FedRAMP Cloud to Cloud Backup PWS_Final.pdf

AMERICAN BATTLE MONUMENTS COMMISSION

Performance Work Statement

For

Cloud Backup and Recovery Services for Microsoft 365 and Azure

June 22, 2026

Contents

1. About ABMC and Purpose

2. Environment

3. Performance Requirements

3.1 CLIN Structure

3.2 In Scope Workloads

3.3 Service Requirements

3.4 Contractor Tasks

5. Acceptance Criteria

6. Security and Support Requirements

7. Place of Performance

8. Order of Precedence

9. Invoicing Instructions

1. About ABMC and Purpose

American Battle Monuments Commission is a United States federal agency responsible for commemorating the service and sacrifice of U.S. armed forces where they have served overseas.

ABMC manages and maintains American military cemeteries, memorials, and monuments outside the continental United States and supports public access to historical and commemorative information.

ABMC requires a fully managed cloud backup and recovery service for Microsoft 365, Azure, and identity systems. Contractor shall provide recurring licenses, software services, and data backup and recovery services under CLIN 0001. Contractor shall provide one-time implementation and deployment services under CLIN 0002. CLIN 0001 shall include one base year and four option years.

2. Environment

ABMC uses Microsoft 365 E5, SharePoint Online, and Azure. ABMC maintains approximately 30 TB of SharePoint Online data, which may include duplicate data. ABMC expects the deduplicated data set to be less than half of that amount. ABMC expects data to grow 5 to 10 percent per year and does not expect SharePoint Online data to exceed 45 TB during the period of performance. In scope Azure workloads include virtual machines, Azure SQL, infrastructure services, platform services, and storage. In scope identity systems include Active Directory and Microsoft Entra ID.

3. Performance Requirements

Contractor shall provide the following service characteristics, tasks, deliverables, and acceptance criteria for cloud backup and recovery services.

3.1 CLIN Structure

• CLIN 0001 Recurring Services. Contractor shall provide licenses, software services, storage, service capacity, and data backup and recovery services for the base year and each option year.

• CLIN 0002 One Time Implementation and Deployment. Contractor shall complete setup, configuration, testing, documentation, and knowledge transfer needed to place the service into operation.

3.2 In Scope Workloads

1. Microsoft 365 E5

2. SharePoint Online data, approximately 30 TB including duplicate data

3. Azure infrastructure services, platform services, and storage

4. Azure virtual machines

5. Azure SQL

6. Identity systems, including Active Directory and Microsoft Entra ID

3.3 Service Requirements

Contractor shall provide a solution that meets the following requirements:

1. Provide a fully managed cloud service hosted in Amazon Web Services or Microsoft Azure.

2. Operate the service without requiring ABMC to deploy, maintain, or operate backup infrastructure.

3. Provide a web based administrative console for authorized ABMC personnel.

4. Support an optional local backup or recovery target without requiring local infrastructure for normal service operation.

5. Include software, storage, compute, and data transfer in the subscription model.

6. Use strong access controls for administrative and service access.

7. Keep backup data separate from production data and protect backup data from unauthorized change or deletion.

8. Monitor the service environment and detect suspicious activity.

9. Support deduplication and maintain deduplicated cloud storage for protected data.

10. Protect and recover in scope on premises workloads, cloud workloads, software as a service workloads, and endpoint data.

11. Support planned and automated recovery using known good backup copies.

12. Support integration with security monitoring or response tools when those integrations are part of the proposed solution.

13. Protect and recover identity data across Active Directory, Microsoft Entra ID, and Okta from one cloud based administrative platform.

14. Restore identity objects with the roles, relationships, dependencies, and settings needed for proper operation.

15. Provide documentation for configuration, administration, recovery, support, and transition out.

16. Host the service only in FedRAMP Moderate authorized sites and disclose hosting location and authorization details.

17. Provide support during east coast business hours and describe the incident response and escalation process.

3.4 Contractor Tasks

CLIN 0001 Recurring Services.

1. Provide all recurring licenses, software services, storage, compute, data transfer, and service capacity required for the systems in scope.

2. Operate the backup and recovery service during the base year and each option year.

3. Provide administrative access for authorized ABMC personnel.

4. Monitor service health and respond to incidents under the standard support process.

5. Maintain current documentation for administration, backup settings, recovery steps, and support contacts.

6. Protect backup storage from unauthorized change or deletion.

CLIN 0002 One Time Implementation and Deployment Tasks

1. Conduct a kickoff meeting with ABMC to confirm scope, roles, assumptions, required inputs, and schedule.

2. Submit an implementation schedule that completes deployment within 6 months after kickoff.

3. Provision the service and activate required accounts.

4. Configure the service for all in scope workloads.

5. Configure backup policies, retention settings, administrative access, and support contacts.

6. Resolve implementation issues that prevent setup or testing.

7. Support user acceptance testing for configured workloads.

8. Validate protection status for all in scope workloads.

9. Complete at least one recovery test for each workload type and document the result.

10. Document final configuration, assumptions, open issues, and follow on actions.

11. Provide knowledge transfer so ABMC personnel can perform routine administration.

Contract End and Transition Out for CLIN 0001

1. Describe how ABMC export or access its data at contract end or during transition to another solution.

2. Describe transition out assistance included in the recurring service or available as an optional item.

3. Describe the data retention and deletion process after expiration or termination.

4. Identify any fees, timing limits, format limits, or other limits that apply to data export or transition out.

4. Deliverables

CLIN 0001 Recurring Service Deliverables

1. Service administration guide

2. Backup and recovery configuration documentation

3. Support contacts and escalation procedures

4. Transition out and data export procedures

CLIN 0002 One Time Implementation and Deployment Deliverables

1. Implementation plan and schedule

2. Final configuration documentation

3. Recovery test results by workload type

4. Implementation issue log

5. User acceptance testing support record

6. Final implementation summary

7. Knowledge transfer materials

5. Acceptance Criteria

CLIN 0001 Recurring Service Acceptance Criteria

1. Contractor activates the recurring service for the applicable period of performance.

2. Authorized ABMC personnel can access the administrative console.

3. Contractor delivers all CLIN 0001 deliverables.

4. Contractor makes support available during east coast business hours.

CLIN 0002 One Time Implementation and Deployment Acceptance Criteria

1. Contractor completes deployment within 6 months after kickoff.

2. Contractor configures backup policies, retention settings, administrative access, and support contacts.

3. Contractor validates protection status for all in scope workloads.

4. Contractor completes and documents at least one recovery test for each workload type.

5. Contractor delivers all CLIN 0002 deliverables.

6. Contractor completes knowledge transfer for ABMC personnel.

6. Security and Support Requirements

Contractor shall provide support during east coast business hours. Contractor shall provide incident response procedures, escalation procedures, planned maintenance notice procedures, and support contact information for ABMC administrators.

7. Place of Performance

Services shall be delivered as cloud hosted services accessible to authorized ABMC personnel.

Hosting shall be limited to FedRAMP Moderate authorized sites.

8. Order of Precedence

In the event of a conflict, the order of precedence shall be: contract, performance work statement, Contractor proposal.

9. Invoicing Instructions

ABMC will pay CLIN 0001 for recurring services according to the payment schedule in the award. ABMC will pay CLIN 0002 after ABMC accepts the implementation and deployment deliverables.

Each invoice shall include the contract number, task or order number if applicable, invoice date, billing period, Contractor name, point of contact, CLIN billed, amount due, and supporting detail for the service period or accepted deliverables.

ABMC may withhold payment for work that Contractor did not perform, for unsupported charges, or for deliverables that ABMC has rejected.

All invoices shall comply with FAR Part 32 and any invoicing instructions in the award.

Contractor shall submit invoices to the payment office identified in the award and shall provide a copy to the COR and CO unless the award states otherwise.