MAS - Rbr-Technologies, Inc. - 47QTCA18D00CZ

GENERAL SERVICES ADMINISTRATION

FEDERAL ACQUISITION SERVICE

AUTHORIZED FEDERAL SUPPLY SCHEDULE CATALOG/PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage!, a menu-driven database system. The INTERNET address for GSA Advantage! is http://www.gsaadvantage.gov

Company Name: RBR-TECHNOLOGIES, INC.

Duns Number: 968116322 UEI Number: NNHAZLAKVX59

Schedule Title: General Purpose Commercial Information Technology Equipment, Software and Services

FSC Group: D305, U012, D301, D306, D311 Contract Number: 47QTCA18D00CZ

Contract Period: May 24, 2023, through May 23, 2028 Service Disabled Veteran Owned Small Business

For more information on ordering from Federal Supply Schedules click on the GSA Schedules link at www.gsa.gov

Contractor:

RBR-Technologies, Inc.

2288 Blue Water Blvd, Suite 322

Odenton, MD 21113 Phone number: 443-306-9250 Fax number: 443-569-7060 www.rbr-technologies.com

Contractor’s Administration Source:

Bryan M. Harte

Business Size:

Service Disabled Veteran Owned Small Business http://www.gsaadvantage.gov/ http://www.gsa.gov/ http://www.rbr-technologies.com/

CUSTOMER INFORMATION:

1a. TABLE OF AWARDED SPECIAL ITEM NUMBERS (SINs)

SIN DESCRIPTION

132 40 Cloud Computing Services 132 50 Training Courses 132 51 Information Technology Professional Services

1b. LOWEST PRICED MODEL NUMBER AND PRICE FOR EACH SIN: See Submitted Price List

1c. HOURLY RATES:

SIN(s) SERVICE UNIT OF

ISSUE

GSA Price

W/ IFF

132 51 Principal Systems Solution Engineer Hourly $215.41 132 51 Net Centric Enterprise Architect Hourly $171.22 132 51 Senior Information Technology Expert Hourly $131.36 132 51 Senior Collaboration Engineer Hourly $158.80 132 51 Unified Capabilities Subject Matter Expert Lead Hourly $211.19

132 51 Unified Capabilities Subject Matter Expert Associate Hourly $167.85

132 51 Cloud Engineering Development Consultant Hourly $207.50 132 51 Subject Matter Expert Lead Hourly $105.36 132 51 Cloud Data Scientist Development Consultant Hourly $242.07 132 51 Principal Systems Engineer Lead Hourly $203.98 132 51 Web Architect Hourly $167.73

132 51 Information Systems Security Specialist Intermediate Hourly $115.51

132 51 IT Security Analyst Hourly $136.95 132 51 Information Systems Security Specialist Associate Hourly $101.98 132 51 Collaboration Analyst Hourly $117.82 132 40 Cloud AMIs Monthly $1,294.49

See Job Descriptions on page 26

SIN(s) Course Title UNIT OF

ISSUE

GSA Price

W/ IFF

132 50 RBR-NO-001. NetOps Dashboard Setup Per Course $3,452.13 132 50 RBR-NO-002. ASI Grid and Calendar Per Course $6,904.25 132 50 RBR-NO-004. DEE Maps Per Course $1,726.06 132 50 RBR-NO-005. DEE Performance Indicator Per Course $1,726.06 132 50 RBR-NO-007. HBSS Performance Indicator Per Course $1,726.06

132 50 RBR-NO-008. ITSM Repository Per Course $1,726.06 132 50 RBR-NO-0010. Mobile Device Management (MDM) Maps Per Course $1,726.06 132 50 RBR-CSA-001. Cloud Search and Analysis Per Course $6,904.25 132 50 RBR-CSA-002. Work Plan Scenario: Search IP Per Course $3,452.13 132 50 RBR-CSA-003. Work Plan Scenario: Using Analytics Per Course

$10,356.38 132 50 RBR-CND-001. Fight by Indicator Per Course $6,904.25 132 50 RBR-CND-003. Working with Reports and Indicators Per Course $3,452.13

132 50 RBR-CND-006. Creating and working with the Signature Repository Per Course $6,904.25

132 50 RBR-CND-007. Working with Cyber Analytic Charts Per Course $3,452.13 132 50 RBR-CND-008. Cyber Countermeasures and Deconfliction Per Course

$10,356.38 See Course Descriptions on page 29

2. MAXIMUM ORDER*:

SINs 132 40 & 132 51

SIN 132 50

*Ordering activities may request a price reduction at any time before placing an order, establishing a BPA, or in conjunction with the annual BPA review. However, the ordering activity shall seek a price reduction when the order or BPA exceeds the simplified acquisition threshold. Schedule contractors are not required to pass on to all schedule users a price reduction extended only to an individual ordering activity for a specific order or

BPA.

3. MINIMUM ORDER: $100

4. GEOGRAPHIC COVERAGE: 48 contiguous states, Alaska, Hawaii, Washington D.C., Puerto

Rico, U.S. Territories, and to a port or consolidation point within the aforementioned locations for orders that are received from overseas activities.

5. POINT(S) OF PRODUCTION: Not Applicable

6. DISCOUNT FROM LIST PRICES: 3%

7. QUANTITY DISCOUNT(S): Not Applicable

8. PROMPT PAYMENT TERMS: Net 30 Days

9a. Government Purchase Cards must be accepted at or below the micro-purchase threshold.

9b. Government Purchase Cards are accepted above the micro-purchase threshold.

10. FOREIGN ITEMS: Not Applicable

11a. TIME OF DELIVERY: Determined on task order level

11b. EXPEDITED DELIVERY: Contact contractor

11c. OVERNIGHT AND 2-DAY DELIVERY: Contact contractor

11d. URGENT REQUIRMENTS: Agencies can contact the Contractor’s representative to affect a faster delivery. Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

12. FOB POINT: Not Applicable

13a. ORDERING ADDRESS: 2288 Blue Water Blvd, Suite 322 Odenton, MD 21113

13b. ORDERING PROCEDURES: For supplies and services, the ordering procedures, information on Blanket Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR) 8.405-3

14. PAYMENT ADDRESS: 2288 Blue Water Blvd, Suite 322 Odenton, MD 21113

15. WARRANTY PROVISION: Not Applicable

16. EXPORT PACKING CHARGES: N/A

17. TERMS AND CONDITIONS OF GOVERNMENT PURCHASE CARD ACCEPTANCE:

N/A

18. TERMS AND CONDITIONS OF RENTAL, MAINTENANCE, AND REPAIR (IF

APPLICABLE): N/A

19. TERMS AND CONDITIONS OF INSTALLATION (IF APPLICABLE): N/A

20. TERMS AND CONDITIONS OF REPAIR PARTS INDICATING DATE OF PARTS

PRICE LISTS AND ANY DISCOUNTS FROM LIST PRICES (IF AVAILABLE): N/A

20a. TERMS AND CONDITIONS FOR ANY OTHER SERVICES (IF APPLICABLE): N/A

21. LIST OF SERVICE AND DISTRIBUTION POINTS (IF APPLICABLE): N/A

22. LIST OF PARTICIPATING DEALERS (IF APPLICABLE): N/A

23. PREVENTIVE MAINTENANCE (IF APPLICABLE): N/A

24a. SPECIAL ATTRIBUTES SUCH AS ENVIRONMENTAL ATTRIBUTES (e.g., recycled content, energy efficiency, and/or reduced pollutants): N/A

24b. Section 508 Compliance for EIT: N/A

25. DUNS NUMBER: 968116322

26. Contractor has an active registration in the SAM database.

1. SCOPE

a. The Contractor shall provide training courses normally available to commercial customers, which will permit ordering activity users to make full, efficient use of general-purpose commercial IT products. Training is restricted to training courses for those products within the scope of this solicitation.

b. The Contractor shall provide training at the Contractor's facility and/or at the ordering activity's location, as agreed to by the Contractor and the ordering activity.

2. ORDER

Written orders, EDI orders (GSA Advantage! and FACNET), credit card orders, and orders placed under blanket purchase agreements (BPAs) shall be the basis for the purchase of training courses in accordance with the terms of this contract. Orders shall include the student's name, course title, course date and time, and contracted dollar amount of the course.

3. TIME OF DELIVERY

The Contractor shall conduct training on the date (time, day, month, and year) agreed to by the Contractor and the ordering activity.

4. CANCELLATION AND RESCHEDULING

a. The ordering activity will notify the Contractor at least seventy-two (72) hours before the scheduled training date, if a student will be unable to attend. The Contractor will then permit the ordering activity to either cancel the order or reschedule the training at no additional charge. In the event the training class is rescheduled, the ordering activity will modify its original training order to specify the time and date of the rescheduled training class.

b. In the event the ordering activity fails to cancel or reschedule a training course within the time frame specified in paragraph a, above, the ordering activity will be liable for the contracted dollar amount of the training course. The Contractor agrees to permit the ordering activity to reschedule a student who fails to attend a training class within ninety (90) days from the original course date, at no additional charge.

c. The ordering activity reserves the right to substitute one student for another up to the first day of class.

d. In the event the Contractor is unable to conduct training on the date agreed to by the Contractor and the ordering activity, the Contractor must notify the ordering activity at least seventy-two (72) hours before the scheduled training date.

5. FOLLOW-UP SUPPORT

The Contractor agrees to provide each student with unlimited telephone support or online support for a period of one (1) year from the completion of the training course. During this period, the student may contact the Contractor's instructors for refresher assistance and answers to related course curriculum questions.

TERMS AND CONDITIONS APPLICABLE TO PURCHASE OF

TRAINING COURSES FOR GENERAL PURPOSE COMMERCIAL

INFORMATION TECHNOLOGY EQUIPMENT AND SOFTWARE

(SPECIAL ITEM NUMBER 132-50)

6. PRICE FOR TRAINING

The price that the ordering activity will be charged will be the ordering activity training price in effect at the time of order placement, or the ordering activity price in effect at the time the training course is conducted, whichever is less.

7. INVOICES AND PAYMENT

Invoices for training shall be submitted by the Contractor after ordering activity completion of the training course. Charges for training must be paid in arrears (31 U.S.C. 3324). PROMPT PAYMENT DISCOUNT, IF APPLICABLE, SHALL BE

SHOWN ON THE INVOICE.

8. FORMAT AND CONTENT OF TRAINING

a. The Contractor shall provide written materials (i.e., manuals, handbooks, texts, etc.) normally provided with course offerings. Such documentation will become the property of the student upon completion of the training class.

b. **If applicable** For hands-on training courses, there must be a one-to-one assignment of IT equipment to students.

c. The Contractor shall provide each student with a Certificate of Training at the completion of each training course.

d. The Contractor shall provide the following information for each training course offered:

(1) The course title and a brief description of the course content, to include the course format (e.g., lecture, discussion, hands-on training);

(2) The length of the course;

(3) Mandatory and desirable prerequisites for student enrollment;

(4) The minimum and maximum number of students per class;

(5) The locations where the course is offered;

(6) Class schedules; and

(7) Price (per student, per class (if applicable)).

e. For those courses conducted at the ordering activity’s location, instructor travel charges (if applicable), including mileage and daily living expenses (e.g., per diem charges) are governed by Pub. L. 99-234 and FAR Part 31.205-46, and are reimbursable by the ordering activity on orders placed under the Multiple Award Schedule, as applicable, in effect on the date(s) the travel is performed. Contractors cannot use GSA city pair contracts. The Industrial Funding Fee does NOT apply to travel and per diem charges.

f. For Online Training Courses, a copy of all training material must be available for electronic download by the students.

9. “NO CHARGE” TRAINING

The Contractor shall describe any training provided with equipment and/or software provided under this contract, free of charge, in the space provided below.

****NOTE: All non-professional labor categories must be incidental to, and used solely to support professional services, and cannot be purchased separately.

a. The prices, terms and conditions stated under Special Item Number 132-51 Information Technology Professional

Services apply exclusively to IT Professional Services within the scope of this Information Technology Schedule.

b. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. PERFORMANCE INCENTIVES I-FSS-60 Performance Incentives (April 2000)

a. Performance incentives may be agreed upon between the Contractor and the ordering activity on individual fixed price orders or Blanket Purchase Agreements under this contract.

b. The ordering activity must establish a maximum performance incentive price for these services and/or total solutions on individual orders or Blanket Purchase Agreements.

c. Incentives should be designed to relate results achieved by the contractor to specified targets. To the maximum extent practicable, ordering activities shall consider establishing incentives where performance is critical to the ordering activity’s mission and incentives are likely to motivate the contractor. Incentives shall be based on objectively measurable tasks.

3. ORDER

a. Agencies may use written orders, EDI orders, blanket purchase agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made, and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

4. PERFORMANCE OF SERVICES

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

b. The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the

Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of IT Services must comply with the Federal Travel Regulation or

Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts.

5. STOP-WORK ORDER (FAR 52.242-15) (AUG 1989)

TERMS AND CONDITIONS APPLICABLE TO INFORMATION TECHNOLOGY (IT)

PROFESSIONAL SERVICES (SPECIAL ITEM NUMBER 132-51)

(a) The Contracting Officer may, at any time, by written order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this contract for a period of 90 days after the order is delivered to the Contractor, and for any further period to which the parties may agree. The order shall be specifically identified as a stop-work order issued under this clause. Upon receipt of the order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the order during the period of work stoppage. Within a period of 90 days after a stop-work is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the Contracting Officer shall either-

(1) Cancel the stop-work order; or

(2) Terminate the work covered by the order as provided in the Default, or the Termination for Convenience of the

Government, clause of this contract.

(b) If a stop-work order issued under this clause is canceled or the period of the order or any extension thereof expires, the Contractor shall resume work. The Contracting Officer shall make an equitable adjustment in the delivery schedule or contract price, or both, and the contract shall be modified, in writing, accordingly, if-

(1) The stop-work order results in an increase in the time required for, or in the Contractor's cost properly allocable to, the performance of any part of this contract; and

(2) The Contractor asserts its right to the adjustment within 30 days after the end of the period of work stoppage;

provided, that, if the Contracting Officer decides the facts justify the action, the Contracting Officer may receive and act upon the claim submitted at any time before final payment under this contract.

(c) If a stop-work order is not canceled and the work covered by the order is terminated for the convenience of the

Government, the Contracting Officer shall allow reasonable costs resulting from the stop-work order in arriving at the termination settlement.

6. INSPECTION OF SERVICES

In accordance with FAR 52.212-4 CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (MAR 2009) (DEVIATION I - FEB 2007) for Firm-Fixed Price orders and FAR 52.212-4 CONTRACT TERMS AND

CONDITIONS −COMMERCIAL ITEMS (MAR 2009) (ALTERNATE I − OCT 2008)

(DEVIATION I – FEB 2007) applies to Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

7. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (Dec 2007) Rights in Data – General, may apply.

8. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite IT Professional Services.

9. INDEPENDENT CONTRACTOR

All IT Professional Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

10. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refer to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

11. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for IT Professional services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

12. PAYMENTS

For firm-fixed price orders the ordering activity shall pay the Contractor, upon submission of proper invoices or vouchers, the prices stipulated in this contract for service rendered and accepted. Progress payments shall be made only when authorized by the order. For time-and-materials orders, the Payments under Time-and-Materials and Labor-Hour Contracts at FAR 52.212-4 (MAR 2009) (ALTERNATE I – OCT 2008) (DEVIATION I – FEB 2007) applies to time-and-materials orders placed under this contract. For labor-hour orders, the Payment under Time-and-Materials and Labor-Hour Contracts at FAR 52.212-4 (MAR 2009) (ALTERNATE I – OCT 2008) (DEVIATION I – FEB 2007) applies to labor-hour orders placed under this contract.

52.216-31(Feb 2007) Time-and-Materials/Labor-Hour Proposal Requirements—Commercial Item Acquisition. As prescribed in 16.601(e)(3), insert the following provision:

(a) The Government contemplates award of a Time-and-Materials or Labor-Hour type of contract resulting from this solicitation.

(b) The offeror must specify fixed hourly rates in its offer that include wages, overhead, general and administrative expenses, and profit. The offeror must specify whether the fixed hourly rate for each labor category applies to labor performed by—

(1) The offeror;

(2) Subcontractors; and/or

(3) Divisions, subsidiaries, or affiliates of the offeror under a common control.

13. RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

14. INCIDENTAL SUPPORT COSTS

Incidental support costs are available outside the scope of this contract. The costs will be negotiated separately with the ordering activity in accordance with the guidelines set forth in the FAR.

15. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

16. DESCRIPTION OF IT PROFESSIONAL SERVICES AND PRICING.

a. The Contractor shall provide a description of each type of IT Service offered under Special Item Numbers 132-51 IT

Professional Services should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all IT Professional Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates, monthly rates, term rates, and/or fixed prices, minimum general experience and minimum education.

The following is an example of the manner in which the description of a commercial job title should be presented:

EXAMPLE:

Commercial Job Title: System Engineer Minimum/General Experience: Three (3) years of technical experience which applies to systems analysis and design techniques for complex computer systems. Requires competence in all phases of systems analysis techniques, concepts and methods; also requires knowledge of available hardware, system software, input/output devices, structure and management practices.

Functional Responsibility: Guides users in formulating requirements, advises alternative approaches, conducts feasibility studies.

Minimum Education: Bachelor’s Degree in Computer Science

The prices, terms and conditions stated under Special Item Number (SIN) 132-40 Cloud Computing Services apply exclusively to Cloud Computing Services within the scope of this Information Technology Schedule.

This SIN provides ordering activities with access to technical services that run in cloud environments and meet the NIST Definition of Cloud Computing Essential Characteristics. Services relating to or impinging on cloud that do not meet all NIST essential characteristics should be listed in other SINs.

The scope of this SIN is limited to cloud capabilities provided entirely as a service. Hardware, software and other artifacts supporting the physical construction of a private or other cloud are out of scope for this SIN. Currently, an Ordering Activity can procure the hardware and software needed to build on premise cloud functionality, through combining different services on other IT Schedule 70 SINs (e.g., 132-51).

Sub-categories in scope for this SIN are the three NIST Service Models: Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). Offerors may optionally select a single sub-category that best fits a proposed cloud service offering. Only one sub-category may be selected per each proposed cloud service offering. Offerors may elect to submit multiple cloud service offerings, each with its own single sub-category. The selection of one of three sub-categories does not prevent Offerors from competing for orders under the other two sub-categories.

See service model guidance for advice on sub-category selection.

Sub-category selection within this SIN is optional for any individual cloud service offering, and new cloud computing technologies that do not align with the aforementioned three sub-categories may be included without a sub-category selection so long as they comply with the essential characteristics of cloud computing as outlined by NIST.

See Table 1 for a representation of the scope and sub-categories.

Table 1: Cloud Computing Services SIN

SIN Description Sub-Categories

• Commercially available cloud computing services

• Meets the National Institute for Standards and Technology (NIST) definition of Cloud Computing essential characteristics

• Open to all deployment models (private, public, community or hybrid), vendors specify deployment models

1. Software as a Service (SaaS): Consumer uses provider’s applications on cloud infrastructure. Does not manage/control platform or infrastructure. Limited application-level configuration may be available.

2. Platform as a Service (PaaS): Consumer deploys applications onto cloud platform service using provider-supplied tools. Has control over deployed applications and some limited platform configuration but does not manage the platform or infrastructure.

3. Infrastructure as a Service (IaaS): Consumer provisions computing resources. Has control over OS, storage, platform, deployed applications and some limited infrastructure configuration, but does not manage the infrastructure.

2. DESCRIPTION OF CLOUD COMPUTING SERVICES AND PRICING

TERMS AND CONDITIONS APPLICABLE TO PURCHASE OF

CLOUD COMPUTING SERVICES

(SPECIAL ITEM NUMBER 132-40)

**NOTE TO CONTRACTORS: The information provided below is designed to assist Contractors in qualifying cloud computing services for this SIN and providing complete descriptions and pricing information. This language should NOT be printed as part of the Information Technology Schedule Pricelist; instead, Contractors should respond to each service requirement as it relates to each cloud computing service offered under the contract. There is guidance provided in subsequent sections of the Terms and Conditions to assist in determining how to meet these requirements. This section delineates requirements for submitting a proposal for the Cloud SIN, as well as requirements that apply to Task Orders**

a. Service Description Requirements for Listing Contractors

The description requirements below are in addition to the overall Schedule 70 evaluation criteria described in SCP-FSS-001-N Instructions Applicable to New Offerors (Alternate I – MAR 2016) or SCP-FSS-001-S Instructions Applicable to Successful FSS Program Contractors, as applicable, SCP-FSS-004 and other relevant publications.

Refer to overall Schedule 70 requirements for timelines related to description and other schedule updates, including but not limited to clauses 552.238-81 – section E and clause I-FSS-600.

Table 2 summarizes the additional Contractor-provided description requirements for services proposed under the Cloud Computing Services SIN. All mandatory description requirements must be complete, and adequate according to evaluation criteria.

In addition, there is one “Optional” reporting descriptions which exists to provide convenient service selection by relevant criteria. Where provided, optional description requirements must be complete and adequate according to evaluation criteria:

• The NIST Service Model provides sub-categories for the Cloud SIN and is strongly encouraged, but not required. The Service Model based sub-categories provide this SIN with a structure to assist ordering activities in locating and comparing services of interest. Contractors may optionally select the single service model most closely corresponding to the specific service offering.

• If a sub-category is selected it will be evaluated with respect to the NIST Service Model definitions and guidelines in “Guidance for Contractors".

Table 2: Cloud Service Description Requirements

Description Requirement Reporting Type Instructions

1. Provide a brief written description of how the proposed cloud computing services satisfies each individual essential NIST Characteristic

Mandatory The cloud service must be capable of satisfying each of the five NIST essential Characteristics as outlined in NIST Special Publication 800-145. See ‘GUIDANCE FOR

CONTRACTORS: NIST

Essential Characteristics’ below in this document for detailed overall direction, as well as guidance on inheriting essential characteristics.

2. Select NIST deployment models for the cloud computing service proposed.

Mandatory Contractors must select at least one NIST deployment model as outlined in NIST Special Publication 800- 145 describing how the proposed cloud computing service is deployed. Select multiple deployment models if the service is offered in more than one deployment model.

See ‘GUIDANCE FOR CONTRACTORS: NIST

Deployment Model’ below in this document for detailed direction on how to best categorize a service for the NIST deployment models.

3. Optionally select the most appropriate NIST service model that will be the designated sub- category, or may select no sub-category

Optional Contractor may select a single NIST Service model to sub-categorize the service as outlined in NIST Special Publication 800-145. Sub-category selection is optional but recommended. See ‘GUIDANCE FOR CONTRACTORS:

NIST Service Model’ below in this document for detailed direction on how to best categorize a service for the NIST IaaS, PaaS, and SaaS service models.

b. Pricing of Cloud Computing Services

All current pricing requirements for Schedule 70, including provision SCP-FSS-001-N (Section III Price Proposal), SCP-FSS-001-S, SCP-FSS-004 (Section III Price Proposal), and clause I-FSS-600 Contract Price Lists, apply. At the current time there is no provision for reducing or eliminating standard price list posting requirements to accommodate rapid cloud price fluctuations.

In addition to standard pricing requirements, all pricing models must have the core capability to meet the NIST Essential Cloud Characteristics, particularly with respect to on-demand self-service, while allowing alternate variations at the task order level at agency discretion, pursuant to the guidance on NIST Essential Characteristics.

3. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character.

a. Acceptance Testing

Any required Acceptance Test Plans and Procedures shall be negotiated by the Ordering Activity at task order level. The Contractor shall perform acceptance testing of the systems for Ordering Activity approval in accordance with the approved test procedures.

b. Training

If training is provided commercially the Contractor shall provide normal commercial installation, operation, maintenance, and engineering interface training on the system. Contractor is responsible for indicating if there are separate training charges.

c. Information Assurance/Security Requirements

The contractor shall meet information assurance/security requirements in accordance with the Ordering Activity requirements at the Task Order level.

d. Related Professional Services

The Contractor is responsible for working with the Ordering Activity to identify related professional services and any other services available on other SINs that may be associated with deploying a complete cloud solution. Any additional substantial and ongoing professional services related to the offering such as integration, migration, and other cloud professional services are out of scope for this SIN.

e. Performance of Cloud Computing Services

The Contractor shall respond to Ordering Activity requirements at the Task Order level with proposed capabilities to Ordering Activity performance specifications or indicate that only standard specifications are offered. In all cases the Contractor shall clearly indicate standard service levels, performance and scale capabilities.

The Contractor shall provide appropriate cloud computing services on the date and to the extent and scope agreed to by the Contractor and the Ordering Activity.

f. Reporting

The Contractor shall respond to Ordering Activity requirements and specify general reporting capabilities available for the Ordering Activity to verify performance, cost and availability.

In accordance with commercial practices, the Contractor may furnish the Ordering Activity/user with a monthly summary Ordering Activity report.

4. RESPONSIBILITIES OF THE ORDERING ACTIVITY

The Ordering Activity is responsible for indicating the cloud computing services requirements unique to the Ordering Activity. Additional requirements should not contradict existing SIN or IT Schedule 70 Terms and Conditions. Ordering Activities should include (as applicable) Terms & Conditions to address Pricing, Security, Data Ownership, Geographic Restrictions, Privacy, SLAs, etc.

Cloud services typically operate under a shared responsibility model, with some responsibilities assigned to the Cloud Service Provider (CSP), some assigned to the Ordering Activity, and others shared between the two. The distribution of responsibilities will vary between providers and across service models.

Ordering activities should engage with CSPs to fully understand and evaluate the shared responsibility model proposed. Federal Risk and Authorization Management Program (FedRAMP) documentation will be helpful regarding the security aspects of shared responsibilities, but operational aspects may require additional discussion with the provider.

a. Ordering Activity Information Assurance/Security Requirements Guidance

i. The Ordering Activity is responsible for ensuring to the maximum extent practicable that each requirement issued is in compliance with the Federal Information Security Management Act (FISMA) as applicable.

ii. The Ordering Activity shall assign a required impact level for confidentiality, integrity and availability (CIA) prior to issuing the initial statement of work.2 The Contractor must be capable of meeting at least the minimum security requirements assigned against a low-impact information system in each CIA assessment area (per FIPS 200) and must detail the FISMA capabilities of the system in each of CIA assessment area.

iii. Agency level FISMA certification, accreditation, and evaluation activities are the responsibility of the Ordering Activity. The Ordering Activity reserves the right to independently evaluate, audit, and verify the FISMA compliance for any proposed or awarded Cloud Computing Services.

iv. The Ordering Activity has final responsibility for assessing the FedRAMP status of the service, complying with and making a risk-based decision to grant an Authorization to Operate (ATO) for the cloud computing service, and continuous monitoring. A memorandum issued by the Office of Management and Budget (OMB) on Dec 8, 2011, outlines the responsibilities of Executive departments and agencies in the context of FedRAMP compliance.

v. Ordering activities are responsible for determining any additional information assurance and security related requirements based on the nature of the application and relevant mandates.

b. Deployment Model

If a particular deployment model (Private, Public, Community, or Hybrid) is desired, Ordering Activities are responsible for identifying the desired model(s). Alternately, Ordering Activities could identify requirements and assess Contractor responses to determine the most appropriate deployment model(s).

c. Delivery Schedule

The Ordering Activity shall specify the delivery schedule as part of the initial requirement. The Delivery Schedule options are found in Information for Ordering Activities Applicable to All Special Item Numbers.

d. Interoperability

Ordering Activities are responsible for identifying interoperability requirements. Ordering Activities should clearly delineate requirements for API implementation and standards conformance.

e. Performance of Cloud Computing Services

The Ordering Activity should clearly indicate any custom minimum service levels, performance and scale requirements as part of the initial requirement.

f. Reporting

The Ordering Activity should clearly indicate any cost, performance or availability reporting as part of the initial requirement.

g. Privacy

The Ordering Activity should specify the privacy characteristics of their service and engage with the Contractor to determine if the cloud service is capable of meeting Ordering Activity requirements. For example, a requirement could be requiring assurance that the service is capable of safeguarding Personally Identifiable Information (PII), in accordance with NIST SP 800-1224 and OMB memos M-06-165 and M-07-16. An Ordering Activity will determine what data elements constitute PII according to OMB Policy, NIST Guidance and Ordering Activity policy.

h. Accessibility

The Ordering Activity should specify the accessibility characteristics of their service and engage with the Contractor to determine the cloud service is capable of meeting Ordering Activity requirements. For example, a requirement could require assurance that the service is capable of providing accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

i. Geographic Requirements

Ordering activities are responsible for specifying any geographic requirements and engaging with the Contractor to determine that the cloud services offered have the capabilities to meet geographic requirements for all anticipated task orders. Common geographic concerns could include whether service data, processes and related artifacts can be confined on request to the United States and its territories, or the continental United States

(CONUS).

j. Data Ownership and Retrieval and Intellectual Property

Intellectual property rights are not typically transferred in a cloud model. In general, CSPs retain ownership of the Intellectual Property (IP) underlying their services and the customer retains ownership of its intellectual property.

The CSP gives the customer a license to use the cloud services for the duration of the contract without transferring rights. The government retains ownership of the IP and data they bring to the customized use of the service as spelled out in the FAR and related materials.

General considerations of data ownership and retrieval are covered under the terms of Schedule 70 and the FAR and other laws, ordinances, and regulations (Federal, State, City, or otherwise). Because of considerations arising from cloud shared responsibility models, ordering activities should engage with the Contractor to develop more cloud-specific understandings of the boundaries between data owned by the government and that owned by the cloud service provider, and the specific terms of data retrieval.

In all cases, the Ordering Activity should enter into an agreement with a clear and enforceable understanding of the boundaries between government and cloud service provider data, and the form, format and mode of delivery for each kind of data belonging to the government.

The Ordering Activity should expect that the Contractor shall transfer data to the government at the government's request at any time, and in all cases when the service or order is terminated for any reason, by means, in formats and within a scope clearly understood at the initiation of the service. Example cases that might require clarification include status and mode of delivery for:

• Configuration information created by the government and affecting the government’s use of the cloud provider’s service.

• Virtual machine configurations created by the government but operating on the cloud provider’s service.

• Profile, configuration and other metadata used to configure SaaS application services or PaaS platform services.

The key is to determine in advance the ownership of classes of data and the means by which Government owned data can be returned to the Government.

k. Service Location Distribution

The Ordering Activity should determine requirements for continuity of operations and performance and engage with the Contractor to ensure that cloud services have adequate service location distribution to meet anticipated requirements. Typical concerns include ensuring that:

• Physical locations underlying the cloud are numerous enough to provide continuity of operations and geographically separate enough to avoid an anticipated single point of failure within the scope of anticipated emergency events.

• Service endpoints for the cloud are able to meet anticipated performance requirements in terms of geographic proximity to service requestors.

Note that cloud providers may address concerns in the form of minimum distance between service locations, general regions where service locations are available, etc.

l. Related Professional Services

Ordering activities should engage with Contractors to discuss the availability of limited assistance with initial setup, training and access to the services that may be available through this SIN.

Any additional substantial and ongoing professional services related to the offering such as integration, migration, and other cloud professional services are out of scope for this SIN. Ordering activities should consult the appropriate GSA professional services schedule.

5. GUIDANCE FOR CONTRACTORS

This section offers guidance for interpreting the Contractor Description Requirements in Table 2, including the NIST essential cloud characteristics, service models and deployment models. This section is not a list of requirements.

Contractor-specific definitions of cloud computing characteristics and models or significant variances from the NIST essential characteristics or models are discouraged and will not be considered in the scope of this SIN or accepted in response to Factors for Evaluation. The only applicable cloud characteristics, service model/subcategories and deployment models for this SIN will be drawn from the NIST 800-145 special publication. Services qualifying for listing as cloud computing services under this SIN must substantially satisfy the essential characteristics of cloud computing as documented in the NIST Definition of Cloud Computing SP 800-1457.

Contractors must select deployment models corresponding to each way the service can be deployed. Multiple deployment model designations for a single cloud service are permitted but at least one deployment model must be selected.

In addition, contractors submitting services for listing under this SIN are encouraged to select a sub- category for each service proposed under this SIN with respect to a single principal NIST cloud service model that most aptly characterizes the service. Service model categorization is optional.

Both service and deployment model designations must accord with NIST definitions. Guidance is offered in this document on making the most appropriate selection.

a. NIST Essential Characteristics

NIST’s essential cloud characteristics provide a consistent metric for whether a service is eligible for inclusion in this SIN. It is understood that due to legislative, funding and other constraints that government entities cannot always leverage a cloud service to the extent that all NIST essential characteristics are commercially available. For the purposes of the Cloud SIN, meeting the NIST essential characteristics is determined by whether each essential capability of the commercial service is available for the service, whether or not the Ordering Activity actually requests or implements the capability. The guidance in Table 3 offers examples of how services might or might not be included based on the essential characteristics, and how the Contractor should interpret the characteristics in light of current government contracting processes.

Table 3: Guidance on Meeting NIST Essential Characteristics

Characteristic Capability Guidance

On-demand self-service • Ordering activities can directly provision services without requiring Contractor intervention.

• This characteristic is typically implemented via a service console or programming interface for provisioning

Government procurement guidance varies on how to implement on-demand provisioning at this time.

Ordering activities may approach on-demand in a variety of ways, including “not-to-exceed” limits, or imposing monthly or annual payments on what are essentially on demand services.

Services under this SIN must be capable of true on- demand self-service, and ordering activities and Contractors must negotiate how they implement on demand capabilities in practice at the task order level:

• Ordering activities must specify their procurement approach and requirements for on-demand service

• Contractors must propose how they intend to meet the approach

• Contractors must certify that on-demand self-service is technically available for their service should

General Guidance procurement guidance become available.

Broad Network Access • Ordering activities are able to access services over standard agency networks

• Service can be accessed and consumed using standard devices such as browsers, tablets and mobile phones

• Broad network access must be available without significant qualification and in relation to the deployment model and security domain of the service

• Contractors must specify any ancillary activities, services or equipment required to access cloud services or integrate cloud with other cloud or non- cloud networks and services. For example, a private cloud might require an Ordering Activity to purchase or provide a dedicated router, etc. which is acceptable but should be indicated by the Contractor.

Resource Pooling • Pooling distinguishes cloud services from offsite hosting.

• Ordering activities draw resources from a common pool maintained by the Contractor

• Resources may have general characteristics such as regional location

• The cloud service must draw from a pool of resources and provide an automated means for the Ordering Activity to dynamically allocate them.

• Manual allocation, e.g., manual operations at a physical server farm where Contractor staff configure servers in response to Ordering Activity requests, does not meet this requirement

• Similar concerns apply to software and platform models; automated provisioning from a pool is required

• Ordering activities may request dedicated physical hardware, software or platform resources to access a private cloud deployment service. However, the provisioned cloud resources must be drawn from a common pool and automatically allocated on request.

Rapid Elasticity • Rapid provisioning and de-provisioning commensurate with demand

• Rapid elasticity is a specific demand-driven case of self-service

• Procurement guidance for on-demand self-service applies to rapid elasticity as well, i.e., rapid elasticity must be technically available but ordering activities and Contractors may mutually negotiate other contractual arrangements for procurement and payment.

• ‘Rapid’ should be understood as measured in minutes and hours, not days or weeks.

• Elastic capabilities by manual request, e.g., via a console operation or programming interface call, are required.

• Automated elasticity, which is driven dynamically by system load, etc. is optional. Contractors must specify whether automated demand-driven elasticity is available and the general mechanisms that drive the capability.

Measured Service • Measured service should be understood as a reporting requirement that enables an Ordering Activity to control their use in cooperation with self service

• Procurement guidance for on-demand self-service applies to measured service as well, i.e., rapid elasticity must be technically available but ordering activities and Contractors may mutually designate other contractual arrangements.

• Regardless of specific contractual arrangements, reporting must indicate actual usage, be continuously available to the Ordering Activity, and provide meaningful metrics appropriate to the service measured

• Contractors must specify that measured service is available and the general sort of metrics and mechanisms available

Cloud services may depend on other cloud services, and cloud service models such as PaaS and SaaS are able to inherit essential characteristics from other cloud services that support them. For example, a PaaS platform service can inherit the broad network access made available by the IaaS service it runs on, and in such a situation would be fully compliant with the broad network access essential characteristic. Services inheriting essential characteristics must make the inherited characteristic fully available at their level of delivery to claim the relevant characteristic by inheritance.

Inheriting characteristics does not require the inheriting provider to directly bundle or integrate the inherited service, but it does require a reasonable measure of support and identification. For example, the Ordering Activity may acquire an IaaS service from “Provider A” and a PaaS service from “Provider B”. The PaaS service may inherit broad network access from “Provider A” but must identify and support the inherited service as an acceptable IaaS provider.

Typ…