Sol_31310019R0013.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

NRCHQ

WASHINGTON DC 20555-0001

MAIL STOP TWFN-8E06M

ACQUISITION MANAGEMENT DIVISION

US NRC - HQ

NRCHQ CODE 16. ADMINISTERED BYCODE

X

X

518210

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORNRCHQ

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

05/08/2019 1700 ET

04/24/2019

301-415-8164DOMONIQUE MALONE

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

31310019R0013

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 70 OCIO-19-0009OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

WASHINGTON DC 20555-0001

NUCLEAR REGULATORY COMMISSION

NUCLEAR REGULATORY COMMISSION

15. DELIVER TO

WASHINGTON DC 20555-0001

MAIL STOP TWFN-07B20M

ACQUISITION MANAGEMENT DIVISION

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$32.50

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

US NRC - HQ

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Period of Performance: 06/01/2019 to 05/31/2020

00001 Public Site Delivery and Continuity of Operations.

Periods of Performance:

Base Year: 6/1/2019 - 5/31/2020; OY1: 6/1/2020 - 5/31/2021;

OY2: 6/1/2021 - 5/31/2022;

OY3: 6/1/2022 - 5/31/2023;

OY4: 6/1/2023 - 5/31/2024;

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

XX

DATED

DOMONIQUE MALONE

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT: REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

OY5: 6/1/2024 - 5/31/2025;

OY6: 6/1/2025 - 5/31/2026;

OY7: 6/1/2026 - 5/31/2027;

OY8: 6/1/2027 - 5/31/2028;

OY9: 6/1/2028 - 5/31/2029

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

70 2 of

SECTION B - Supplies or Services/Prices

B.1 PRICE SCHEDULE

See Attachment 1.

B.2 CONSIDERATION AND OBLIGATION-FIRM-FIXED-PRICE

The total amount of the Firm-Fixed-Price of this contract is $TBD, and this amount is fully-funded.

End of Clause

B.3 CONTRACT LINE ITEMS (CLINS)

The contract, if awarded, will contain a one-year base and nine one-year option periods. All CLINS are firm-fixed-price. Below is a consolidation of all CLINS under the contract. See attachment 1 for the price schedule.

CLIN

Grouping DESCRIPTION Contract Type

00001-90001 Cloud-hosted Web Application Firewall Service (80 MB/S) Firm-Fixed-Price 00002-90002 Cloud-hosted Content Delivery Network Service (80 MB/S) Firm-Fixed-Price 00003-90003 Cloud-hosted Client Reputation Filtering Service (80 MB/S) Firm-Fixed-Price 00004-90004 Cloud-hosted Web Bot Management Service (80 MB/S) Firm-Fixed-Price

00005-90005 Cloud-hosted Realtime Site Spidering and Backup Service (4

TB)

Firm-Fixed-Price

00006-90006 Cloud-hosted Web Request Redirection Service (80 MB/S) Firm-Fixed-Price 00007-90007 Security Optimization Configuration and Optimization Service Firm-Fixed-Price 00008-90008 Technical Advisory Service Firm-Fixed-Price 00009-90009 Service Management Firm-Fixed-Price 00010-90010 Annual Internet Traffic Overage Allowance Firm-Fixed-Price 00011-90011 Annual Vendor-specific Training Firm-Fixed-Price

SECTION C – Statement of Work

C.1 Title of Project

This is a non-personal services contract to provide Public Web Site Content Delivery and Continuity of Operations.

C.2 Background

The Public Web Site of the U.S. Nuclear Regulatory Commission (NRC)1 contains approximately 35,000 Web pages and 53,000 files in Adobe Portable Document Format (PDF).

All pages are in static form and available at a single Internet domain. This requirement for site delivery and continuity of operations was previously provided by Akamai Technologies, Inc.2

C.3 Objective

The objective of this contract/order is to acquire commercially hosted Content Delivery Network (CDN) services to maintain the following business objectives and legal requirements currently provided:

To deliver the NRC Public Web Site (the Site) without interruption to users in each primary Internet Service Provider (ISP) world-wide (except where prevented by local governmental restriction or lack of permanent Internet connection)

To optimize the delivery of requests and responses passed across mobile networks

To ensure all requests for Site content and their associated responses are delivered securely using NRC-approved Secure Sockets Layer (SSL) certificates and in conformance with HTTP Strict Transport Security (HSTS)

To ensure that the Site fully supports the IPv6 protocol while simultaneously continuing to serve users who make requests using the IPv4 protocol

To protect the NRC origin servers from malicious requests, and limit the frequency of requests from automated sources using contractor-maintained rate-limiting protections and source lists tailored to NRC requirements, while fulfilling requests from NRC-approved sources

To ensure that all requests for content at the Site are routed through CDN servers that are both physically located in the United States and documented to the NRC before being passed to the NRC origin server

To ensure the Site remains available should the NRC’s origin server(s) (from which the CDN obtains all source content for the Site) become unavailable for any reason

1 https://www.nrc.gov 2 under Delivery Order NRC-HQ-10-14-T-0001, Contract GS35F0626M, which expires 5/31/2019 https://www.nrc.gov/

To obtain statistics and automated notifications regarding all aspects of the CDN services and the Web traffic delivered by them on behalf of the NRC

These objectives support the Openness principle of good regulation by enabling the agency to communicate rapidly, effectively and reliably with external stakeholders. They also support various program-specific goals and requirements of agency authors and content sponsors.

C.4 Scope of Work/Tasks

The contractor shall provide all resources necessary to accomplish the tasks and deliverables described in this Statement of Work (SOW). The contractor shall achieve the above objectives by providing the following services for the Site (and, at the option of the NRC, any subdomains thereto). Detailed requirements for each of these services are provided in Section C.6, “List of Services.”

1. The contractor shall deliver all traffic for the NRC’s Public Web Site across the contractor’s secure Content Delivery Network (CDN)

2. The contractor shall provide continuous and on-demand caching, indexing, and long-term backup of all Web content to contractor-maintained Cloud hosting services with automatic, real-time fail-over

3. The contractor shall provide Web Application Firewall (WAF) services to protect NRC IT infrastructure against Internet-based threats and risks

4. The contractor shall route all traffic through CDN servers physically located in the United States before forwarding this traffic to the NRC origin servers

5. The contractor shall provide scheduled e-mail reports of CDN traffic statistics and contract usage

6. The contractor shall provide daily site usage logs delivered to contractor-maintained Cloud-hosting services

7. The contractor shall provide services to enable the NRC to manage server-side redirects

8. The contractor shall provide automatic e-mail and cellular text alerts for traffic and security events

9. The contractor shall provide the NRC with secure access to a Customer Web Portal to allow for NRC oversight and configuration of the CDN and WAF

10. The contractor shall provide professional services to monitor and configure all hosted services provided under this contract, and provide recommendations for improved delivery and tuning of all services

11. The contractor shall host annual training classes, and provide associated training materials, on the use of the technologies and Customer Web Portal features supporting this contract

12. The contractor shall provide technical support to NRC inquiries made by means of the Customer Web Portal, e-mail, and telephone.

SECURITY REQUIREMENTS

The contractor shall require each user to access the Site securely using NRC-approved Secure Sockets Layer (SSL) server certificates and with the CDN configured to support HTTP Strict Transport Security (HSTS).

All hosted services shall be provided from within the boundary of a system currently authorized at the moderate impact level by the Federal Risk and Authorization Management Program (FedRAMP).3

All encryption used by the contractor’s hosted system shall comply with Federal Information Processing Standard (FIPS) 140-2, “Security Requirements for Cryptographic Modules.”4

No physical access to NRC facilities or IT infrastructure shall be required for this contract.

All content made available to the CDN from the NRC origin server(s) for display at the Site will be considered at the time of release to have prior NRC authorization for unrestricted access by the public.

C.5 Reporting Requirements

The following describes the overall reporting requirements for all support areas included within this PWS. The COR will monitor the vendor’s customer portal daily and receive daily, weekly, monthly and ad hoc reports.

Report 1: Scheduled e-mail reports of CDN traffic statistics and hosted service usage.

Frequency: The customer portal shall provide the means to configure reporting intervals at all the above intervals.

Report 2: Ad hoc reports of all hosted services and hosted service usage levels shall be available for viewing in the Web-based customer portal and shall be submitted to the COR via e-mail.

Report 3: Scheduled reports shall be delivered automatically and periodically to an NRC-defined list of e-mail recipients. The reports shall cover site usage statistics and hosted service usage summaries.

C.6 List of Services

C.6.1 Service Descriptions and Performance Criteria

Service 1. The contractor shall deliver all traffic for the NRC’s Public Web Site across the contractor’s secure Content Delivery Network (CDN)

Description. The contractor shall respond to Hypertext Transport Protocol-Secure (HTTPS) requests for Web content at the NRC Public Web Site made by users world-wide, and shall route both the requests and the responses across the contractor’s CDN. The CDN shall obtain all content for delivery from the points of origin defined by the NRC business rules. The CDN shall provide both testing and production networks to enable validation and verification of changes to content delivery rules. The CDN content delivery rules for both testing and

3 https://marketplace.fedramp.gov/ 4 https://csrc.nist.gov/publications/detail/fips/140/2/final https://marketplace.fedramp.gov/ https://csrc.nist.gov/publications/detail/fips/140/2/final production networks shall be managed in a revision control system with full version control and roll-back capabilities.

Performance Criteria

1.1. Availability. All site content available 24 hours/day, 365 days/year, with 100% availability.1

1.2. Latency. No more than 1 second latency in responding to valid requests.5

1.3. Bandwidth. Maximum of 80 MB/s data transferred (calculated monthly using a 95th percentile calculation with 5-minute intervals).

1.4. Accuracy. All content presented to the CDN for delivery shall be delivered to the intended recipient without error.

1.5. Monitoring Method. The COR or designee continuously monitors vendor-provided reports online and by email. Any service discrepancy is immediately logged by the vendor’s system. In addition, the NRC has 3rd party tools to evaluate availability independently.

Service 2. The contractor shall provide continuous and on-demand caching, indexing, and long-term backup of all Web content to contractor-maintained Cloud hosting services with automatic, real-time fail-over

Description. The contractor shall retain user-requested content in a short-term cache, and maintain a cloud-hosted long-term backup of all content at the NRC Public Site. The frequency of the refresh interval for all content in the short-term cache and long-term backup shall match the business rules established in consultation with the NRC.

Performance Criteria

2.1. Hot-swap backup. There shall be no measurable difference in response time for requests to the NRC Public Site should any NRC origin server become unavailable.

2.2. Short-term cache freshness. All content in the contractor-maintained short-term cache shall match content found on the NRC origin server to the degree defined in the business rules established in consultation with the NRC.

2.3. Long-term backup storage capacity. The contractor’s long-term backup facility shall be provisioned to store 4 TB of data for the NRC.

2.4. Long-term backup freshness. All content at the contractor-maintained long-term backup site shall be synchronized with the NRC origin server at a frequency defined in the business rules established in consultation with the NRC.

Service 3. The contractor shall provide Web Application Firewall (WAF) services

5 A request is valid if it does not trigger any rule in the Web Application Firewall (WAF) that would result in a mitigation response.

Description. The contractor shall provide Cloud-hosted WAF services to protect NRC origin servers from malicious traffic and traffic bursts from all sources, and to prevent cost overruns by limiting bandwidth usage, subject to the business rules established in consultation with the NRC. The WAF services shall include malicious traffic blocking, bot management, continuous dynamic client reputation management, malicious traffic source black-listing, partner white-listing, statistics, and trend analysis. See Section C.6.2, “Mitigation Requirements For Web Application Firewall Services” for definitions associated with these services. WAF services shall include the following capabilities:

1. Malicious traffic blocking. The contractor shall maintain a database of known Internet threats based on request characteristics obtained through its continuous monitoring of such traffic world-wide and the contractor’s continuing cooperative efforts with government and private-sector Internet security professionals. The contractor shall ensure that the WAF services provided under this contract are optimized to benefit from this database.

2. Automated (bot) traffic limiting. The contractor shall provide tools to create and manage mitigation strategies for both contractor-defined and NRC-defined automated traffic sources.

3. Custom traffic source list management. The contractor shall provide tools to create and manage lists of IPs and IP CIDRs of traffic sources to be mitigated based on WAF policies and rules. Mitigation shall include both blacklists and whitelists. The contractor shall also maintain enterprise-wide malicious traffic source lists without NRC intervention. The contractor shall also integrate contractor-maintained enterprise-wide traffic source lists with NRC-managed traffic source lists using WAF policies and rules developed by the contractor in consultation with the NRC and hosted within the contractor’s WAF.

4. Continuous, dynamic traffic source mitigation. The contractor shall provide tools to mitigate threats from previously unidentified sources based on request characteristics and frequency. These tools shall enable the automatic activation and subsequent timed release of mitigation responses to bot requests based on business rules established in consultation with the NRC.

5. Configuration and reporting tools. The contractor shall provide the NRC access to a secure Web portal to monitor, manage, and administer all WAF functions. The portal shall provide access to user-configurable tools to accomplish the following:

configure and manage WAF rules with full version control;

view real-time and historical statistics on total site usage, WAF rules triggered, bot traffic mitigated, and custom NRC-specific rules activated;

create alerts tied to WAF trigger events and disseminated by e-mail and text message; and manage all changes to WAF rules with full version control and roll-back capabilities.

Performance Criteria

3.1. Alert response time. Alert messages configured through the WAF portal shall be sent by e-mail and text message within 15 minutes of each triggering event.

Monitoring Method. The COR or designee compares the alert timestamp to data available in the customer portal.

3.2. Malicious traffic blocking. The percentage of malicious traffic (measured by request volume) meeting the WAF rule triggering criteria and passed to the NRC origin shall not exceed 0.5 percent of all malicious traffic meeting the WAF rule triggering criteria (a 99.5% accuracy rate).

Monitoring Method. The COR will compare the alert timestamp to data available in the customer portal.

Service 4. The contractor shall route all traffic through CDN servers physically located in the United States before forwarding this traffic to the NRC origin servers

Description. The contractor shall ensure that all Internet requests that pass across the contractor’s CDN for content at the NRC Public Web Site shall be routed through CDN servers hosted in the United States before being routed from CDN to the NRC origin servers. The contractor shall inform the Contracting Officer Representative in writing before making any changes to the list of domestic servers authorized to route Internet requests to the NRC origin servers.

Performance Criteria

4.1. Domestic traffic routing. No Internet traffic routed to the NRC origin servers from the contractor’s CDN shall be passed to the NRC by servers located outside the United States. The NRC may perform a WHOIS lookup at any time to validate the identity and geographic location of the final CDN servers passing requests to the NRC.

4.2. Domestic CDN server list maintenance. The contractor shall notify the NRC Contracting Officer Representative by e-mail at least 7 calendar days in advance of any change to the list of domestic CDN servers authorized to route Internet requests to the NRC origin servers.

Service 5. The contractor shall provide scheduled e-mail reports of CDN traffic statistics and contract usage

Description. The contractor shall provide the capability to configure an unlimited number of ad hoc and scheduled reports. The ad hoc reports shall be available for viewing in the Web-based customer portal and for delivery by e-mail. The scheduled reports shall be delivered automatically and periodically to an NRC-defined list of e-mail recipients. The reports shall cover site usage statistics and contract usage summaries.

Performance Criteria

5.1. Latency of online reports. All reports shall be presented in the Web-based Customer Portal within 1 minute of request.

5.2. Latency of e-mailed reports. All reports shall be delivered within 1 hour of the scheduled time.

Service 6. The contractor shall provide daily site usage logs delivered to contractor-maintained Cloud-hosting services

Description. The contractor shall provide Web daily access logs of all requests to the NRC Public Web Site. The log data shall be made available to the NRC at the contractor’s hosted backup site.

Performance Criteria

6.1. Latency of log delivery. No log file shall be delivered more than 12 hours after the final entry therein.

6.2. Log format. All log file data shall be recorded in Combined Log Format6 unless otherwise approved by the NRC in advance.

Service 7. The contractor shall provide services to enable the NRC to manage server-side redirects.

Description. The contractor shall provide the capability in the Web-based customer portal to manage an unlimited number of server-side Web redirects for the NRC Public Web Site. This management solution shall include automated deployment support for redirection rules with full version control and roll-back capabilities.

Performance Criteria

7.1. Latency of redirect rule deployment. Changes to server-side redirection rules shall deploy in no more than 60 minutes from the time of request.

7.2. Rollback of redirect rules. All revisions to server-side redirection rules shall be available for rollback at any time during the period of performance.

Service 8. The contractor shall provide automatic e-mail and cellular text alerts for traffic and security events

Description. The contractor shall provide the capability in the Web-based customer portal to manage the automatic dissemination of e-mail and cellular text alerts for traffic and security events for the NRC Public Web Site. A traffic event is a fixed period of time during which the volume of data transmitted across the CDN exceeds a threshold defined by the NRC. A security event is a fixed period of time during which the volume of requests identified as malicious or suspect based on preset criteria defined in the WAF and transmitted across the CDN exceeds a threshold defined by the NRC.

6 See https://httpd.apache.org/docs/1.3/logs.html#combined https://httpd.apache.org/docs/1.3/logs.html#combined

Performance Criteria

8.1. Latency of e-mail and cellular text alerts. Email and cellular test alerts shall be delivered within 30 minutes of the initiating event.

Service 9. The contractor shall provide the NRC with secure access to a Customer Web Portal to allow for NRC oversight and configuration of the CDN and WAF

Description. The contractor shall provide the NRC with secure access to a Customer Web Portal to allow for NRC oversight and configuration of all administrative, monitoring, alerting and statistical functions and features of the CDN and WAF. The portal shall provide an integrated management platform for all CDN and WAF services. NRC access to the portal shall not diminish the contractor’s responsibility for meeting any other contractual obligations stated elsewhere herein.

Performance Criteria

9.1. Portal availability. The Customer Web Portal shall be available for NRC access at a rate of 99.9% annually, excluding planned outages.

9.2. Portal integration scope. The Customer Web Portal shall provide a single integrated management platform for the configuration, management, and monitoring of all features and functions necessary to administer the CDN and WAF.

Service 10. The contractor shall provide professional services to monitor and configure all hosted services provided under this contract, and provide recommendations for improved delivery and tuning of all services.

Description. The professional services provided by the contractor shall include the following:

o Continuous monitoring. The contractor shall monitor traffic trends that indicate possible overages, and take steps to alert the NRC and mitigate high bandwidth usage before overage charges are accrued.

o Troubleshooting and root cause analysis. The contractor shall identify delivery-related performance issues that may diminish or prevent user access to the NRC Public Website, or that may negatively affect the NRC origin servers, and recommend solutions to the NRC.

The contractor shall determine the cause of performance issues to determine whether they result from intentional contractor intervention (i.e. protective measure taken on behalf of the NRC to prevent harm to the NRC or loss of service to its internet customers) or from outside internet connectivity issues.

o Monthly status meetings and reports. The contractor shall schedule, facilitate, and document monthly meetings with the NRC to review the status of open issues, site delivery, statistics, and related hosted services. The contractor shall use these meetings to recommend steps to improve the efficiency and effectiveness of each of the contractor’s services provided under this contract.

o Quarterly Web Application Firewall review meetings and reports. The contractor shall schedule, facilitate and document quarterly meetings with the NRC to present detailed reviews of the WAF services configured to support the NRC.

Performance Criteria

10.1. Timeliness and completeness of meeting documentation. The contractor shall document each monthly and quarterly meeting with the NRC by e-mail within 1 business day of the meeting.

10.2. Troubleshooting and root cause analysis. The contractor shall follow up by e-mail upon identifying issues requiring root cause analysis and mitigation. The contractor shall coordinate with the NRC to resolve all identified issues within 1 week of identification unless otherwise approved by the NRC.

10.3. Quarterly optimization guidance and recommendations. The contractor shall include optimization guidance and recommendations in each e-mail documenting the outcome of each quarterly WAF meeting.

Service 11 The contractor shall host annual training classes and provide associated training materials on the use of the technologies and Customer Web Portal features supporting this contract

Performance Criteria

11.1. Training frequency. The contractor shall provide up to 6 class seats annually at the request of the NRC.

11.2. Training materials. The contractor shall supply training materials for each class seat requested by the NRC. The training materials may be provided electronically in PDF format or as printed training manuals.

11.3. Training scope. The training shall address each service provided under this contract upon request by the NRC.

11.4. Training location. The training shall be held at a contractor-provided facility in the Washington DC metropolitan area or through a secure, contractor-provided Web-based training interface.

Service 12 The contractor shall provide technical support to NRC inquiries made by means of the Customer Web Portal, e-mail and telephone.

Performance Criteria

12.1. Response time for technical support inquiries. The contractor shall respond by e-mail or telephone within 30 minutes for inquiries made by e-mail or through the Customer Web Portal 24 hours/day, 365 days/year.

12.2. Periodic optimization and recommendations. The contractor shall identify root causes and solutions for all NRC inquiries that are attributable to conditions within the scope of this contract within 2 business days of initial inquiry.

C.6.2 Mitigation Requirements for Web Application Firewall Services

The contractor shall sanitize traffic routed to the NRC origin servers in a manner that protects the NRC IT assets while ensuring that legitimate traffic is allowed. The contractor shall employ solutions that are flexible and time-sensitive to reduce the need for continuous manual intervention. Examples of such flexible solutions include temporary denials, tarpitting, delaying, slowing, and monitoring.

C.6.3 Summary of Services and Performance Criteria

The following is a summary of the services and performance criteria in C.6.1, “Service Descriptions and Performance Criteria.” See the applicable paragraph(s) in this section for a detailed description of each performance criterion and the related requirements.

Table 1. Summary of Services and Performance Criteria Service Performance

Criterion Description

1.1 Availability

1.2 Latency

1.3 Bandwidth

1: Content delivery services

1.4 Accuracy

2.1 Hot-swap backup

2.2 Short-term cache freshness

2.3 Long-term backup storage capacity

2: Short-term caching and long-term backup services

2.4 Long-term backup freshness

3.1 Alert response time3: Web Application Firewall services

3.2 Malicious traffic blocking

4.1 Domestic traffic routing4: Domestic traffic routing service

4.2 Domestic CDN server list maintenance

5.1 Latency of online reports5: Scheduled reporting services

5.2 Latency of e-mailed reports

6.1 Latency of log delivery6: Daily log delivery service

6.2 Log format

7.1 Latency of redirect rule deployment7: Server-side redirect management service 7.2 Rollback of redirect rules

8: Automated alerting service 8.1 Latency of e-mail and cellular text alerts

9.1 Portal availability9. Customer Web portal access

9.2 Portal integration scope

10.1 Timeliness and completeness of meeting documentation

10.2 Troubleshooting and root cause analysis

10. Professional services: service monitoring

10.3 Quarterly optimization guidance and recommendations

11.1 Training frequency

11.2 Training materials

11.3 Training scope

11. Training service

11.4 Training location

12.1 Response time for technical support inquiries12. Technical support

12.2 Periodic optimization and recommendations

C.7 Required Materials, Facilities, Hardware/Software

The contractor shall provide access to the following materials, facilities, hardware, and software required for this contract/order:

1. CDN, hosted storage and WAF hosting facilities, servers, and server SSL certificates

2. CDN, hosted storage and WAF management software

The contractor shall retain ownership and full responsibility for all facilities, hardware and software leased under this contract. These facilities, hardware and software shall be within a system authorized for Moderate risk under the Federal Risk and Authorization Management Program (FedRAMP) throughout the term of this contract.

All software provided by the contractor for leased access by the NRC and external parties under this contract shall be Commercial Off The Shelf (COTS). The contractor shall periodically test, validate and install all security patches, feature patches, and version upgrades to this software consistent with the latest stable version of the software released by the contractor in a timely manner consistent with Section C.7.3, “System Availability and Planned Outages.”

C.7.1 RESERVED

C.7.2 SYSTEM AVAILABILITY AND PLANNED OUTAGES

Planned Outages The contractor shall ensure the NRC Public Site remains available worldwide by delivery through the contractor’s CDN 24 hours per day, 365 days per year without interruption.

The contractor shall maintain the hosted customer portal unavailable for Planned System Maintenance (PSM) no more than six hours per contract month. A message regarding a PSM event shall be (1) displayed prominently on each NRC user’s login screen (2) delivered by email to the NRC COR at least one government business day in advance of the start of the PSM event unless approved in advance by the NRC COR.

Any event attributable to the CDN or WAF portal that renders the portal unavailable and that does not meet the above definition of PSM shall be considered unplanned and shall be included in the calculation of system availability.

System Availability For the purposes of this contract, system availability is the ratio of the number of hours the system is available per contract year to 8,760 (the number of hours in a contract year), with all calculations rounded upward to the nearest 5-minute interval. While the calculation of system availability does not include PSM outages, unused time for PSM events shall not accrue from month to month. The lack of one or more PSM events during a contract year shall not decrease the percentage of system availability required for that contract year. The NRC may use various tools to measure system availability, including but not limited to availability reports from the NRC’s CDN contractor, log files, external monitoring services and documented notifications from NRC system users.

C.8 Release of Publications

Any documents generated by the contractor under this contract/order shall not be released for publication or dissemination without CO and COR prior written approval.

C.9 Place of Performance

All services provided under this contract/order shall be performed at the contractor’s facility.

C.10 Contractor Travel

The Contractor will not be required to travel to support the services required in the Statement of Work.

C.11 Data Rights

Far clause 52.227-14 “Rights In Data General” applies to this contract and is incorporated by reference in Section I. The contractor shall produce no software exclusively for this contract. All software and associated source code shall be COTS and remain the property of the contractor.

The NRC shall have unlimited rights to and ownership of all NRC data modified, imported, stored, delivered or migrated by the contractor under this contract.

The NRC shall have unlimited rights to and ownership of all deliverables provided under this contract/order, including reports, recommendations, briefings, work plans and all other deliverables. All documents and materials, to include the source codes of any software, produced under this contract/order are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without prior written authorization from the CO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

C.12 Section 508 – Electronic and Information Technology Standards

See Section I.2 for the 508 Standards that apply to this procurement.

C.13 Applicable Publications (Current Editions)

The contractor shall comply with the following applicable regulations, publications, manuals, and local policies and procedures:

1. Office of Management and Budget Memorandum M-17-6, “Policies for Federal Agency Public Websites and Digital Services,” [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17- 06.pdf]

2. Key Cloud Service Provider (CSP) documents for a system authorized for Moderate risk under the Federal Risk and Authorization Management Program (FedRAMP) [https://www.fedramp.gov/documents/]

SECTION D - Packaging and Marking

D.1 BRANDING

The Contractor is required to use the statement below in any publications, presentations, articles, products, or materials funded under this contract/order, to the extent practical, in order to provide NRC with recognition for its involvement in and contribution to the project. If the work performed is funded with NRC funds, then the contractor must acknowledge that information in its documentation/presentation.

Work Supported by the U.S. Nuclear Regulatory Commission (NRC), Office of the Chief Human Capital Officer, under Contract number TBD.

D.2 PACKAGING AND MARKING

(a) The Contractor shall package material for shipment to the NRC in such a manner that will ensure acceptance by common carrier and safe delivery at destination. Containers and closures shall comply with the Surface Transportation Board, Uniform Freight Classification Rules, or regulations of other carriers as applicable to the mode of transportation.

(b) On the front of the package, the Contractor shall clearly identify the contract number under which the product is being provided.

(c) Additional packaging and/or marking requirements are as follows: TBD.

SECTION E - Inspection and Acceptance

E.1 INSPECTION AND ACCEPTANCE BY THE NRC (SEP 2013)

Inspection and acceptance of the deliverable items to be furnished hereunder shall be made by the NRC Contracting Officer’s Representative (COR) at the destination, accordance with FAR 52.247-34 - F.o.b. Destination.

Contract Deliverables:

See section C.8.

SECTION F - Deliveries or Performance

F.1 PERIOD OF PERFORMANCE

Base Period: June 01, 2019 – May 31, 2020

Option Period 1: June 01, 2020 – May 30, 2021

Option Period 2: June 01, 2021 – May 30, 2022

Option Period 3: June 01, 2022 – May 30, 2023

Option Period 4: June 01, 2023 – May 30, 2024

F.2 PLACE OF PERFORMANCE

The work to be performed under this contract shall be performed at the contractor’s facility. The Contracting Officer Representative will be located at the NRC Headquarters Complex:

http://www.nrc.gov/aboutnrc/locations/hq.html.

F.3 LIST OF FEDERAL HOLIDAYS

Federal Holidays are located at https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/#url=Overview.

http://www.nrc.gov/aboutnrc/locations/hq.html https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/#url=Overview https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/#url=Overview

SECTION G - Contract Administration Data

G.1 REGISTRATION IN FEDCONNECT® (JULY 2014)

The Nuclear Regulatory Commission (NRC) uses Compusearch Software Systems’ secure and auditable two-way web portal, FedConnect®, to communicate with vendors and contractors.

FedConnect® provides bi-directional communication between the vendor/contractor and the NRC throughout pre-award, award, and post-award acquisition phases. Therefore, in order to do business with the NRC, vendors and contractors must register to use FedConnect® at https://www.fedconnect.net/FedConnect. The individual registering in FedConnect® must have authority to bind the vendor/contractor. There is no charge for using FedConnect®. Assistance with FedConnect® is provided by Compusearch Software Systems, not the NRC. FedConnect® contact and assistance information is provided on the FedConnect® web site at https://www.fedconnect.net/FedConnect.

SECTION H - Special Contract Requirements

H.1 AWARD NOTIFICATION AND COMMITMENT OF PUBLIC FUNDS

It is also brought to your attention that the contracting officer is the only individual who can legally obligate funds or commit the NRC to the expenditure of public funds in connection with this procurement. This means that unless provided in a contract document or specifically authorized by the contracting officer, NRC technical personnel may not issue contract modifications, give formal contractual commitments, or otherwise bind, commit, or obligate the NRC contractually. Informal unauthorized commitments, which do not obligate the NRC and do not entitle the contractor to payment, may include:

(1) Encouraging a potential contractor to incur costs prior to receiving a contract;

(2) Requesting or requiring a contractor to make changes under a contract without formal contract modifications;

(3) Encouraging a contractor to incur costs under a cost-reimbursable contract in excess of those costs contractually allowable; and

(4) Committing the Government to a course of action with regard to a potential contract, contract change, claim, or dispute.

H.2 USE OF AUTOMATED CLEARING HOUSE (ACH) ELECTRONIC

PAYMENT/REMITTANCE ADDRESS

The Debt Collection Improvement Act of 1996 requires that all Federal payments except IRS tax refunds be made by Electronic Funds Transfer. lt is the policy of the Nuclear Regulatory Commission to pay government vendors by the Automated Clearing House (ACH) electronic funds transfer payment system. Item 15C of the Standard Form 33 may be disregarded.

H.3 GREEN PURCHASING (SEP 2015)

(a) In furtherance of the sustainable acquisition goals of Executive Order (EO) 13693, "Planning for Federal Sustainability in the Next Decade," products and services provided under this contract/order shall be energy efficient (EnergyStar® or Federal Energy Management Program - FEMP-designated products), water efficient, biobased, environmentally preferable (excluding EPEAT®-registered products), non-ozone depleting, contain recycled content, or are non- or low toxic alternatives or hazardous constituents (e.g., non-VOC paint), where such products and services meet agency performance requirements. See: Executive Order (EO) 13693, "Planning for Federal Sustainability in the Next Decade."

(b) The NRC and contractor may negotiate during the contract term to permit the substitution or addition of designated recycled content products (i.e., Comprehensive Procurement Guidelines

- CPG), EPEAT®-registered products, EnergyStar®- and FEMP designated energy efficient products and appliances, USDA designated biobased products (Biopreferred® program), environmentally preferable products, WaterSense and other water efficient products, products containing non- or lower-ozone depleting substances (i.e., SNAP), and products containing non-or low-toxic or hazardous constituents (e.g., non-VOC paint), when such products and services are readily available at a competitive cost and satisfy the NRC’s performance needs.

(c) The contractor shall flow down this clause into all subcontracts and other agreements that relate to performance of this contract.

H.4 CONTRACTOR RESPONSIBILITY FOR PROTECTING PERSONALLY IDENTIFIABLE

INFORMATION (PII)

In accordance with the Office of Management and Budget's guidance to Federal agencies and the Nuclear Regulatory Commission's (NRC) implementing policy and procedures, a contractor (including subcontractors and contractor employees), who performs work on behalf of the NRC, is responsible for protecting, from unauthorized access or disclosure, personally identifiable information (PII) that may be provided, developed, maintained, collected, used, or disseminated, whether in paper, electronic, or other format, during performance of this contract.

A contractor who has access to NRC owned or controlled PII, whether provided to the contractor by the NRC or developed, maintained, collected, used, or disseminated by the contractor during the course of contract performance, must comply with the following requirements:

(1) General. In addition to implementing the specific requirements set forth in this clause, the contractor must adhere to all other applicable NRC guidance, policy and requirements for the handling and protection of NRC owned or controlled PII. The contractor is responsible for making sure that it has an adequate understanding of such guidance, policy and requirements.

(2) Use, Ownership, and Nondisclosure. A contractor may use NRC owned or controlled PII solely for purposes of this contract, and may not collect or use such PII for any purpose outside the contract without the prior written approval of the NRC Contracting Officer. The contractor must restrict access to such information to only those contractor employees who need the information to perform work under this contract, and must ensure that each such contractor employee (including subcontractors' employees) signs a nondisclosure agreement, in a form suitable to the NRC Contracting Officer, prior to being granted access to the information. The NRC retains sole ownership and rights to its PII. Unless the contract states otherwise, upon completion of the contract, the contractor must turn over all PII in its possession to the NRC, and must certify in writing that it has not retained any NRC owned or controlled PII except as otherwise authorized in writing by the NRC Contracting Officer.

(3) Security Plan. When applicable, and unless waived in writing by the NRC Contracting Officer, the contractor must work with the NRC to develop and implement a security plan setting forth adequate procedures for the protection of NRC owned or controlled PII as well as the procedures which the contractor must follow for notifying the NRC in the event of any security breach. The plan will be incorporated into the contract and must be implemented and followed by the contractor once it has been approved by the NRC Contracting Officer. If the contract does not include a security plan at the time of contract award, a plan must be submitted for the approval of the NRC Contracting Officer within 30 days after contract award.

(4) Breach Notification. The contractor must immediately notify the NRC Contracting Officer and the NRC Contracting Officer’s Representative (COR) upon discovery of any suspected or confirmed breach in the security of NRC owned or controlled PII.

(5) Legal Demands for Information. If a legal demand is made for NRC owned or controlled PII (such as by subpoena), the contractor must immediately notify the NRC Contracting Officer and the NRC Contracting Officer’s Representative (COR). After notification, the NRC will determine whether and to what extent to comply with the legal demand. The Contracting Officer will then notify the contractor in writing of the determination and such notice will indicate the extent of disclosure authorized, if any. The contractor may only release the information specifically demanded with the written permission of the NRC Contracting Officer.

(6) Audits. The NRC may audit the contractor's compliance with the requirements of this clause, including through the use of online compliance software.

(7) Flow-down. The prime contractor will flow this clause down to subcontractors that would be covered by any portion of this clause, as if they were the prime contractor.

(8) Remedies:

(a) The contractor is responsible for implementing and maintaining adequate security controls to prevent the loss of control or unauthorized disclosure of NRC owned or controlled PII in its possession. Furthermore, the contractor is responsible for reporting any known or suspected loss of control or unauthorized access to PII to the NRC in accordance with the provisions set forth in Article 4 above.

(b) Should the contractor fail to meet its responsibilities under this clause, the NRC reserves the right to take appropriate steps to mitigate the contractor's violation of this clause. This may include, at the sole discretion of the NRC, termination of the subject contract.

(9) Indemnification. Notwithstanding any other remedies available to the NRC, the contractor will indemnify the NRC against all liability (including costs and fees) for any damages arising out of violations of this clause.

H.5 INTERNET

Neither NRC nor its third party contractors that manage or develop the NRC web site shall send persistent cookies, place persistent cookies on users' computers, nor collect personally identifiable information from visitors to the NRC web site unless in addition to clear and conspicuous notice, each of the following conditions are met: there is a compelling need to gather the data on the site; there are appropriate and publicly disclosed privacy safeguards for handling of information derived from "cookies"; and personal approval is obtained from the head of the agency.

H.6 ANNUAL AND FINAL CONTRACTOR PERFORMANCE EVALUATIONS

Annual and final evaluations of contractor performance under this contract will be prepared in accordance with FAR Subpart 42.15, "Contractor Performance Information," normally at or near the time the contractor is notified of the NRC's intent to exercise the contract option. If the multi-year contract does not have option years, then an annual evaluation will be prepared []. Final evaluations of contractor performance will be prepared at the expiration of the contract during the contract closeout process.

The Contracting Officer will transmit the NRC Contracting Officer’s Representative’s (COR) annual and final contractor performance evaluations to the contractor's Project Manager, unless otherwise instructed by the contractor. The contractor will be permitted thirty days to review the document and submit comments, rebutting statements, or additional information.

Where a contractor concurs with, or takes no exception to an annual performance evaluation, the Contracting Officer will consider such evaluation final and releasable for source selection purposes. Disagreements between the parties regarding a performance evaluation will be referred to an individual one level above the Contracting Officer, whose decision will be final.

The Contracting Officer will send a copy of the completed evaluation report, marked "Source Selection Information”, to the contractor's Project Manager for their records as soon as practicable after it has been finalized. The completed evaluation report also will be used as a tool to improve communications between the NRC and the contractor and to improve contract performance.

The completed annual performance evaluation will be used to support future award decisions in accordance with FAR 42.1502 and 42.1503. During the period the information is being used to provide source selection information, the completed annual performance evaluation will be released to only two parties - the Federal government personnel performing the source selection evaluation and the contractor under evaluation if the contractor does not have a copy of the report already.

H.7 GOVERNMENT FURNISHED EQUIPMENT/PROPERTY

(a) The NRC will provide the contractor with the following items for use under this contract:

1. None

(b) Only the equipment/property listed above in the quantities shown will be provided by the Government.