FCS2 SOW Draft v1.0 241115.pdf

Contract # TBD – Section C FAA Cloud Services 2.0 (FCS 2.0) Statement of Work (SOW) Page 1 of 11

C.1 Introduction

C.1.1 Purpose

This document describes the requirements for the services provided under the Federal Aviation Administration (FAA) Cloud Services 2.0 (FCS 2.0) contract.

C.1.2 Scope of Services

The Contractor must provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform IT cloud consumption services.

The scope of the FCS contract encompasses the commercial Cloud Service Provider (CSP) reseller services to support all FAA Lines of Business. The FAA requires access to two CSPs: Amazon Web Services (AWS) and Microsoft Azure. The CSPs own and control the current underlying cloud infrastructure and services. The FAA cloud service consumers administer and utilizes CSP provided infrastructure and services via CSP provided consoles and Application Programming Interface (API). The FAA cloud service consumer also has control over deployed applications and the associated data.

The FCS 2.0 scope of services will support the operational mission of the FAA’s Mission Support Operating Environment (MSOE), Research and Development Operating Environment (RDOE), Mission Essential Operating Environment (MEOE), and Mission Critical Operating Environment (MCOE) associated with day-to-day agency operations.

CSP reseller services refer to capabilities provided by the Contractor to support the functions that rely upon computer processing that can be implemented in a cloud environment because they do not require on-site (local) processing and so they can utilize consolidated computing resources that are accessible via a wide area network.

CSP reseller services provided for the FCS 2.0 contract includes, but are not limited to:

Core cloud computing services:

• AWS Infrastructure as a Service (IaaS) in which the Contractor provides processing, storage, networks, and other computing resources that enable the service consumer to deploy and run software applications.

AWS services must be limited to AWS regions residing on United States soil.

• AWS Platform as a Service (PaaS) in which the Contractor provides programming languages, libraries, services, and tools for use by service consumers. AWS services must be limited to AWS regions residing on United States soil.

• Microsoft Azure Infrastructure as a Service (IaaS) in which the Contractor provides processing, storage, networks, and other computing resources that enable the service consumer to deploy and run software applications. Microsoft Azure services must be limited to Microsoft Azure regions residing on United States soil.

• Microsoft Azure Platform as a Service (PaaS) in which the Contractor provides programming languages, libraries, services, and tools for use by service consumers. Microsoft Azure services must be limited to Microsoft Azure regions residing on United States soil.

Ancillary cloud services:

• Other AWS services such as snow family devices.

• Other Microsoft Azure services such as data box family devices.

Professional services:

Statement of Work (SOW) Page 2 of 11

• AWS Professional Services

• Microsoft Azure Professional Services

In accordance with NIST Special Publication 800-145, the services may be delivered via “private” cloud computing infrastructure dedicated to the delivery of FCS 2.0 services, shared Government Community Cloud (GCC) computing infrastructure, or “public” cloud computing infrastructure depending upon the FAA’s cloud architecture for individual FAA business applications and workloads. Within this contract, the term “private cloud computing infrastructure” refers to computing infrastructure that is provisioned for exclusive use by the FAA and does not have interconnectivity to other cloud computing infrastructure.

C.2 Applicable Documents

The following documents are referenced in other sections of the SOW and are applicable to the extent specified herein. The latest version of these documents date applies throughout the period of performance of this contract. If an applicable document is updated during the contract period of performance, the Contractor must identify any impact of the updates to the delivery of FCS services. In the event that listed applicable documents have been updated or superseded, the latest document must be referenced.

Document Number Document Title FAA Order 1600.1F Personnel Security Program FAA Order 1370.121 FAA Information Security and Privacy: Policy NIST Special Publication 800-145 The NIST Definition of Cloud Computing NIST Special Publication 800-150 Guide to Cyber Threat Information Sharing

C.2.1 Order of Precedence

a) When the requirements of this document and referenced applicable documents are in conflict, this document must have precedence over all documents referenced herein.

b) If two or more referenced applicable documents are in conflict or two or more sections of this document are in conflict, the FAA Contracting Officer must be notified to resolve the conflict.

C.2.2 Availability of Documents

Copies of FAA specifications, standards, and publications may be obtained from the FCS 2.0 Contracting Officer.

Requests should clearly identify the desired material by number and state the intended use of the material.

Copies of other federal publications may be obtained from the U.S. Government Printing Office, 710 North Capitol Street, Washington DC, 20401, by calling (202) 512-0132, or through the web site http://bookstore.gpo.gov/.

C.3 Government-Furnished Items http://bookstore.gpo.gov/

Statement of Work (SOW) Page 3 of 11

C.3.1 Telecommunications Connectivity

At no cost to the Contractor, the Government will furnish all wide area network connectivity between:

a) the CSP’s data center facilities and the Government systems to which the tenant applications are associated; and

b) the CSP’s data center facilities and any remote operations control or security control centers used to remotely manage and monitor FCS cloud environments.

C.3.2 Government Furnished Equipment

The FAA may provide Government Furnished Equipment (GFE) (i.e. laptops, desktops, etc.) to the Contractor. In addition, the FAA will provide LAN/Internet access to the Contractor for those tasks performed using the GFE. All relevant GFE will be provided by the FAA.

The Contractor must track all GFE distribution, location, and inventory. The Contractor must make this tracking information available to the FAA as needed. Unless otherwise specified, the Contractor must return all GFE at the completion of the contract. Note: If the Contractor identifies the need for any GFE, the Contractor must submit a request to the COR.

C.4 Requirements

This section defines the required work efforts that must be performed by the Contractor in conjunction with the delivery of the required computing services.

C.4.1 Contract Administration

The Contractor is responsible for acquiring and managing all the facilities, third-party services, personnel, and resources necessary to perform FCS services that meet requirements and achieve scheduled milestones.

The contractor must implement processes for the delivery of services in accordance with the contract. The contractor must provide a single POC for the Government to communicate needs or information.

C.4.1.1 Post-Award Conference

The Contractor must hold a post-award conference within 15 calendar days of contract award. The Government will determine the date of the post-award conference within 5 calendar days of contract award. The Post-Award Conference must be held at a Contractor facility unless otherwise designated by the Government. The purpose of the conference will be for the Government and Contractor to:

• Identify team personnel and their roles;

• Reach a mutual understanding of the contract requirements and the Government’s expectations;

• Discuss administrative details of the contract; and

• Identify areas of risk and develop strategies for managing the risks.

Statement of Work (SOW) Page 4 of 11

C.4.1.2 Program Status Reporting and Program Management Reviews

The Contractor is responsible for reporting performance with respect to the accomplishment of identified requirements and objectives to the Government. The Contractor must inform the Government of any instances in which the Contractor has failed to meet identified requirements or objectives and of the actions taken to restore performance to the required level. The Contractor must also notify the Government of any risks to successful delivery of services and the actions taken to resolve them. The Contractor must provide a Monthly Status Report and Monthly Financial Report that summarizes the status of contract performance and cloud service consumption and spend.

The Monthly Status Reports must document the activities and progress of the previous month and identifying planned activities for the following month. Monthly Status Reports are Deliverable 001 in Section C.5. Monthly Financial Reports are Deliverable 002 in Section C.5.

Monthly Status Reports must include, at a minimum:

• Detailed record of activities and accomplishments during the previous month, work in progress, and work planned.

• Status of individual deliverables, planned submission dates, actual acceptance dates, and corrective actions being taken, if any, to address rejected deliverables.

• Identification of risk areas with recommended mitigation strategies for managing risk.

• Status of all outstanding risks identified in previous Monthly Status Reports.

• Government Furnished Equipment (GFE) Listing.

• Other information pertinent to administering performance of this effort or as requested by the COR.

Monthly Financial Reports must include, at a minimum:

• Monthly and cumulative financial expenditures itemized by delivery order and CLIN.

• CLIN costs must be further itemized by CSP hosting account, CSP service type, CSP service type quantity, and CSP service type cost.

The Contractor must develop Monthly Status Report and Monthly Financial Report templates (Deliverables 003 and 004) prior to delivering the reports.

The Contractor must be prepared to participate in monthly Program Management Reviews (PMRs). The Government will determine the exact date and location of PMRs. The purpose of a PMR will be to:

• Discuss the Contractor’s performance with respect to FAA requirements;

• Discuss the Contractor’s performance with respect to cloud service consumption and spend rates;

• Discuss the Contractor’s performance with respect to service quality; and

• Discuss the disposition of new and previously identified risks.

The Contractor must present cloud service consumption and spend data to support the discussion. The Contractor must also submit a Monthly Status Report regardless of whether a PMR is held.

C.4.1.3 Meeting Attendance

The Contractor must provide personnel at meetings and conferences when requested by the Government. The personnel provided by the Contractor must have the requisite knowledge and skills to discuss the topics identified on the meeting agenda. As requested by the Government, the Contractor must prepare and submit agendas, minutes, and presentation materials for all meetings and reviews.

The Contractor must provide meeting agendas (Deliverable 005) prior to any scheduled meeting. Meeting agendas must identify the meeting purpose, objectives, date, time, place, and participants. The Contractor must develop a meeting agenda template (Deliverable 006). The Contractor must provide meeting minutes at the

Statement of Work (SOW) Page 5 of 11 conclusion of any scheduled meetings (Deliverable 007) prior to any scheduled meeting. Meeting minutes must summarize the meetings discussion and decisions. The Contractor must develop a meeting minutes template (Deliverable 008).

C.4.2 Transfer of Existing CSP Hosting Accounts to Contract

The Contractor must support the transfer of all existing FAA CSP hosting accounts (master payer accounts and member accounts) from the previous contract to this contract at time of award or when determined by the FAA.

The Contractor must accept transfer of additional CSP hosting accounts over the life of the contract.

The Contractor must ensure that the required resources are assigned and provide the required level of management oversight to ensure on-time transition of delivery orders and cloud hosting accounts from the current contract to this contract. When requested by the FAA, the Contractor must coordinate any changes to the transition timeline as defined by the appropriate points-of-contact within the Government’s Program Office for the FCS Program. The Contractor must identify risks to the successful completion of transition timeline and recommend mitigation strategies to ensure that the timeline is maintained, and the transition is successful.

C.4.3 Cloud Hosting Services

The Contractor must provide access to cloud hosting services:

Core cloud computing service, as previously defined:

• AWS Infrastructure as a Service (IaaS)

• AWS Platform as a Service (PaaS)

• Microsoft Azure Infrastructure as a Service (IaaS)

• Microsoft Azure Platform as a Service (PaaS)

AWS services and Microsoft Azure services must be limited to regions residing on United States soil. The Contractor must obtain the CSP services directly from the CSPs with no third party resellers.

Ancillary cloud services, as previously defined:

• AWS Machine Images (AMIs)

• Azure VM Images

• Other AWS services such as snow family devices.

• Other Microsoft Azure services such as data box family devices.

The Contractor must demonstrate the commitment and ability to support complex AWS and Microsoft Azure environments and have the experienced personnel on staff to perform. The Contractor must possess the following AWS and Microsoft Azure partner designations:

AWS:

• The Contractor must be designated as an AWS Advanced Partner, or higher, within AWS’s partner network.

• AWS recognizes partners knowledgeable in the Government space to include knowledge of government contracting and unique government regulations and processes. The Contractor must also be designated as an AWS Government Competency Partner.

Microsoft Azure:

• The Contractor must be designated as a Solutions Partner for Infrastructure at the Intermediate Certification level or higher. If a Contractor has not transitioned to Microsoft’s new Solutions Partner Program, legacy Silver or Gold Partner designation is a suitable replacement.

Statement of Work (SOW) Page 6 of 11

C.4.3.1 CSP Account Management

In support of the ordering, provisioning, delivery, and consumption of cloud hosting services, the Contractor must provide the FAA with capability to first manage CSP hosting accounts. The Contractor must provide the FAA the ability to directly manage AWS and Microsoft Azure hosting accounts within the native CSP environments or using FAA specified tools and interfaces. This includes master payer accounts and member accounts. The FAA will retain all administrative access and responsibility for all CSP hosting accounts. The FAA will have ownership of the FAA CSP accounts and account root credentials. The Contractor will provide the FAA direct access to all CSP hosting account management functions. Account management functions using FAA specified access methods or tools include, but are not limited to:

a) Creating new AWS or Microsoft Azure hosting accounts.

b) Terminating existing AWS or Microsoft Azure hosting accounts.

c) Configuring new or reconfiguring existing AWS or Microsoft Azure hosting accounts.

d) Performing AWS or Microsoft Azure account management (e.g., password resets, updates to access privileges, etc.).

The Contractor must create and support dedicated CSP Master Payer Accounts for the exclusive use of the FAA that must contain billing and usage data for all FAA CSP member accounts and only FAA CSP member accounts.

The Contractor must never provide any non-FAA entity or software tool access to CSP hosting account cost and usage information without written approval by the FAA CO.

The FAA will retain ownership of all data contained within CSP accounts. The FAA is solely responsible for entering and maintaining all FAA data (including back-up and restoration of data)

The FAA will provide the Contractor with Payer Account IAM Read Only access (or equivalent) to selected CSP Billing and Cost Management information for purposes of enabling the reseller to provide consolidated billing services to the FAA.

The Contractor must also provide the FAA the ability to directly manage the AWS and Microsoft Azure end user service access accounts within the native CSP environments or using FAA specified tools and interfaces. This includes end user service access accounts to master payer accounts and member accounts. The FAA will retain all administrative access and responsibility for all end user service access accounts. The Contractor will provide the FAA direct access to all end user service account management functions. Account management functions using FAA specified access methods or tools include, but are not limited to:

a) Creating new user profiles.

b) Terminating existing user profiles.

c) Configuring new or reconfiguring existing user profiles.

d) Performing AWS or Microsoft Azure account management (e.g., password resets, updates to access privileges, etc.).

C.4.3.2 Ordering and Provisioning of Cloud Hosting Services The Contractor must support and process the following types of FCS service ordering and provisioning actions:

a) New – The provisioning of a new cloud hosting service. Contractor must provide FAA capability to provision services via FAA specified access methods and/or tools (e.g., direct CSP console access to CSP APIs, etc.).

Statement of Work (SOW) Page 7 of 11

b) Change – The modification to an existing cloud hosting service that has been previously provisioned and is in operation. Changes may include the addition, removal, or modification to the quantity of cloud hosting services. Contractor must provide FAA capability to change services via FAA specified access methods and/or tools.

c) Start/Stop – The starting or stopping of cloud hosting services. Stopping services preserves data and configuration of the resource and incurs a small cost associated with persistent services.

Starting services restores stopped services to resume operation. Contractor must provide FAA capability to start/stop services via FAA specified access methods and/or tools.

d) Terminate – The termination of cloud hosting services. Once terminated, cloud services cannot be restored. Termination results in the loss of data and configuration of the resource and effectively ends the accrual of any additional costs. Contractor must provide FAA capability to terminate services via FAA specified access methods and/or tools.

For any of the FCS CSP reseller services, the Contractor must support self-provisioning of FCS services by authorized FAA tenants. The self-service provisioning capability must include the allocation of the required computing resources and the de-allocation of those resources upon service discontinuation.

The Contractor must provide the FAA with access to all current, enhanced, and future CSP IaaS and PaaS resources in both Public Cloud domain and Government Community Cloud domain. The Contractor must provide direct access to CSP Enterprise Support Services.

The Contractor must provide unrestricted access to all CSP provided billing and usage reports and tools.

Contractor must allow multiple delivery orders to be placed against the contract. Contractor must allow orders as small as $100.

C.4.3.3 Cost Savings Requirements

The Contractor must pass through to the FAA all CSP price changes at the time of effectivity.

The Contractor must provide to the FAA unrestricted access to all offered CSP cost savings options to include Reserved Instances, Savings Plans, Reservations, individual service volume discounts, etc. The Contractor must pass these cost savings along to the FAA. The Contractor must limit to procurement of Reserved Instances, Savings Plans, and Reservations to one-year terms. Three-year reservations are not applicable.

The FAA anticipates the contractor will share with the FAA any committed capacity discounts for all CSPs. For example, AWS’s Enterprise Discount Program.

C.4.3.4 CSP Service Level Agreements

The performance requirements for the CSP Reseller Services are defined in the CSPs’ published service level agreements as indicated below:

The Amazon Web Services Compute Service Level Agreement can be found:

https://aws.amazon.com/compute/sla/

The Microsoft Azure Service Level Agreement can be found here:

https://azure.microsoft.com/en-us/support/legal/sla/ https://aws.amazon.com/compute/sla/ https://azure.microsoft.com/en-us/support/legal/sla/

Statement of Work (SOW) Page 8 of 11

In the event of a performance shortfall covered within the CSPs’ respective service level agreements, the Contractor must request the appropriate CSP service credits as specified in the CSP service level agreements and provide those service credits to the FAA.

C.4.3.5 CSP Service Maintenance

C.4.3.5.1 CSP Emergency Maintenance The Contractor must plan with the CSPs on behalf of FAA to ensure that any emergency maintenance that will affect FAA’s ability to use CSP services is reported to the FAA CO and COR. The Contractor must submit Emergency Maintenance Notifications (Deliverable 009). Information must be provided that enables FAA to effectively assess the un-planned activity for purposes of understanding which FAA-utilized CSP resources may be affected and for determining appropriate contingency mechanisms. To ensure timely updates subsequent to FAA notification, the Contractor must make arrangements with the CSPs to ensure (1) the FAA is kept informed of emergency maintenance progress, including notification when the activity is complete and (2) the FAA primary and/or alternate contacts (designated by FAA) associated with affected FAA CSP accounts can contact the CSPs directly for updates and assistance.

C.4.3.5.2 CSP Planned and Scheduled Maintenance The Contractor must make arrangements with the CSPs on behalf of FAA to ensure that any Planned Maintenance that will affect FAA’s ability to use CSP services is reported to the FAA CO and COR a minimum of five business days in advance, with as much lead time as possible. The Contractor must submit Planned and Scheduled Maintenance Notifications (Deliverable 010). Information must be provided that enables FAA to effectively assess the planned activity for purposes of understanding which FAA-utilized CSP resources may be affected and for determining appropriate contingency mechanisms. FAA will also monitor the appropriate CSP web pages to maintain an awareness of Scheduled Maintenance affecting FAA resources operating within the CSPs and will take the appropriate operational steps to minimize impact and accommodate the Scheduled Maintenance.

C.4.3.5.3 CSP Incident Reporting

C.4.3.5.3.1 Incidents Not Involving a Security Threat or Compromise

The Contractor must ensure that incidents impacting FAA’s ability to use any CSP service is reported to FAA CO, COR, and any other FAA designated POC in a manner that is consistent with notification of CSP’s other commercial and federal account holders. The Contractor must submit Incident Reports (Deliverable 011) upon the determination that an incident has occurred. Information must be provided that enables FAA to effectively assess the incident for purposes of understanding which FAA-utilized CSP resources may be affected and for determining appropriate contingency mechanisms. To ensure timely updates subsequent to FAA notification, the Contractor must make arrangements with the CSPs to ensure (1) that FAA is kept informed of problem resolution progress, and (2) FAA primary and/or alternate contacts (designated by FAA) associated with affected FAA CSP accounts can contact the CSPs directly for updates and assistance.

C.4.3.5.3.2 Incidents Involving a Security Threat or Compromise

Statement of Work (SOW) Page 9 of 11

The Contractor must ensure that a suspected or confirmed security incident or compromise affecting the FAA’s ability: to use any CSP service, to protect FAA applications operating within the CSPs, or to protect FAA information existing within CSPs is reported by the CSPs to the FAA CO, COR, and FAA Security Operations Center (SOC) at SOC@faa.gov and by calling 1-866-580-1852 immediately upon gaining knowledge which supports the suspicion, or provides confirmation, of a security threat or compromise, with the specific communications approach and protocol agreed upon in advance by FAA and the Contractor. The Contractor must also submit Incident Reports (Deliverable 011) upon the determination that an incident has occurred. Information must be provided that enables FAA to effectively assess the incident for purposes of understanding which FAA-utilized CSP resources may be affected and determining appropriate contingency mechanisms. To ensure timely updates subsequent to FAA notification, the Contractor must make arrangements with the CSPs to ensure (1) that FAA kept informed of problem resolution progress, and (2) FAA primary and/or alternate contacts (designated by FAA) associated with affected FAA CSP accounts can contact the CSPs directly for updates and assistance.

C.4.4 CSP Professional Services

The Contractor must provide CSP professional services.

Professional services:

• AWS Professional Services directly from Amazon in accordance with Amazon terms and conditions. AWS Professional Services will be limited to no more than 1,300 hours per year.

• Microsoft Azure Professional Services directly from Microsoft in accordance with Amazon terms and conditions. Microsoft Professional Services will be limited to no more than 200 hours per year.

The Contractor must coordinate with the FAA for ordering CSP professional services.

The Contractor must provide a Amazon Web Services and Microsoft Professional Services Status Report (Deliverable 012) on a quarterly basis. This status report must identify:

a) Name of each Professional Services engagement and the associated delivery order.

b) Number of ceiling hours for each Professional Services engagement.

c) Number of hours for each Professional Services engagement consumed and the number of hours remaining.

d) Total number of hours consumed and remaining for all AWS Professional Services.

e) Total number of hours consumed and remaining for all Microsoft Azure Professional Services.

C.4.5 FAA Invoice and Billing

The Contractor must provide a CSP Master Cost, Consumption, and Usage Report on a monthly basis. This report must be generated for each CSP and contain the following information:

• Delivery Order Number

• Account Name and Number

• Master Payer Account Name and Number

• CSP Service Type

• CSP Service Type Quantity

• CSP Service Type Cost

The contractor must submit separate invoices for each delivery order. Each delivery order invoice must itemize charges per Contract Line Item Number (CLIN). Within each CLIN, the Contractor must also further itemize charges by individual CSP hosting account and CSP service type. The account and service type information must be included as a backup document (preferably in a Microsoft Excel spreadsheet) to the invoices.

Some CSP hosting accounts and services are designated as FCS 2.0 Enterprise Services. These services (such as mailto:SOC@faa.gov

Statement of Work (SOW) Page 10 of 11 centralized monitoring, logging, etc.) are required but are often not able to be billed back to individual CSP hosting accounts by the CSPs. When centrally billed by the CSPs, the contractor must support reallocating these CSP charges to individual delivery orders as designated by the FAA.

The Contractor must develop tailored billing and usage reports in support of FAA requirements. The Contractor must invoice the FAA’s actual utilization monthly in arrears. The Contractor must notify the FAA once 75% of the FAA’s obligated funding for a given delivery order is expended in order to provide the FAA with sufficient time to, at its option, add incremental funding or discontinue service. The Contractor must not operate at financial risk once obligated funding is 100% consumed. The Contractor must not automatically terminate or suspend services without first coordinating with the FAA. Service disruption must be determined by the FAA.

C.4.6 Transfer to Successor Contract

The Contractor must commit to promptly transfer at no additional cost FAA’s dedicated master payer account and member accounts to any successor contractor or to the FAA directly at FAA’s direction.

The Contractor must provide a Transition-Out Plan (Deliverable 013) to facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the contract. The Transition-Out Plan must be provided and implemented within three months of the contract end date. In the Transition-Out Plan, the Contractor must identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

a) The transfer of master payer accounts and member accounts.

b) The transfer of end user accounts.

c) Status of ongoing technical initiatives.

d) Actions requested by the successor contractor of the Government.

The Contractor must also establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings or as often as necessary to ensure a seamless transition-out.

C.5 Deliverables

All deliverables under this contract are subject to review and inspection by the COR. All deliverables (Plans, Presentations, Reports, Schedules, etc.) must be completed using Microsoft Office products, unless otherwise specified in the table below. The Contractor must provide electronic copies of files, reports, and deliverables.

# SOW # End Result/ Deliverable Due Date Acceptance Criteria

001 C.4.1.2 Monthly Status Report Monthly, NLT 15 calendar days after month end

COR Approval

002 C.4.1.2 Monthly Financial Report Monthly, NLT 15 calendar days after month end

COR Approval

003 C.4.1.2 Monthly Status Report Template 30 days after contract award

COR Approval

004 C.4.1.2 Monthly Financial Report Template

30 days after contract award

COR Approval

005 C.4.1.3 Meeting Agenda 1 day prior to meeting COR Approval

Statement of Work (SOW) Page 11 of 11

# SOW # End Result/ Deliverable Due Date Acceptance Criteria

006 C.4.1.3 Meeting Agenda Template 30 days after contract award

COR Approval

007 C.4.1.3 Meeting Minutes 3 days after meeting COR Approval 008 C.4.1.3 Meeting Minutes Template 30 days after contract award COR Approval

009 C.4.3.5.1 Emergency Maintenance Notification

Within 24 hours of the emergency maintenance

COR Approval

010 C.4.3.5.2 Planned Maintenance Notification

5 days prior to the maintenance activity

COR Approval

011 C.4.3.5.3.1 and

C.4.3.5.3.2

Incident Report Within 24 hours of the incident occurrence

COR Approval

012 C.4.4 Amazon Web Services and Microsoft Professional Services Status Report

Quarterly COR Approval

013 C.4.6 Transition Out Plan 90 days prior to end of contract

COR Approval