MAS - Carahsoft Technology Corp - 47QSWA18D008F

Page 1 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

47QSWA18D008F

General Services Administration

Federal Supply Service Authorized Federal Supply Schedule Price List

Contractor:

Carahsoft Technology Corp.

11493 Sunset Hills Rd., Suite 100 Reston, VA 20190

Phone: (703) 871-8500 Fax: (703) 871-8505 www.carahsoft.com

Contract Number:

Multiple Award Schedule (MAS)

Period Covered by Contract:

August 22, 2018 – August 21, 2028

Authorized Special Item Numbers (SINs):

Special Item No. 33411: Purchasing of new electronic equipment Special Item No. 511210: Software Publishers Special Item No. 518210C: Cloud and Cloud-Related IT Professional Services Special Item No. 532420L: Leasing of new electronic equipment Special Item No. 541370GEO: Earth Observation Solutions Special Item No. 54151: Software Maintenance Services Special Item No. 54151ECOM: Electronic Commerce and Subscription Services Special Item No. 54151S: Information Technology Professional Services Special Item No. 561422: Automated Contact Center Solutions (ACCS) Special Item No. 611420: Information Technology Training Special Item No. 811212: Maintenance of Equipment, Repair Services &/or Repair/Spare Parts Special Item No. 333429: 3D Printing and Additive Manufacturing Solutions Special Item No. 518210ERM: Electronic Records Management Special Item No. 493110RM: Physical Records Management Solutions Special Item No. 3361E: Electric and Autonomous Vehicles and Accessories Special Item No. OLM: Order-Level Materials (OLM) Special Item No. 518210FM Financial Management Quality Service Management Office Special Item No. 541519CSP Credential Service Providers

Online access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order are available through GSA Advantage!, a menu-driven database system. The Internet address for GSA Advantage! Is https://gsaadvantage.gov

Page 2 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Table of Contents

Contractor Data and Points of Contact Contractor’s Point of Contact for Contract Administration

Ordering Instructions / Terms and Conditions 1a. Authorized Special Item Numbers (SINs) 1b. Lowest Priced Model Number and Price for Each SIN 1c. Hourly Rates

2. Maximum Order

3. Minimum Order

4. Geographic Coverage

5. Point(s) of Production

6. Discount from Internal Rate

7. Quantity Discount

8. Prompt Payment Terms

9. Government Purchase Card

10. Foreign Items 11a. Time of Delivery 11b. Expedited Delivery 11c. Overnight and 2-Day Delivery 11d. Urgent Requirements

12. FOB Point 13a. Ordering Address 13b. Ordering Procedures

14. Payment Address

15. Warranty Provision

16. Export Packing Charges

17. Terms and Conditions of Government Purchase Card Acceptance

18. Terms and Conditions of Rental, Maintenance, and Repair (if applicable)

19. Terms and Conditions of Installation

21. List of Service and Distribution Points

22. List of Participating Dealers

23. List of Approved Manufacturer CSAs Manufactures End-User License Agreements Additional terms may apply 24a. Preventative Maintenance

25. Data Universal Number System (DUNS) Number

26. Notification Regarding Registration in System for Award Management (SAM) Database

27. Labor Category Descriptions and Pricing

28. Non-Defective Product Returns

Table of Awarded Special Item Numbers (SINs) Special Item Number Information Special Item No. 33411: Purchasing of New Electronic Equipment Special Item No. 511210: Software Publishers Special Item No. 518210C: Cloud and Cloud-Related IT Professional Services Special Item No. 532420L: Leasing of new electronic equipment

SIN 532420L Option 1 Lease Terms and Conditions SIN 532420L Option 2 Lease Terms and Conditions

Special Item No. 541370GEO: Earth Observation Solutions Special Item No. 54151: Software Maintenance Services Special Item No. 54151ECOM: Electronic Commerce and Subscription Services Special Item No. 54151S: Information Technology Professional Services Special Item No. 561422: Automated Contact Center Solutions (ACCS) Special Item No. 611420: Information Technology Training Special Item No. 811212: Maintenance of Equipment, Repair Services and/or Repair/Spare Parts SIN 811212 Hardware Maintenance Order Terms SIN 811212 Hardware Repair Service Order Terms Special Item No. 333429: 3D Printing Solutions and Additive Manufacturing Solutions

Page 3 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Special Item No. 518210ERM: Electronic Records Management Vendor Certification for SIN 518210ERM Vendor Certification for SIN 493110RM Vendor Certification for SIN 493110RM

ATTACHMENT I - AUTHORIZED PARTICIPATING DEALERS

ATTACHMENT II – Contractor Team Arrangements ATTACHMENT III – Commercial Supplier Agreements ATTACHMENT IV A – U.S. Government Adobe FITARA Addendum ATTACHMENT IV B – U.S. Government Nutanix FITARA Addendum ATTACHMENT IV C - U.S. Government VERITAS FITARA Addendum ATTACHMENT V – Approved IT Manufacturers Promotions

Page 4 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Contractor Data and Points of Contact

Contractor’s Point of Contact for Contract Administration Yvonne DLuzen – Contract Manager Carahsoft Technology Corp.

11493 Sunset Hills Rd., Suite 100

Reston, VA 20190

(703) 871-8500 (Main) | (703) 871-8505 (fax) contracts@carahsoft.com

Business Size: Other than Small

DUNs Number: 088365767

Ordering Instructions / Terms and Conditions

1a. Authorized Special Item Numbers (SINs) Special Item No. 33411: Purchasing of new electronic equipment.

Special Item No. 511210: Software Publishers Special Item No. 518210C: Cloud and Cloud-Related IT Professional Services Special Item No. 532420L: Leasing of new electronic equipment Special Item No. 541370GEO: Earth Observation Solutions Special Item No. 54151: Software Maintenance Services Special Item No. 54151ECOM: Electronic Commerce and Subscription Services Special Item No. 54151S: Information Technology Professional Services Special Item No. 561422: Automated Contact Center Solutions (ACCS) Special Item No. 611420: Information Technology Training Special Item No. 811212: Maintenance of Equipment, Repair Services &/or Repair/Spare Parts Special Item No. 333429: 3D Printing and Additive Manufacturing Solutions Special Item No. 518210ERM: Electronic Records Management Special Item No. 493110RM: Physical Records Management Solutions Special Item No. 3361E: Electric and Autonomous Vehicles and Accessories Special Item No. OLM: Order-Level Materials (OLM) Special Item No. 518210FM Financial Management Quality Service Management Office Special Item No. 541519CSP Credential Service Providers

1b. Lowest Priced Model Number and Price for Each SIN:

Not applicable.

1c. Hourly Rates See the Terms and Conditionsfor SIN 54151S on pg. 37, below.

2. Maximum Order

SIN 33411 $500,000

SIN 511210 $500,000

SIN 518210C $500,000

SIN 532420L $500,000

SIN 541370GEO $1,000,000

SIN 54151 $500,000

SIN 54151ECOM $500,000

SIN 54151S $500,000

SIN 564122 $500,000

SIN 611420 $250,000

SIN 811212 $500,000

Page 5 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

SIN 333429 $750,000

SIN 518210ERM $1,000,000

SIN 493110RM $1,000,000

SIN 3361E $2,000,000

SIN OLM $250,000

SIN 518210FM $500,000

SIN 541519CSP $500,00

Page 6 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

3. Minimum Order: Not Applicable

4. Geographic Coverage

Domestic and Overseas

5. Point(s) of Production Varies by Manufacturer

6. Discount from Internal Rate The GSA Net Price published on GSA Advantage! Reflects the fully burdened price. The negotiated discount has been applied and the Industrial Funding Fee has been added.

7. Quantity Discount Varies by Manufacturer, as reflected on GSA Advantage!

8. Prompt Payment Terms Net 30 Days Information for Ordering Offices: Prompt Payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

9. Government Purchase Card Accepted for sales at or below the micro-purchase threshold.

Acceptance for purchases above the micro-purchase threshold will be determined on a procurement-by-procurement basis.

10. Foreign Items

None

11a. Time of Delivery SIN 33411: 45 Days after Receipt of Order

Page 7 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

SIN 511210: 30 Days after Receipt of Order SIN 518210C: 30 Days after Receipt of Order SIN 532420L: 30 Days after Receipt of Order SIN 541370GEO: 30 Days after Receipt of Order SIN 54151: 30 Days after Receipt of Order SIN 54151ECOM: 30 Days after Receipt of Order SIN 54151S: 30 Days after Receipt of Order SIN 561422: 30 Days after Receipt of Order SIN 611420: 30 Days after Receipt of Order SIN 811212: 30 Days after Receipt of Order SIN 333429: 30 Days after Receipt of Order SIN 518210ERM: 30 Days after Receipt of Order SIN 493110RM: 30 Days after Receipt of Order SIN 3361E: 30 Days after Receipt of Order SIN 518210FM 30 Days after Receipt of Order SIN 541519CSP 30 Days after Receipt of order

11b. Expedited Delivery Please contact the Contractor for availability and rates.

11c. Overnight and 2-Day Delivery Please contact the Contractor for availability and rates.

11d. Urgent Requirements

Agencies can contact the Contractor’s representative to affect a faster delivery. Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

12. FOB Point Destination

13a. Ordering Address

Karina Woods – Operations Manager Carahsoft Technology Corp.

11493 Sunset Hills Rd., Suite 100

Reston, VA 20190

(703) 871-8519 (telephone)

(703) 871-8505 (fax) gsaorders@carahsoft.com

13b. Ordering Procedures

For supplies and services, the ordering procedures and information on Blanket Purchase Agreements (BPAs) are found in Federal Acquisition Regulation (FAR) 8.405-3.

14. Payment Address Jillian Szczepanek Accounts Receivable Carahsoft Technology Corp.

11493 Sunset Hills Rd., Suite 100 Reston, VA 20190

(703) 871-8614 (telephone)

(703) 871-8505 (fax) gsapayments@carahsoft.com

Page 8 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

15. Warranty Provision Varies by Manufacturer and Product/Service

16. Export Packing Charges Not applicable

17. Terms and Conditions of Government Purchase Card Acceptance Please contact the Contractor for terms and conditions of acceptance.

18. Terms and Conditions of Rental, Maintenance, and Repair (if applicable)

19. Terms and Conditions of Installation

20a. Terms and Conditions of Repair Parts Indicating Date of Parts Price Lists and Any Discounts from List Prices (if available)

Not applicable

20b. Terms and Conditions for Any Other Services Not applicable

21. List of Service and Distribution Points

22. List of Participating Dealers The full list of Participating Dealers can be found on the Carahsoft website, GSA MAS Schedule Authorized Dealers | Carahsoft

23. List of Approved Manufacturer CSAs Manufactures End-User License Agreements Additional terms may apply.

24a. Preventative Maintenance None

24b. Special Attributes such as Environmental Attributes (e.g. recycled content, energy efficiency, and/or reduced pollutants)

None

24c. Section 508 Compliance for Electronic and Information Technology Varies by Manufacturer

25. Data Universal Number System (DUNS) Number 088365767

26. Notification Regarding Registration in System for Award Management (SAM) Database Contractor has an Active Registration in the SAM database

Page 9 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

27. Labor Category Descriptions and Pricing See the Terms and Conditions for SIN 54151S beginning on page 37 below.

28. Non-Defective Product Returns Products are eligible for return or replacement within 30 days of invoice. New and unopened product return requests received more than 30 days after invoice are considered to be out-of-policy return requests. These types of requests will be considered on a case-by-case basis. Any applicable shipping costs are to be paid by the customer.

Page 10 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Table of Awarded Special Item Numbers (SINs)

Authorized Special Item Numbers (SINs) Title/ Description

33411 Purchasing of new electronic equipment

511210 Software Publishers

518210C Cloud and Cloud-Related IT Professional Services

532420L Leasing of new electronic equipment

541370GEO Earth Observation Solutions

54151 Software Maintenance Services 54151ECOM Electronic Commerce and Subscription Services

54151S Information Technology Professional Services

561422 Automated Contact Center Solutions (ACCS)

611420 Information Technology Training

811212 Maintenance of Equipment, Repair Services and/or Repair/Spare Parts

333429 3D Printing and Additive Manufacturing Solutions

518210ERM Electronic Records Management

493110RM Physical Records Management Solutions

3361E Electric and Autonomous Vehicles and Accessories

OLM Order-Level Materials (OLM)

518210FM Financial Management Quality Service Management Office (FM QSMO) Core Financial Management (FM) Solutions and IT Professional Services

541519CSP Credential Service Providers

Special Item Number Information

Special Item No. 33411: Purchasing of New Electronic Equipment

Includes desktop, laptop, tablet computers (including rugged), servers, storage equipment, hyperconverged integrated systems, supercomputers, routers, switches and other communications equipment, IT security equipment (hardware based firewalls), audio and video (AV) equipment, public address systems, monitors/displays, sensors, and other Internet of Things (IOT) devices, printers and Multi-Function Device (MFD) equipment, broadcast band radio, two-way radio (LMR), microwave radio equipment, satellite communications equipment, radio transmitters/receivers (airborne), radio navigation equipment/antennas, optical/imaging systems, and associated peripherals required for operations (such as controllers, connectors, cables, drivers, adapters, etc., ancillary installation of any equipment purchased.

NOTE: Subject to Cooperative Purchasing FSC CLASS 7010 - SYSTEM CONFIGURATION End User Computers/Desktop Computers Professional Workstations Servers Laptop/Portable/Notebook Computers Large Scale Computers Optical and Imaging Systems Other Systems Configuration Equipment, Not Elsewhere Classified

FSC CLASS 7025 - INPUT/OUTPUT AND STORAGE DEVICES

Printers Display Graphics, including Video Graphics, Light Pens, Digitizers, Scanners, and Touch Screens

Page 11 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Network Equipment

Other Communications Equipment Optical Recognition Input/Output Devices Storage Devices including Magnetic Storage, Magnetic Tape Storage and Optical Disk Storage Other Input/Output and Storage Devices, Not Elsewhere Classified

FSC CLASS 7035 - ADP SUPPORT EQUIPMENT

ADP Support Equipment

FSC Class 7042 - MINI AND MICRO COMPUTER CONTROL DEVICES Microcomputer Control Devices Telephone Answering and Voice Messaging Systems

FSC CLASS 7050 - ADP COMPONENTS

ADP Boards

FSC CLASS 5995 - CABLE, CORD, AND WIRE

ASSEMBLIES: COMMUNICATIONS EQUIPMENT

Communications Equipment Cables

FSC CLASS 6015 - FIBER OPTIC CABLES

Fiber Optic Cables

FSC CLASS 6020 - FIBER OPTIC CABLE ASSEMBLES AND HARNESSES

Fiber Optic Cable Assemblies and Harnesses

FSC CLASS 6145 - WIRE AND CABLE, ELECTRICAL

Coaxial Cables

FSC Class 5805 - TELEPHONE AND TELEGRAPH EQUIPMENT Telephone Equipment Audio and Video Teleconferencing Equipment

FSC CLASS 5810 - COMMUNICATIONS SECURITY EQUIPMENT AND COMPONENTS

Communications Security Equipment

FSC CLASS 5815 - TELETYPE AND FACSIMILE EQUIPMENT

Facsimile Equipment (FAX)

FSC CLASS 5820 - RADIO AND TELEVISION COMMUNICATION EQUIPMENT, EXCEPT

AIRBORNE

Two-Way Radio Transmitters/Receivers/Antennas Broadcast Band Radio Transmitters/ Receivers/ Antennas Microwave Radio Equipment/Antennas and Waveguides Satellite Communications Equipment

FSC CLASS 5821 - RADIO AND TELEVISION COMMUNICATION EQUIPMENT, AIRBORNE

Airborne Radio Transmitters/Receivers

FSC CLASS 5825 - RADIO NAVIGATION EQUIPMENT, EXCEPT AIRBORNE

Radio Navigation Equipment/Antennas

FSC CLASS 5826 - RADIO NAVIGATION EQUIPMENT, AIRBORNE

Airborne Radio Navigation Equipment

FSC CLASS 5830 - INTERCOMMUNICATION AND P UBLIC ADDRESS SYSTEMS, EXCEPT

AIRBORNE

Page 12 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Pagers and Public Address Systems (wired and wireless transmissions, including background music systems)

FSC CLASS 5841 - RADAR EQUIPMENT, AIRBORNE

Airborne Radar Equipment

FSC CLASS 5895 - MISCELLANEOUS COMMUNICATION EQUIPMENT

Miscellaneous Communications Equipment Installation (FPDS Code N070) for Equipment Offered Deinstallation (FPDS N070) Reinstallation (FPDS N070)

Special Item No. 511210: Software Publishers

Includes both term and perpetual software licenses and maintenance. NOTE: Subject to

Cooperative Purchasing

FSC CLASS 7030 - INFORMATION TECHNOLOGY SOFTWARE

Large Scale Computers

- Operating System Software

- Application Software

- Electronic Commerce (EC) Software

- Utility Software

- Communications Software

- Core Financial Management Software

- Ancillary Financial Systems Software

- Special Physical, Visual, Speech, and Hearing Aid

Software Microcomputers

- Software Microcomputers

- Operating System Software

- Application Software

- Electronic Commerce (EC) Software

- Utility Software

- Communications Software

- Core Financial Management Software

- Ancillary Financial Systems Software

- Special Physical, Visual, Speech, and Hearing Aid Software

Page 13 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Special Item No. 518210C: Cloud and Cloud-Related IT Professional Services

Includes commercially available cloud computing services such as Infrastructure as a Service (Iaa S), Platform as a Service (Paa S), and Software as a Service (Saa S) and emerging cloud services. IT professional services that are focused on providing the types of services that support the Government ’s adoption of, migration to or governance/management of Cloud computing. Specific labor categories and/or fixed price solutions (e.g. migration services, etc.) that support activities associated with assessing Cloud solutions, refactoring workloads for Cloud solutions, migrating legacy or other systems to Cloud solutions, providing management/governance of Cloud solutions, DevOps, developing cloud native applications or other Cloud oriented activities.

NOTE: Subject to Cooperative Purchasing

FSC/PSC Class D305 IT AND TELECOM- TELEPROCESSING, TIMESHARE, AND CLOUD COMPUTING Cloud Computing Services

Table 1: Cloud Computing Services (i.e. IaaS, etc.)

SIN Description Sub-Categories

Commercially available cloud computing services

Meets the National Institute for

Standards and Technology (NIST) definition of Cloud Computing essential characteristics.

Open to all deployment models (private, public, community or

Software as a Service (SaaS): Consumer uses provider’s applications on cloud infrastructure. Does not manage/control platform or infrastructure. Limited application level configuration may be available.

Platform as a Service (PaaS): Consumer deploys applications onto cloud platform service using provider-supplied tools. Has control over deployed hybrid), vendors specify applications and some limited platform deployment models configuration but does not manage the platform or infrastructure.

3. Infrastructure as a Service (IaaS):

Consumer provisions computing resources. Has control over OS, storage, platform, deployed applications and some limited infrastructure configuration, but does not manage the infrastructure.

Page 14 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

NOTE: Offerors may optionally select the single sub-category that best fits each cloud service offering, per Service Model Guidance, or select no sub-category if the offering does not fit an existing NIST service model.

DESCRIPTION OF CLOUD COMPUTING SERVICES (i.e. IaaS, etc.) AND PRICING

a) The information provided below is designed to assist Offerors in qualifying cloud computing services and provide complete descriptions.

b) In addition to standard pricing requirements, all pricing models must have the core capability to meet the NIST Essential Cloud Characteristics, particularly with respect to on-demand self-service, while allowing alternate variations at the task order level at agency discretion, pursuant to the guidance on NIST Essential Characteristics.

Table 2 summarizes the additional Offeror provided description requirements for services proposed under the Cloud Computing Services (i.e Iaa S, etc.). All mandatory description requirements must be complete, and adequate according to evaluation criteria.

In addition, there is one “Optional” reporting descriptions which exists to provide convenient service selection by relevant criteria. Where provided, optional description requirements must be complete and adequate according to evaluation criteria:

1) The NIST Service Model provides sub-categories for the Cloud SIN and is strongly encouraged, but not required. The Service Model based sub-categories provide this SIN with a structure to assist ordering activities in locating and comparing services of interest. Contractors may optionally select the single service model most closely corresponding to the specific service offering.

2) If a sub-category is selected it will be evaluated with respect to the NIST Service

Model definitions and guidelines in “Guidance for Contractors".

Page 15 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Table 2: Cloud Service Description Requirements

Description Requirement

Reporting Type

Instru ctions

Provide a brief written description of how the proposed cloud computing services (i.e.

Iaa S, etc.)

satisfies each individual essential NIST Characteristic

Mandatory

The cloud service must be capable of satisfying each of the five NIST essential Characteristics as outlined in NIST Special Publication 800-145. See ‘GUIDANCE FOR CONTRACTORS:

NIST Essential Characteristics’ below in this document for detailed overall direction, as well as guidance on inheriting essential characteristics. The NIST “Measured Service” characteristic requires a minimal “pay as you go” unit of measurement appropriate for the service. In the case of SaaS, the appropriate maximum measured increment of service shall be no more than 30 days per user, or some other equivalent discrete measurement that provides the government with the advantage of frequent (approximately every 30 days) “pay as you go” metering cycles. SaaS products, where consumption is only measured on an annual basis, may better fit under “Term Software License” SIN 132-32. Likewise, offers of any combinations of IaaS, Paa S or any other cloud product services in a bundle or other fashion that do not meet the frequency requirements of approximately 30 - day measurement and billing cycles, will not be accepted as complying with the NIST Measured Service characteristic.

Select NIST deployment models for the cloud computing service proposed.

Mandatory

Contractors must select at least one NIST deployment model as outlined in NIST Special Publication 800 - 145 describing how the proposed cloud computing service is deployed. Select multiple deployment models if the service is offered in more than one deployment model.

See ‘GUIDANCE FOR CONTRACTORS: NIST Deployment Model’ below in this document for detailed direction on how to best categorize a service for the NIST deployment models.

Optionally select the most appropriate NIST service model that will be the designated sub- category, or may select no sub-category.

Optional

Contractor may select a single NIST Service model to sub-categorize the service as outlined in NIST Special Publication 800-145. Sub- category selection is optional but recommended.

See ‘GUIDANCE FOR CONTRACTORS: NIST Service Model’ below in this document for detailed direction on how to best categorize a service for the NIST Iaa S, Paa S, and Saa S service models.

Page 16 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

General Guidance

2) GUIDANCE FOR OFFERORS

This section offers guidance for interpreting the Contractor Description Requirements in Table 2 (above) including the NIST essential cloud characteristics, service models and deployment models. This section is not a list of requirements.

Offeror specific definitions of cloud computing characteristics and models or significant variances from the NIST essential characteristics or models are discouraged and will not be considered in the scope of this SIN or accepted in response to evaluation factors. The only applicable cloud characteristics, service model/subcategories and deployment models for this SIN will be drawn from the NIST 800-145 special publication. Services qualifying for listing as cloud computing services (i.e. Iaa S, etc.) under this SIN must substantially satisfy the essential characteristics of cloud computing as documented in the NIST Definition of

Cloud Computing SP 800-1451

Offerors must select deployment models corresponding to each way the service can be deployed. Multiple deployment model designations for a single cloud service are permitted but at least one deployment model must be selected.

Both Cloud service model (i.e. Iaa S, etc.) and deployment model (i.e. public, etc.) designations must accord with NIST definitions. Guidance is offered in this document on making the most appropriate selection

a) NIST Essential Characteristics

NIST’s essential cloud characteristics provide a consistent metric for whether a service is eligible for inclusion in this SI N. It is understood that due to legislative, funding and other constraints that government entities cannot always leverage a cloud service to the extent that all NIST essential characteristics are commercially available. For the purposes of the Cloud SIN, meeting the NIST essential characteristics is determined by whether each essential capability of the commercial service is available for the service, whether or not the Ordering Activity actually requests or implements the capability.

The guidance in Table 3 offers examples of how services might or might not be included based on the essential characteristics, and how the Contractor should interpret the characteristics in light of current government contracting processes.

1 7 http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf

Page 17 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Table 3: Guidance on Meeting NIST Essential Characteristics

Characteristic Capability Guidance

On-demand self-service

● Ordering activities can directly provision services without requiring Contractor intervention.

● This characteristic is typically implemented via a service console or programming interface for provisioning

Government procurement guidance varies on how to implement on-demand provisioning at this time.

Ordering activities may approach on-demand in a variety of ways, including “not-to-exceed” limits, or imposing monthly or other appropriate payment cycles on what are essentially on demand services.

Services under this SIN must be capable of true on- demand self-service, and ordering activities and Contractors must negotiate how they implement on demand capabilities in practice at the task order level:

● Ordering activities must specify their procurement approach and requirements for on- demand service

● Contractors must propose how they intend to meet the approach

● Contractors must certify that on-demand self-service is technically available for their service should procurement guidance become available.

Broad Network Access

● Ordering activities are able to access services over standard agency networks

● Service can be accessed and provisioned using standard devices such as browsers, tablets and mobile phones

● Broad network access must be available without significant qualification and in relation to the deployment model and security domain of the service

● Contractors must specify any ancillary activities, services or equipment required to access cloud services or integrate cloud with other cloud or non-cloud networks and services. For example, a private cloud might require an Ordering Activity to purchase or provide a dedicated router, etc. which is acceptable but should be indicated by the Contractor.

Resource Pooling

● Pooling distinguishes cloud services from simple offsite hosting.

● Ordering activities draw resources from a common pool maintained by the Contractor

● Resources may have general characteristics such as regional location

● The cloud service must draw from a pool of resources and provide an automated means for the Ordering Activity to dynamically allocate them.

● Manual allocation, e.g. manual operations at a physical server farm where Contractor staff configure servers in response to Ordering Activity requests, does not meet this requirement

● Similar concerns apply to software and platform models; automated provisioning from a pool is required

● Ordering activities may request dedicated physical hardware, software or platform resources to access a private cloud deployment service. However the provisioned cloud resources must be drawn from a common pool and automatically allocated on request.

Rapid Elasticity ● Rapid provisioning and de- provisioning commensurate with demand

● Rapid elasticity is a specific demand-driven case of self-service

● ‘Rapid’ should be understood as measured in minutes and hours, not days or weeks.

● Elastic capabilities by manual request, e.g. via a console operation or programming interface call, are required.

● Automated elasticity which is driven dynamically by system load, etc. is optional. Contractors must specify whether automated demand-driven elasticity is available and the general mechanisms that drive the capability.

Page 18 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Inheriting Essential Characteristics

Assessing Broad Network Access

Resource Pooling and Private Cloud

Measured Service

● Measured service should be understood as a reporting requirement that enables an Ordering Activity to control their use in cooperation with self service

● Procurement guidance for on-demand self-service applies to measured service as well, i.e. rapid elasticity must be technically available but ordering activities and Contractors may mutually designate other contractual arrangements.

● Regardless of specific contractual arrangements, reporting must indicate actual usage, be continuously available to the Ordering Activity, and provide meaningful metrics appropriate to the service measured

● Contractors must specify that measured service is available and the general sort of metrics and mechanisms available

● The goal of the Measured Service requirement is to ensure Ordering Activities realize the full benefit of “pay as you go” consumption models.

Consumption measurements that are not discrete enough or frequent enough (greater than 30 days), will not fulfill this NIST essential characteristic and will not be eligible for inclusion in this SIN.

Cloud Services (i.e. Iaa S, etc.) may depend on other cloud services, and cloud service models such as Paa S and Saa S are able to inherit essential characteristics from other cloud services that support them. For example a Paa S platform service can inherit the b road network access made available by the Iaa S service it runs on, and in such a situation would be fully compliant with the broad network access essential characteristic. Cloud Services (i.e. Iaa S, etc.) inheriting essential characteristics must make the inherited characteristic fully available at their level of delivery to claim the relevant characteristic by inheritance.

Inheriting characteristics does not require the inheriting provider to directly bundle or integrate the inherited service, bu t it does require a reasonable measure of support and identification. For example, the Ordering Activity may acquire an Iaa S service from “Provider A” and a Paa S service from “Provider B”. The Paa S service may inherit broad network access from “Provider A” but must identify and support the inherited service as an acceptable IaaS provider.

Typically broad network access for public deployment models implies high bandwidth access from the public internet for authorized users.

In a private cloud deployment internet access might be considered broad access, as might be access through a dedicated shared high bandwidth network connection from the Ordering Activity, in accord with the private nature of the deployment model.

All cloud resource pools are finite, and only give the appearance of infinite resources when sufficiently large, as is sometimes the case with a public cloud. The resource pool supporting a private cloud is typically smaller with more visible limits. A finite pool of resources purchased as a private cloud service qualifies as resource pooling so long as the resources within the pool can be dynamically allocate d to the ultimate users of the resource, even though the pool itself appears finite to the Ordering Activity that procures access to the pool as a source of dynamic service allocation.

1) NIST Service Model The Contractor may optionally document the service model of cloud computing (e.g. Iaa S, Paa S, Saa S, or a combination thereof, that most closely describes their offering, using the definitions in the NIST Definition of

Page 19 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Cloud Computing SP 800 -145. The following guidance is offered for the proper selection of service models.

NIST’s service models provide this SIN with a set of consistent sub-categories to assist ordering activities in locating and comparing Cloud services (i.e. Iaa S, etc.) of interest. Service model is primarily concerned with the nature of the service offered and the staff and activities most likely to interact with the service. Contractors should select a single service model most closely corresponding to their proposed service based on the guidance below. It is understood that cloud services can technically incorporate multiple service models and the intent is to provide the single best categorization of the service.

Contractors should take care to select the NIST service model most closely corresponding to each service offered. Contractors should not invent, proliferate or select multiple cloud service model sub-categories to distinguish their offerings, because ad-hoc categorization prevents consumers from comparing similar offerings. Instead vendors should make full use of the existing NIST categories to the fullest extent possible.

For example, in this SIN an offering commercially marketed by a Contractor as “Storage as a Service” would be properly characterized as Infrastructure as a Service (Iaa S), storage being a subset of infrastructure.

Services commercially marketed as “LAMP as a Service” or “Database as a Service” would be properly characterized under this SIN as Platform as a Service (Paa S), as they deliver two kinds of platform services.

Services commercially marketed as “Travel Facilitation as a Service” o r “Email as a Service” would be properly characterized as species of Software as a Service (Saa S) for this SIN.

However, Contractors can and should include appropriate descriptions (including commercial marketing terms) of the service in the full descriptions of the service’s capabilities.

When choosing between equally plausible service model sub-categories, Contractors should consider several factors:

a) Visibility to the Ordering Activity. Service model sub-categories in this SIN exist to help Ordering

Activities match their requirements with service characteristics. Contractors should select the most intuitive and appropriate service model from the point of view of an Ordering Activity.

b) Primary Focus of the Cloud Service (i.e. Iaa S, etc.). Services m ay offer a mix of capabilities that span service models in the strict technical sense. For example, a service may offer both Iaa S capabilities for processing and storage, along with some Paa S capabilities for application deployment, or Saa S capabilities for specific applications. In a service mix situation the Contractor should select the service model that is their primary focus. Alternatively contractors may choose to submit multiple service offerings for the SIN, each optionally and separately subcategorized.

c) Ordering Activity Role. Contractors should consider the operational role of the Ordering Activity’s primary actual

d) consumer or operator of the service. For example services most often consumed by system managers are likely to fit best as Iaa S; services most often consumed by application deployers or developers as Paa S, and services most often consumed by business users as Saa S.

e) Lowest Level of Configurability. Contractors can consider Iaa S, Paa S and Saa S as an ascending hierarchy of complexity, and select the model with the lowest level of available Ordering Activity interaction. As an example, virtual machines are an Iaa S service often bundled with a range of operating systems, which are Paa S services. The Ordering Activity usually has access to configure the lower level Iaa S service, and the overall service should be considered Iaa S. In cases where the Ordering Activity cannot configure the speed, memory, network configuration, or any other aspect of the Iaa S component, consider categorizing as a Paa S service.

Cloud management and cloud broker services should be categorized based on their own characteristics and not those of the othe r cloud services that are their targets. Management and broker services typically fit the Saa S service model, regardless of whether the services they manage are Saa S, Paa S or Iaa S. Use

Page 20 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Table 3 to determine which service model is appropriate for the cloud management or cloud broker services, or, alternately choose not to select a service model for the service.

The guidance in Table 4 offers examples of how services might be properly mapped to NIST service models and how a Contractor should interpret the service model sub-categories.

Table 4: Guidance on Mapping to NIST Service Models

Service Model Guidance

Infrastructure as a Service (IaaS)

Select an IaaS model for service based equivalents of hardware appliances such as virtual machines, storage devices, routers and other physical devices.

● IaaS services are typically consumed by system or device managers who would configure physical hardware in a non-cloud setting

● The principal customer interaction with an IaaS service is provisioning then configuration, equivalent to procuring and then configuring a physical device.

Examples of IaaS services include virtual machines, object storage, disk block storage, network routers and firewalls, software defined networks.

Gray areas include services that emulate or act as dedicated appliances and are directly used by applications, such as search appliances, security appliances, etc. To the extent that these services or their emulated devices provide direct capability to an application they might be better classified as Platform services (PaaS). To the extent that they resemble raw hardware and are consumed by other platform services they are better classified as IaaS.

Page 21 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Platform as a Service (PaaS) Select a PaaS model for service based equivalents of complete or partial software platforms. For the purposes of this classification, consider a platform as a set of software services capable of deploying all or part of an application.

● A complete platform can deploy an entire application. Complete platforms can be proprietary or open source

● Partial platforms can deploy a component of an application which combined with other components make up the entire deployment

● PaaS services are typically consumed by application deployment staff whose responsibility is to take a completed agency application and cause it to run on the designated complete or partial platform service

● The principal customer interaction with a PaaS service is deployment, equivalent to deploying an application or portion of an application on a software platform service.

● A limited range of configuration options for the platform service may be available.

Examples of complete PaaS services include:

● A Linux/Apache/MySQL/PHP (LAMP) platform ready to deploy a customer PHP application,

● a Windows .Net platform ready to deploy a .Net application,

● A custom complete platform ready to develop and deploy a customer application in a proprietary language

● A multiple capability platform ready to deploy an arbitrary customer application on a range of underlying software services.

The essential characteristic of a complete PaaS is defined by the customer’s ability to deploy a complete custom application directly on the platform.

PaaS includes partial services as well as complete platform services. Illustrative examples of individual platform enablers or components include:

● A database service ready to deploy a customer’s tables, views and procedures,

● A queuing service ready to deploy a customer’s message definitions

● A security service ready to deploy a customer’s constraints and target applications for continuous monitoring

The essential characteristic of an individual PaaS component is the customer’s ability to deploy their unique structures and/or data onto the component for a partial platform function.

Note that both the partial and complete PaaS examples all have two things in common:

● They are software services, which offer significant core functionality out of the box

● They must be configured with customer data and structures to deliver results

As noted in IaaS, operating systems represent a gray area in that OS is definitely a platform service, but is typically bundled with IaaS infrastructure. If your service provides an OS but allows for interaction with infrastructure, please sub-categorize it as IaaS. If your service “hides” underlying infrastructure, consider it as PaaS.

Page 22 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

2) Deployment Model

Deployment models (e.g. private, public, community, or hybrid) are not restricted at the SIN level and any specifications for a deployment model are the responsibility of the Ordering Activity.

Multiple deployment model selection is permitted, but at least one model must be selected. The guidance in Table 4 offers examples of how services might be properly mapped to NIST deployment models and how the Contractor should interpret the deployment model characteristics. Contractors should take care to select the range of NIST deploym ent models most closely corresponding to each service offered.

Note that the scope of this SIN does not include hardware or software components used to construct a cloud, only cloud capabilities delivered as a service, as noted in the Scope section.

Software as a Service (SaaS)

Select a SaaS model for service based equivalents of software applications.

● SaaS services are typically consumed by business or subject-matter staff who would interact directly with the application in a non-cloud setting

● The principal customer interaction with a SaaS service is actual operation and consumption of the application services the SaaS service provides.

Some minor configuration may be available, but the scope of the configuration is limited to the scope and then the permissions of the configuring user. For example an agency manager might be able to configure some aspects of the application for their agency but not all agencies. An agency user might be able to configure some aspects for themselves but not everyone in their agency. Typically only the Contractor would be permitted to configure aspects of the software for all users.

Examples of SaaS services include email systems, business systems of all sorts such as travel systems, inventory systems, etc., wiki’s, websites or content management systems, management applications that allow a customer to manage other cloud or non-cloud services, and in general any system where customers interact directly for a business purpose.

Gray areas include services that customers use to configure other cloud services, such as cloud management software, cloud brokers, etc. In general these sorts of systems should be considered SaaS, per guidance in this document.

Page 23 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Table 5: Guidance for Selecting a Deployment Model

Deployment Model Guidance

Private Cloud The service is provided exclusively for the benefit of a definable organization and its components; access from outside the organization is prohibited. The actual services may be provided by third parties, and may be physically located as required, but access is strictly defined by membership in the owning organization.

Public Cloud The service is provided for general public use and can be accessed by any entity or organization willing to contract for it.

Community Cloud The service is provided for the exclusive use of a community with a definable shared boundary such as a mission or interest. As with private cloud, the service may be in any suitable location and administered by a community member or a third party.

Hybrid Cloud The service is composed of one or more of the other models. Typically hybrid models include some aspect of transition between the models that make them up, for example a private and public cloud might be designed as a hybrid cloud where events like increased load permit certain specified services in the private cloud to run in a public cloud for extra capacity, e.g.

bursting.

Page 24 Carahsoft Technology Corp. MAS Schedule Terms & Conditions

Special Item No. 532420L: Leasing of new electronic equipment

Leasing of new electronic equipment. Includes the following lease types:

Lease to Ownership, and Lease with Option to Own

NOTE: Subject to Cooperative Purchasing

FSC/PSC Class W070 LEASE OR RENTAL OF EQUIPMENT- ADP

EQUIPMENT/SOFTWARE/SUPPLIERS/SUPPORT EQUIPMENT

Lease of Products

INFORMATION TECHNOLOGY CATEGORY HARDWARE SUBCATEGORY

SIN 532420L Option 1 Lease Terms and Conditions Option 1 Lease Terms and Conditions does not contain a cancellation clause and all leases automatically expire on September 3 0th or sooner.

52.207-5 Option to Purchase Equipment Feb 1995

52.227-14 Rights in Data-General May 2014

1. STATEMENT

a. It is understood by all parties to this contract that orders issued under this SIN shall constitute a lease arrangement. Un less the ordering activity intends to obligate other than annual appropriations to fund the lease, the base period o f the lease is from the date of the product acceptance through September 30 of the fiscal year in which the order is placed.

b. Agencies are advised to follow the guidance provided in Federal Acquisition Regulation (FAR)

Subpart 7.4 Product Lease or Purchase and OMB Circular A-11. Agencies are responsible for the obligation of funding consistent with all applicable legal principles when entering into any lease arrangement.

2. FUNDING AND PERIODS OF LEASING ARRANGEMENTS

a. Annual Funding. When annually appropriated funds are cited on an order for leasing, the following applies:

i. The base period of an order for any lease executed by the ordering activity shall be for the duration of the fiscal year. All ordering activity renewal options under the lease shall be specified in the delivery order. All orders for leasing shall remain in effect through September 30 of the fiscal year or the planned expiration date of the lease, whichever is earlier, unless t he ordering activity exercises its rights hereunder to acquire title to the product prior to the planned expiration date or unless the ordering activity exercises its right to terminate under GSAR 552.212 -4. Orders under the lease shall not be deemed to obligate succeeding fiscal year’s funds or to otherwise commit the ordering activity to a renewal.

ii. All orders for leasing shall automatically terminate on September 30, unless the ordering activity notifies the Contractor in writing thirty (30) calendar days prior to the expiration of such orders of the ordering activity’s intent to renew. Such notice to renew shall not bind

Page 25 Carahsoft Technology Corp. MAS Schedule Terms & Conditions the ordering activity. The ordering activity has the option to renew each year at the original rate in effect at the time the order is placed. This rate applies for the duration o f the order.

If the ordering activity exercises its option to renew, the renewal order shall be issued within 15 days after funds become available for obligation by the ordering activity, or as specified in the initial order. No termination fees shall apply if the ordering activity does not exercise an option.

a. Crossing Fiscal Years Within Contract Period. Where an ordering activity has specific authority to cross fiscal years with annual appropriations, the ordering activity may place an order under this option to lease product for a period up to the expiration of its period of appropriation availability, or twelve months, whichever occurs later, notwithstanding the intervening fiscal years.

3. DISCONTINUANCE AND TERMINATION

Notwithstanding any other provision relating to this SIN, the ordering activity may terminate products leased under this agreement, at any time during a fiscal year in accordance with the termination provisions contained in GSAR 552.212 -4(l) Termination for the ordering activity’s convenience, or (m) Termination for cause. Additionally, no termination for cost or fees shall be charged for non-renewal of an option.

4. The following terms and conditions may be included.

a. ASSIGNMENT OF CLAIMS

GSAR 552.232-23, Assignment of Claims, is incorporated herein by reference as part of these lease provisions. The ordering activity’s contracting officer will acknowledge the assignment of claim for a lease in accordance with FAR 32.8. The extent of the assignee’s protection is in accordance with FAR 32.804. Any setoff provision must be in accordance with

FAR 32.803.

b. PEACEFUL POSSESSION AND UNRESTRICTED USE

In recognition of the types of products available for lease and the potential adverse impact to the ordering activity’s mission, the ordering activity’s quiet and peaceful possession and unrestricted use of the…