MAS - Epiccyber, Inc. - 47QTCA18D00A9

GENERAL SERVICES ADMINISTRATION

FEDERAL ACQUISITION SERVICE

AUTHORIZED FEDERAL SUPPLY SCHEDULE PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order are available through GSA Advantage!, a menu-driven database system. The INTERNET address for GSA Advantage! is GSAAdvantage.gov.

FEDERAL SUPPLY SCHEDULE 70

GENERAL PURPOSE COMMERCIAL INFORMATION TECHNOLOGY

EQUIPMENT, SOFTWARE AND SERVICES

Special Item No. 132-32 Term Software Licenses Special Item No. 132-33 Perpetual Software Licenses Special Item No. 132-34 Maintenance of Software as a Service Special Item No. 132-40 Cloud Computing Services

SPECIAL ITEM NUMBER 132-32 - TERM SOFTWARE LICENSES

Software maintenance as a product includes the publishing of bug/defect fixes via patches and updates/upgrades in function and technology to maintain the operability and usability of the software product. It may also include other no charge support that are included in the purchase price of the product in the commercial marketplace. No charge support includes items such as user blogs, discussion forums, on-line help libraries and FAQs (Frequently Asked Questions), hosted chat rooms, and limited telephone, email and/or web-based general technical support for user’s self-diagnostics.

Software maintenance as a product does NOT include the creation, design, implementation, integration, etc. of a software package. These examples are considered software maintenance as a service – which is categorized under a difference SIN (132-34).

FSC CLASS 7030 - INFORMATION TECHNOLOGY SOFTWARE

Large Scale Computers

Operating System Software Application Software Electronic Commerce (EC) Software Utility Software Communications Software Core Financial Management Software Ancillary Financial Systems Software Special Physical, Visual, Speech, and Hearing Aid Software

Microcomputers Operating System Software Application Software Electronic Commerce (EC) Software

Utility Software Communications Software Core Financial Management Software Ancillary Financial Systems Software Special Physical, Visual, Speech, and Hearing Aid Software

NOTE: Offerors are encouraged to identify within their software items any component interfaces that support open standard interoperability. An item’s interfaces may be identified as interoperable on the basis of participation in a Government agency-sponsored program or in an independent organization program. Interfaces may be identified by reference to an interface registered in the component registry located at http://www.core.gov

SPECIAL ITEM NUMBER 132-33 - PERPETUAL SOFTWARE LICENSES

Software maintenance as a product includes the publishing of bug/defect fixes via patches and updates/upgrades in function and technology to maintain the operability and usability of the software product. It may also include other no charge support that are included in the purchase price of the product in the commercial marketplace. No charge support includes items such as user blogs, discussion forums, on-line help libraries and FAQs (Frequently Asked Questions), hosted chat rooms, and limited telephone, email and/or web-based general technical support for user’s self-diagnostics.

Software maintenance as a product does NOT include the creation, design, implementation, integration, etc. of a software package. These examples are considered software maintenance as a service.

FSC CLASS 7030 - INFORMATION TECHNOLOGY SOFTWARE

Large Scale Computers

Operating System Software Application Software Electronic Commerce (EC) Software Utility Software Communications Software Core Financial Management Software Ancillary Financial Systems Software Special Physical, Visual, Speech, and Hearing Aid Software

Microcomputers Operating System Software Application Software Electronic Commerce (EC) Software Utility Software Communications Software Core Financial Management Software Ancillary Financial Systems Software Special Physical, Visual, Speech, and Hearing Aid Software

NOTE: Offerors are encouraged to identify within their software items any component interfaces that support open standard interoperability. An item’s interface may be identified as interoperable on the basis of participation in a Government agency-sponsored program or in an independent organization program. Interfaces may be identified by reference to an interface registered in the component registry located at http://www.core.gov/ http://www.core.gov/

SPECIAL ITEM NUMBER 132-34 - MAINTENANCE OF SOFTWARE AS A SERVICE

Software maintenance as a service creates, designs, implements, and/or integrates customized changes to software that solve one or more problems and is not included with the price of the software. Software maintenance as a service includes person-to-person communications regardless of the medium used to communicate: telephone support, on- line technical support, customized support, and/or technical expertise that are charged commercially.

Software maintenance as a service is billed arrears in accordance with 31 U.S.C. 3324.

SPECIAL ITEM NUMBER 132-40 – CLOUD COMPUTING SERVICES

Includes commercially available cloud computing services such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) and emerging cloud services. The new Cloud SIN is open to all deployment models (private, public, community or hybrid).

FSC/PSC Class D305 IT AND TELECOM- TELEPROCESSING, TIMESHARE, AND

CLOUD COMPUTING

Cloud Computing Services

CONTRACT NUMBER:

CONTRACT PERIOD: _____________ through _____________________

PRICELIST CURRENT THROUGH: ___________________

For more information on ordering from Federal Supply Schedules, click on the FSS Schedule button at fss.gsa.gov

CONTRACTOR: Epic Machines Inc.

230 California Street, Suite 405 San Francisco, California 94111

DUNS: 062483674

EIN: 46-0895276

Phone: 877-374-2778 (877-EPIC-778) www.epicmachines.com

CONTRACTOR’S POINT OF CONTACT FOR CONTRACT ADMINISTRATION:

David Gottesman Epic Machines Inc.

San Francisco, California 94111

DUNS: 062483674

EIN: 46-0895276

BUSINESS SIZE: Small Disadvantaged Business

CONTRACTOR INFORMATION

1a. TABLE OF AWARDED SPECIAL ITEM NUMBERS (SINs)

SIN 132-32 Term Software License SIN 132-33 Perpetual Software License SIN 132-34 Maintenance of Software as a Service SIN 132-40 Cloud Computing Services

1b. LOWEST PRICED MODEL NUMBER AND PRICE FOR EACH SIN:

Not Applicable

1c. HOURLY RATES:

2. MAXIMUM ORDER:

SIN 132-32 $500,000

SIN 132-33 $500,000

SIN 132-34 $500,000

SIN 132-40 $500,000

3. MINIMUM ORDER: $100

4. GEOGRAPHIC COVERAGE: Domestic and Overseas

5. POINT(S) OF PRODUCTION:

Varies by Manufacturer. Splunk is located in San Francisco, California

6. DISCOUNT FROM INTERNAL RATE:

The GSA Net Prices published on the GSA Advantage website reflect the fully burdened price. The negotiated discount has been applied and the Industrial Funding Fee has been added.

7. QUANTITY DISCOUNT:

Varies as reflected in GSA Advantage.

8. PROMPT PAYMENT TERMS:

Net 30 Days

Information for Ordering Offices: Prompt Payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

9. GOVERNMENT PURCHASE CARD:

Accepted for sales at or below the micro-purchase threshold.

Acceptance for purchases above the micro-purchase threshold will be determined on a procurement-by procurement basis.

10. FOREIGN ITEMS:

None

11a. TIME OF DELIVERY:

SIN 132-32 30 Days after Receipt of Order SIN 132-33 30 Days after Receipt of Order SIN 132-34 30 Days after Receipt of Order SIN 132-40 30 Days after Receipt of Order

11b. EXPEDITED DELIVERY:

Please contact the Contractor for availability and rates.

11c. OVERNIGHT AND 2-DAY DELIVERY:

Please contact the Contractor for availability and rates.

11d. URGENT REQUIRMENTS:

Agencies can contact the Contractor’s representative to affect a faster delivery. Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

1 1 . FOB POINT:

Destination

13a. ORDERING ADDRESS:

San Francisco, California 94111

DUNS: 062483674

EIN: 46-0895276

Phone: 877-374-2778 (877-EPIC-778) GSA@epicmachines.com

13b. ORDERING PROCEDURES:

For supplies and services, the ordering procedures and information on Blanket Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR) 8.405-3.

14. PAYMENT ADDRESS:

2269 Chestnut Street #877 San Francisco, California 94123

EIN: 46-0895276

15. WARRANTY PROVISION:

Varies by Manufacturer and Product/Service

16. EXPORT PACKING CHARGES:

17. TERMS AND CONDITIONS OF GOVERNMENT PURCHASE CARD ACCEPTANCE:

Please contact the Contractor for terms and conditions of acceptance.

18. TERMS AND CONDITIONS OF RENTAL, MAINTENANCE, AND REPAIR (IF APPLICABLE):

19. TERMS AND CONDITIONS OF INSTALLATION:

20. TERMS AND CONDITIONS OF REPAIR PARTS INDICATING DATE OF PARTS PRICE LISTS

AND ANY DISCOUNTS FROM LIST PRICES (IF AVAILABLE):

20a. TERMS AND CONDITIONS FOR ANY OTHER SERVICES:

21. LIST OF SERVICE AND DISTRIBUTION POINTS:

Not Applicable.

22. LIST OF PARTICIPATING DEALERS:

Not Applicable.

23. PREVENTIVE MAINTENANCE:

24a. SPECIAL ATTRIBUTES SUCH AS ENVIRONMENTAL ATTRIBUTES (e.g. recycled content, energy efficiency, and/or reduced pollutants):

24b. SECTION 508 COMPLIANCE FOR ELECTRONIC and INFORMATION TECHNOLOGY:

Varies by Manufacturer.

25. DATA UNIVERSAL NUMBER SYSTEM (DUNS) NUMBER:

062483674

26. NOTIFICATION REGARDING REGISTRATION IN SYSTEM FOR AWARD MANAGEMENT (SAM)

DATABASE:

Contractor has an Active Registration in the SAM database.

27. LABOR CATEGORY DESCRIPTIONS and PRICING:

28. NON-DEFECTIVE PRODUCT RETURNS

Products are eligible for return or replacement within 30 days of invoice. New and unopened product return requests received more than 30 days after invoice are considered to be out of policy return requests. These type requests will be considered on a case-by-case basis. Any applicable shipping costs to be paid by the customer.

1. INSPECTION/ACCEPTANCE

The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The ordering activity reserves the right to inspect or test any software that has been tendered for acceptance. The ordering activity may require repair or replacement of nonconforming software at no increase in contract price.

The ordering activity must exercise its post acceptance rights (1) within a reasonable time after the defect was discovered or should have been discovered; and (2) before any substantial change occurs in the condition of the software, unless the change is due to the defect in the software.

2. ENTERPRISE USER LICENSE AGREEMENTS REQUIREMENTS (EULA)

The Contractor shall provide all Enterprise User License Agreements in an editable Microsoft Office (Word) format.

3. GUARANTEE/WARRANTY

a. Unless specified otherwise in this contract, the Contractor’s standard commercial guarantee/warranty as stated in the Contractor’s commercial pricelist will apply to this contract.

Please Refer to GSAADVANTAGE! For Specific Information Regarding Warranty

b. The Contractor warrants and implies that the items delivered hereunder are merchantable and fit for use for the particular purpose described in this contract.

If no implied warranties are given, an express warranty of at least 60 days must be given in accordance with FAR 12.404(b)(2).

c. Limitation of Liability. Except as otherwise provided by an express or implied warranty, the Contractor will not be liable to the ordering activity for consequential damages resulting from any defect or deficiencies in accepted items.

4. TECHNICAL SERVICES

The Contractor, without additional charge to the ordering activity, shall provide a hot line technical support number 888-662-2724 for the purpose of providing user assistance and guidance in the implementation of the software. The technical support number is available from 8 AM Eastern Time to 5 PM Eastern Time.

5. SOFTWARE MAINTENANCE

a. Software maintenance as it is defined:

TERMS AND CONDITIONS APPLICABLE TO TERM SOFTWARE LICENSES

(SPECIAL ITEM NUMBER 132-32), PERPETUAL SOFTWARE LICENSES (SPECIAL

ITEM NUMBER 132-33) AND MAINTENANCE AS A SERVICE (SPECIAL ITEM

NUMBER 132-34) OF GENERAL PURPOSE COMMERCIAL INFORMATION

TECHNOLOGY SOFTWARE

X 1. Software Maintenance as a Product (SIN 132-32 or SIN 132-33)

Software maintenance as a product includes the publishing of bug/defect fixes via patches and updates/upgrades in function and technology to maintain the operability and usability of the software product. It may also include other no charge support that are included in the purchase price of the product in the commercial marketplace. No charge support includes items such as user blogs, discussion forums, on-line help libraries and FAQs (Frequently Asked Questions), hosted chat rooms, and limited telephone, email and/or web-based general technical support for user’s self-diagnostics.

Software maintenance as a product does NOT include the creation, design, implementation, integration, etc. of a software package. These examples are considered software maintenance as a service. Software Maintenance as a product is billed at the time of purchase.

X 2. Software Maintenance as a Service (SIN 132-34)

Software maintenance as a service creates, designs, implements, and/or integrates customized changes to software that solve one or more problems and is not included with the price of the software. Software maintenance as a service includes person-to-person communications regardless of the medium used to communicate: telephone support, on-line technical support, customized support, and/or technical expertise that are charged commercially. Software maintenance as a service is billed arrears in accordance with 31 U.S.C. 3324.

Software maintenance as a service is billed in arrears in accordance with 31 U.S.C.

3324.

b. The Contractor on a quarterly or monthly basis shall submit invoices for maintenance service, after the completion of such period. Maintenance charges must be paid in arrears (31 U.S.C.

3324). PROMPT PAYMENT DISCOUNT, IF APPLICABLE, SHALL BE SHOWN ON THE

INVOICE.

6. PERIODS OF TERM LICENSES (SIN 132-32) AND MAINTENANCE (SIN 132-34)

a. The Contractor shall honor orders for periods for the duration of the contract period or a lessor period of time.

b. Term licenses and/or maintenance may be discontinued by the ordering activity on thirty (30) calendar days written notice to the Contractor.

c. Annual Funding. When annually appropriated funds are cited on an order for term licenses and/or maintenance, the period of the term licenses and/or maintenance shall automatically expire on September 30 of the contract period, or at the end of the contract period, whichever occurs first. Renewal of the term licenses and/or maintenance orders citing the new appropriation shall be required, if the term licenses and/or maintenance is to be continued during any remainder of the contract period.

d. Cross-Year Funding Within Contract Period. Where an ordering activity’s specific appropriation authority provides for funds in excess of a 12 month (fiscal year) period, the ordering activity may place an order under this schedule contract for a period up to the expiration of the contract period, notwithstanding the intervening fiscal years. e. Ordering activities should notify the Contractor in writing thirty (30) calendar days prior to the expiration of an order, if the term licenses and/or maintenance is to be terminated at that time. Orders for the continuation of term licenses and/or maintenance will be required if the term licenses and/or maintenance is to be continued during the subsequent period.

7. CONVERSION FROM TERM LICENSE TO PERPETUAL LICENSE

a. The ordering activity may convert term licenses to perpetual licenses for any or all software at any time following acceptance of software. At the request of the ordering activity the Contractor shall furnish, within ten (l0) calendar days, for each software product that is contemplated for conversion, the total amount of conversion credits which have accrued while the software was on a term license and the date of the last update or enhancement.

b. Conversion credits, which are provided, shall, within the limits specified, continue to accrue from one contract period to the next, provided the software remains on a term license within the ordering activity.

c. The term license for each software product shall be discontinued on the day immediately preceding the effective date of conversion from a term license to a perpetual license.

d. The price the ordering activity shall pay will be the perpetual license price that prevailed at the time such software was initially ordered under a term license, or the perpetual license price prevailing at the time of conversion from a term license to a perpetual license, whichever is the less, minus an amount equal to % of all term license payments during the period that the software was under a term license within the ordering activity. Not available under the scope of this contract.

8. TERM LICENSE CESSATION

a. After a software product has been on a continuous term license for a period of * months, a fully paid-up, non-exclusive, perpetual license for the software product shall automatically accrue to the ordering activity. The period of continuous term license for automatic accrual of a fully paid-up perpetual license does not have to be achieved during a particular fiscal year; it is a written Contractor commitment which continues to be available for software that is initially ordered under this contract, until a fully paid-up perpetual license accrues to the ordering activity.

However, should the term license of the software be discontinued before the specified period of the continuous term license has been satisfied, the perpetual license accrual shall be forfeited.

b. The Contractor agrees to provide updates and maintenance service for the software after a perpetual license has accrued, at the prices and terms of Special Item Number l32-34, if the licensee elects to order such services. Title to the software shall remain with the Contractor. Not available under the scope of this contract.

9. UTILIZATION LIMITATIONS - (SIN 132-32, SIN 132-33, AND SIN 132-34)

Software acquisition is limited to commercial computer software defined in FAR Part 2.101.

a. When acquired by the ordering activity, commercial computer software and related documentation so legend shall be subject to the following:

(1) Title to and ownership of the software and documentation shall remain with the Contractor, unless otherwise specified.

(2) Software licenses are by site and by ordering activity. An ordering activity is defined as a cabinet level or independent ordering activity. The software may be used by any subdivision of the ordering activity (service, bureau, division, command, etc.)

that has access to the site the software is placed at, even if the subdivision did not participate in the acquisition of the software. Further, the software may be used on a sharing basis where multiple agencies have joint projects that can be satisfied by the use of the software placed at one ordering activity's site. This would allow other agencies access to one ordering activity's database. For ordering activity public domain databases, user agencies and third parties may use the computer program to enter, retrieve, analyze and present data. The user ordering activity will take appropriate action by instruction, agreement, or otherwise, to protect the Contractor's proprietary property with any third parties that are permitted access to the computer programs and documentation in connection with the user ordering activity's permitted use of the computer programs and documentation. For purposes of this section, all such permitted third parties shall be deemed agents of the user ordering activity.

(3) Except as is provided in paragraph 8.b(2) above, the ordering activity shall not provide or otherwise make available the software or documentation, or any portion thereof, in any form, to any third party without the prior written approval of the Contractor. Third parties do not include prime Contractors, subcontractors and agents of the ordering activity who have the ordering activity's permission to use the licensed software and documentation at the facility, and who have agreed to use the licensed software and documentation only in accordance with these restrictions. This provision does not limit the right of the ordering activity to use software, documentation, or information therein, which the ordering activity may already have or obtains without restrictions.

(4) The ordering activity shall have the right to use the computer software and documentation with the computer for which it is acquired at any other facility to which that computer may be transferred, or in cases of Disaster Recovery, the ordering activity has the right to transfer the software to another site if the ordering activity site for which it is acquired is deemed to be unsafe for ordering activity personnel; to use the computer software and documentation with a backup computer when the primary computer is inoperative; to copy computer programs for safekeeping (archives) or backup purposes; to transfer a copy of the software to another site for purposes of benchmarking new hardware and/or software; and to modify the software and documentation or combine it with other software, provided that the unmodified portions shall remain subject to these restrictions.

(5) "Commercial Computer Software" may be marked with the Contractor's standard commercial restricted rights legend, but the schedule contract and schedule pricelist, including this clause, "Utilization Limitations" are the only governing terms and conditions, and shall take precedence and supersede any different or additional terms and conditions included in the standard commercial legend

10. SOFTWARE CONVERSIONS - (SIN 132-32 AND SIN 132-33)

Full monetary credit will be allowed to the ordering activity when conversion from one version of the software to another is made as the result of a change in operating system, or from one computer system to another. Under a perpetual license (132-33), the purchase price of the new software shall be reduced by the amount that was paid to purchase the earlier version. Under a term license (132-32), conversion credits that accrued while the earlier version was under a term license shall carry forward and remain available as conversion credits which may be applied towards the perpetual license price of the new version.

11. DESCRIPTIONS AND EQUIPMENT COMPATIBILITY

The Contractor shall include, in the schedule pricelist, a complete description of each software product and a list of equipment on which the software can be used. Also, included shall be a brief, introductory explanation of the modules and documentation, which are offered.

12. RIGHT-TO-COPY PRICING

The Contractor shall insert the discounted pricing for right-to-copy licenses. Not available under the scope of this contract.

1. SCOPE

The prices, terms and conditions stated under Special Item Number (SIN) 132-40 Cloud Computing Services apply exclusively to Cloud Computing Services within the scope of this Information Technology Schedule.

This SIN provides ordering activities with access to technical services that run in cloud environments and meet the NIST Definition of Cloud Computing Essential Characteristics. Services relating to or impinging on cloud that do not meet all NIST essential characteristics should be listed in other SINs.

The scope of this SIN is limited to cloud capabilities provided entirely as a service. Hardware, software and other artifacts supporting the physical construction of a private or other cloud are out of scope for this SIN. Currently, an Ordering Activity can procure the hardware and software needed to build on premise cloud functionality, through combining different services on other IT Schedule 70 SINs (e.g.

132-51).

Sub-categories in scope for this SIN are the three NIST Service Models: Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). Offerors may optionally select a single sub-category that best fits a proposed cloud service offering. Only one sub-category may be selected per each proposed cloud service offering.

Offerors may elect to submit multiple cloud service offerings, each with its own single sub-category. The selection of one of three sub-categories does not prevent Offerors from competing for orders under the other two sub-categories. See service model guidance for advice on sub-category selection.

Sub-category selection within this SIN is optional for any individual cloud service offering, and new cloud computing technologies that do not align with the aforementioned three sub-categories may be included without a sub-category selection so long as they comply with the essential characteristics of cloud computing as outlined by NIST. See Table 1 for a representation of the scope and sub-categories.

TERMS AND CONDITIONS APPLICABLE TO PURCHASE OF CLOUD COMPUTING

SERVICES (SPECIAL ITEM NUMBER 132 40)

Table 1: Cloud Computing Services SIN

2. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character.

a. Acceptance Testing

The Ordering Activity at task order level shall negotiate any required Acceptance Test Plans and Procedures. The Contractor shall perform acceptance testing of the systems for Ordering Activity approval in accordance with the approved test procedures.

b. Training

If training is provided commercially the Contractor shall provide normal commercial installation, operation, maintenance, and engineering interface training on the system.

Contractor is responsible for indicating if there are separate training charges.

c. Information Assurance/Security Requirements

The contractor shall meet information assurance/security requirements in accordance with the Ordering Activity requirements at the Task Order level.

d. Related Professional Services

The Contractor is responsible for working with the Ordering Activity to identify related professional services and any other services available on other SINs that may be associated with deploying a complete cloud solution. Any additional substantial and ongoing professional services related to the offering such as integration, migration, and other cloud professional services are out of scope for this SIN.

e. Performance of Cloud Computing Services

The Contractor shall respond to Ordering Activity requirements at the Task Order level with proposed capabilities to Ordering Activity performance specifications or indicate that only standard specifications are offered. In all cases the Contractor shall clearly indicate standard service levels, performance and scale capabilities. The Contractor shall provide appropriate cloud computing services on the date and to the extent and scope agreed to by the Contractor and the Ordering Activity.

f. Reporting

The Contractor shall respond to Ordering Activity requirements and specify general reporting capabilities available for the Ordering Activity to verify performance, cost and availability.

In accordance with commercial practices, the Contractor may furnish the Ordering Activity/user with a monthly summary Ordering Activity report.

3. RESPONSIBILITIES OF THE ORDERING ACTIVITY

The Ordering Activity is responsible for indicating the cloud computing services requirements unique to the Ordering Activity. Additional requirements should not contradict existing SIN or IT Schedule 70 Terms and Conditions. Ordering Activities should include (as applicable) Terms & Conditions to address Pricing, Security, Data Ownership, Geographic Restrictions, Privacy, SLAs, etc.

Cloud services typically operate under a shared responsibility model, with some responsibilities assigned to the Cloud Service Provider (CSP), some assigned to the Ordering Activity, and others shared between the two.

The distribution of responsibilities will vary between providers and across service models. Ordering activities should engage with CSPs to fully understand and evaluate the shared responsibility model proposed. Federal Risk and Authorization Management Program (FedRAMP) documentation will be helpful regarding the security aspects of shared responsibilities, but operational aspects may require additional discussion with the provider.

a. Ordering Activity Information Assurance/Security Requirements Guidance

1. The Ordering Activity is responsible for ensuring to the maximum extent practicable that each requirement issued is in compliance with the Federal Information Security Management Act (FISMA) as applicable.

2. The Ordering Activity shall assign a required impact level for confidentiality, integrity and availability (CIA) prior to issuing the initial statement of work.1 The Contractor must

1 Per Federal Information Processing Standards Publication 199 & 200 (FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems”) (FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems”) be capable of meeting at least the minimum-security requirements assigned against a low-impact information system in each CIA assessment area (per FIPS 200) and must detail the FISMA capabilities of the system in each of CIA assessment area.

3. Agency level FISMA certification, accreditation, and evaluation activities are the responsibility of the Ordering Activity. The Ordering Activity reserves the right to independently evaluate, audit, and verify the FISMA compliance for any proposed or awarded Cloud Computing Services.

4. The Ordering Activity has final responsibility for assessing the FedRAMP status of the service, complying with and making a risk-based decision to grant an Authorization to Operate (ATO) for the cloud computing service, and continuous monitoring. A memorandum issued by the Office of Management and Budget (OMB) on Dec 8, 2011 outlines the responsibilities of Executive departments and agencies in the context of FedRAMP compliance. 2

5. Ordering activities are responsible for determining any additional information assurance and security related requirements based on the nature of the application and relevant mandates.

b. Deployment Model

If a particular deployment model (Private, Public, Community, or Hybrid) is desired, Ordering

Activities are responsible for identifying the desired model(s). Alternately, Ordering Activities could identify requirements and assess Contractor responses to determine the most appropriate deployment model(s).

c. Delivery Schedule

The Ordering Activity shall specify the delivery schedule as part of the initial requirement.

The Delivery Schedule options are found in Information for Ordering Activities Applicable to All Special Item Numbers.

d. Interoperability Ordering Activities are responsible for identifying interoperability requirements. Ordering Activities should clearly delineate requirements for API implementation and standards conformance.

e. Performance of Cloud Computing Services The Ordering Activity should clearly indicate any custom minimum service levels, performance and scale requirements as part of the initial requirement.

f. Reporting

The Ordering Activity should clearly indicate any cost, performance or availability reporting as part of the initial requirement.

2 MEMORANDUM FOR CHIEF INFORMATION OFFICERS: Security Authorization of Information Systems in Cloud Computing Environments. December 8, 2011.

g. Privacy

The Ordering Activity should specify the privacy characteristics of their service and engage with the Contractor to determine if the cloud service is capable of meeting Ordering Activity requirements. For example, a requirement could be requiring assurance that the service is capable of safeguarding Personally Identifiable Information (PII), in accordance with NIST SP 800-122

3 and OMB memos M-06-16 and M-07-165. An Ordering Activity will determine what data elements constitute PII according to OMB Policy, NIST Guidance and Ordering Activity policy.

h. Accessibility

The Ordering Activity should specify the accessibility characteristics of their service and engage with the Contractor to determine the cloud service is capable of meeting Ordering Activity requirements. For example, a requirement could require assurance that the service is capable of providing accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

i. Geographic Requirements

Ordering activities are responsible for specifying any geographic requirements and engaging with the Contractor to determine that the cloud services offered have the capabilities to meet geographic requirements for all anticipated task orders. Common geographic concerns could include whether service data, processes and related artifacts can be confined on request to the United States and its territories, or the continental United States (CONUS).

j. Data Ownership and Retrieval and Intellectual Property

Intellectual property rights are not typically transferred in a cloud model. In general, CSPs retain ownership of the Intellectual Property (IP) underlying their services and the customer retains ownership of its intellectual property. The CSP gives the customer a license to use the cloud services for the duration of the contract without transferring rights. The government retains ownership of the IP and data they bring to the customized use of the service as spelled out in the FAR and related materials.

General considerations of data ownership and retrieval are covered under the terms of Schedule 70 and the FAR and other laws, ordinances, and regulations (Federal, State, City, or otherwise).

Because of considerations arising from cloud shared responsibility models, ordering activities should engage with the Contractor to develop more cloud specific understandings of the boundaries between data owned by the government and that owned by the cloud service provider, and the specific terms of data retrieval.

In all cases, the Ordering Activity should enter into an agreement with a clear and enforceable

3 NIST SP 800-122, “Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)” 4 OMB memo M-06-16: Protection of Sensitive Agency Informhttp://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf 5 OMB Memo M-07-16: Safeguarding Against and Responding to the Breach of Personally Identifiable http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf understanding of the boundaries between government and cloud service provider data, and the form, format and mode of delivery for each kind of data belonging to the government.

The Ordering Activity should expect that the Contractor shall transfer data to the government at the government's request at any time, and in all cases when the service or order is terminated for any reason, by means, in formats and within a scope clearly understood at the initiation of the service. Example cases that might require clarification include status and mode of delivery for:

1) Configuration information created by the government and affecting the government’s use of the cloud provider’s service.

2) Virtual machine configurations created by the government but operating on the cloud provider’s service.

3) Profile, configuration and other metadata used to configure SaaS application services or PaaS platform services.

The key is to determine in advance the ownership of classes of data and the means by which Government owned data can be returned to the Government.

k. Service Location Distribution

The Ordering Activity should determine requirements for continuity of operations and performance and engage with the Contractor to ensure that cloud services have adequate service location distribution to meet anticipated requirements.

Typical concerns include ensuring that:

1) Physical locations underlying the cloud are numerous enough to provide continuity of operations and geographically separate enough to avoid an anticipated single point of failure within the scope of anticipated emergency events.

2) Service endpoints for the cloud are able to meet anticipated performance requirements in terms of geographic proximity to service requestors.

Note that cloud providers may address concerns in the form of minimum distance between service locations, general regions where service locations are available, etc.

l. Related Professional Services

Ordering activities should engage with Contractors to discuss the availability of limited assistance with initial setup, training and access to the services that may be available through this SIN.

Any additional substantial and ongoing professional services related to the offering such as integration, migration, and other cloud professional services are out of scope for this SIN.

Ordering activities should consult the appropriate GSA professional services schedule.

4. GUIDANCE FOR CONTRACTORS

This section offers guidance for interpreting the Contractor Description Requirements in Table 2, including the NIST essential cloud characteristics, service models and deployment models. This section is not a list of requirements.

Contractor-specific definitions of cloud computing characteristics and models or significant variances from the NIST essential characteristics or models are discouraged and will not be considered in the scope of this SIN or accepted in response to Factors for Evaluation. The only applicable cloud characteristics, service model / subcategories and deployment models for this SIN will be drawn from the NIST 800-145 special publication.

Services qualifying for listing as cloud computing services under this SIN must substantially satisfy the essential characteristics of cloud computing as documented in the NIST Definition of Cloud Computing SP 800-1456.

Contractors must select deployment models corresponding to each way the service can be deployed. Multiple deployment model designations for a single cloud service are permitted but at least one deployment model must be selected.

In addition, contractors submitting services for listing under this SIN are encouraged to select a subcategory for each service proposed under this SIN with respect to a single principal NIST cloud service model that most aptly characterizes the service. Service model categorization is optional. Both service and deployment model designations must accord with NIST definitions. Guidance is offered in this document on making the most appropriate selection.

a. NIST Essential Characteristics

General Guidance NIST’s essential cloud characteristics provide a consistent metric for whether a service is eligible for inclusion in this SIN. It is understood that due to legislative, funding and other constraints that government entities cannot always leverage a cloud service to the extent that all NIST essential characteristics are commercially available. For the purposes of the Cloud SIN, meeting the NIST essential characteristics is determined by whether each essential capability of the commercial service is available for the service, whether or not the Ordering Activity actually requests or implements the capability. The guidance in Table 3 offers examples of how services might or might not be included based on the essential characteristics, and how the Contractor should interpret the characteristics in light of current government contracting processes.

http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf

Table 3: Guidance on Meeting NIST Essential Characteristics

6 NIST SP 800-122, “Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)”

Inheriting Essential Characteristics

Cloud services may depend on other cloud services, and cloud service models such as PaaS and SaaS are able to inherit essential characteristics from other cloud services that support them. For example a PaaS platform service can inherit the broad network access made available by the IaaS service it runs on, and in such a situation would be fully compliant with the broad network access essential characteristic. Services inheriting essential characteristics must make the inherited characteristic fully available at their level of delivery to claim the relevant characteristic by inheritance.

Inheriting characteristics does not require the inheriting provider to directly bundle or integrate the inherited service, but it does require a reasonable measure of support and identification. For example, the Ordering Activity may acquire an IaaS service from “Provider A” and a PaaS service from “Provider B”. The PaaS service may inherit broad network access from “Provider A” but must identify and support the inherited service as an acceptable IaaS provider.

Assessing Broad Network Access

Typically, broad network access for public deployment models implies high bandwidth access from the public internet for authorized users. In a private cloud deployment internet access might be considered broad access, as might be access through a dedicated shared high bandwidth network connection from the Ordering Activity, in accord with the private nature of the deployment model.

Resource Pooling and Private Cloud

All cloud resource pools are finite, and only give the appearance of infinite resources when sufficiently large, as is sometimes the case with a public cloud. The resource pool supporting a private cloud is typically smaller with more visible limits. A finite pool of resources purchased as a private cloud service qualifies as resource pooling so long as the resources within the pool can be dynamically allocated to the ultimate users of the resource, even though the pool itself appears finite to the Ordering Activity that procures access to the pool as a source of dynamic service allocation.

b. NIST Service Model

The Contractor may optionally document the service model of cloud computing (e.g. IaaS, PaaS, SaaS, or a combination thereof, that most closely describes their offering, using the definitions in The NIST Definition of Cloud Computing SP 800-145. The following guidance is offered for the proper selection of service models.

NIST’s service models provide this SIN with a set of consistent sub-categories to assist ordering activities in locating and comparing services of interest. Service model is primarily concerned with the nature of the service offered and the staff and activities most likely to interact with the service. Contractors should select a single service model most closely corresponding to their proposed service based on the guidance below. It is understood that cloud services can technically incorporate multiple service models and the intent is to provide the single best categorization of the service. Contractors should take care to select the NIST service model most closely corresponding to each service offered. Contractors should not invent, proliferate or select multiple cloud service model sub-categories to distinguish their offerings, because ad-hoc categorization prevents consumers from comparing similar offerings. Instead vendors should make full use of the existing NIST categories to the fullest extent possible.

For example, in this SIN an offering commercially marketed by a Contractor as “Storage as a Service” would be properly characterized as Infrastructure as a Service (IaaS), storage being a subset of infrastructure. Services commercially marketed as “LAMP as a Service” or “Database as a Service” would be properly characterized under this SIN as Platform as a Service (PaaS), as they deliver two kinds of platform services. Services commercially marketed as “Travel Facilitation as a Service” or “Email as a Service” would be properly characterized as species of Software as a Service (SaaS) for this SIN. However, Contractors can and should include appropriate descriptions (include commercial marketing terms) of the service in the full descriptions of the service’s capabilities.

When choosing between equally plausible service model sub-categories, Contractors should consider several factors:

1) Visibility to the Ordering Activity. Service model sub-categories in this SIN exist to help Ordering Activities match their requirements with service characteristics.

Contractors should select the most intuitive and appropriate service model from the point of view of an Ordering Activity.

2) Primary Focus of the Service. Services may offer a mix of capabilities that span service models in the strict technical sense. For example, a service may offer both IaaS capabilities for processing and storage, along with some PaaS capabilities for application deployment, or SaaS capabilities for specific applications. In a service mix situation the

Contractor should select the service model that is their primary focus. Alternatively contractors may choose to submit multiple service offerings for the SIN, each optionally and separately subcategorized.

3) Ordering Activity Role. Contractors should consider the operational role of the Ordering Activity’s primary actual consumer or operator of the service. For example services most often consumed by system managers are likely to fit best as IaaS; services most often consumed by application deployers or developers as PaaS, and services most often consumed by business users as SaaS.

4) Lowest Level of Configurability. Contractors can consider IaaS, PaaS and SaaS as an ascending hierarchy of complexity, and select the model with the lowest level of available Ordering Activity interaction. As an example, virtual machines are an IaaS service often bundled with a range of operating systems, which are PaaS services. The Ordering Activity usually has access to configure the lower level IaaS service, and the overall service should be considered IaaS. In cases where the Ordering Activity cannot configure the speed, memory, network configuration, or any other aspect of the IaaS component, consider categorizing as a PaaS service.

Cloud management and cloud broker services should be categorized based on their own characteristics and not those of the other cloud services that are their targets. Management and broker services typically fit the SaaS service model, regardless of whether the services they manage are SaaS, PaaS or IaaS. Use Table 3 to determine which service model is appropriate for the cloud management or cloud broker services, or, alternately choose not to select a service model for the service.

The guidance in Table 3 offers examples of how services might be properly mapped to NIST service models and how a Contractor should interpret the service model sub-categories.

Table 3: Guidance on Mapping to NIST Service Models

c. Deployment Model

Deployment models (e.g. private, public, community, or hybrid) are not restricted at the SIN level and any specifications for a deployment model are the responsibility of the Ordering Activity.

Multiple deployment model selection is permitted, but at least one model must be selected. The guidance in Table 4 offers examples of how services might be properly mapped to NIST deployment models and how the Contractor should interpret the deployment model characteristics. Contractors should take care to select the range of NIST deployment models most closely corresponding to each service offered.

Note that the scope of this SIN does not include hardware or software components used to construct a cloud, only cloud capabilities delivered as a service, as noted in the Scope section.

Table 4: Guidance for Selecting a Deployment Model

SIN

MANUFACTURE

R NAME

EMI PART NUMBER PRODUCT NAME

PRODUCT DESCRIPTION UOI

PRICE PER UNIT OFFER

PRICE ( inclusive of .75%

IFF)

132 32 SPLUNK SE-B-CAB-100 GB/day Splunk Enterprise - Customer Adoption Bundle Splunk Enterprise - Customer Adoption Bundle 100 GB/day SW License $ 180,806.05

132 32 SPLUNK SE-B-CAB-1000 GB/day Splunk Enterprise - Customer Adoption Bundle Splunk Enterprise - Customer Adoption Bundle 1000 GB/day SW License $ 1,407,355.16

132 32 SPLUNK SE-B-CAB-200 GB/day Splunk Enterprise - Customer Adoption Bundle Splunk Enterprise - Customer Adoption Bundle 200 GB/day SW License $ 332,292.19

132 32 SPLUNK SE-B-CAB-300 GB/day Splunk Enterprise - Customer Adoption Bundle Splunk Enterprise - Customer Adoption Bundle 300 GB/day SW License $ 547,304.79

132 32 SPLUNK SE-B-CAB-400 GB/day Splunk Enterprise - Customer Adoption Bundle Splunk Enterprise - Customer Adoption Bundle 400 GB/day SW License $ 703,677.58

132 32 SPLUNK SE-B-CAB-500 GB/day Splunk Enterprise - Customer Adoption Bundle Splunk Enterprise - Customer Adoption Bundle 500 GB/day SW License $ 811,183.88

132 32 SPLUNK SE-B-CAB-750 GB/day Splunk Enterprise - Customer Adoption Bundle Splunk Enterprise - Customer Adoption Bundle 750 GB/day SW License $ 1,143,476.07

132 32 SPLUNK QS-ES-SIEM-T-B-100GB

Splunk Quick Start for SIEM -Term License Splunk Quick Start for SIEM -Term License

100 GB/day SW License $ 117,279.60

132 32 SPLUNK QS-ES-SIEM-T-B-50GB

Splunk Quick Start for SIEM -Term License Splunk Quick Start for SIEM -Term License

50 GB/day SW License $ 92,846.35

132 32 SPLUNK QS-ES-SIE-T-B-100GB Splunk Quick Start for Security Investigation

Splunk Quick Start for Security Investigation - Endpoint - Term License 100 GB/day SW License $ 75,743.07

132 32 SPLUNK QS-ES-SIE-T-B-20GB Splunk Quick Start for Security Investigation

Splunk Quick Start for Security Investigation - Endpoint - Term License 20 GB/day SW License $ 29,319.90

132 32 SPLUNK QS-ES-SIE-T-B-50GB Splunk Quick Start for Security Investigation

Splunk Quick Start for Security Investigation - Endpoint - Term License 50 GB/day SW License $ 53,264.48

132 32 SPLUNK QS-ES-SII-T-B-100GB Splunk Quick Start for Security Investigation

Splunk Quick Start for Security Investigation - Infrastructure - Term License 100 GB/day SW License $ 75,743.07

132 32 SPLUNK QS-ES-SII-T-B-20GB Splunk Quick Start for Security Investigation

Splunk Quick Start for Security Investigation - Infrastructure - Term License 20 GB/day SW License $ 29,319.90

132 32 SPLUNK QS-ES-SII-T-B-50GB Splunk Quick Start…