Attachment 1 - PWS - ERP Cloud Hosting C2C.pdf

Attachment 1: Performance Work Statement DLA ERP Cloud Hosting and Subscription Licenses with Managed Services

CUI

Source Selection Information – See FAR 2.101 & 3.104

1.0 Scope:

The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency that provides worldwide logistics support for the missions of the Military Departments and the Unified Combatant Commands under conditions of peace and war.

Program Executive Office Enterprise Information System, SAP Platform has a requirement for firm-fixed-price SAP® RISE Cloud Hosting Licenses and Maintenance (SAP® RISE) to host DLA’s ERP environment in the cloud and support continued operations. This PWS describes the scope for DLA’s ERP for continued sustainment operations in GovCloud with Impact Level 4 certification in the Cloud.

1.1 Background:

DLA’s Enterprise Resource Planning (ERP) program, managed under DLA SAP Platform, is an integrated platform primarily based on SAP software with supplemental Non-SAP applications. This cohesive business environment includes multiple integrations and customizations that enable DLA to establish end- to-end processes to fulfill logistics and financial reporting requirements, streamline and use data sources effectively, reduce inefficient or non-value added operations, and audit its resources so that it can monitor and make decisions about how the resources are allocated and utilized for the benefit of the warfighter and the US taxpayer.

2.0 Award Type:

2.1 The government is seeking to procure and utilize SAP services in a commit-to-consume model under an Indefinite Delivery Indefinite Quantity (IDIQ). The principal objective of this IDIQ is to utilize the module to receive purchased credits equal to dollar value that the government can utilize for services as defined in the task listed in the contract. The expectation is that the government will receive cost effective services while allowing them to utilize flexibilities that are offered in a cloud hosted environment. This method will allow the government to focus on cost efficient methods to expand scope and decrease scope of the hosted landscape in a streamline fashion while providing the government with the detailed billing and consumption rate of SAP services that government is utilizing.

Service will be utilized and executed in the following task structure.

CLIN Description Qty Unit Base Period 0001 Cloud Hosting and Subscription

Licenses with Managed Services

1 MO

Option Period 1 1001 Cloud Hosting and Subscription

Licenses with Managed Services

1 MO

Option Period 2 2001 Cloud Hosting and Subscription

Licenses with Managed Services

1 MO

Option Period 3 3001 Cloud Hosting and Subscription

Licenses with Managed

1 MO

SECTION 2: PERFORMANCE WORK STATEMENT

CUI

Source Selection Information – See FAR 2.101 & 3.104

Services Option Period 4 4001 Cloud Hosting and Subscription

Licenses with Managed Services

1 MO

Option Period 5 5001 Cloud Hosting and Subscription

Licenses with Managed Services

1 MO

Option Period 6 6001 Cloud Hosting and Subscription

Licenses with Managed Services

1 MO

2.2 The government further expects to see a “Rate Card” that clearly defines the rate at which each of these services will be charged. A credit will equal $1 U.S. dollar and thus can be charged against the services defined in the delivered “Rate Card”. The Rate Card will allow the government to charge against the below tasks to procure services that the government can clearly define and provide cost transparency to the government in an accountable method.

3.0 (Task 1) Requirements:

3.1 Cloud Hosting:

3.1.1 SAP Cloud Hosting:

3.1.1.1 The contractor shall provide “Cloud Computing”

environment as defined in Attachment A. The contractor shall provide a continued cloud computing platform for a hosting solution for DLA’s SAP Platform, and supporting services in a Department of Defense (DoD) certified FedRAMP Impact Level 4 (IL4) with a DISA Provisional Authority (PA) cloud hosting environment. This shall include the below hosting environments; with each environment’s use, operational time to be determined at the government’s discretion. Each environment will only be charged for while in use.

3.1.1.1.1 Sandbox

3.1.1.1.2 Development

3.1.1.1.3 System Test

3.1.1.1.4 Stage

3.1.1.1.5 Production

3.1.1.1.6 High Availability (HA) and/or

Continuity of Operations (COOP)

3.1.1.1.6.1 Requirements for systems to

operate in an HA setup with or without a separate COOP is defined individually by application and system at the

CUI

Source Selection Information – See FAR 2.101 & 3.104 governments discretion

3.1.1.1.6.2 The COOP environment must

be separated from the primary processing site by at least 75 miles or as required by RMF standards at the government’s discretion

The Disaster Recovery (DR) environment must be separated from the primary processing site by at least 75 mile or as required by RMF standards at the government’s discretion.

The current environment is in the Amazon Web Services (AWS) NS2 Secure HANA Cloud (SHC) offering.

3.1.2 Non SAP Cloud Hosting:

3.1.2.1 The contractor shall provide a “Cloud Computing” environment for non-SAP applications as defined Attachment B. These systems are primarily used to support other operations. The contractor shall provide all services and environments as defined in section 3.1.1.

3.2 Managed services:

3.2.1 The contractor shall provide managed services (see Attachment A: Definitions and Systems) in conjunction with the government for all DLA ERP Cloud environments. Any design or changes must be approved by the government to include:

3.2.1.1 Environment planning and management, including system, storage, and network capacity, as well as performance monitoring.

3.2.1.2 Service management and service delivery, including application administration services for SAP and Non-SAP applications for technical upgrade execution, ongoing patching and maintenance, and ticket resolution/escalation. The contractor shall meet the requirements as defined in Attachment A: Definitions and Systems and Attachment D Service level Agreements. At a minimum, the contractor shall provide the following KPIs/Metrics at the level indicated in Attachment A and Attachment D.

3.2.1.3 The contractor will be responsible for code scanning, pen tests, and overall attestation for the applications and their associated operating system/containers. DLA will manage the applications themselves, while the contractor will manage the environments on which the applications reside. DLA reserves the right to conduct pen testing, code scanning, and full review of all systems at any time it chooses.

3.2.1.4 The managed services described herein shall be provided for all infrastructure.

3.2.1.5 The managed services described herein shall be provided for all applications in conjunction with the government and as defined by the government.

3.2.1.6 Detailed inventory of environments by the DLA

Systems identified in Attachment A: Definitions and Systems. The contractor shall provide an After Action Report (AAR) within 3 business days after the conclusion of all Very High Incidents, High Incidents, CUI

Source Selection Information – See FAR 2.101 & 3.104 and Outages.

3.2.1.7 The contractor shall configure Audit and Event Logs

per DLA and DoD IA policies. The Audit and Event Logs are defined in DOD and DLA Guidance. See Risk Management Framework (RMF) AU Control family - NIST Risk Management Framework | CSRC and DLA Auditing Implementation Guide V1.4.1 section 7. The contractor will provide a weekly report that confirms the appropriate logs are being captured to the designated area for DLA consumption. The logs will include the following information:

3.2.1.7.1 What type of event occurred;

3.2.1.7.2 When the event occurred;

3.2.1.7.3 Where the event occurred;

3.2.1.7.4 Source of the event;

3.2.1.7.5 Outcome of the event; and

3.2.1.7.6 Identity of any individuals, subjects, or

objects/entities associated with the event.

3.2.1.7.6.1 Event descriptions

3.2.1.7.6.2 Time stamps

3.2.1.7.6.3 Source and destination addresses

3.2.1.7.6.4 User or process identifiers

3.2.1.7.6.5 Success or fail indications

3.2.1.7.6.6 Filenames involved

3.2.1.7.6.7 Event outcomes include

indicators of event success or failure and event-specific results, such as the system security and privacy posture after the event occurred.

3.2.1.8 The contractor shall utilize DLA ticketing system for all work tracking and actions performed within the environment. The system will be defined by DLA, it may involve multiple systems, and can change according to the agencies needs. DLA ticketing systems may require CAC authorizations for access and all personnel will be required to hold and maintain a DoD issued CAC for any work performed and logged into the ticketing system. The contractor will be required to maintain open tickets/incidents/tasks with updates made daily. The systems currently in use is SNOW, Jira, and Workbench. The contractor shall follow the same metric requirements for ticket completions as defined in Attachment D Service level Agreements

3.2.1.8.1 Tickets shall not be closed without completion of work being performed. Any ticket that is closed prematurely will not require another ticket to be opened but instead will require the original ticket to be reopened and worked accordingly. This will count against the contractor’s metrics for ticket completion.

3.2.1.9 The Contractor will be required to maintain an alternate token for system access at the administrator level and all required with

CUI

Source Selection Information – See FAR 2.101 & 3.104 certifications and cyber regulations will be adhered to as defined in Cyber adherence section of this contract. DLA regularly updates computing certification requirements and the contractor must have staff that will obtain the required certifications within 3 months of any update.

3.2.1.10 The contractor shall provision and manage local system accounts on Operating systems and databases. These shall be managed and comply of all cyber requirements and follow DLA account provisioning guideline with the use of DLA systems such as AMPs or 2875s. Root accounts and other system level accounts will be managed by the contractor.

3.2.1.11 The contractor shall ensure that all systems and data is encrypted in compliance with DoD, DLA, regulations and any applicable laws.

3.2.1.12 Managing governments resources covers several areas of operations that require building, sustaining, patching, and monitoring. Some key areas are identified as but is not limited to this list that follows:

3.2.1.12.1 IaaS (Infrastructure as a Service)- Physical/Virtual

Infrastructure

3.2.1.12.1.1 Provide support and SME for IaaS Technical

Design, IaaS onboarding and migration, IaaS System Builds, IaaS Program Management and IaaS Delivery management.

3.2.1.12.2 Network, Connectivity, Storage, and Compute

Management

3.2.1.12.2.1 Provide Network connectivity, including

instantiation, sustainment, and integration with DLA Enterprise Telecommunications Network and Enterprise Services, ensuring compliance with DLA and DoD Network IA Policies. Support design, provisioning, and monitoring of required IaaS Storage and Compute based on requirements provided by DLA.

3.2.1.12.3 Operating System & Database

3.2.1.12.3.1 Deployment – Deploy and support Operating

System(s) and Database(s) based on DLA requirements and agreed upon SLA’s.

3.2.1.12.3.2 Support – Provide Infrastructure, Operating

System, and Database support for all DLA defined environments, to include Production, Disaster Recovery (DR), and non-Production. Including administration and maintenance of deployed and planned infrastructure, operating systems, and databases. Supported infrastructure, operating systems, and databases will align with underlying Cloud Service Provider offerings based on DLA Requirements.

3.2.1.12.3.3 Patching – Provide patching support for all

infrastructure, operating systems, and databases as required by DLA and DoD IA Policies.

3.2.1.12.3.4 Monitoring and Alert Management – Provide

monitoring and alerting of all infrastructure, operating system, and databases. Requirements

CUI

Source Selection Information – See FAR 2.101 & 3.104 may vary between non-Production, Production, and DR. Includes system and audit log retention to align with DLA requirements.

3.2.1.12.4 SAP Applications

3.2.1.12.4.1 Deployment – Deploy and support SAP

Applications based on DLA requirements and agreed upon SLA’s.

3.2.1.12.4.2 Support – Provide SAP Application support for all DLA defined environments, to include Production, DR, and non-Production. Includes administration and maintenance of deployed and planned applications.

3.2.1.12.4.3 Patching – Provide patching support for all

Applications as required by DLA and DoD IA Policies.

3.2.1.12.4.4 Application support is shared responsibility with

DLA.

3.2.1.13 Scalability

3.2.1.13.1 The contractor must provide flexible scalability options for IaaS, PaaS, and SaaS services. This includes:

3.2.1.13.1.1 Scaling up and down based on performance

requirements.

3.2.1.13.1.2 Decommissioning unused services.

3.2.1.13.1.3 Resizing and rearchitecting systems to meet

dynamic operational needs.

3.2.1.13.1.4 Scale out and in based on defined requirements of the systems and applications

3.2.1.13.2 Repurposing and rebuilding existing hardware.

3.2.1.13.3 Providing recommendations for system redesigns and cost optimization, including the use of FinOps tools for cloud cost management.

3.2.1.13.4 Provide the ability scale the underlying infrastructure to include new VPCs (Virtual Private Clouds) or hosting CSP equivalent.

3.2.1.13.4.1 This includes subnets, networking routes, security configurations, and other items as it relates to expansion of the desired services, defined by

DLA.

3.2.2 Integration with DLA Services

3.2.2.1 To maintain business continuity and minimize disruption to end users, Managed Services will integrate with the following DLA Services

3.2.2.2 Program Management

3.2.2.3 Environment Management

3.2.2.4 System Integration

3.2.2.5 Compliance

3.2.2.5.1 Integration with DLA SAP Platform technical and

functional Compliance activities. To include:

3.2.2.5.2 Audit Record Review Analysis, and Reporting

3.2.2.5.3 Review and analyze system audit records

organization-defined frequency for indications of inappropriate or unusual activity and the potential

CUI

Source Selection Information – See FAR 2.101 & 3.104 impact of the inappropriate or unusual activity.

3.2.2.5.4 Report findings to organization-defined personnel or roles; and

3.2.2.5.5 Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

3.2.2.6 Enterprise Services

3.2.2.6.1 Integration with DLA Enterprise Services, to include, but not limited to, Active Directory, Cyber Security (HBSS, Arch Site, ACAS, etc.), and DLA ETN.

3.2.2.7 Release Management

3.2.2.7.1 Integration with DLA SAP Platform Release

Management Processes and Procedures.

3.2.2.8 User Provisioning and Access Management

3.2.2.8.1 Integration with DLA SAP Platform User

Provisioning and Access Management (AMPS, Active Directory, Application accounts, etc.)

Processes and Procedures. Local system account management will be provisioned and managed by the contractor at the guidance of DLA.

3.2.3 Staffing

3.2.3.1 The contractor shall maintain a staffing plan for DLA. The staffing plan shall be maintained and updated to date for the work week, any scheduled maintenance windows, and after hours on call support, and an escalation contact list. The staffing plan shall contain the following at minimum:

3.2.3.1.1 The number of staff assigned to DLA for each week, scheduled maintenance window, and after-hours support for each functional area.

3.2.3.1.2 Employee name

3.2.3.1.3 Employee working hours and days.

3.2.3.1.4 Employees assigned to afterhours support.

3.2.3.1.5 Employees after hours support contact number.

3.2.3.1.6 The staffing plan shall display and the number of

hours each staff member is assigned to DLA for.

3.2.3.1.7 The number of scheduled working hours for each

day.

3.2.3.1.8 On-call staff shall display call back contact numbers.

3.2.3.1.9 Employees functional working assignment.

3.3 Licensing:

3.3.1 The contractor shall provide continued licensing for the

DLA ERP Environment identified in Attachment B. DLA currently has two types of license models, subscription and perpetual.

3.3.1.1 Licensing will be clearly defined on how many is

available to the agency for any particular product

CUI

Source Selection Information – See FAR 2.101 & 3.104 as well as how many is used.

3.3.1.2 All licensing cost will be provided to the

government that clearly describes what the license is, how many was purchased, how it is applied, what systems it is applied to, how many is used, and what the expiration date is.

3.3.1.3 DLA reserves the right to move a licensing from

any system, application, hardware, appliance, or virtual instance of any of the said devices.

3.3.2 The Non-SAP application licenses, with the exception of OpenText, will be provided by the Government and are not required to be provided by the contractor. The listing of the entire environment is identified in Attachment B.

3.4 Cyber adherence:

3.4.1 Certifications:

3.4.1.1 The contractor shall provide a 8570/ 8140 Report as required at the task order level

3.4.2 Regulations, policies, and directives:

The contractor shall provide FedRAMP IL4 (GovCloud) certified hosting for all DLA ERP components to include all associated technology. The following shall be referred to as policy in all instances following in this document;

Federal regulations; NIST; DoD security policies, regulations and memos;

JFHQ-DODIN directive, policies, memos, and regulations; DLA directive, policies, memos, and regulations regarding security and compliance. The contractor shall adhere to all policies.

3.4.2.1 All corresponding policy mentioned in the following documents shall be in scope and any deemed by DLA Cyber. The government regularly performs updates to current documentation and rules. Any replacement or revisions to current documents will be enforceable at the time of policy authorization. In addition, the contractor will work to implement the changes in a timely manner as defined by the government.

3.4.2.2 The following list contains some identified items that shall be adhered to in implemented within the environment:

NIST SP 800-45, et al.

NIST SP 800-53, et al.

NIST SP 800-63, et al.

NIST SP 800-88, et al.

NIST SP 800-207, et al.

NIST SP 800-160, et al.

NISTIR 8006, et al.

DoDI 8500.01, et al.

DoDI 8580.1, et al.

DoDD 5000.01, et al.

DoDD 5000.02, et al.

DoDM 5200.01, et al.

DoD 5220.22, et al.

44 U.S. Code Chapter 21, et al.

NIST RMF, CSSP, et al.

CNSSI 1253, DoDI 8510.01, et al.

DoDD 8100.02, FIPS 140, Circular A-130, et al

CUI

Source Selection Information – See FAR 2.101 & 3.104

44 U.S. Code Chapter 21, et al.

Government Accountability Office (GAO) Federal Information

System Control Audit Manual (FISCAM); a copy of the FISCAM manual can be found at: https://www.gao.gov/fiscam

This includes all corresponding and referenced polices, publications, Cloud Security Reference Architecture v2Cloud Service Provider (CSP) Security Requirements GUIDE (SRG) Version 1, Release 1

All DISA published SRGs Database, Operating System, Networking, Cloud, KMS/PKI, et al

All DISA published STIGs Database, Operating System, Networking, Cloud, KMS/PKI et al

DEPARTMENT OF DEFENSE (DoD) Secure Cloud Computing Architecture (SCCA) Functional Requirements

8570/8140

3.4.2.3 The Impact Level 4 GovCloud Solution must provide security that enables enhanced cyber defenses from the root level of systems through the Operating System (OS) and database (DB) layer with improved capabilities including continuous monitoring and auditing, automated threat identification resiliency against persistent adversary threat, and an operating environment that meets or exceeds DoD information security requirements.

3.4.2.3.1 The Contractor shall comply with Support Controls

described in the Government Accountability Office (GAO) Federal Information System Control Audit Manual (FISCAM); a copy of the FISCAM manual can be found at: https://www.gao.gov/fiscam/overview

3.4.2.4 Provide support for Cyber compliance, directive, audits, initiatives and other Cyber responses as directed by DLA Cyber, compliance teams, DoD and other government agencies.

3.4.2.4.1 The contractor will provide plans of action to the

government within 5 business to remediate any newly issued directives or cyber risk identified by the government.

3.4.2.4.2 At times zero day exploits or other directives will require immediate action to remediate the finding or vulnerability.

In these cases the contractor will provide resources and plans of action in order to remediate the finding in an accelerated fashion that stresses urgency.

3.4.2.4.3 ACAS scanning will be performed by the government to ensure compliance of the hosting environment. In the event that the contractor receives scans from another entity other than DLA, they shall be required to provide those scan results to the government within 1 business day of receipt.

CUI

Source Selection Information – See FAR 2.101 & 3.104

3.4.2.4.3.1 ACAS and cyber vulnerabilities shall have a

remediation plan developed for each vulnerability discovered and delivered to DLA with 5 business days of discovery.

3.4.2.4.4 POAMs, and AORAs must be approved by DLA

prior to admission into eMASS. This includes any issue regardless of the hosting landscapes to include all IaaS, PaaS, and SaaS offerings that the contractor will provide. Approved documentation will be delivered within 5 business days to DLA.

3.4.2.4.5 Any other cyber or audit reports required by DLA

must be delivered by Cloud Service SaaS provider by the 5th of each month or within 5 business days to DLA, whichever is sooner. Reports include any report generated by the vendor or received from another entity that details any cyber or Audit related documentation identified by any government entity, law, regulation, policy or requested by a government entity.

3.4.2.5 Contractor Hosting Center and DLA IT Control Responsibilities

3.4.2.5.1 As part of the Government’s authorization to commence system hosting services, the Contractor shall implement the IT controls for the DLA ERP that are appliable at the Operating System/Database/Application (OS/DB/APP) levels. Additionally, the Contractor shall implement the relevant IT controls as defined in Section 3: Overarching Security Requirement cited above for the contracted hosting center and DLA users (end users, administrators) including DLA ERP access controls, segregation of duties, configuration management, contingency planning, security management, audit logging, incident response, identification and authentication, business process controls and interface controls.

3.4.2.6 The contractor shall ensure all systems, data in transit, and at rest are encrypted with government owned and managed encryption keys. Keys are rotated annually and at the government’s request. The contractor shall ensure that the new keys are applied in accordance with policy.

3.4.3 Compliance with Department of Defense Issuances

(DoDI) Risk Management Framework (RMF):

The contractor shall maintain the environment that complies with the below requirements:

System Compliance with DoDI RMF for DoD IT

3.4.3.1.1 The Contractor shall assess and

validate applicable security controls and responsibilities.

3.4.3.1.2 The Contractor shall provide

Information Assurance (IA) and

CUI

Source Selection Information – See FAR 2.101 & 3.104

Authority to Operate (ATO) implementation planning and validation.

3.4.3.1.3 The Contractor shall define Cloud

Foundation and IA activities for the cloud environment.

The Contractor shall ensure systems that are deemed financially relevant by the Government are in compliance with DoDI 8510.01, Department of Defense Instruction Risk Management Framework (RMF) for DoD Information Technology (IT).

The Contractor shall provide requested documentation or explanations, to DLA in the electronic format requested in response to Financial Statement (FS) auditors’ queries, cyber security requests for hosted capabilities and functions, any other request made by auditors.

3.4.3.4 The Contractor shall ensure governance, risk

and compliance with industry standards and regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) and the Payment Card Industry Data Security Standard (PCI DSS) as applicable to the data type in the environment.

3.5 Audit support:

3.5.1 The contractor shall support all audit requirements of the government and any independent auditors. Audit requirements may include but are not limited to the following:

3.5.1.1 Providing information as audit evidence, whether it be in the execution of business processes and internal controls by DLA or the contractor or provided in the form of a Provided by Client (PBC) document(s) responding to financial statement audit requests. Performing testing on systems, infrastructure, and applications.

3.5.1.2 Maintaining and reviewing logs in accordance with cyber, audit, compliance, NIST, RMF, DoD Policy, DLA policy, and other directives as defined by the government or any other regulatory body that applies to the government’s systems as defined by the government.

3.5.1.3 Providing source code and scripts used in the government’s environments as requested by internal and external auditors.

3.5.1.4 Support with dedicated staff at the government’s request.

3.5.1.5 Assisting with or performing the resolution of correction action plans.

3.5.2 Federal Financial Management Improvement Act (FFMIA)

3.5.2.1 The Contractor shall ensure that all SAP Cloud Hosting, Subscription

Licenses, and Managed Services provided under this contract fully support the Defense Logistics Agency’s compliance with the FFMIA.

Specifically:

3.5.2.2 Hosted SAP ERP environment must comply with:

CUI

Source Selection Information – See FAR 2.101 & 3.104

3.5.2.3 Federal financial management standards, including FASAB, USSGL, OMB Circular A-123, and Treasury/OMB reporting requirements.

3.5.2.4 Maintaining Data integrity, provide audit support, and enable required financial reporting.

3.5.3 USC, Title 10, Section 2222 Defense business systems: business process reengineering; enterprise; management

3.5.3.1 The Contractor shall ensure that all SAP Cloud Hosting, Subscription

Licenses, and Managed Services provided under this contract fully support the Defense Logistics Agency’s compliance with USC, Title 10, Section 2222. Specifically:

3.5.3.1.1 Hosted SAP ERP environment must comply with:

3.5.3.1.2 DoD Business Enterprise Architecture (BEA)

3.5.3.1.3 Incremental development requirements

3.5.3.1.4 DoD auditability requirements

3.5.4 Third Party Assurance:

The Contractor shall provide DLA assurances that cloud service provider relationships are being monitored and documented. A combination of attestation products may be provided to satisfy third party relationships between DLA and the Contractor’s cloud service provider: attestation products include Statement on Standards for Attestation Engagement (SSAE-18) System and Organization Controls Type 1 (SOC 1 AND SOC 2) report.

3.5.4.1 SOC 1 AND SOC 2 Report

Cloud / Data Center Hosting Organizations and Application Service Providers (ASPs): The SOC 1 AND SOC 2 report must be prepared in accordance with Attestation Standards Clarified (AT- C) 320, AT-C 105, and AT-C 205.

The SOC 1 AND SOC 2 report must address the design and operating effectiveness of the Cloud Hosting organization’s controls to meet identified control objectives (generally referred to as a Type II report). The Government will review any findings gleaned from the SOC 1 AND SOC 2 Report and/or Type II report and the contractor will be notified of the findings. The contractor shall address those findings according to the timelines identified in the Corrective Action Plan (CAP).

The SOC 1 AND SOC 2 report must address any user entity controls of higher-level providers as applicable.

The SOC 1 AND SOC 2 report will include information system general control objectives that are comparable with the U.S. Government

CUI

Source Selection Information – See FAR 2.101 & 3.104

Accountability Office (GAO) Federal Information System Controls Audit Manual (FISCAM) control objectives for security management, access controls, configuration management, segregation of duties, and contingency planning.

The SOC 1 AND SOC 2 report period will begin October 1 and end on June 30 of each year.

The SOC 1 AND SOC 2 report will be delivered to DoD (FIAR Directorate) no later than August 15 of each year.

The contractor will provide a bridge letter to DoD no later than October 8 of each year to address the period from July 1 through September 30.

Incremental Requirements for Application Service Providers: In addition to the requirements for Cloud / Data Center Hosting Organizations, SOC 1 AND SOC 2 reports for ASPs will include the following incremental requirements for the hosting of the following applications(s): EBS, EA2, COPE, and GR&C

3.5.4.1.8.1 The report will include business

process application control objectives that are comparable with the GAO FISCAM control objectives for the hosting environment.

3.5.4.1.8.2 The SOC 1 AND SOC 2

report will identify key inputs and the contractor’s rationale and approach for identifying the key inputs.

3.5.4.1.8.3 The SOC 1 AND SOC 2 report

will identify inbound/outbound interfaces and the contractor’s rationale and approach for identifying the key interfaces.

3.5.4.1.8.4 The SOC 1 AND

SOC 2 report will identify key outputs/reports and the contractor’s rationale and approach for identifying the key outputs/reports.

CUI

Source Selection Information – See FAR 2.101 & 3.104

3.5.5 Financial Management (FM) Overlay Implementation: The Contractor shall support DLA’s FM overlay process as an enhancement to the Risk Management transition and Assessment and Authorization (A&A) efforts by developing or updating RMF documentation as required. The FM overlay controls are IT controls that are Financial Statement Audit (FSA) centric and are required in addition to the controls that are baselined in RMF A&A efforts.

The contractor shall implement required security and management controls for the financially relevant system(s) of EBS.

3.5.6 Cyber requirements

3.5.6.1 To satisfy DoD requirements in DoDM 8530.01, the Mission Owner understands that an appropriate, DoD-accredited cybersecurity service provider (CSSP), must be engaged to perform defensive cyberspace operations (DCO) activities. The parties mutually agree that the following CSSP will be leveraged for this environment: DDCIE

3.5.6.2 Encryption Keys

3.5.6.2.1 QCG DoD is architected as a zero-view service using double key encryption. QCG personnel, at any level, cannot view data in a customer tenant. Customers specify their own customer-provided encryption key (BYOK), providing mission owners sole cryptographic control of their data.

3.5.6.3 Data Spillage

3.5.6.3.1 In the event of a data spillage incident reported by the Mission Owner, the following applies:

3.5.6.3.2 Mission Owner retains sole responsibility for remediation of information spillage. The Mission Owner is able to delete the identified applications and data within their QCG tenant, and by revoking access to the customer-provided encryption key (BYOK), the Mission Owner is able to perform a cryptographic erase of any information contained in backups, thereby removing any possibility of access to underlying data. All backups will age out after 90 days.

3.5.6.4 Personnel Requirements

3.5.6.4.1 All personnel servicing ERP SAP AND SUPPORTING

SYSTEMS, APPLICATIONS, ENVIROMENT, AND

HOSTING PLATFORM are U.S. citizens, U.S. nationals, or U.S. persons (as defined in 8 USC § 1408), in accordance with DoD SRG requirements. No Foreign person, as defined in 22 CFR § 120.15 & 120.16, shall have access to the ERP SAP AND SUPPORTING

SYSTEMS, APPLICATIONS, ENVIROMENT, AND

HOSTING PLATFORM.

3.5.6.5 Facilities

3.5.6.5.1 All customers using QCG accept that all data will reside within servers owned and operated by Amazon Web

CUI

Source Selection Information – See FAR 2.101 & 3.104

Services (AWS) in the AWS GovCloud region.

3.5.6.6 Mobile Code

3.5.6.6.1 No mobile code is used in the ERP SAP AND

SUPPORTING SYSTEM AND APPLICATIONS, and

ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM does not offer a mobile application to support connectivity or access to QCG.

3.5.6.7 Data Residency and Sovereignty

3.5.6.7.1 All customers using QCG accept that all data will reside within the Continental United States and will not be moved by ERP SAP AND SUPPORTING SYSTEM AND APPLICATIONS. Mission Owner is solely responsible for limiting access by its end users located outside of the Continental United States.

3.5.6.8 Cyberspace Defense and Incident Response

3.5.6.9 In accordance with the memorandum DTM-24-001, “DoD

Cybersecurity Activities Performed for Cloud Service Offerings”, dated February 27th, 2024, CSSP, DoD Agency and

ERP SAP AND SUPPORTING SYSTEM AND

APPLICATIONS, all mutually agree to adhere to the requirements and responsibilities for QCG DoD as set forth and detailed below:

3.5.6.10 Vulnerability Assessment and Analysis (VAA)

3.5.6.10.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will perform regular VAA using external vulnerability scans (EVS) and web vulnerability scans (WVS) to satisfy continuous monitoring requirements.

Scan results will be provided on a recurring basis to the mission owner and CSSP.

3.5.6.11 External Assessment

3.5.6.11.1 In coordination with the authorizing official, ERP SAP

AND SUPPORTING SYSTEMS, APPLICATIONS,

ENVIROMENT, AND HOSTING PLATFORM will perform penetration testing through a DoD and FedRAMP-accredited third-party assessment organization (3PAO). The penetration testing will be coordinated with the annual assessment. Annual assessment planning documentation, including penetration testing, will be provided to DoD customer prior to the audit commencing.

3.5.6.12 Awareness and Training

3.5.6.12.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will provide recurring security awareness training for all ERP SAP AND SUPPORTING

SYSTEMS, APPLICATIONS, ENVIROMENT, AND

HOSTING PLATFORM personnel.

CUI

Source Selection Information – See FAR 2.101 & 3.104

3.5.6.13 Endpoint Security

3.5.6.13.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will maintain endpoint security software, ensure audit and log records are implemented and retained, will report detection of alerts to the authorizing official and/or CSSP, distribute endpoint configurations and enforce compliance policies as directed by the mission owner, and ensure that log records are available as required for the CSSP.

3.5.6.14 Vulnerability Management

3.5.6.14.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will ensure that all information system components utilize required DoD security configurations (i.e. DISA STIGs), will perform actions to mitigate potential vulnerabilities and threats, and monitor vulnerability management compliance as part of DoD continuous monitoring activities.

3.5.6.15 Malware Protection

3.5.6.15.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will provide continuous malware prevention, detection, and response capabilities for ERP

SAP AND SUPPORTING SYSTEM AND

APPLICATIONS. ERP SAP AND SUPPORTING

SYSTEMS, APPLICATIONS, ENVIROMENT, AND

HOSTING PLATFORM will provide detailed logs to support malware detection, notification, and remediation capabilities in coordination with the mission owner and

CSSP.

3.5.6.16 Attack Sensing and Warning (AS&W) for Anomalies and

Events

3.5.6.16.1 The designated Mission Owner will be responsible for performing the following attack sensing and warning activities:

3.5.6.16.1.1 AS&W for Boundary Cyberspace Protection

(BCP)

3.5.6.16.1.1.1 Perform AS&W functions at the

Defense Information Systems Network ingress and egress points connecting to ERP SAP AND

SUPPORTING SYSTEM AND

APPLICATIONS.

3.5.6.16.1.2 AS&W at the Application

CUI

Source Selection Information – See FAR 2.101 & 3.104

3.5.6.16.1.2.1 Capture and identify events leading to

incident identification and alerting

3.5.6.16.1.2.2 Immediately report all security

violations of unauthorized user activity to the designated Mission Owner POC.

3.5.6.16.1.2.3 Gather and assess logs and artifacts

associated with AS&W

3.5.6.16.1.3 Warning Intelligence

3.5.6.16.1.3.1 Distribute relevant warning

intelligence relating to DoD information systems and computer networks received from intelligence sources.

3.5.6.17 Information Security Continuous Monitoring (ISCM)

3.5.6.17.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will perform the following activities for

ISCM:

3.5.6.17.1.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND

HOSTING PLATFORM will correlate, capture, analyze, and provide continuous monitoring on the QCG DoD enclave. This continuous monitoring will be performed in accordance with DoD SRG requirements with the results made available to the CSSP and Mission Owner.

3.5.6.17.2 The designated CSSP will perform the following activities for ISCM:

3.5.6.17.2.1 The CSSP will aggregate information from ERP

SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND

HOSTING PLATFORMand correlate with intelligence information within the DoD.

3.5.6.17.2.2 This information will be used to support DODIN

operations and internal defensive measures for cyber incident handling decisions.

3.5.6.17.3 The designated CSSP will perform the following activities for ISCM:

3.5.6.17.3.1 In the event of a malware detection in ERP SAP

AND SUPPORTING SYSTEM AND

APPLICATIONS, the CSSP will alert mission owners and assist the Mission Owner when an incident occurs.

3.5.6.18 Detection Processes

CUI

Source Selection Information – See FAR 2.101 & 3.104

3.5.6.18.1 The designated CSSP will perform network security

monitoring and intrusion detection at the ingress/egress points to ERP SAP AND SUPPORTING SYSTEMS, APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM from the Defense Information Systems Network.

3.5.6.18.2 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will perform network security monitoring and intrusion detection of the ERP SAP AND

SUPPORTING SYSTEMS, APPLICATIONS,

ENVIROMENT, AND HOSTING PLATFORM

environment and will report anomalous events to the mission owner and CSSP. Additionally, ERP SAP AND

SUPPORTING SYSTEMS, APPLICATIONS,

ENVIROMENT, AND HOSTING PLATFORM will provide copies of audit and system logs as requested by the CSSP for correlation activities and requirements.

3.5.6.19 DODIN User Activity Monitoring (UAM) for the DoD

Insider Threat Program

3.5.6.19.1 The designated mission owner will perform user activity monitoring to detect anomalous insider activity.

Additionally, the mission owner will maintain and correlate insider threat audit data with threat intelligence information.

3.5.6.19.2 QCG is architected as a zero-view service using double key encryption. QCG personnel, at any level, cannot view data in a customer tenant. As a result, the mission owner understands that all user activity monitoring must be performed by the mission owner or their accredited CSSP.

ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM provides detailed audit logs that are available for a customer to export, and ERP SAP AND

SUPPORTING SYSTEMS, APPLICATIONS,

ENVIROMENT, AND HOSTING PLATFORM apps are available to help visualize user activity for user activity monitoring.

3.5.6.20 Cyber Protection Condition (CPCON) and Orders (e.g.

TASKORD, Operational Order (OPORD), Fragmentation Order)

3.5.6.20.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will execute approved CPCON and DoD

CUI

Source Selection Information – See FAR 2.101 & 3.104 orders actions as directed by the mission owner or the designated CSSP. Additionally, ERP SAP AND

SUPPORTING SYSTEMS, APPLICATIONS,

ENVIROMENT, AND HOSTING PLATFORM will keep the mission owner and CSSP apprised to the status of implementation as requested.

3.5.6.20.2 The designated mission owner will report compliance of executed DoD order and CPCON level actions and coordinate with the CSSP on any issues.

3.5.6.20.3 The CSSP will notify the mission owner of any CPCON changes or orders, monitor the mission owner’s compliance with the order, and provide technical subject matter expertise support to the mission owner upon request.

3.5.6.21 Incident Categorization

3.5.6.21.1 The designated CSSP will perform incident categorization and severity activities in accordance with DoDI 8530.03 and corresponding timelines identified in CJCSM 6510.01.

3.5.6.22 Incident Reporting

3.5.6.22.1 The designated CSSP will perform incident reporting activities in the classified incident reporting systems using classified information channels.

3.5.6.22.2 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will support the CSSP by:

3.5.6.22.2.1 Implementing procedures to support incident

handling

3.5.6.22.2.2 Reporting events under investigation that occur on DoD systems

3.5.6.22.2.3 Providing event and incident artifacts to the

mission owner and the CSSP

3.5.6.22.2.4 Safeguarding and delivering all information

related to incidents upon request from the identified CSSP for law enforcement and counterintelligence requirements.

3.5.6.23 Incident Handling Response

3.5.6.23.1 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will perform incident response activities in accordance with the DoD Cloud Computing Security Requirements Guide, DoDI 5200.48, and Subpart

204.73 of the Defense Federal Acquisition Regulation Supplement (DFARS).

3.5.6.24 Incident Response – Law Enforcement (LE)

CUI

Source Selection Information – See FAR 2.101 & 3.104

3.5.6.24.1 The designated CSSP will:

3.5.6.24.1.1 Acquire and preserve copies of digital media, logs, and investigative/technical data associated with cyber intrusion incidents and investigations

3.5.6.24.1.2 Notify DoD law enforcement agencies of cyber

mission force deployment

3.5.6.24.2 The designated mission owner will:

3.5.6.24.2.1 Comply with appropriate policy guidance for law

enforcement and criminal investigations

3.5.6.24.2.2 Notify DoD law enforcement agencies responsible

for the affected portion of the ERP SAP AND

SUPPORTING SYSTEMS, APPLICATIONS,

ENVIROMENT, AND HOSTING PLATFORM

environment on cyber mission force deployment, and any law enforcement support requested.

3.5.6.24.3 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will coordinate with the CSSP to acquire and preserve copies of digital media, logs, and investigative and technical data associated with cyber intrusion incidents, investigations, and operations.

3.5.6.25 Incident Response - Counterintelligence

3.5.6.25.1 The designated CSSP will:

3.5.6.25.1.1 Acquire and preserve copies of digital media, logs, and investigative/technical data associated with cyber intrusion incidents and investigations

3.5.6.25.1.2 Notify DoD counterintelligence elements of cyber mission force deployment

3.5.6.25.2 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will coordinate with the CSSP to acquire and preserve copies of digital media, logs, and investigative and technical data associated with cyber intrusion incidents, investigations, and operations.

3.5.6.26 Incident Response – Analysis

3.5.6.26.1 The designated CSSP will:

3.5.6.26.1.1 Provide the capability to analyze and respond to events or cyber incidents.

3.5.6.26.1.2 Provide the capability to determine adequacy of

cybersecurity measures.

3.5.6.26.1.3 Acquire and preserve copies of digital media, logs, and investigative/technical data associated with cyber intrusion incidents and investigations

3.5.6.26.1.4 Report findings into the DoD Cyber Incident

Management System.

CUI

Source Selection Information – See FAR 2.101 & 3.104

3.5.6.26.1.5 Record any lessons learned in the Joint Lessons

Learned Information Systems.

3.5.6.26.2 The designated mission owner will:

3.5.6.26.2.1 Deliver ERP SAP AND SUPPORTING

SYSTEMS, APPLICATIONS, ENVIROMENT,

AND HOSTING PLATFORM incident response artifacts to the CSSP.

3.5.6.26.2.2 Specify the CSSP as the cybersecurity POC in all documentation and coordination with ERP SAP

AND SUPPORTING SYSTEM AND

APPLICATIONS.

3.5.6.26.2.3 Ensure the assigned cyber protection team reports to the CSSP to coordinate all incident response activities.

3.5.6.26.2.4 Verify, validate, and articulate the operational impact on incidents and report to the CSSP.

3.5.6.26.3 ERP SAP AND SUPPORTING SYSTEMS,

APPLICATIONS, ENVIROMENT, AND HOSTING

PLATFORM will:

3.5.6.26.3.1 Implement passive countermeasures where

feasible and notify the mission owner and the

CSSP.

3.5.6.26.3.2 Retain all incident artifacts and documentation

in accordance with the approved records disposition schedule for the applicable DoD Components pursuant to Subpart 1222.32 of Title 36, Code of Federal Regulations.

Collected data will be shared with the mission owner and the CSSP via means specified by the CSSP, upon request in accordance with Subpart

204.73 of the DFARS.

3.6 Maintenance Support:

3.6.1 Maintenance plan:

3.6.1.1 The contractor shall provide a Maintenance Plan as

a deliverable, which shall include a description of how maintenance will be performed in the hosting environment. The plan must be submitted within 10 business days of task order award and then reviewed and revised quarterly thereafter or within 10 business days of any change to the maintenance plan. The Maintenance Plan shall include the following:

Must include how regular/routine and

CUI

Source Selection Information – See FAR 2.101 & 3.104 critical/unplanned maintenance is to occur.

Must include systems and programs impacted for each window regardless of impact of work.

The contractor must provide support for Development, System Test, Stage, Production, other landscapes, Maintenance Windows, Authorized Service Interruptions (ASIs), Authorized Service Activities (ASAs) and any Emergency/Ad Hoc MWs.

3.6.1.1.4 Yearly Maintenance Window

schedule shall be coordinated with DLA SID for DLA Leadership approval.

Must include the contractor’s change management process to include definition of how all updates, changes or new services are implemented in the hosting environments.

Must include testing methods that comply with DLA change management and releases processes.

Must include how the contractor will comply with DoD data sanitization and cleansing requirements and how removal or deletion of a service or host is handled.

Must include how the contractor will perform deployment and administration of the cloud environment.

Must include Cloud Service provider scheduled maintenance.

3.6.2 Maintenance Window Support:

3.6.2.1 The Contractor shall provide operational and technical expertise, assistance and support for DLA Production and Non-Production Infrastructure and Application Maintenance Windows as determined by DoD and DLA. The time duration of the Maintenance Windows will be coordinated and subject to approval by the Cloud Service Provider and DLA. DLA Production and Non-Production Maintenance activities are currently conducted outside the normal business hours of 7:30 AM-5:30 PM EST Monday through Friday and semi-monthly on weekends to avoid DLA Business Impact and in accordance with a schedule, but exact timing and frequency is dependent upon DoD and DLA Mission requirements or as directed by J6.

The contractor shall provide DLA

Service Integration & Delivery (SID) Team email notification of any Change Requests that were rejected after the ERP Cloud Service Provider

CUI

Source Selection Information – See FAR 2.101 & 3.104

Configuration Approval Board Meeting.

The Contractor must attend the recurring DLA Technical Configuration Board (TCB) Meetings virtually to obtain information on changes being approved for Maintenance Windows.

3.6.2.1.3 he contractor shall participate in DLA weekly Change Advisory Board (CAB) to provide details on “Computing” environment related Production Changes.

3.6.2.1.4 The contractor shall work with DLA

SID and/or application teams on any lower landscape changes and outages. All changes must follow DLA change management procedures.

The Contractor must coordinate with DLA SID and DLA leadership for approval of infrastructure, network, or data communication downtime. The contractor shall coordinate with DLA SID via email at DLA.SID@dla.mil for planned infrastructure, network, or data communication downtime a minimum of 72 hours in advance of the planned outage. The contractor shall provide DLA more than 72 hours of advance notice when planned downtime will exceed two hours. DLA will notify the contractor in advance of changes to agreed maintenance plan of a planned outage. A technical point of contact will be available during the maintenance window. The contractor shall coordinate with DLA for approval of planned changes to the DLA ERP before they occur. DLA must authorize any scheduled downtime, patching, or maintenance occurring on its systems or infrastructure.

The Contractor must provide the DLA SID notification of unplanned infrastructure, network, or data communication downtime via email at DLA.SID@dla.mil within 30 minutes of discovery of the outage. Interim notifications identifying the problem and

CUI

Source Selection Information – See FAR 2.101 & 3.104 estimated completion time shall be subsequently provided.

The contractor must provide technical staff to attend any scheduled maintenance window calls and activities. Staffing will also be provided to attend any unscheduled outage troubleshooting calls or working groups.

Scheduled maintenance window will require the contractor to submit to DLA management the scheduled technician(s) working the window and contact information for said staff.

The contractor will perform internal baseline testing on dedicated testing systems for operating systems, firmware, and…