70RTAC26R00000004 - A0002_SOW.pdf

70RTAC26D00000004, Amendment 0002 A achment 2

Statement of Work (SOW)

U.S. Department of Homeland Security (DHS)

Cumulus Program

Enterprise Cloud Service Provider (CSP) Requirements

Office of the Chief InformaƟon Officer (OCIO) 6595 Springfield Center Drive

Springfield, VA 22150

1 INTRODUCTION

Cloud CompuƟng is defined by NIST SP 800-145 as a “model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable compuƟng resources, such as networks, servers, storage, applicaƟons, and services, which can be rapidly provisioned and released with minimal management effort or interacƟon with the provider.” Cloud Service Providers (CSPs) offer cloud compuƟng services to consumers. DHS and DHS Components hereaŌer referred to as “DHS” share a vision for leveraging cloud compuƟng across the department to transform mission operaƟons by enabling rapid applicaƟon development, enhancing funcƟonality and security, and expanding its porƞolio of commercial and government CSP cloud compuƟng services. DHS requires an integrated, interoperable, and secure mulƟ-cloud ecosystem that supports reliable, dynamic, and innovaƟve IT services accessible anyƟme, anywhere, and under all condiƟons. This ecosystem will facilitate workflows across mulƟple security fabrics, maximize data reuse and sharing, and support diverse consumers, including disconnected or edge operaƟons. DHS aims to incorporate advanced technologies such as arƟficial intelligence (AI), machine learning (ML), and high-performance compuƟng while ensuring unified security processes for quick adopƟon and portability of applicaƟons, data, and code. This SOW supports an indefinite-delivery, indefinite-quanƟty (IDIQ) contract award, allowing subsequent task orders for enterprise government and commercial CSP Anything as a Service (XaaS) cloud services, professional services, and training to be established under it. XaaS refers to the vast number of products, tools, technologies delivered to users as a service over the internet such as Infrastructure as a Service (IaaS), Plaƞorm as a Service (PaaS), and SoŌware as a Service (SaaS). It also allows for the flexibility to include new and emerging service models such as FuncƟons as a Service (FaaS), Database as a Service (DBaaS), or Container as a Service (CaaS). DHS’ cloud porƞolio is expected to evolve into a mulƟ-cloud ecosystem leveraging heterogeneous architectures to capitalize on CSPs' unique investments, while diversifying offerings to promote compeƟƟon, integraƟng cybersecurity best pracƟces, and extend cloud services to disconnected and low-bandwidth environments. This SOW specifically defines the scope and requirements for Department-wide CSP soluƟons, providing maximum flexibility for vendors to support DHS's mission success.

2 BACKGROUND

DHS has requirements for secure, scalable, flexible, automated, and cost-effecƟve cloud compuƟng capabiliƟes to support its over 600 cloud hosted systems including major, mission-criƟcal, safety-criƟcal, and life-criƟcal systems hosted by commercial and government CSPs. This aligns with the federal strategy outlined in OMB Memoranda M-22-09 and M-21-31, which advances a zero trust cybersecurity approach for improving the NaƟon’s Cybersecurity. DHS systems serve diverse public and private stakeholders, requiring CSPs to provide on-demand access to hosƟng services via web Graphical User Interfaces (GUIs) and ApplicaƟon Programming Interfaces (APIs) for programmaƟc provisioning and de-provisioning. DHS employs hardened images, formaƟon templates, auto-scaling infrastructure, scalable databases and storage, containerizaƟon, and automated configuraƟon control to enable rapid provisioning of system environments within minutes, ensuring robust support for IT and operaƟonal technology systems criƟcal to naƟonal safety and security.

3 SCOPE

The scope of this SOW allows for task order awards to be established which enable DHS to dynamically consume cloud services from CSPs in both commercial and government with established records for innovaƟon (i.e., Technical Agility) and operaƟonal excellence in cloud service delivery (i.e., Cloud Maturity) in a uƟlity consumpƟon based compuƟng model, supporƟng financial tracking and forecasƟng. Acquiring services from CSPs, rather than developing those services in-house, has been shown to scale faster to meet DHS compute needs, to facilitate the adopƟon of innovaƟon occurring in the commercial marketplace, saƟsfy the rigorous performance and security requirements of DHS while allowing DHS consumers to focus on mission delivery. This IDIQ award and subsequent task orders will focus on modernizing and innovaƟng DHS systems and soŌware through cloud-based soluƟons, emphasizing microservices, API-driven frameworks, mobile extensibility, container strategies, and standardized, portable environments.

This IDIQ award will provide access to XaaS services, through CSPs. XaaS opƟons must meet DHS requirements with CSP marketplace offerings included. This IDIQ award and resulƟng task orders will focus exclusively on true on-demand commercial and government CSP provided XaaS and marketplace cloud services including enterprise support, professional services support, and training for these services. The IDIQ award and resulƟng task orders will exclude non CSP, third party resellers, Managed Service Providers (MSPs), or contractor Lead System Integrator (LSI) specific services such as system development, architecture, implementaƟon, interoperability, and migraƟon services that leverage CSP services. Decisions on CSP uƟlizaƟon for new and legacy systems will be based on mission requirements, technical architecture and cost-effecƟveness analyses conducted by the Government. AdministraƟve support for access, service outages, and technical discussions related to CSP services is also within scope of this IDIQ award.

4 REFERENCE AND POLICY DOCUMENTS

The following documents and corresponding successors shall be incorporated into this IDIQ award. Required compliance with agency-specific policies, NIST standards, guidelines and special publicaƟons, and any corresponding successors that can change without noƟce shall be in full effect if and unless revised based on order level requirements established within an order level award.

DHS AcquisiƟon Management DirecƟve 102-01 Handbook, 11/17/25 o hƩps://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja

&uact=8&ved=2ahUKEwj2g8DZ- LuUAxVuFlkFHcEsDYYQFnoECBgQAQ&url=hƩps%3A%2F%2Fwww.dhs.gov%2Fsite s%2Fdefault%2Ffiles%2F2026-02%2F26_0204_mgmt_dhs-direcƟve-102-01-acquisiƟon-management.pdf&usg=AOvVaw2DkBpGSCqtBRBgm1X8SJsV&opi=89978449

DHS Policy DirecƟve (PD) 4300A – InformaƟon Technology System Security Program, SensiƟve Systems, version 13.4, 12/6/24 o hƩps://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja &uact=8&ved=2ahUKEwiclfak_ruUAxWBD1kFHZq2MIkQFnoECBQQAQ&url=hƩps %3A%2F%2Fwww.dhs.gov%2Fsites%2Fdefault%2Ffiles%2FpublicaƟons%2FSensiƟ ve%2520Systems%2520Policy%2520DirecƟve%25204300A.pdf&usg=AOvVaw0-pONHaV66ECe6sxfSGdX1&opi=89978449

DHS 4300A SensiƟve Systems Handbook, version 9.1, 7/24/12 o DHS 4300A SensiƟve Systems AƩachments | Homeland Security

NIST SP 800-145 - The NIST DefiniƟon of Cloud CompuƟng, 9/28/11 o hƩps://doi.org/10.6028/NIST.SP.800-145

NIST SP 800-53, Rev 5, 12/10/20 o hƩps://doi.org/10.6028/NIST.SP.800-53r5

5 TECHNICAL REQUIREMENTS

5.1 Ownership, Management, Reporting, and Support

This secƟon describes ownership of accounts and metadata, centralized account management capabiliƟes, and administraƟve access within technical / architectural boundaries governed by commercial SLAs to detailed billing, usage, and spend data. It specifies integraƟon of cloud reporƟng tools for cost tracking, configuraƟon management, and security compliance, as well as direct technical support access. AddiƟonally, it details program management support, including recurring working groups, subject maƩer experƟse, and monthly contract status reports with performance metrics, billing data, and security compliance deliverables. AddiƟonal in-scope requirements may be established at the order level based on order level requirements.

5.1.1 Ownership

The awarded CSP shall provide DHS and Components full ownership of all tenancies, root accounts, linked accounts, payer / master organizaƟon accounts and subscripƟons which contain DHS data and processing systems. DHS and Components shall provide tenancies, root accounts, linked accounts, and payer / master organizaƟon accounts and subscripƟons to Government personnel at their discreƟon upon receipt from the CSPs.

5.1.2 OrganizaƟon

The awarded CSP shall provide DHS administraƟve ability within technical / architectural boundaries governed by commercial SLAs to link and group accounts in a logical structure specified by DHS for centralized management of billing, secure configuraƟon, account policies and idenƟty management within a single CSP.

5.1.3 Billing, Usage, Spend, and Cost Savings

The awarded CSP shall provide DHS administraƟve access within technical / architectural boundaries governed by commercially available SLAs to raw CSP usage and spend data in management billing accounts (Azure billing account) via CSP Graphical User Interface (GUI) consoles and other XaaS cost tracking and opƟmizing tools via ApplicaƟon Programming Interface (API) to include regular access to and generaƟon of Cost and Usage (CUR) Reports in a current supported version specified by the Government.

The awarded CSP shall provide exports of CUR data in FinOps Open Cost and Usage SpecificaƟon (FOCUS) version 1.X format or current supported version specified by the Government.

The awarded CSP shall provide references to CSP developed product lists that include current and new products as they are added to the product list. This product list shall include all commercial, government, region specific products, as applicable, offered by the CSP.

The awarded CSP shall provide DHS administraƟve ability within technical / architectural boundaries governed by commercial SLAs to create, buy, apply, manage and terminate long term funding commitment, resource commitment, and unused compute capacity cost saving services and tools including but not limited to Savings Plans, CommiƩed Use Discounts, Reserved Instances, Spot Instances, PreempƟble Instances.

Further billing, usage, spending and cost savings requirements may be established at the task order award level.

5.1.4 Cloud ReporƟng Tool IntegraƟon

The awarded CSP shall ensure that cloud reporƟng tools are able to integrate with the

CSPs cloud naƟve fabric to report cost, configuraƟon management, and security compliance.

The awarded CSP shall provide tools that allow DHS to view performance and recommended opƟmizaƟon configuraƟons for resources that are deployed in their cloud environments. These opƟmizaƟon recommendaƟons should allow consumers to evaluate configuraƟons for performance and/or price and allow consumers to target the tool at specific resources to determine opƟmizaƟons and efficiencies for targeted infrastructure.

5.1.5 Technical Support Requests

The awarded CSP shall provide the ability for DHS to submit technical support requests to the CSP and interface directly with the CSP support team as applicable without restricƟon or approval by the CSP.

The awarded CSP shall provide evaluaƟon of system and environmental architectures and implementaƟon designs to ensure scalability over Ɵme through architectural reviews with soluƟons architects and engineers leveraging the CSP Well-Architected frameworks.

The awarded CSP shall provide proacƟve services delivered by CSP support experts to assist DHS in reviewing the health of cloud operaƟons, opƟmize costs, and scale workloads efficiently through workload reviews, best pracƟces workshops, and deep dives.

5.1.6 Program Management Office (PMO) Support

The awarded CSP shall support overarching (IDIQ award level) program management support to DHS including a dedicated Program Manager (PM) and support staff. Program Management Support will involve overseeing administraƟon of all contract acƟviƟes during the enƟre period of performance. ResponsibiliƟes include, but are not limited to program reviews, CSP management team roles and interacƟons, scheduling, documentaƟon, and account billing as outlined in the Program Management Plan (PMP).

The awarded CSP shall conduct monthly Program Management Reviews (PMRs) with DHS. The PMR presentaƟon materials shall be delivered to DHS and include, at a minimum, updates on acƟon items, contract and financial metrics (e.g., consumpƟon/expenditures by Component, service usage, billing data, budget limits), key schedule updates (including the Integrated Master Schedule), capacity ahead of demand and operaƟonal metrics, clearance status, security-relevant updates, and service offering strategic plans and roadmaps.

The awarded CSP shall support recurring, tacƟcal level, joint working groups at a frequency directed by DHS. These working groups shall address focus topics (e.g., faciliƟes, security, service roadmaps, capacity, operaƟonal metrics, new product availability, preview product availability, etc.) as directed by DHS. The CSPs shall provide subject maƩer experts with decision authority, to parƟcipate in these working groups.

The awarded CSP shall ensure that all personnel with direct access to DHS informaƟon systems complete all applicable mandatory training requirements.

Further in-scope PM requirements as reviewed and validated by DHS ContracƟng Officer and ContracƟng Officer’s RepresentaƟve may be established at the task order level based on task order level requirements.

5.1.7 Ordering Guide InstrucƟons

The awarded CSP shall provide ordering guide instrucƟons for Department-wide use providing any specific informaƟon or process that Department users need to understand in successfully ordering CSP services in accordance with CSP published, commercial pricing.

The awarded CSP shall provide account request, provisioning, access, usage and FAQ informaƟon for Department-wide use detailing any specific informaƟon or process including required steps, Ɵmelines, procedures and requirements for users in successfully ordering CSP services in accordance with CSP published, commercial pricing.

The awarded CSP shall provide main Point of Contact (POC) informaƟon including the name, Ɵtle, email, and telephone informaƟon of the awarded CSP contracƟng office.

Referenced CSP POC shall be able to Ɵmely respond to any/all quesƟons regarding CSP published, commercial pricing as well as technical quesƟons related to the CSP’s offerings.

5.1.8 Marketplace Ordering Procedures

In-scope requirements established at the task order level may include in-scope Commercial Off the Shelf (COTS) soluƟons available through the CSP published, commercial marketplace pricing.

The CSP will provide the ability to procure in-scope, within the not-to-exceed (NTE) marketplace ceiling value, marketplace soluƟons reviewed and approved by the IDIQ ContracƟng Officer (CO) and ContracƟng Officer’s RepresentaƟve (COR). Further, IDIQ CO and COR will establish and manage a list of those DHS HQ and Component COs approved to make marketplace purchases at the task order level.

All marketplace soluƟons offered are required to be iniƟally approved by IDIQ CO and COR before being formally published and available on the CSP marketplace. ExcepƟons for emergency conƟnuity of operaƟons will be handled on a case by case basis in accordance with established DHS procedures. The IDIQ CO and COR will review all requested in-scope marketplace soluƟons based on a template provided to DHS HQ and Components to ensure usage is limited to only approved in scope soluƟons secured under task orders awarded by approved COs. In order to proceed with a marketplace procurement, DHS HQ and Component COs shall have submiƩed template approval by the IDIQ CO and COR. ALL requests to purchase a marketplace soluƟon must receive an official approval from the IDIQ CO and COR.

In providing fair and reasonable prices for marketplace soluƟons at the task order level, the awarded CSP shall first leverage exisƟng contractual awards, pricing agreements, and/or End User License Agreements (EULAs) terms already established by DHS. In those instances where a soluƟon is available via marketplace, but is not supported by an exisƟng contractual award, pricing agreement, and/or End User License Agreements (EULAs), it is the responsibility of the HQ and Component CO to secure a fair and reasonable price for said marketplace soluƟon. This may include collaboraƟon with the CSP in securing pricing informaƟon to ensure selected marketplace soluƟon is provided to DHS at a fair and reasonable price. This may include, for example, obtaining and validaƟng a minimum of three (3) quotes for the requested marketplace soluƟons from vendors or resellers of the product to demonstrate that compeƟƟve pricing was received. In the event three (3) quotes are not available as many quotes as are available shall be provided along with a jusƟficaƟon as to why (3) quotes were not received.

The awarded CSP is encouraged to offer addiƟonal discounts beyond the discount represented within the IDIQ award. The Ownership of all marketplace soluƟons included on awarded task orders, for performance of in-scope IDIQ award requirements, will be defined at the task order level based on task order level requirements.

The awarded CSP shall document within its monthly IDIQ level award reporƟng all the marketplace purchases made.

ALL marketplace soluƟons considered shall be in full accordance with those terms and condiƟons included within this IDIQ award.

NO marketplace purchases shall be made under this IDIQ award and its resulƟng task orders without following and in fully documenƟng those requirements represented within this secƟon.

5.2 CSP Service Requirements

This secƟon describes requirements for cloud service providers, including access to commercially available and FedRAMP-authorized cloud services, resource provisioning, and integraƟon capabiliƟes for mulƟ-cloud ecosystems. It specifies technical criteria for scalability, reliability, and availability, as well as offerings for XaaS, serverless compuƟng, and integraƟon plaƞorms. These services are designed to support mission-criƟcal workloads, enable rapid deployment, and ensure high performance, resilience, and compliance across DHS operaƟons.

AddiƟonal in-scope requirements validated by DHS ContracƟng Officer and ContracƟng Officer’s RepresentaƟve may be established at the task order level based on task order level requirements.

5.2.1 Access and Availability

The awarded CSP shall comply with NaƟonal InsƟtute of Standards and Technology

(NIST) Special PublicaƟon 800-145, which describes cloud compuƟng as:

o A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable compuƟng resources (e.g., networks, servers, storage, applicaƟons, and services) that can be rapidly provisioned and released with minimal management effort or service provider interacƟon.

The awarded CSP shall provide the full breadth of the CSP's offered cloud services in commercial and government cloud regions as Commercial Off The Shelf (COTS) technology including CSP specific marketplaces. All currently emerging and future CSP service offerings are within the scope of the full breadth of the CSP’s offered cloud services.

The awarded CSP shall offer GSA FedRAMP Low (if available), Moderate and High authorized cloud services in addiƟon to commercially available, non FEDRAMP authorized cloud services that support the storage and processing of data within an environment with restricted user access.

The awarded CSP shall provide DHS administraƟve access within technical / architectural boundaries governed by commercial SLAs to CSP Graphical User Interface (GUI) consoles and ApplicaƟon Programming Interface (API) endpoints required to iniƟate creaƟon, provisioning, configuraƟon, and terminaƟon of all resource instances in alignment with the CSP’s commercially available service capabiliƟes, applicable SLAs, security enforcement mechanisms, and operaƟonal governance requirements within 5 minutes of request using automated Infrastructure as Code (IaC), direct API calls, or manual GUI console workflows.

The awarded CSP shall provide administraƟve funcƟonality within technical / architectural boundaries governed by commercial SLAs to integrate cloud services offerings through user-facing, self-service interfaces and service endpoints to enable system interoperability in a mulƟ-cloud ecosystem through the exchange of informaƟon and idenƟƟes.

The awarded CSP shall maintain a large market presence in providing public cloud IaaS service offerings defined as a CSP that has more than three (3) years of market presence and demonstrates a minimum of $250 million in annual IaaS service revenue over the 12-month period reflected in the CSP’s most recent financial statement or records, excluding all managed and professional services, and a minimum of 100,000 virtual machines (VMs) currently in producƟon, operaƟng simultaneously, within its public commercial cloud. Referenced market presence directly aligns with current Department-wide mission requirements.

5.2.2 Systems Requirements

The awarded CSP shall provide real-Ɵme hardware resources to support the

Government’s virtual infrastructure without any need to esƟmate or procure those hardware resources. The hardware resources underlying the virtual infrastructure shall become available in near real Ɵme at the launch of the virtual instance and the virtual instances shall be billed in increments no larger than one hour.

The awarded CSP shall provide infrastructure, plaƞorm, and soŌware as a service cloud services and the hardware to operate those resources without any interacƟon between the CSP and the DHS teams. For example, there shall be no ƟckeƟng system to a third party to configure any resources.

5.2.2.1 Scalability

The awarded CSP shall be both horizontally and verƟcally scalable to four thousand virtual instances in less than 10 minutes, support hundreds of petabytes of storage, support a minimum of six terabytes of storage for databases, and be able to scale across two or more data centers as a selectable opƟon in the API or web console.

The awarded CSP shall provide a Point of Presence at a co-locaƟon facility where a connecƟon of 10GB or greater can be connected to the DHS network without a partner connecƟon.

5.2.2.2 Reliability

The awarded CSP shall provide redundancy across mulƟple data centers, geographically dispersed from each other, to prevent natural and man-made disasters from impacƟng operaƟonal status. All services with the excepƟon of a list of services provided by a CSP shall be scaled over mulƟple data centers and provide for real-Ɵme automaƟc failover without interrupƟon to the service the systems are supporƟng, should a disaster occur.

Launching resources in mulƟple data centers shall be a selectable opƟon within the API and web console.

5.2.2.3 Availability

The awarded CSP shall provide a minimum availability level of 99.9% for each of their services unless otherwise agreed to by the Government for a parƟcular service in accordance with their commercially adverƟsed Service Level Agreements (SLAs).

Resources launched in mulƟple datacenters shall conƟnue to operate and be available when other but not the enƟrety of data centers are offline.

5.2.3 Infrastructure as a Service (IaaS)

NIST SP 800-145 defines IaaS as the capability provided to the consumer is to provision processing, storage, networks, and other fundamental compuƟng resources where the consumer is able to deploy and run arbitrary soŌware, which can include operaƟng systems and applicaƟons. The consumer does not manage or control the underlying cloud infrastructure but has control over operaƟng systems, storage, and deployed applicaƟons; and possibly limited control of select networking components (e.g., host firewalls).

The awarded CSP shall provide foundaƟonal compute, storage, and network resources needed to produce any form of capability in the cloud. The CSP shall provide a vast range of compute configuraƟons to run mission workloads; object storage capabiliƟes to house mission data; and network to enable resilient, highly performant, connecƟvity to build and serve the organizaƟons mission capabiliƟes.

5.2.4 Plaƞorm as a Service (PaaS)

NIST SP 800-145 defines PaaS as the capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applicaƟons created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operaƟng systems, or storage, but has control over the deployed applicaƟons and possibly configuraƟon seƫngs for the applicaƟon-hosƟng environment.

The awarded CSP shall provide plaƞorms in the form of managed compute, storage, database and container orchestrator offerings. These services enable the organizaƟon to build a plethora of custom applicaƟons that meet a varying range of enterprise and mission objecƟves without requiring the direct configuraƟon of IaaS.

5.2.5 SoŌware as a Service (SaaS)

NIST SP 800-145 defines SaaS as the capability provided to the consumer is to use the provider’s applicaƟons running on a cloud infrastructure. The applicaƟons are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operaƟng systems, storage, or even individual applicaƟon capabiliƟes, with the possible excepƟon of limited user-specific applicaƟon configuraƟon seƫngs.

The awarded CSP shall offer and provide access to commercially available and FedRAMP approved SaaS products available through CSP SaaS product offerings, CSP specific marketplaces and third party SaaS interfaces. These SaaS products shall uƟlize a soŌware distribuƟon model where a CSP hosts the applicaƟons (products) and makes them available to their customers, relieving the customer of the responsibility of managing the associated applicaƟon, plaƞorm, or infrastructure.

The awarded CSP shall ensure CSP SaaS offerings and CSP specific marketplace offerings comply with the CSP billing model with billing informaƟon available through the CSP console.

The awarded CSP shall ensure all SaaS licenses follow either a "Bring Your Own License (BYOL) model or are integrated with the CSP billing system such that there is no separate billing.

5.2.6 Serverless

The awarded CSP shall provide capabiliƟes that enable the organizaƟon to rapidly deploy low-cost, highly scalable, applicaƟon architectures with minimal setup and administraƟon requirements. These capabiliƟes shall include, but not be limited to funcƟons, API gateways serverless databases and integraƟon plaƞorms.

The awarded CSPs shall provide plaƞorms and services used to build resilient, highly distributed, and decoupled applicaƟons. The integraƟon plaƞorms shall include but are not limited to messaging, noƟficaƟon, queueing, and low / no code.

5.2.7 CSP Specific Marketplace Services

The awarded CSP shall offer CSP marketplace approved services that meet or exceed

FedRAMP High, Moderate, and Low (as available) accreditaƟon and cybersecurity protecƟon requirements, as defined in NIST SP 800-53, Rev. 5, for sensiƟve government applicaƟons and systems.

The awarded CSP shall provide DHS the administraƟve ability within technical / architectural boundaries governed by commercial SLAs to procure and uƟlize in-scope marketplace products and services available directly supporƟng and complimenƟng exisƟng service uƟlizaƟon and opƟmizaƟon available through CSP specific marketplaces.

The awarded CSP shall provide DHS the administraƟve ability within technical / architectural boundaries governed by commercial SLAs to procure and uƟlize in-scope CSP specific marketplace products and services including but not limited to Bring Your Own License (BYOL), SaaS and third party license agreements through centralized DHS procurement workflows with terms and condiƟons negoƟated, executed, and enforceable solely between the Government and marketplace service providers governed by user based permissions and roles. The Government will ensure that prior to any marketplace purchase that it is thoroughly reviewed by the DHS Cumulus governance team described in the Cumulus Ordering Guide to ensure compliance with all applicable IDIQ terms and condiƟons.

The awarded CSP shall provide DHS capability to access, leverage and uƟlize in-scope, publicly available CSP marketplace capabiliƟes such as operaƟng system base images that vendors provide through CSP marketplaces.

The awarded CSP shall provide DHS capability to publish capabiliƟes to private CSP marketplace offerings for sharing of resources.

5.2.8 Bring Your Own License

The awarded CSP shall provide DHS the capability to uƟlize COTS licenses procured from a variety of third party sources in all CSP services that naƟvely support leveraging a third party license known as Bring Your Own License (BYOL). BYOL capabiliƟes allow DHS users to reduce the costs of consumpƟon based CSP services that leverage COTS licensed tools that the CSPs are required to pay directly to COTS vendors for their usage. BYOL promotes license portability and supportability across CSPs and service offerings to the greatest extent pracƟcable.

5.3 CSP PaaS & SaaS Service Performance Requirements

This secƟon describes technical requirements for CSP XaaS services to ensure robust security, operaƟonal efficiency, and compliance across DHS cloud environments to support DHS operaƟons. These XaaS services do not comprise the finite amount of services the CSP shall provide to DHS. AddiƟonal requirements may be established at the task order level based on task order level requirements.

5.3.1 RelaƟonal Database Services (RDS)

The awarded CSP shall provide a highly available relaƟonal database service for large scalable databases without DHS having to manage the servers or DBMS. This service must be geographically redundant over more than 500 miles. The database creaƟon, modificaƟon, deleƟon and management on this service must be available via API’s and scale on demand to 20000 IOPS and 6 TB.

5.3.2 NoSQL Database Service (NSDS)

The awarded CSP shall provide a fast and flexible NoSQL database service for applicaƟons that need consistent, single-digit millisecond latency within exisƟng CSP SLAs per service. It shall be a fully managed cloud database that supports both document and key-value store models. It shall provide a flexible data model, reliable performance, and automaƟc scaling of throughput capacity, providing response Ɵmes from milliseconds to microseconds up to millions of requests per second.

5.3.3 ArƟficial Intelligence Plaƞorms

The awarded CSP shall provide ArƟficial Intelligence (AI) plaƞorms to support machine learning and arƟficial intelligence algorithm development and tesƟng. These algorithms will allow DHS to parse data, find paƩerns, and learn from that data to make determinaƟons/predicƟons.

5.3.4 Big Data

The awarded CSP shall provide services necessary for processing and analyzing vast amounts of data amassing mulƟple petabytes of informaƟon. The CSP shall provide services that enable the organizaƟon to store, query, and derive insight from its data are criƟcal to execuƟng mission.

5.3.5 Data Warehouse Service (DWS)

The awarded CSP shall provide a fully managed, gigabyte to petabyte-scale data warehouse service in the cloud, which allows for 100GB of data to scale to a petabyte or more. This service shall allow the user to run Business Intelligence (BI) tools against the data source to use the data to acquire new insights for the business. Complex query datasets shall be returned within minutes using SQL based tools to analyze the data.

5.3.6 Network

The awarded CSP shall provide DHS administraƟve control within technical / architectural boundaries governed by commercial SLAs over the enƟre virtual networking environment, including selecƟon of its own IP address range, creaƟon of subnets, and configuraƟon of route tables and network gateways.

The awarded CSP shall support a minimum of 1000 Security / Firewalling rules and a minimum of 1000 Access Control Rules to control traffic flow.

The awarded CSP shall provide the ability to perform logical separaƟon of processing, data, and workloads, as well as providing and supporƟng isolaƟon and boundary control for infrastructure, workloads, and internal and external networks.

The awarded CSP shall provide a dedicated and secure network that supports secure encoding methods for data at rest and data in transit and end-to-end communicaƟon to support the deployment and administraƟon of CSP services.

The awarded CSP shall provide ability to bypass the public internet and provide a direct connecƟon to the commercial or government CSP from a DHS Data Center over a secure scalable on-demand cloud interconnecƟon, providing a secure connecƟon over a private link that improves performance, reduces costs, increases security, and ensures consistent throughput at network speeds up to 10Gbps.

5.3.7 Desktop VirtualizaƟon Services

The awarded CSP shall provide a XaaS capability to deliver virtual desktops to the enƟre

DHS organizaƟon. The number of desktops will be defined at the order level. The desktops shall support Government security standards, provide per user profiles, support MicrosoŌ Windows Desktop and Linux OperaƟng systems, and be capable of running any applicaƟon that can run on these operaƟng systems on a physical desktop.

5.3.8 IdenƟty and Access Management

The awarded CSP shall provide the ability for idenƟty and access management cloud services to securely verify user idenƟty using modern authenƟcaƟon protocols that work in all DHS environments, such as mulƟ-factor authenƟcaƟon (MFA) and public key infrastructure (PKI).

5.3.9 EncrypƟon and Key Management

The awarded CSP shall provide plaƞorms that facilitate the creaƟon, deleƟon, and management of the cryptographic material used to encrypt the data that passes through the organizaƟon’s network, applicaƟons, and systems is monumental to the organizaƟons mission.

The awarded CSP shall provide data encrypƟon capabiliƟes across all service offerings, hardware and soŌware, including the ability to securely manage, back up, and recover encrypƟon keys.

The awarded CSP shall provide mulƟple encrypƟon capabiliƟes using diverse algorithms for all cloud service offerings and underlying infrastructure in compliance with commercially available standards for data at rest and data in transit, including but not limited to cipher strength, permiƩed algorithms, and encrypƟon schemes. The algorithms and configuraƟons of key standards shall be made available upon request by the DHS ContracƟng Officer and ContracƟng Officer’s RepresentaƟve.

5.3.10 Secrets Management

The awarded CSP shall provide the ability for the DHS to leverage a plaƞorm that aids developers in protecƟng sensiƟve informaƟon within the mission applicaƟons that serve

DHS.

5.3.11 Secure Environment ConfiguraƟon

The awarded CSP shall provide the ability for DHS to implement cybersecurity controls and policies through IaC, API endpoints, or manual GUI configuraƟon at a management account level that other accounts are able to leverage and inherit from to enforce secure environment baseline requirements and standard control compliance.

The awarded CSP shall develop and mature the capability to provide unified organizaƟonal level policies and guard rails with consistent syntax allowing for the ability to easily enforce limiƟng informaƟon leaving an environment if not already present by the end of the base ordering period.

The awarded CSP shall develop and mature the capability to provide private networking opƟons for CSP provided services eliminaƟng the need for public internet exposure for Government data if not already present by the end of the base ordering period.

5.3.12 Monitoring and Logging

The awarded CSP shall provide the ability to conƟnuously log, monitor, and audit infrastructure, cloud services, and administraƟve acƟvity to support technology operaƟons and insider threat programs.

5.3.13 Intrusion DetecƟon

The awarded CSP shall provide automated intrusion detecƟon and idenƟficaƟon for all

CSP service offerings and physical hardware.

5.3.14 Cost UƟlizaƟon and Management CapabiliƟes

The awarded CSP shall develop and mature the capability to provide visual dashboards and capabiliƟes for automated hierarchical resource tagging, traceability and reporƟng of costs from the highest level of an organizaƟon to the individual resource level if not already present by the end of the contract base year of performance.

5.3.15 CSP Metadata Control

For the purposes of the below requirements, the following definiƟons will be used:

Metadata - Any non-content data generated, collected, or derived from the Government’s use of CSP services, including but not limited to access logs, Ɵmestamps, user behaviors, resource usage paƩerns, query histories, performance metrics, and any aggregated or anonymized forms thereof. metadata excludes Government data.

Government Data - All data owned or controlled by the Government that the Government or any end user transfers to a CSP for processing, storage, or hosƟng by the services in connecƟon with a CSP enterprise account and any computaƟonal results that customer or any end user devise from the foregoing through its use of the services.

Prohibited Use - Any use of metadata for purposes not explicitly authorized by this agreement, including but not limited to AI/ML training, markeƟng, adverƟsing, or sharing/selling to third parƟes, whether in raw, aggregated, or anonymized form.

The awarded CSP shall collect metadata only to the extent strictly necessary for the provision, maintenance, security, and billing of CSP services. Any collecƟon beyond this scope requires prior wriƩen consent from the Government.

The awarded CSP shall not engage in any prohibited use of metadata without the Government’s explicit, prior wriƩen approval. This includes, but is not limited to:

o Using metadata to train, fine-tune, or improve arƟficial intelligence models, algorithms, or other CSP products/services;

o AggregaƟng, anonymizing, or deriving insights from metadata for sale, licensing, or sharing with third parƟes;

o IncorporaƟng metadata into any datasets, benchmarks, or analyƟcs offered via the Provider's marketplace or external services.

The awarded CSP shall implement data minimizaƟon pracƟces, retaining metadata only for the duraƟon necessary for CSP service delivery unless required by law or Government instrucƟon. Upon expiraƟon, metadata shall be securely deleted or returned to the Government at no addiƟonal cost.

The awarded CSP shall protect all metadata with the same level of security as Government data consistent with exisƟng FedRAMP requirements.

The awarded CSP shall develop and mature the capability to provide technical controls to isolate Government metadata from other customers' data if not already present by the end of the contract base year of performance, including:

o Metadata firewalls or equivalent mechanisms to prevent unauthorized internal or external sharing.

o OrganizaƟon level policies configurable via a centralized dashboard, to automaƟcally enforce metadata sharing restricƟons across all CSP services.

The awarded CSP shall provide real-Ɵme access to metadata usage logs through a secure, dashboard.

The awarded CSP shall provide details on collecƟon, processing, and any aƩempted prohibited uses, updated at least monthly.

The awarded CSP shall allow the Government, or a designated third-party auditor subject to reasonable confidenƟality, the right to audit the CSP’s metadata handling pracƟces including access to relevant systems and records to verify compliance with this agreement in accordance with FedRAMP requirements.

The awarded CSP shall noƟfy the Government in wriƟng of any policy changes affecƟng metadata at least 30 days prior, allowing for Government review and objecƟon.

The awarded CSP shall engage an independent third-party approved by the Government for annual audits of metadata pracƟces, with results shared with the Government to align with FedRAMP conƟnuous monitoring requirements.

The awarded CSP shall noƟfy the Government within 24 hours and provide a root cause analysis within 72 hours in the event of any unauthorized metadata use or breach in accordance with FedRAMP requirements. The awarded CSP Remedies shall include, at the Government’s discreƟon:

o The awarded CSP shall immediately engage the documented Incident Response Plan based on NIST, ISO/IEC, and FedRAMP specific to customer’s data where applicable.

o Offer remediaƟon according to the CSP Service Level Agreement (SLA) policies.

5.4 Support, Training, SLAs & CSP Specific Professional Services This secƟon describes CSP requirements to deliver enterprise-level support, including dedicated subject maƩer experts for consultaƟon on architecture, security, automaƟon, and migraƟon, as well as automated noƟficaƟons for service changes. It outlines training provisions to enhance cloud plaƞorm experƟse, adherence to high-performance Service Level Agreements (SLAs), and access to emerging technologies. AddiƟonally, it includes CSP specific professional services for planning, design, and implementaƟon of cloud-based systems throughout the systems engineering lifecycle. CSP specific professional services are defined as professional services engagements provided by awarded CSP personnel or CSP subcontractors for the purpose of compleƟng discrete requirements directed by the Government. AddiƟonal requirements may be established at the task order level based on task order level requirements.

5.4.1 Enterprise Support

The awarded CSP shall provide DHS customers with Enterprise Support services. Vendor or third-party equivalents are not acceptable. The CSP shall provide automated mechanisms for noƟficaƟons, including any change that may affect the security and funcƟonality of provided services, environments, strategic plans, and service roadmaps.

The awarded CSP shall provide access to subject maƩer experts to comprise a dedicated cloud team for consultaƟon. The consultaƟon shall encompass areas including architecture, services recommendaƟons, best pracƟces, configuraƟons, operaƟonal health, security, automaƟon, and migraƟon.

5.4.2 Enterprise Training

The awarded CSP shall provide training to aid the maturity and understanding of how to build and deliver mission capabiliƟes in the vendor’s cloud plaƞorm.

The awarded CSP shall make at least fiŌeen (15) seats available per year per CSP. Topics for training shall include, but not be limited to: cloud security, cloud architecture, cloud systems operaƟons & engineering, cloud development & DevOps, serverless soluƟons, data stewardship & compliance, AI/ML development in the cloud, and cloud project management.

5.4.3 CSP Service Level Agreements

The awarded CSP shall ensure service offerings, product, applicaƟon, data availability, performance, and durability meet or exceed thresholds described by the CSP’s commercially published Service Level Agreement (SLA) to meet the highest levels of performance in accordance with those SLAs.

The awarded CSP shall offer any new emerging technologies to DHS through their commercial and FedRAMP catalogs.

The awarded CSP shall allow for requested modificaƟons to exisƟng commercially published SLAs to be negoƟated by the awarded CSP and the Government at the order level based on order level requirements.

The awarded CSP shall maintain all CSP provided services, or materially equivalent successor services, in use by DHS IT systems to ensure they are available, maintained and supported for the length of the IDIQ contract, in accordance with the CSP’s commercial terms of service, which provides that the CSP will noƟfy DHS at least 36 months before disconƟnuing any key service (or associated material funcƟonality), and at least 12 months before disconƟnuing any other service (or associated material funcƟonality), in each case unless the CSP replaces such disconƟnued service or funcƟonality with a materially similar service or funcƟonality.

5.4.4 CSP Specific Professional Services Support

The awarded CSP shall provide cloud adopƟon accounts for the purposes of user orientaƟon to CSP services and training.

The awarded CSP shall provide CSP specific professional and engineering services such as support for planning, design, development, acquisiƟon, provisioning, cost opƟmizaƟon, and implementaƟon of cloud-based systems and applicaƟons. SoluƟons architect and engineering services shall be furnished as needed during any phase of the systems engineering lifecycle.

5.4.5 CSP Data Transfer Cost Control

The awarded CSP shall limit intra and external Availability Zone, Availability Domain, Region and public internet data transfer ingress and egress costs based on a Ɵered threshold of total data transferred not to exceed a total amount agreed to by the awarded CSP and the Government

The awarded CSP shall limit intra and external Availability Zone, Availability Domain, Region and public internet data transfer ingress and egress costs in mission specific scenarios such as interagency sharing, public data releases, crisis driven events or other legally binding acƟviƟes agreed to by the awarded CSP and the Government

6 NON-TECHNICAL REQUIREMENTS

6.1 Government Furnished Property, Facilities, Services, and

Information (GFX) It is not anƟcipated that Government-furnished property (GFP), faciliƟes (GFF), services (GFS), and informaƟon (GFI) may be provided at the IDIQ award level. Government-furnished property (GFP), faciliƟes (GFF), services (GFS), and informaƟon (GFI) may be included at the task order level based on task order level requirements.

6.2 Contract Reporting

In addiƟon to those IDIQ award reporƟng requirements established immediately below, further reporƟng may be established at the task order level based on task order level requirements

6.2.1 Usage Report

The awarded CSP shall provide a monthly usage report submiƩed to the DHS IDIQ CO, COR, and Program Manager using the below template. The report shall have at least two

(2) tabs, one summary tab and one for each Component.

o Tab 1: IDIQ Summary Report

IDIQ ID

IDIQ Total Ceiling IDIQ Awarded CSP Name IDIQ ReporƟng Month IDIQ ReporƟng Year IDIQ Total ReporƟng Month List Cost IDIQ Total ReporƟng Month Invoiced Cost o Tab 2: IDIQ Task Order Summary Report Task Order ID Task Order Total Ceiling Task Order Awarded CSP Name Task Order Base Year PoP Start Date Task Order Base Year PoP End Date

Task Order Base Year Ceiling Task Order OpƟon Year X PoP Start Date Task Order OpƟon Year X PoP End Date Task Order OpƟon Year X Ceiling Task Order ReporƟng Month Task Order ReporƟng Year Task Order Total ReporƟng Month List Cost Task Order Total ReporƟng Month Invoiced Cost o Tab 3: Usage Detail Report Contract CLIN Component Name Component ReporƟng Month List Cost Component ReporƟng Month Invoiced Cost

6.3 508 Requirements SecƟon 508 of the RehabilitaƟon Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use informaƟon and communicaƟons technology (ICT), it shall be accessible to people with disabiliƟes. Federal employees and members of the public with disabiliƟes must be afforded access to and use of informaƟon and data comparable to that of Federal employees and members of the public without disabiliƟes.

All products, plaƞorms and services delivered as part of this work statement that, by definiƟon, are deemed ICT shall conform to the revised regulatory implementaƟon of SecƟon 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at hƩps://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulaƟon, ICT replaced the term electronic and informaƟon technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

ExcepƟons for this work statement have been determined by DHS and only the excepƟons described herein may be applied. Any request for addiƟonal excepƟons shall be sent to the ContracƟng Officer and a determinaƟon will be made according to DHS DirecƟve 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS InstrucƟon 139-05- 001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publicaƟon.

When providing Plaƞorm as a Service (PaaS) or SoŌware as a Service (SaaS), the contractor shall ensure services conform to the applicable SecƟon 508 standards (including the requirements in Chapter 5 for soŌware and WCAG Level A and AA Level 2.0 success criteria for web and soŌware. When the requirements in Chapter 5 do not address one or more soŌware funcƟons, the Contractor shall ensure conformance to the FuncƟonal Performance Criteria specified in Chapter 3.) The agency reserves the right to request an Accessibility Conformance Report (ACR) for PaaS and SaaS offerings. The ACR should be created using the Voluntary Product Accessibility Template Version 2.2 508 (or later). The template can be located at hƩps://www.iƟc.org/policy/accessibility/vpat

When providing cloud hosƟng services (Infrastructure as a Service, Plaƞorm as a Service, SoŌware as a Service, etc.) the Contractor shall ensure user administraƟve screens, dashboards and portals used to configure and monitor cloud services conform to the SecƟon 508 standards.

The Contractor shall provide informaƟon that will facilitate DHS’s selecƟon of services that conform to the level of SecƟon 508 compliance relevant for the Component/Task Order requirements.

The Contractor shall ensure cloud hosƟng services…