes:

• Describe the process for how the awarded CSP shall transition the existing DHS CSP enrollments, accounts, and marketplace product offerings from any incumbent VARs/MSPs.

• Describe the process for how the awarded CSP shall ensure maximum environment availability during CSP enrollment, account, and marketplace product offering transition.

• Identify the process for how the awarded CSP will capture historic data from the previous VAR/MSP accounts and/or enrollments and maintain cloud-based usage statistics.

8.3 Product List Set 1 and 2

The Contractor shall provide Product List Set 1 via electronic document and website Uniform Resource Locator (URL) with the initial listing one month after start of Order. Every month except months when the updated product list is provided. This update will be reflective of only the products either added or removed from the Contractor’s Product Listing for the cloud service being proposed by the Contractor.

The Contractor shall provide Product List Set 2 via electronic document and website Uniform Resource Locator (URL) within one week after start of order PoP and delivered 90 calendar days thereafter. This update will reflect all currently available CSP product offerings from the awarded CSP’s product listing for the CSP.

8.4 Notification of Usage Consumption Letter

The awarded CSP shall provide a written notification of actual usage consumption when the order exceeds 75%, 90% and 99% thresholds. This letter will include the allotted funding and estimated time remaining on each order. This letter will also be sent via e-mail to the order-level COR, Task Order Manager, and Contracting Officer. The awarded CSP shall not provide any products or services that exceed 100% of funding. If the awarded CSP chooses to provide products or services that exceed 100% of funding, the awarded CSP does so at risk and is subject to not being reimbursed for such products or services, and the government is not liable to reimburse the awarded CSP for such products or services.

8.4.1 Written Acceptance/Rejection by the Government

All rejection notifications from the COR and/or Contracting Officer will contain an explanation of the specific deficiencies causing the rejection.

Items must be approved by the order-level COR and/or the Contracting Officer to be considered “accepted.” Deliverables shall be deemed acceptable if the document:

• adequately covers all required topics,

• meets general quality measures,

• is professionally prepared in terms of format, clarity, and readability,

• is delivered in electronic copy on time to the designated delivery location.

General quality measures, as set forth below, shall be applied to each deliverable received from the awarded CSP.

• Accuracy: Deliverables shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity: Deliverables shall be clear and concise. Any/All diagrams and graphics shall be easy to understand and be relevant to the supporting narrative.

• File Editing: All text and diagrammatic files shall be editable by the government.

• Format: Deliverables shall be transmitted via e-mail and in media mutually agreed upon prior to submission.

• Timeliness: Deliverables shall be submitted on or before the due date specified in this statement of work or submitted in accordance with a later scheduled date determined by the government.

The documents shall be considered final upon receiving…