Attachment_1_PWS_Cloud_Service_Provider_CSP_2_13_25_DRAFT_1.docx

ATTACHMENT 1 - Performance Work Statement (PWS) IOO Cloud Service Provider (CSP) 02/13/2025 Version 1.2

Performance Work Statement (PWS) IOO Cloud Service Provider (CSP) - Export - Import Vision Statement The US Department of Housing and Urban Development (HUD) Office of Chief Information Officers (OCIO) Vision is to be "The trusted Information Technology (IT) Resource for HUD and its customers. Additionally, to support the vision of OCIO, to enable HUDs business operations with a hybrid multi-cloud operational environment to support the mission of the Departments mission and ensures HUD continues to transform it the way it does business to create strong, sustainable, inclusive communities and quality affordable homes for all.

1 General Information

1.1 Scope of Work

The HUD OCIO mission is to "Deliver technology solutions to support our customers' mission." In support of this mission, the Infrastructure Operations Office (IOO) has adopted the mission "Provide, maintain, and secure HUD's virtual and physical enterprise IT infrastructure, IT enterprise services, and IT enterprise operational support resources." The HUD OCIO Cloud Service Provider (CSP) Service Agreement effort will execute and support the mission of OCIO by enabling the ability of OCIO to develop, modernize, enhance, integrate, deploy, operate, and maintain the HUD hybrid multi-cloud operational environment and supporting cloud services. The contractor shall provide cloud services, for cloud service provider environments such as Microsoft Azure, Microsoft 365, AWS, Salesforce, ServiceNow, etc. Additionally, the contractor shall provide an avenue to onboard Cloud Support Services such as Microsoft Premier/Unified Support Services, AWS Support Plans, Salesforce Support and Maintenance, ServiceNow IT Service Management, process cloud billing payments, etc.

1.2 Background

The Cloud Service Provider Service Agreement effort is a new contract capability to support IOO's ability to develop, modernize, enhance, migrate, integrate, deploy, operate, and maintain HUD's portfolio of cloud capabilities and investments within the HUD's hybrid multi-cloud operational environment. The enterprise and end-user operation environments are a hybrid environment consisting of both on-premises and cloud capabilities and investments. The current environment consists of Microsoft Azure and Microsoft 365 subscriptions and cloud services, AWS subscriptions and cloud services, Salesforce subscription and cloud services, ServiceNow subscriptions and cloud services, on-premises hardware, and on-premises/cloud software, middleware, and applications.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by The Department of the Interior (DOI) Acquisition Services Directorate (AQD) on behalf of HUD as well as within the Federal Government. Constraints include the following:

Strategy | Federal Cloud Computing Strategy (cio.gov)

NIST SP 800-47

1.3.1 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUDs PPM Life Cycle Website:

http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME PPM was designed based on the best practices from Capability Maturity Model Integration (CMMI) for systems development and PMBok for project management. While at the foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development and delivery of useable functionality within 6-9 month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, includes prototypes or pilots, Commercial Off the Shelf (COTS)/ Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the HUD Project Manager(s), the Contractor will tailor PPM to take advantage of Contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all of the work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring or omitting specific artifacts applicable to the project, as well as adjust project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUDs Deputy Chief Information Officer (DCIO) for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making, or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance (POP) for this contract shall be for one (1) (12)-month base period and nine (9) 12-month option periods.

1.6 Place of Performance

No Government facilities will be provided. The Places of Performance for the contract will be at the Contractor and reseller offices, and cloud service providers (CSPs) data center and offices unless otherwise stated.

1.7 Hours of Operation

The Contractor shall provide 24 hours, seven days a week, 365 days a year technical support coverage and support services. The Contractor is responsible for providing services between the hours of 8 am to 5 pm, Eastern Standard Time. Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. Weekly hours shall not exceed a forty (40) hour work week and a typical workday will be 8 hours each day Monday through Friday. The Government reserves the right to change hours of operation or restrict Contractor access. Work outside of these daily hours is prohibited without Contracting Officer approval. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

The Contractor for the cloud service provider (CSP) Service Agreement is responsible for providing cloud service provider account manager and technical account manager (TAM). The CSP shall have an account manager with five (5) to ten (10) years of federal, state, or local government cloud services experience and have a proven background in successfully leading federal government cloud service programs. The account manager shall lead the execution of the contract and oversee the performance of the contract efforts. The account manager shall serve as the liaison between the HUD Project Manager (PM), HUD Contracting Officer's Representative (COR), and the CSP. Each CSP shall provide an account manager.

The CSP shall have technical account manager (TAM) with three (3) to five (5) years of federal, state, or local government cloud services experience and have a proven background in successfully leading federal government cloud service and migration projects. The TAM will provide technical support and training for all cloud services and cloud migration efforts. The TAM shall provide training to HUD government staff and supporting Contractors on all cloud service providers processes and procedures as required and/or requested. The TAM shall work with the PM and IOO Division Directors (or designated representatives), vendors, and Contractors as required and requested. Each CSP shall provide a TAM.

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5 and HUD Acquisition Regulation (HUDAR) clause 2452.237-79 - Post Award Conference. The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award.

1.10 Status Meetings

The Contracting Officer, Contracting Officers Representative (COR) and other Government personnel, as appropriate may meet monthly or as needed with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. The Post Award Conference and subsequent meetings may be held via teleconference.

1.11 Contractor Travel

No Contractor travel is anticipated during the performance period of this task order.

1.12 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services as required. As a successor, the Contractor shall have sufficient personnel on board during the 90-calendar day Transition-In period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract Transition-In period. Transition-In is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 90-calendar day Transition-Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period.

2 Definitions and Acronyms

2.1 Definitions

Business/Work-Days - Every official work-day of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities in regard to technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable - Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP ) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes Contractor-acquired property if the Contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime Contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level

CBT - Computer-Based Training CCB - Change Control Board CCMB - Configuration Change Management Board CMMI - Capability Maturity Model Integration CFO or OCFO - Office of the Chief Financial Officer of HUD CFR - Code of Federal Regulations CIO or OCIO - Office of the Chief Information Officer of HUD CO - Contracting Officer COR - Contracting Officer's Representative COR - Contracting Officer Representative COTS - Commercial Off-the-Shelf CPO - Office of the Chief Procurement Officer of HUD EST - Eastern Standard Time (U.S.)

ETC - Estimate to Completion GAO - U.S. General Accounting Office HUD - U.S. Department of Housing and Urban Development HUDAR - HUD Acquisition Regulation HUD/ISG - Internet Services Group within the Telecom Processing Division HUD Web - HUDs Intranet Web Site and related WEB pages.

IG or OIG - Inspector General (Office of) IOO – Infrastructure Operations Office IT - Information Technology IV&V - Independent Validation and Verification LOOCS - Line of Credit Control System OCPO - Office of the Chief Procurement Officer OIG - Office of Inspector General OMB - Office of Management and Budget PL Public Law PM - Project Manager POC - Point of Contact PPM - Project Planning and Management QA - Quality Assurance QASP - Quality Assurance Surveillance Plan QCP - Quality Control Plan SF - Standard Form TBD - To be determined U.S.C - United States Code 3 Government-Furnished Property and Services The Contractor shall ensure accurate control and accountability of all Government-Furnished Property (GFP) in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

No Government service will be provided.

3.2 Facilities

No facilities will be provided by the Government.

3.3 Equipment

The Government will provide all software, middleware, and applications to be integrated into the cloud service providers’ operational environment. HUD will provide GFE devices to any Contractors that require access to HUD's network.

3.4 Materials

The Government will provide electronically all HUD materials (HUD standards, policies, documentation, etc.) required to support work efforts under this performance work statement (PWS).

Copies of required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services The Contractor shall furnish all supplies, equipment, facilities, and services required to perform work under this performance work statement (PWS).

4.1 Facilities

N/A

4.2 Equipment

The Contractor will provide cloud service provider infrastructure hardware, software, middleware, and applications required to support the cloud service provider's data center backbone operational environment, cloud services, and subscription/tenants.

4.3 Material

The Contractor shall furnish all non-HUD materials required to support work efforts under this performance work statement (PWS).

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

The Contractor shall provide a Contract/Project Manager who shall be responsible for the performance of work. An alternate shall also be designated to act in the absence of the Contract/Project Manager. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel.

The Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to actually receive assignment, guidance, and direction from the COR, PM and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to the requirement to ensure successful performance.

These points of points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 8:00am to 4:30pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

4.7 Quality Control

The Contractor shall establish and maintain a complete quality control program that shall ensure services are performed in accordance with this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non reoccurrence of defective services. The Contractor's quality control program is the means by which he assures himself that his work complies with the requirements of the contract. The Contractor shall provide the associated Quality Control Plan to the Government as directed.

4.7.1 Quality Control Plan

The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP). The QCP shall ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor's methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor's methodology for resolving problems identified by the Government during reviews conducted in accordance with its Quality Assurance Surveillance Plan (QASP). The QCP shall also provide the Contractor's methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system.

The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the Government's QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards.

5 Specific Tasks

5.1 Program and Project Management Support Services

The Contractor shall provide program management, account manager, and technical account manager support services for the duration of the contract. The program manager and cloud service providers account manager and technical account manager are essential to the successful accomplishment of the work to be performed under this PWS as such they will serve as "key personnel" for the duration the Task Order. The Contractor shall provide detailed objectives for establishing the cloud service catalog for this Task Order.

The program management services shall include accomplishment of monthly performance and financial status reports (MPSR/MFSR). The Contractor reports shall provide performance defaults, settings, suggestions, and tiered options of provisional performance related services, including on-demand, fluctuations, and metrics. The contract shall provide briefing materials, meeting minutes (for all meetings held in support of the Task Order efforts), The Contractor shall provide a project management plan for delivery of the Cloud Service Providers Agreements and underlying services. The Contractors project management plan describes the Contractors plans for professional agreement task order and includes an integrated master schedule (IMS) in MS Project, detailing tasks, milestones, deliverables, risks, resources, and dependencies. The Contractor shall also update the plan report for adjustment to the program plans of actions and milestones (POA&M), and other ad hoc programmatic reports and documentation as required.

Performance Standards

a) Standard: Project Plan delivered within 5 business days after the Post-award Kickoff meeting.

AQL: Two ( 2) Business Days Deviation

b) Standard: Monthly Performance review scheduled and held by the sixth (6th) business day of each month.

AQL: One (1) Business Day Deviation

c) Standard: Meeting minutes for Monthly Performance review, ad hoc status meetings, and daily programmatic meetings delivered by the next business day.

AQL: One (1) Business Day Deviation

d) Standard: Risks and Issues Log is posted to the IOO Document Repository site to the IOO Document Repository for review by 8AM the morning at least one (1) business day prior to the status meeting AQL: One (1) Business Day Deviation Deliverables A010 Monthly Performance Reports A011 Contract Kick-Off Meeting A012 Dashboard A013 Briefing Materials A014 Project Management Plans A015 Risk and Issues Log

A016 POA&M

A017 Transition-In Plan A018 Transition-Out Plan A019 Quality Control Plan

5.1.1 Monthly Performance Status and Financial Reports

The Contractor will submit a monthly performance status and financial report to the COR by the fifth (5th) of every month. The monthly status report shall provide a synopsis of all activities for the preceding month, identify program risk(s) and recommend mitigation approaches, and provide sufficient detail to understand the contract status and activities. The financial status report will provide a synopsis of the contract financials for the preceding month, track project financials for all months of the contract, track projected burn versus actual burn for all months of the contract, itemize monthly charges (metered electric, apportioned share of the actual data center operations and maintenance, etc.), and graphically depict the financial status of the contract. The Contractor shall submit a template for the monthly status and financial reports for review and approval to the COR no later than five (5) business days post award.

Performance Standards

a) Standard: Monthly Performance and Financial Status Reports are delivered NLT on the 5th of every month.

AQL: Zero Day Deviation

b) Standard: Program Plans of Actions and Milestones (POA&M) and other ad hoc programmatic reports and documents are delivered Monthly.

AQL: Zero Deviation Deliverables A010 Monthly Financial Report

5.2 Cloud Service Providers Support Agreements and Multi-Cloud Operational Environments HUD's program offices provide housing services and mortgages to millions of Americans as such its critically important that HUD's information technology (IT) infrastructure and multi-cloud operational environments is available to provide services 7/24/365. A failure in HUD's IT infrastructure and multi-cloud operational environment could result in tertiary impacts to the US economy and housing market. The Contractor shall provide Cloud Services capabilities to enhance HUD's mission execution. The Contractor shall provide Cloud Services capabilities that include cloud subscriptions for Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS), in both the Commercial/Public Cloud and Government Cloud environments. The Contractor shall provide Cloud Service capabilities available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations). The Contractor shall provide short and long-term Cloud Based Storage Services in support of HUD applications, Continuity of Operations, Disaster Recovery, and customer data storage. In doing so the Contractor shall provide 24/7/365 access to HUD data in HUD designated data centers supporting HUD hybrid multi-cloud environment. Additionally, the Contractor shall ensure continuous and uninterrupted delivery of Cloud Data Center Security services to protect information, data, applications, and the networks associated with the HUD hybrid multi-cloud environment.

Performance Standards

a) Standard: Cloud Service Provider (CSP) Support Agreements order delivery summarization -services delivered and orders received NLT twenty (20) business days of the award. Subsequent orders are due NLT 5 days of each month.

AQL: Zero Day Deviation

b) Standard: The CSP shall stand up the cloud service, resource, and/or operational environment (subscription/tenant) within ten (10) business days of award.

AQL: Zero Day Deviation

c) Standard: CSP Cloud Operational Environment shall be in One hundred percent (100%) compliance meet federal, NIST, FAR, and HUD Handbooks on cloud, procurement/acquisitions, zero trust, and cyber security.

AQL: Zero Day Deviation

d) Standard: CSP maintains equal to or greater than 99.999% annual facility/cloud uptime performance percentage requirements.

AQL: Zero Day Deviation

e) Standard: One hundred percent (100%) compliance Backup, COOP, and Disaster Recovery capabilities delivery and separation of power grids.

AQL: Zero Day Deviation

f) Standard: Notification to the COR, PM and IOO Division Directors within thirty (30) minutes of issue /event. That degrades connectivity to cloud services and/or facility operations, and/or trigger of COOP and/or Disaster Recovery events.

AQL: Zero Day Deviation

g) Standard: Notification to the COR, PM and IOO Division Directors NLT ten (10) business days notification of all CSP maintenance activities.

AQL: Zero Day Deviation

h) Standard: Incident report delivery within twenty-four (24) hours of incident/event conclusion.

AQL: Zero Day Deviation Deliverables A001 Cloud Service Providers Agreements and Hybrid Multi-Cloud Operational Environments

5.2.1 Infrastructure as a Service (IaaS)

The Contractor shall provide Infrastructure as a Service (IaaS) subscriptions with commercial Cloud Service Providers that meet HUD's business and security requirements. The National Institutes of Standards and Technology (NIST) defines Infrastructure as a Service (IaaS) as "the capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

The Contractor shall provide 24/7/365 access to HUD data in HUD designated data centers supporting the HUD IaaS hybrid multi-cloud environment. As part of the Cloud Service Providers Support Agreements and Hybrid Multi-Cloud Operational Environments effort the Contractor shall provide HUD with Federal Risk and Authorization Management Program (FedRAMP), Federal Information Security Act (FISMA) Moderate Impact Level (IL), Unclassified Cloud Services in support of HUD's hybrid multi-cloud operational environments.

The Contractor shall provide virtualized elastic computing infrastructure resources ensuring rapidly scalable, secure, automated, resilient, and accessible cloud operational environments with the HUDs operational demand.

The Contractor shall provide Virtual Machine (VM) with private IP Address blocks. The Contractor shall provide VM bulk import/export services. Moreover, the Contractor shall provide user access to log events. Also, the Contractor shall provide Measured/Metered usage visibility service capabilities to automatically control and optimize resources. The Contractor shall provide Metadata Tags with run reports. The Contractor shall provide On-Demand Self-service platforms. The Contractor shall provide 24x7 Customer Service. The Contractor shall provide cloud access security brokers service to enable data loss prevention capabilities in the HUD hybrid multi-cloud operational environment. The Contractor shall ensure all cloud resources are located within the Continental United States (CONUS). The Contractor shall ensure HUD 100% retains cloud data ownership.

The Contractor shall ensure all procured cloud services, capabilities, and investments meet Federal Acquisition Regulations (FAR) for TAA Compliance and Buy American-Supplies, National Defense Authorization Act Section 889 (NDAA 889), White House Executive Order (EO) on Buy American, and other procurement guidelines and standards as required.

The Contractor provided Cloud Service Provider Support Agreements and Hybrid Multi-cloud Operational Environments will maintain a 99.999% annual facility/cloud uptime performance percentage. The Contractor shall provide back up, continuity of operations (COOP), and disaster recovery capabilities for all Contractor provided cloud operational environments. The Contractor shall ensure the backup, COOP, and disaster recovery capabilities for each of the cloud operational environments are on separate US power grids to ensure there is power grid separation between the CSP cloud data centers.

The Contractor provided Cloud Service Provider Support Agreements shall enable HUD data center augmentation with common information technology service management (ITSM) platforms. Hence, the Contractor shall augment already virtualized HUD premises data center resources. The Contractor shall provide integrated cloud and Data Center Virtual Resource Management. The contract shall provide and common management platform and integration with the existing and future HUD Data Center Management platform.

The Contractor will provide notification within thirty (30) minutes to the COR, PM, and Division Directors (or designated representative) when a COOP and/or Disaster Recovery event is triggered. The Contractor shall provide notification to the COR, PM, and Division Directors (or designated representative) within thirty (30) minutes when issues arise that degrade the connectivity to the cloud services and/or facility operations and provide ten (10) business days advance notification of all maintenance activities. Post issue and/or incident resolution the Contractor will provide HUD with an incident report of the issue and corrective measures taken to mitigate the risk associated with incident reoccurrence. The incident report shall provide a "root cause analysis" of the issue(s) and/or incident.

The following Cloud computing service types from commercial Cloud Service Providers (CSP) shall be available to HUD under this Task Order vehicle.

Performance Standards

a) Standard: IaaS availability is equal to or greater than 99.999% cloud uptime and is accessible to HUD, meeting the department performance percentage requirements.

AQL: Zero Day Deviation Deliverables A002 Infrastructure as a Service (IaaS) A003 Microsoft Azure A004 Amazon Web Services (AWS)

5.2.1.1 Amazon Web Services (AWS)

The Contractor shall provide Amazon Web Services (AWS) subscriptions for AWS Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) cloud computing services. All AWS Cloud services will be provided to HUD on a consumption basis and billed monthly. The Contractor shall provide AWS Cloud services in both the commercial US East/West Regions and AWS Gov Cloud (US) Regions; The Contractor shall ensure all services provided must meet Federal Risk and Authorization Management Program (FedRAMP) requirements at the Moderate level or higher. The Contractor shall ensure that all data must be stored on servers physically located within the Continental United States (CONUS).

Performance Standards

a) Standard: AWS maintains equal to or greater than 99.999% cloud uptime and is accessible to HUD, meeting the department performance percentage requirements.

AQL: Zero Day Deviation Deliverables A004 Amazon Web Services (AWS)

5.2.1.2 Microsoft Azure

The Contractor shall provide Microsoft Azure Cloud computing subscriptions for Azure Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) cloud computing services. All Azure Cloud services will be provided to HUD on a consumption basis and billed monthly. The Contractor shall provide Azure Cloud services in both the Azure Public and Azure Government; The Contractor shall ensure all services provided must meet Federal Risk and Authorization Management Program (FedRAMP) requirements at the Moderate level or higher. The Contractor shall ensure that all data must be stored on servers physically located within the Continental United States (CONUS).

Performance Standards

a) Standard: Azure maintains equal to or greater than 99.999% cloud uptime and is accessible to HUD, meeting the department performance percentage requirements.

AQL: Zero Day Deviation Deliverables A003 Microsoft Azure

5.2.2 Platform as a Service (PaaS)

The Contractor shall provide Platform as a Service (PaaS) subscriptions with commercial Cloud Service Providers that meet HUD's business and security requirements. The National Institutes of Standards and Technology (NIST) defines Platform as a Service (PaaS) as "the capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment."

The Contractor shall provide 24/7/365 access to HUD data in HUD designated data centers supporting the HUD PaaS hybrid multi-cloud environment. The Contractor shall provide PaaS environment can provision On-Demand tools to support development, testing, staging quality of application released to the HUD's production environment. As part of the environment, the Contractor shall provide Developer Tools. The Contract shall provide the platform access to Database Systems. Also, the Contractor shall provide access to Developer Testing Tools. Moreover, the Contract shall provide the platform access to a Big Data Solution platform. The Contractor shall provide directory services to ensure the PaaS environment provides secure access.

Performance Standards

a) Standard: PaaS maintains equal to or greater than 99.999% cloud uptime and is accessible to HUD, meeting the department performance percentage requirements.

AQL: Zero Day Deviation Deliverables A005 Platform as a Service (PaaS) A006 Salesforce (PaaS) A007 ServiceNow (PaaS)

5.2.2.1 Salesforce (P)

The Contractor shall provide Salesforce Platform as a Service (PaaS) Cloud subscriptions. All Salesforce Cloud services will be provided to HUD on a consumption basis and billed monthly. The Contractor shall provide Salesforce Cloud services in Salesforce Government Cloud and Salesforce Government Cloud Plus environments; The Contractor shall ensure all services provided must meet Federal Risk and Authorization Management Program (FedRAMP) requirements at the Moderate level or higher. The Contractor shall ensure that all data must be stored on servers physically located within the Continental United States (CONUS).

Performance Standards

a) Standard: Salesforce (P) maintains equal to or greater than 99.999% cloud uptime and is accessible to HUD, meeting the department performance percentage requirements.

AQL: Zero Day Deviation Deliverables A006 Salesforce (PaaS)

5.2.2.2 ServiceNow (P)

The Contractor shall provide ServiceNow Platform as a Service (PaaS) Cloud subscriptions. All ServiceNow Cloud services will be provided to HUD on a consumption basis and billed monthly.