A04_SOW_-_CFA_Drupal_PaaS_Recompete_-_Draft.pdf

STATEMENT OF WORK (SOW)

Commission of Fine Arts (CFA)

Drupal Platform as a Service (PaaS) Website Content Management System

(CMS)

June 4, 2025

1 INTRODUCTION

1.1 BACKGROUND

The Commission of Fine Arts (CFA), an independent federal agency established in 1910 by Act of Congress, is charged with giving expert advice to the President, Congress and the heads of departments and agencies of the Federal and District of Columbia governments on matters of design and aesthetics, as they affect the Federal interest and preserve the dignity of the nation’s capital. The Commission consists of seven members who are appointed by the President and serve for a term of four years. The work of the Commission is currently supported by a staff of fifteen full-time Federal employees (FTEs).

The CFA is pursuing the acquisition of a managed cloud-based Drupal “Platform as a Service” (PaaS) Web Content Management System (CMS) and hosting solution for the agency’s website (https://www.cfa.gov/). The primary goal of this acquisition is to provide the solution and services necessary for CFA to have its website hosted in a cloud environment with improvements in efficiency, agility, innovation, and potential cost savings.

The acquired web hosting service will meet industry performance standards, offer the necessary redundancy and contingency features to meet CFA needs, and provide state-of-the-art technology enhancements to improve user experience and minimize service disruption. It will reflect the standards detailed in the Federal Cloud Computing Strategy (https://cloud.cio.gov/strategy/), and will comply with government mandates including the Federal Information Security Management Act (FISMA), Office of Management and Budget (OMB) Circular A-130 and OMB Memorandum 17-06 Policies for Federal Agency Websites and Digital Services.

The CFA website is a Drupal 10.4.5 application, following its upgrade from Drupal 9 in 2024. It is running in a cloud environment in Red Hat Enterprise Linux OS release 8.10 on an Apache HTTPD 2.4 web server utilizing MySQL 5.7.22 and PHP 8.2.27. This acquisition effort is necessitated by the impending expiration of the current task order. In addition to the need for a hosting service, there is also a requirement to upgrade the current website to Drupal 11 before the Drupal 10 End-of-Life (EOL) date of mid-late 2026.

SECTION 2 – DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

2.1. OBJECTIVES

https://www.cfa.gov/ https://cloud.cio.gov/strategy/

One objective of this effort is to provide CFA with an externally hosted, managed, and administered Drupal PaaS environment for its existing Drupal 10x website application.

The other objective is to upgrade the website application to Drupal 11 in the Base Period to meet the End-of-Life support deadline for Drupal 10 in mid-late 2026.

Fulfillment of these objectives will allow for greater confidence in the overall operation of Drupal-based websites and applications. Once completed, this project will provide the modern, flexible, scalable, secure, stable, highly available, and survivable steady-state website hosting environment the CFA requires.

2.2. SCOPE

The scope of this effort includes discovery/design workshops required to appropriately determine the configuration of the Drupal instance(s), implementation of the chosen configuration and modules, and all cloud computing and support services required to operate, maintain, safeguard and manage the Drupal CMS PaaS as specified herein. The Contractor shall provide a comprehensive management approach for managing the PaaS.

The Contractor shall provide labor, materials, and software for the design and implementation of CFA’s Drupal CMS configuration as well as the platform’s hosting services. The Contractor shall use already developed, pre-existing modules and avoid using modules expected to be discontinued in future Drupal versions, to the maximum extent possible. The Contractor shall be directly responsible for ensuring completion of all tasks under this effort. The Contractor shall ensure that the visual, organizational, and functional features of the website match the existing website, and that any visual, organizational, and functional features requiring changes be reviewed and approved by CFA staff.

Content migration services may be part of the scope for this effort. No direct customer (end user) support is required: only technical, system administration, and contract acquisition staff and teams will interface directly with the Contractor during administration of this task order. Regardless of teaming arrangements, the Contractor and its subcontractors and/or teaming partners, shall comply with all required and applicable laws, rules, regulations, and standards, and these laws, rules, regulations, and standards shall apply equally to all parties involved in any aspect of managing, hosting, delivering, maintaining and/or supporting the cloud services in performance of this task order.

The cloud computing environment must consist of either a government community cloud (including the United States federal, state, local and tribal entities), or private cloud. For legal jurisdiction implications regarding ensuring the adequate safeguarding of Government sensitive information, including Personally Identifiable Information (PII), service provider information systems that access and store government data at rest must be located within the sole jurisdiction of the United States Federal Government (i.e. within the continental United States, Hawaii, Alaska, Puerto Rico, Guam, and/or the Virgin Islands).

Regardless of teaming arrangements, the Contractor and its subcontractors and/or teaming partners, shall comply with all required and applicable laws, rules, regulations, and standards, and these laws, rules, regulations, and standards shall apply equally to all parties involved in any aspect of managing, hosting, delivering, maintaining, and/or supporting the cloud services in performance of this task order.

2.3. TECHNICAL REQUIREMENTS

The cloud-based solution must:

● Provide features, functionality and capabilities that meet industry performance and interoperability standards and utilize industry best practices.

● Provide and ensure the necessary redundancy, resiliency, and contingency capabilities to ensure service availability that meets CFA’s current and future needs, as identified herein.

● Improve both visitor and content publisher experience and productivity.

● Provide secure environments that comply with all required Federal laws, rules, regulations, standards. FedRAMP, FISMA, OMB and NIST references addressed in more detail herein.

● Leverage standard, commercial PaaS offerings that are elastic in their capacity rather than

“built-to-order” and static.

● Ensure open data standards, portability and data export at no additional charge to another

CMS and cloud hosting platform upon contract completion/termination.

2.3.1. Discovery and Review – Phase I

The CFA requires the Contractor to work with the CFA team to determine the design and configuration of the current and future Drupal systems. As part of this effort, the Contractor shall:

● Work with the CFA team to review high-level goals of the project to define and agree to clear success criteria.

● Review the scope of the existing system and elaborate high-level configuration requirements for the system including the overall capabilities of web services and integrations with external systems, if any.

● Gather and document requirements related to Drupal configuration and platform extension.

● Work with CFA team to identify and understand the requirements that drive required data schemes and migration constraints CFA may expect when migrating data.

● Make a recommendation for a phased migration approach that will support CFA’s requirements.

● Work with CFA team to identify and evaluate possible risks and their mitigation across the areas of design, knowledge, resourcing, and technical environments.

● Analyze data collected during Phase I of the project and work with CFA to develop and deliver to CFA a detailed Requirements Matrix that describes all of the high-level requirements and features of the sites.

● Use the Requirements Matrix to prepare a detailed Project Plan for the hosted Drupal 10x environment and a Project Plan for the future Drupal 11 application and environment.

2.3.2. System Planning and Design – Phase II

The Contractor shall work with the CFA team to define the architecture of the Drupal systems.

As part of this effort, the Contractor shall:

● Work with CFA team to review the scope and configuration of the system as it understands it from Phase I.

● Communicate to CFA team how the proposed configuration meets the high-level requirements identified in Phase I.

● Identify major components of the proposed Drupal systems (Drupal core) and identify if and how it will be extended with community and/or custom Drupal modules.

● Finalize and implement Requirements Matrix and Project Plan developed from Phase I.

● Implement a Test environment initially for the purposes of development, with the latest stable version of Drupal 10x core and appropriate contributed modules to support CFA’s mission and identified requirements. This Test environment is to be retained post-launch of the Production environment for the purposes of testing Change Control functions (i.e. patches, security updates, etc.) prior to implementation on the live site.

● Work with the CFA team to transfer the code and data bases from the current Production environment to the working Test environment.

● Once testing of transferred code and data bases is complete, push code and data bases (i.e. the completed Drupal application) to the live Production environment.

● Implement the latest stable Drupal version, currently version 10.4.5 core and appropriate contributed modules to support CFA’s mission and identified requirements.

● Work with the CFA team to ensure the cloud-based PaaS architecture meets the performance and security requirements as identified in the RFQ and as explained in the Contractor’s quote.

2.3.3. Hosting Functional Requirements – Phase III

The CFA requires a cloud-based Drupal PaaS environment. Based on the requirements gathering and plan review from the previous phases, the Contractor shall provide a Drupal PaaS environment that at a minimum:

Item Unit Description

System Availability Service Band 2, 99.5-99.99% system availability with a financial backed penalty schedule

Annual uptime percentage target for the System. The Contractor will design an environment configured to support the system availability target.

System Usage Average 20,000 page views per month and about 3,000 visits per day. Additional capacity available as required by usage.

Approximate target throughput the system should handle

System Monitoring and Support

Provide 24 hours per day, seven days a week, 365 days per year proactive monitoring and support for resolution of any and all outages that affect the availability of the hosting environment.

Provide troubleshooting services and support during core duty hours.

System monitoring of the hosting environment and troubleshooting incidents associated with it.

IPv6 requirements Compliance with federally mandated IPv6 requirements for public facing services (see https://csrc.nist.gov/publications/detail/sp/800- 119/final)

OMB M-17-06

requirements

Compliance with OMB M-17-06 Policies for Federal Agency Public Websites and Digital Services, especially:

GSA’s Digital Analytics Program (DAP) Make Information Searchable and Discoverable Use Secure Connections (HTTPS)

Backups Daily Backup, 2 Week Retention, 15 Minute Mean-Time to Restore

Weekly Backup, 1 Month Retention, 4 Hour Mean-Time to Restore

Backup period https://csrc.nist.gov/publications/detail/sp/800-119/final https://csrc.nist.gov/publications/detail/sp/800-119/final

Recovery Time Objective

(RTO)

Service Band 2

From 5 Minutes to 4 Hours

Length of Time for Backup restoration (how long to restore backup)

Recovery Point Objective

(RPO)

Service Band 3

From 4 to 4 Hours

Length of time between backups (how much data could be lost)

System Administration Infrastructure and Platform (Drupal and all subcomponents) Administration provided by Contractor

Administration of the infrastructure, including the Virtual Machine(s), Operating System, storage, network connectivity, and system access provided by Contractor.

Administration of the Platform, including Drupal and all required subcomponents, also provided by the Contractor.

System and Software Updates/Patching

Includes hosting environment and all software components included as part of the PaaS

The Contractor shall have a Change Control process in place to review, test, and seek approval for the installation of patches and system updates to any PaaS components. Testing must not occur on the production site. CFA shall have the opportunity to review and approve patches and system updates as part of this Change Control process.

Helpdesk Support

24x7x365 Support Acknowledge Requests – Band 1 Mean-Time-To Resolve – Band 2

Software Versions and Licenses

Drupal 10-11 (open source)

Web server application

Database application

Development language

Other open-source tools as required

Contractor shall provide the required software versions and licenses for the Drupal environment.

System Security All Environments Provide a secure platform that prevent loss of, or tampering with, Government data, service degradation, and/or service disruption to the hosting environment;

FIPS-199 Security FISMA Low

Network Access Public Access to Hosted Site

Virtual Private Network (VPN) or other authenticated means of connection from the CFA Network

2.3.4. Upgrade to Drupal 11 – Phase IV

• Develop and implement, during the Base Period, Drupal version 11 core, environment and appropriate contributed modules to support CFA’s mission and identified requirements.

• Upgrade the completed Drupal 10x website application to a Drupal 11 website application and implement in developed Drupal 11 PaaS environment prior to Drupal 10 EOL in mid-late 2026.

• Work with the CFA team to ensure the cloud-based PaaS architecture meets the performance and security requirements as identified in the RFQ and as explained in the Contractor’s quote.

2.4. GENERAL REQUIREMENTS

2.4.1. Management Objectives

The Contractor shall provide cloud services in order to:

● Maintain ongoing high levels of user satisfaction with the cloud services.

● Provide a mechanism that measures, and reports on, customer satisfaction with the delivery and use of cloud services.

● Increase end-user efficiency related to the management of Cloud Services capabilities.

● Allows for controlled, real-time, on-demand and automated provisioning of storage and bandwidth capacity to support content delivery.

● Provides CFA service level managers with uptime reports to include:

o Cloud services performance, service status, and key performance indicators of the system against the proposed SLAs and operational parameters.

o Reporting and analytics that provides CFA with comprehensive information regarding technical and management performance.

2.4.2. Data Location

The service provider shall not host any portion of the environment in facilities outside the contiguous United States, Alaska, Hawaii, Puerto Rico, Guam, and/or the Virgin Islands). The hosting will be provided at the contractors’ facility.

2.4.3. Responsibilities

Initially, the Contractor shall provision (setup and configure) the Drupal platform and all associated infrastructure and software components required for the CFA site. Once established, the Contractor shall coordinate with the CFA team in order for the Government to import the developed CFA site (Drupal Database) and begin operations testing. The expected delineation of responsibilities is shown in the table below.

Delineation of Responsibilities

Government Contractor\Hosting Provider

● Coordination of delivery of initial Site Database for upload/import.

● Site content, including site pages, web forms, links, and modules.

● Ongoing site content updates.

● Site testing (Operational Acceptance Testing)

● Hosting environment, including the hosting facility, all hardware components, and other core infrastructure services (DHCP, NTP, etc.)

● Virtual Machine provisioning and resource provisioning to meet demands.

● Operating System installation, configuration, and on-going maintenance.

● The Drupal platform, including the installation, configuration, and maintenance of the Drupal software and all required software components (e.g. Apache, MySQL, PHP, etc.).

● Operations and maintenance of site Database.

● Storage management, including provisioning and expanding space as needed.

● System backups and restores (file and system level) and Disaster Recovery failover.

● System Support (Help Desk)

● System monitoring of entire solution

● System and software maintenance for the OS, Drupal, and all required sub-components, including system updates and patching following an approved Change Control process, which should include update and patch testing. CFA shall be included in this Change Control process to review and approve system updates and patches.

● Licensing for the OS, Drupal, and all required sub-components

● Establish and maintain network access, both for public internet access to site and private VPN or other authenticated connection to CFA.

2.4.3.1 Delineation Responsibilities between the Government and Hosting Provider

2.4.4. General Quality Measures

General quality measures, as set forth below, will be applied to each deliverable received from the contractor under this effort.

1. Accuracy – Deliverables will be accurate in presentation, technical content, and adherence to accepted elements of style.

2. Clarity – Deliverables will be clear and concise. Any and all diagrams will be easy to understand and be relevant to the supporting narrative.

3. Consistency to Requirements – All deliverables must satisfy the requirements of this RFQ.

4. File Editing – All text and diagrammatic files will be editable by the Government.

5. Format – Deliverables will be submitted in hard copy where applicable and in media mutually agreed upon prior to submission. Hard copy formats will follow any specified directives or manuals.

6. Timeliness – Deliverables will be submitted on or before the due date specified herein or submitted in accordance with a later scheduled date determined by the Government

2.4.5. Quality Assurance

The COR will review, for completeness, preliminary or draft documentation that the Contractor submits, and may return it to the Contractor for correction. Absence of any comments by the COR will not relieve the Contractor of the responsibility for complying with the requirements of this work statement. Final approval and acceptance of documentation required herein shall be by letter of approval and acceptance by COR. The Contractor shall not construe any letter of acknowledgement of receipt material as a waiver of review, or as an acknowledgement that the material is in conformance with the work statement. Any approval given during preparation of the documentation, or approval for shipment shall not guarantee the final acceptance of the completed documentation.

2.4.6. Hosting Functional Requirements

CFA requires a cloud-based Drupal PaaS that will, at a minimum:

a. Provide 99.5% availability, or higher, to web site visitors and content publishers with a financially backed penalty schedule;

b. Provide a secure platform that prevents loss of, or tampering with, CFA data, service degradation, and/or service disruption to site visitors and CFA web publishers;

c. Provide the capability, including capacity and availability, that ensures immediate and uninterrupted service of web sites to the public which must be consistent with the SLA identified herein;

d. Provide 24 hours per day, 7 days a week, 365 days per year proactive monitoring and support for resolution of any and all outages that affect the availability of content to visitors. Provide troubleshooting services and support during core duty hours for issues not affecting the presentation of web content;

e. Compliance with federally mandated IPv6 requirements for public facing services (https://csrc.nist.gov/publications/detail/sp/800-119/final); and

f. Maintain the current web design and aesthetics, and provide improvements where necessary to accommodate additional functionality within the Drupal framework.

2.5. DELIVERABLES AND DELIVERY SCHEDULE

2.5.1. Task 1: Complete Requirements Matrix and Project Plan

As described in Section 2.3.1, Requirements Discovery and Review – Phase I, the Contractor shall, within thirty (30) calendar days of award, work with the CFA team to gather and document all system requirements. At the close of Phase I and this task, the Contractor shall deliver to the Government for review and acceptance a draft Requirements Matrix and Project Plan describing the proposed solution architecture and migration plans for the successful implementation of the hosted Drupal environment.

2.5.2. Task 2: Review and Approve Project Plan and Drupal Environment Design As described in Section 2.3.2, System Planning and Design – Phase II, the Contractor and Government shall review, finalize, and reach acceptance of the Requirements Matrix and Project Plan. Following the completion of Task 1 above, the Government shall have seven

(7) calendar days to review and respond with recommended edits or changes to the draft Requirements Matrix and Project Plan. The Contractor shall then have seven (7) calendar days to respond to the Governments requested changes, if necessary. The Government will then have seven (7) calendar days for final review and acceptance or rejection of the Contractor’s proposed solution.

2.5.3. Task 3: Deployment and Implementation of Drupal 10x Environment Following the acceptance of Task 2 above, the Contractor shall have thirty (30) calendar days to complete the implementation of the Drupal PaaS environment as agreed to in the Project Plan and as described in Section 2.3.3, Hosting Functional Requirements – Phase III. The Government will have seven (7) days calendar days to review and submit a report pertaining to environment testing. The Contractor shall then have seven (7) calendar days to respond to the Government’s report with a corrective action plan, if necessary. The Government will then have seven (7) calendar days for final review and acceptance or rejection of the Contractor’s proposed environment solution and /or action plan(s).

2.5.4. Task 4: Steady-State Operations of Drupal Environment

The Contractor shall, following the completion of Task 3, ensure the steady-state operations and maintenance of the cloud hosted Drupal PaaS environment that meets all the requirements described herein. Site must be ready for production implementation in June 2025. Exact delivery dates to be negotiated post-award during Phase I.

2.5.5. Task 5: Deployment and Implementation of Drupal 11x Environment The Contractor shall, during the Base Period, develop and deploy a Drupal 11 PaaS environment and upgrade the Drupal 10x website application to Drupal 11. The contractor shall perform this task in close consultation with the CFA Team in a phased approach similar to Tasks 1-3 of this section, with an emphasis on planning.

2.5.6. Non-Disclosure

Service provider employees performing activities are required to sign appropriate non-disclosure agreements. Service provider employees may be exposed to data pertaining to other contracts and services in the course of their duties. The service provider shall not divulge this information or use this information for gain and shall not divulge any information to any person without written permission from the Contracting Officer and

COR.

2.5.7. Incident Response

The service provider shall have, and exercise annually, an incident response plan to address security or privacy breaches, data loss, and unauthorized access to data. Such plan shall comply with FISMA, the Trusted Internet Connection (TIC) initiative, ISO 27001, NIST standards, and the GSA FSS contract. The service provider shall adhere to U.S. Computer Emergency Readiness Team (US-CERT) guidance on incidence response and threat notifications.

2.5.8. Privacy

The services provided shall comply with the provisions of the Privacy Act of 1974, especially with regard to the handling and protection of Personally Identifiable Information (PII). The service provider shall cooperate in the conduct of periodic Privacy Impact Assessments (PIA), as required by Section 208 of the e-Government Act of 2002.

2.5.9. Security and Compliance

The Contractor shall provide cloud services with the requisite security, confidentiality, integrity, availability, and privacy levels and controls that are compliant with regulations, to include the following:

a. Federal government regulatory compliance requirements (i.e. Privacy Act, FISMA, CIPSEA, Federal Records Act, Freedom of Information Act, Trade Secrets Act, Health Insurance Portability and Accountability Act (HIPAA), Privacy Rules, etc.)

b. Security standards and security control requirements for a Moderate Impact system as described in NIST Special Publications (SP) for cloud computing (SP 800-144, SP 800-145, and SP 800-146) as well as NIST SP 800-53 with an accepted Certification and Accreditation (C&A) or Security Authorization

c. Privacy Act, Title 5 of the United States Code (U.S.C.) § 552a and applicable agency rules and regulations

d. The hosting environment provisioned by the service provider must demonstrate an appropriate level of security for a FISMA Moderate system by meeting the requirements of Section C.5.3.1, Comply with FedRAMP and CFA Information Security and Privacy Requirements, of the IDIQ. The continuous monitoring provided must comply with the NIST Special Publication 800-137 framework and Department of Homeland Security (DHS) guidance.

Prior to CFA’s operational readiness testing, the contractor shall provide (for Government review and acceptance) the complete set of Security Assessment and Authorization artifacts, as required by FISMA. These deliverables are required to support system certification and CFA authorization to operate (ATO).