Attachment A - FCC Auction Bidding System and Support Services - SOW.pdf

For Official Use Only (FOUO)

Federal Communications Commission

Statement of Work

FCC Auction Bidding System and Support Services

08/17/2023

Prepared by:

Federal Communications Commission Office of Economics and Analytics 45 L Street NE Washington, DC 20554 i

Table of Contents I. Introduction

II. Background

III. Auction Process Overview

A. Auction Process Lifecycle

1. Pre-Bidding

a. Bidder Preparation

b. Auction Application

c. Auction Application (Review) and Upfront Payment

2. Bidding

3. Post-Bidding

a. Post-Bidding

b. Down/Final Payments and Refunds

c. Licensing

IV. Purpose, Scope, and Objectives

A. Purpose of Procurement and Scope of Work

B. Objectives

1. Program/Business Objectives

2. Technical Objectives

3. Operational Objectives

V. Contract Supplies and Services

A. Description of Activities

1. Activity 1: Contract Management

a. Contract Kick-Off Meeting

b. Program Management Plan (PMP) and Quality Control Plan (QCP)

c. Conduct Contract Management Reviews (CMR) and Prepare CMR Reports

d. Meetings

e. Monthly Contractor Staffing Report

f. Transition-Out/Termination Strategy Plan

g. Final Contract Report

2. Activity 2: Software, Maintenance, and Other Support

3. Activity 3: Software Delivery Method – Hosting ii

4. Activity 4: Technical Support

a. Operations and Maintenance (O&M) Support

b. IT Security Support

c. Other Required Assessments

d. Service Support

e. Operational Uptime

f. Continuity of Operations/Disaster Recovery Support

5. Activity 5: System Implementation and Integration

a. Minimum Requirements at the Time of Proposal Due Date

b. Minimum Software Requirements for Production Service to Support Live Auctions

c. Testing

d. Training

e. Deployment

f. Documentation

g. Project Management

6. Activity 6: Special Projects

B. Deliverables

1. Deliverable Formats

2. Delivery Requirements

3. Review and Acceptance of Deliverables

4. Schedule of Deliverables

a. Deliverables for Activity 1: Contract Management

b. Deliverables for Activity 2: Software, Maintenance, and Other Support

c. Deliverables for Activity 3: Software Delivery Method – Hosting

d. Deliverables for Activity 4: Technical Support

e. Deliverables for Activity 5: System Implementation and Integration

f. Deliverables for Activity 6: Special Projects

C. Constraints and Considerations

1. Data Rights and Usage of FCC Information

2. Government Furnished Property and Information

3. Cybersecurity

4. Privacy/Privacy Act

5. Section 508 Compliance iii

6. Access Controls and Authentication

7. Need-to-Know Acknowledgement

8. IT Security

D. Personnel Requirements

1. Key Personnel

2. Substitution of Key Personnel

VI. Period of Performance

VII. Place of Performance

VIII. Work Schedule and Holidays

Appendix 1: Software Requirements and Additional Design Features

Appendix 2: Testing

Appendix 3: IT Security, Privacy, and Accessibility Control and Mandate References

Appendix 4: Section 508 Compliance

Appendix 5: FCC Auction 110 Procedures Public Notice

Appendix 6: FCC Auction 112 Procedures Public Notice

Appendix 7: Rights in Data Addendum

Appendix 8: Software Bill of Materials (SBOM)

Appendix 9: Authority to Operate (ATO)

Appendix 10: IT Refresh

I. Introduction

This is a Statement of Work (SOW) for Contractor support to assist the Federal Communications Commission’s (FCC) Auctions Program with carrying out the FCC’s statutory mandates as well as other FCC priorities using auctions. This SOW is for the provision of an auction bidding system and support services.

II. Background

The FCC is an independent agency established by the Communications Act of 1934, as amended, to regulate communications by wire, radio, television, satellite, and cable. Since 1994, the FCC has used competitive bidding to assign spectrum licenses when it accepts mutually exclusive applications for any initial license or construction permit. Over the past several years, the FCC has taken actions to make spectrum available for fifth generation (5G) wireless, Internet of Things (IoT), and other advanced services. These actions have served to promote robust and efficient spectrum use and help to ensure the rapid deployment of advanced wireless technologies – including 5G – in the United States. To meet the demand for spectrum, the FCC needs to be able to maintain its current competitive bidding capabilities and rapidly develop and deploy new auction designs.

The FCC’s current auction bidding system (i.e., bidding software, procedures, documentation, and training) supports bidding in FCC spectrum auctions (wireless and media) and universal service auctions, and also integrates/interfaces with other FCC systems to support auction data exchanges/transfers. The FCC’s current auction bidding service consists of a contracted bidding software that is licensed for use with customized configurations and modifications that adhere to specific IT security, privacy, accessibility, and maintenance requirements. The service is hosted in a segregated cloud infrastructure boundary that is provided and maintained by the contractor. The bidding system in use today allows for a variety of auction formats, including ascending simultaneous multiple round (SMR) auctions, single-round auctions, ascending clock auctions with or without an assignment phase, and descending clock auctions. In addition to conducting auctions using established bidding formats, the FCC is constantly evaluating new, unique auction capabilities to meet its current and anticipated auction needs and incorporates design and technology advances into its auction bidding system.

III. Auction Process Overview

The FCC’s Auctions Program has an established process for creating and conducting FCC auctions. This process starts with the rulemaking and related activities concerning the spectrum or universal service support to be offered in the auction and the procedures for participating in the auction. It then runs through the licensing of spectrum won (for wireless/media auctions) or support assigned (for universal service auctions) during the auction bidding. The FCC’s current auction bidding services support the auction bidding and bidding-related aspects of the auction process, in addition to activities and data support and exchanges during the pre-bidding and post-bidding timeframes. The highest-level view of the auction process is depicted in diagram 1 (note: while depicted from left to right, some of these process areas and activities occur concurrently and should not be assumed to be consecutive).

Diagram 1: Spectrum Auction Timeline

A. Auction Process Lifecycle

The bulleted lists associate two views: (1) the high-level process areas of an auction as depicted in the puzzle pieces in Diagram 1 above, and (2) auction data interfaces and integrations for generic spectrum auctions and universal service auctions, which can be found in Diagrams 2 and 3 below.

Throughout the auction process, the FCC makes certain application data for a current auction available to the general public via public search on the FCC’s website, releases certain bidding data during the bidding portion of the auction through a web-based reporting service, and makes additional application data and bidding data available in both places following the close of the auction. Additional information related to public notices can be found in Appendix 5 and Appendix 6.

1. Pre-Bidding

a. Bidder Preparation

Internal FCC Activities:

• Solicit public comment on the proposed procedures for applying to participate and bid in the auction, and then adopt the final application and bidding procedures for the auction

• Prepare auction educational materials and make them available to potential bidders on the

FCC’s website

• Perform development work on the auction application system and the auction bidding system as needed to implement any additional requirements and/or modifications

• Conduct training/testing with FCC internal users for both the auction application system and the auction bidding system

• Create/configure the auction in the FCC’s auction application system

• Create/configure the auction in the FCC’s auction bidding system

External/Non-FCC Activities:

• Potential bidders prepare to apply to participate in the auction by reviewing public notices and other auction educational materials provided by the FCC

b. Auction Application

Internal FCC Activities:

• Open the initial filing window and make the auction application available to the public in the

FCC’s auction application system

External/Non-FCC Activities:

• Potential bidders submit applications to participate in the auction1

1 Information provided by all auction applicants (including those deemed qualified bidders) includes (1) contact and/or certification information that the FCC considers to be personally identifiable information (PII) under OMB Circular A-130 and subject to an agencywide System of Records Notice (SORN), which can be found here:

https://www.fcc.gov/sites/default/files/sor-fcc-2.pdf; and (2) other confidential or proprietary information that may be maintained on the system. In performance of the work set forth in this SOW, it is expected that certain of Contractor’s staff may require access to this PII, other PII regarding FCC staff (e.g., admin users) and other authorized contractors who perform work on the system, and/or other confidential or proprietary information maintained on the system. Any such Contractor staff may be subject to additional requirements (e.g., sign Need-to-Know Acknowledgement, Section V.C.7) prior to receiving such access.

c. Auction Application (Review) and Upfront Payment

Internal FCC Activities:

• Review/process auction applications and determine initial application status, and later determine the qualified bidders

• Transfer qualified bidder information, along with other auction related and inventory data, into the auction bidding system (currently imported as flat files; data transfer between the FCC’s auction application system and the bidding service is required)

External/Non-FCC Activities:

• Potential bidders update applications to participate in the auction as necessary

• Potential bidders submit upfront payments through the FCC’s financial system to establish their eligibility to bid in the auction

2. Bidding

• Conduct bidding and communicate with qualified bidders via the bidding system

• Make certain auction bidding data available to each qualified bidder during the auction

• Make a subset of auction bidding data available to the public after each round of bidding through a web-based reporting service

• As required, update auction application data and qualified bidder information in the bidding system during the auction

External/Non-FCC Activities:

• Qualified bidders participate in a mock auction to practice using the bidding system before bidding in the production auction

• Qualified bidders bid in the auction

3. Post-Bidding

a. Post-Bidding

Internal FCC Activities:

• Close the auction after bidding concludes

• Transfer winning bidder and withdrawal data into the FCC’s auction application system

(currently imported as flat files; data transfer between the FCC’s auction application system and the bidding software is required)

• Make additional auction bidding data available to the public in the web-based reporting service

• Make auction bidding data (including system transactional and log data) available to the FCC within the FCC’s boundary/environment

b. Down/Final Payments and Refunds

• Send winning bidder, withdrawal, and auction application data from the FCC’s auction application system to the separate FCC licensing/authorization systems (for wireless and media auctions) and the FCC’s financial system

• Issue refunds through the FCC’s financial system

External/Non-FCC Activities:

• Winning bidders submit down payments and final payments through the FCC’s financial system

• Winning bidders request refunds of upfront payments amounts not needed to satisfy their winning bid obligations

c. Licensing

• Grant licenses/construction permits (for wireless and media auctions) or assign universal service support (for universal service auctions)

External/Non-FCC Activities:

• Winning bidders submit applications for licenses/construction permits in the separate FCC licensing/authorization systems (for wireless and media auctions) or applications for assignment of universal service support in the auction application system (for universal service auctions)

Diagram 2: Data Interfaces and Integrations for Generic Spectrum Auctions

Diagram 3: Data Interfaces and Integrations for Universal Service Auctions

IV. Purpose, Scope, and Objectives

A. Purpose of Procurement and Scope of Work

The purpose of this SOW is to obtain a complete business solution for the FCC’s current and future auction bidding processes and to provide support to the auction program. The Contractor shall provide an auction bidding system and non-personal professional services.

The Contractor shall provide services to support auction bidding and tangentially related activities.

The Contractor shall provide a software solution that can be configured/modified to meet the FCC’s minimum requirements/functionality for various types of auctions described in this SOW and can be further modified/customized as needed to meet more advanced auction designs and new auction design requirements.

The solution shall be hosted with a cloud service provider (CSP) that is FedRAMP authorized for the IaaS and PaaS service models, at a minimum level of moderate.

The Contractor shall provide software, hosting, and operations and maintenance support included as part of the overall service provided under this contract. The services, technical environment, and bidding system shall be capable of complying with and adhering to all FCC IT policy requirements and all relevant Federal IT security, privacy, and accessibility standards, controls, guidelines, regulations, laws, and other mandates, which include, but are not limited to, those described in Appendix 3 to this SOW.

The Contractor's auction bidding service shall be accessible to all potential users, including authorized FCC employees and authorized contractors, auction bidders, other public participants, and other FCC automated systems.

At the time of proposal due date, the software solution shall have available the following bidding formats:

• Ascending SMR without package bidding

• Ascending clock auction with assignment phase

• Ascending clock auction without assignment phase

• Descending clock auction without assignment phase

Within six (6) months after the Contract Effective Date, the auction bidding formats listed above shall be configured/modified to meet the FCC’s specifications/minimum software requirements, which includes modifying the software to support a bidding format of an ascending clock auction without assignment phase with a quantity of 1. This includes, but is not limited to, establishing the cloud infrastructure and environments, configuring/modifying the software, integrating the system with other FCC systems, and establishing the authentication mechanism, such that within six (6) months after the Contract Effective Date, the service will be available in a test environment for the FCC staff and contractors to test. (see Appendix 1, Section B for minimum software requirements within 6 months after Contract Effective Date).

The scope of work further includes any future modifications/enhancements or any new auction bidding formats and/or any system/technical requirements that are necessary to support the Auctions Program, which would be tasked as a ‘Special Project.’ Examples of additional auction bidding formats that the FCC might require include, but are not limited to, single-round auctions, SMR auctions with package bidding, and clock auctions with package bidding (see Appendix 1, Section C for possible future modifications/enhancements during the period of performance of this contract).

The Contractor shall provide services for the configuration or modification of the software through face- -to-face and teleconference consulting services and shall provide face-to-face or teleconference/virtual training of designated FCC staff on the use of the software. After initial implementation, software modification services shall be required on an as needed basis through special projects for requirements analysis and software configuration and/or modification for the specified auction as identified in this SOW. The Contractor shall provide continuous and on-going technical support and training after completion of the initial implementation and any subsequent modifications of the software.

The Contractor shall provide professional services, including expert consulting and advisory services as described in this SOW. These services shall support the initial implementation as well as any potential future auction designs and configurations and/or modifications of the bidding service and/or auction formats.

The Contractor's solution shall ensure a seamless transition from the FCC’s current auction bidding system to the auction bidding system provided under this SOW. The Contractor shall provide highly qualified and experienced personnel to support the work identified in this SOW. These personnel shall have documented experience and training with the system and have experience in auction software design.

A Contracting Officer’s Representative (COR) from the Office of Economics and Analytics (OEA) shall provide technical direction to the Contractor with respect to the work to be performed.

B. Objectives

The objective of this procurement is to enable the FCC to continue to provide the capabilities needed to support competitive bidding, thereby meeting its current and future needs for conducting auctions. The Contractor shall provide the software and services for an adaptable and versatile auction bidding system (i.e., capable of hosting multiple auction designs) and non-personal professional services to support auction design and the auction bidding system. The software and services provided by the Contractor shall meet the FCC's program/business, technical, and operational objectives in the performance of the contract.

1. Program/Business Objectives

The principal program/business objective of this contract is to ensure the FCC is able to maintain, without adverse impact to the Auctions Program, a bidding service with the core functionality and bidding formats that are in use today, and to provide for any modifications to the system that are required for future auctions. Developing any future auction designs and configurations will require the Contractor to have expert knowledge both in auction economics and mechanism design and expertise in the implementation and support of those designs. The Contractor’s software service shall be able to support auction bidding using the Clock (descending and ascending) and SMR auction bidding formats upon proposal due date and shall be a software service that can be configured to meet, with minor modifications or modifications customarily available in the commercial marketplace, the FCC’s requirements. The Contractor shall complete the configuration of the service to meet the minimum software requirements for a live (production) auction as outlined in Appendix 1, Section B within six (6) months after the Contract Effective Date. The software solution shall allow the FCC to quickly configure the bidding software for each auction and shall allow the FCC to incorporate new and various design formats auction by auction. The Contractor's software shall provide for:

• Various possible combinations of typical auction design considerations, discussed in Appendix 1 of this SOW;

• Flexibility for modifications to support other new and/or novel auction features, components, and designs;

• Ability to implement final auction rules adopted during the FCC rulemaking process;

• Robust and flexible query and reporting capabilities;

• Access to up-to-the-minute data and reports for fast and transparent external reporting;

• Accountability and ability to audit transactions.

2. Technical Objectives

The principal technical objectives of this contract are to obtain a software solution and services with a high degree of reliability and availability (i.e., 99.999% or “five 9s availability”) and that comply with and adhere to all FCC IT policy requirements and all relevant Federal IT security, privacy, and accessibility standards, controls, guidelines, regulations, laws, and other mandates, which include, but are not limited to, those described in Appendix 3 to this SOW.

The Contractor’s software and/or support services shall:

• Provide a secure cloud-based solution and provided in a hosted CSP that is FedRAMP moderate authorized for the IaaS and PaaS service models, with environments cordoned off from other systems so as not to be shared with any other services and that is able to connect to/integrate with the FCC’s network and designated systems (e.g., CORES II, RSA);

• Provide all necessary services to support and host the software solution, including infrastructure hosting, application functionality as well as cybersecurity compliance and technical support;

• Provide software that has received or is able to receive post contract award an FCC authority to operate (ATO);

• Adhere to federal regulations and guidelines;

• Provide reliable system uptime (i.e., 99.999%) and scalability;

• Ensure that all data are stored (in-transit and at-rest) and processed only in the Continental United States;

• Provide data security and privacy;

• Provide technical and maintenance support; and

• Provide for ease of data exchange through the use of standard and transparent data formats conforming to modern conventions.

3. Operational Objectives

The principal operational objective of this contract is to obtain software (and associated services) that provide outstanding management and customer support. The Contractor must be able to demonstrate exceptional experience in the use and support of its auction bidding software, its auction design services, and supporting auction administration. The Contractor's services shall include:

• Staff with expert knowledge and proven experience in spectrum auctions, a variety of auction formats, and auction bidding software;

• Documentation that includes, but is not limited to, security and software configuration, technical specifications, system interface descriptions, and user manuals;

• Training and user support for the users of the system that is based on the level, responsibility, and roles of individual users;

• Services that are easily accessed and intuitive to use by all potential users, including authorized FCC employees and authorized contractors, auction bidders, other public participants

• Providing user-friendly, well-designed, and purposeful system administration and application management capabilities that are operated by FCC employees;

• Customer information and relationship management capabilities; and

• Providing a seamless transition from the current auction bidding service.

V. Contract Supplies and Services

This SOW describes the specific supplies and services/work required by this contract along with any special requirements. The supplies and services required by this contract shall be delivered in accordance with this SOW.

A. Description of Activities

The Contractor shall perform all tasks, activities, and support needed to provide a complete business solution for the FCC’s Auctions Program and auction bidding activities. This includes all activities that impact the auction bidding processes, designs, software, environments, architecture, hosting, and operational support.

The activities are categorized in the following table:

Activity No. Activity Type Contract Periods

1 Contract Management Fixed Price Base + 4 Option Years

2 Software, Maintenance, and Other Support Fixed Price

Base + 4 Option Years

3 Software Delivery Method- Hosting Fixed Price Base + 4 Option Years

4 Technical Support Fixed Price Base + 4 Option Years

5 Implementation and Integration Fixed Price Base

6 Special Projects Fixed Price or Time and Materials with Ceiling

Base + 4 Option Years

1. Activity 1: Contract Management

Activity 1: Contract Management is a Firm Fixed Price (FFP) contract line item number (CLIN) under which the Contractor shall provide contract management in support of this SOW and the services required therein. Under Activity 1, the Contractor shall complete routine administrative obligations (e.g., background investigation forms, staff roster, mandatory training), and report and update burn rates, progress, risks, issues, and opportunities. This includes the delivery of monthly contract progress reports, the ad hoc creation of meeting minutes, and the coordination of a kick-off meeting, among other administrative activities. It also requires the Contractor to submit a monthly contractor staffing report.

The Contractor shall also manage and evaluate the quality of the work, the risks of meeting the scope of work, and focus on following the approved Program Management Plan (PMP), or initiating changes to the PMP to create efficiencies, and generally monitor the contract and the service.

The PMP will serve as the agreed upon management approach and timing for this effort and will be updated throughout as process improvements or changes are made. A draft version of the PMP shall be submitted with the Contractor’s response to this SOW, and shall provide enough detail for the FCC to have a solid understanding of the Contractor’s proposed approach, staffing, communication, schedule, and timing for achieving the requirements of this SOW. The PMP should include staffing plan information such as labor mix (Key Personnel and other proposed staff) and level of effort (number of staff) for supporting the Activities/CLINs under this SOW.

The Contractor shall monitor the quality of all work performed under this contract. This includes the quality of the services as well as the products and deliverables produced. The Contractor will ensure the quality, completeness, and timeliness of all deliverables, services, and work performed. The Contractor shall ensure that all deliverables and products comply with all applicable FCC standards, policies, and procedures.

a. Contract Kick-Off Meeting

The Contractor’s Program Manager shall schedule and coordinate a Contract Kick-Off Meeting within one week after contract award at a location approved by the Government. The meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss the implementation approach as well as any technical, management, and security issues, and travel authorization and reporting procedures. At a minimum, the attendees shall include key Contractor personnel, representatives from the FCC’s OEA, Office of the Chief Information Officer (OCIO), Enterprise Acquisition Center (EAC), and other key Government officials.

b. Program Management Plan (PMP) and Quality Control Plan (QCP)

The Contractor shall prepare a PMP with a schedule that covers all of the support and services that are under this SOW. The PMP shall describe the proposed management approach for each of the Activities in the Contract. The PMP shall detail standard operating procedures (SOPs) for all Activities. At a minimum, the PMP shall:

• Provide for information on the Contractor’s management organization and internal management policies and procedures.

• Describe the approach and method for the identification, assessment, and mitigation of program risks.

• Describe the communications plan in support of this contract.

• Identify milestones, tasks, and subtasks required for all Activities.

• Staffing plan that includes labor mix (Key Personnel and other proposed staff) and level of effort (number of staff) for each Activity and staffing approach to ensure the staff is retained such that services and requirements are consistently met throughout the period of performance of this contract.

• Provide a schedule that supports all Activities under this contract.

A draft version of the PMP with a schedule shall be submitted with the Contractor’s response to this SOW, and shall provide enough detail for the FCC to have an understanding of the Contractor’s proposed approach, staffing, communication, schedule, and timing for achieving the work under this SOW. The Contractor shall provide the Government with a final draft PMP that includes a schedule within ten (10) business days after the contract kick-off meeting. The FCC shall have an opportunity to comment on this version of the PMP and the final PMP shall be completed within ten (10) business days after receipt of final comments from the Government. The PMP is an evolutionary document and shall be reviewed monthly, as requested by the COR, or as the management approach or schedule changes.

The Contractor shall prepare a schedule that covers each activity with sufficient detail so as to demonstrate that all of the work is appropriately resourced, thoroughly planned, and can successfully meet requirements and deliverables. Such schedule(s) shall be detailed at a task level that is useable by the FCC to manage a baseline schedule and risks in accordance with the Contractor’s PMP. Upon submission and approval by FCC, the schedule(s) shall be become the baseline plan and will be managed/updated as a standalone document separate from the PMP. Schedule updates shall be evaluated/made with any changes in tasks or schedules, or as designated by the COR. Changes to scheduled baseline milestones shall be documented by the Contractor and formally authorized by the

FCC.

The Contractor shall prepare a Quality Control Plan (QCP) that provides measurements and assessment criteria for determining quality of the services and systems provided under this SOW. The QCP shall describe the Contractor’s approach to ensuring quality in all aspects of the contract.

A draft version of the QCP shall be submitted with the Contractor’s response to this SOW, and shall provide enough detail for the FCC to have an understanding of the Contractor’s approach to ensure quality in the services delivered under this contract and includes all aspects of this contract such as quality of deliverables, products, systems, code, and staffing. The Contractor shall provide the Government with a final draft QCP that includes a schedule within fifteen (15) business days after the contract kick-off meeting. The FCC shall have an opportunity to comment on this version of the QCP and the final QCP shall be completed within ten (10) business days after receipt of final comments from the Government.

c. Conduct Contract Management Reviews (CMR) and Prepare CMR Reports

On a monthly basis the Contractor shall prepare and submit to the COR a Contract Management Review (CMR) Report along with a Contract Funds Attachment. The report will be a consolidation of all currently exercised options with work reported separately by CLIN. The purpose of the CMRs shall be for the FCC to review Contractor performance, quality, and contract status.

(i) CMR Report

The CMR Report shall include, at a minimum, the following unless otherwise agreed to with the COR:

• Contract cost information financial reporting (see Section V.A.1.c.(ii), Contract Funds Attachment, below)

• Contract and project risks

• Quality and performance measures/metrics (calculated through agreed upon performance metrics, customer surveys and evaluations of performance)

• Personnel gains, losses, and status

• Administrative items such as PIV card and laptop issuance, mandatory training completion, etc.

• Program and project management information, including:

• Changes to the PMP

• Planned activities during reporting period (shall include: on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Each section shall start with a brief description of the activity

• Schedule (shall show major activities, milestones, and deliverables; planned and actual start and completion dates for each)

• Risk management – all activities performed by the contractor to reduce project risk must be identified

• Issues/problems and corrective actions taken; shall also include issues or concerns and proposed resolutions to address them

• Government actions required – If an activity is dependent upon government action, it must be included

• Action Items – All items that require action by either the contractor or the government as identified during the meeting must be included

• Priorities – Any priorities concerning the project plan, action items or any other items discussed during the meeting must be included

(ii) Contract Funds Attachment

For other than fixed price CLINs, as an attachment to the invoice (Contracts Funds Attachment), the Contractor shall provide a monthly detailed breakdown of expenditures on the contract. At a minimum, this shall include a breakdown of labor hours (by labor category) used by the Contractor and any subcontractors, associated labor costs, material costs and any other direct costs incurred. The report shall include both reporting period and cumulative expenditures, presented in both tabular and graphical form.

d. Meetings

The Contractor may conduct meetings and reviews in accordance with the FCC-approved PMP and this SOW, as appropriate, to ensure successful contract performance. Meeting types may include those in support of project activities which include, but are not limited to, coordination meetings with infrastructure, security, and database contractors, deployment meetings, go/no-go meetings and strategy meetings. Other meetings include those in support of contract management, such as weekly status meetings and monthly Contract Management Review (CMR) meetings. The Contractor shall prepare and submit meeting agendas and read-ahead presentation materials for all scheduled meetings, unless otherwise instructed by the COR. The Contractor shall be prepared to substantiate assumptions made and methodologies used in arriving at recommendations or conclusions. The Contractor shall record meeting minutes during all meetings. The Contractor shall prepare formal written minutes, unless otherwise instructed by the COR. Meetings and reviews shall not be considered final, and the Contractor's obligation satisfied, until the FCC has approved the minutes.

The Contractor shall provide, via electronic transmission, complete copies of all minutes to the COR and all attendees within 2 business days after the meeting. All challenges to the minutes shall be reflected in a revised version prepared by the Contractor. Copies of updated minutes shall be distributed to the FCC and all attendees within 1 business day after notice of a challenge to the minutes.

e. Monthly Contractor Staffing Report

The Contractor shall submit a Monthly Contractor Staffing Report to the FCC’s Security Office Center (SOC) and the COR within the first five (5) days of each month. The staffing report shall list each contractor working on the contract and specific details about the contractor using a template provided by the FCC and noting any changes in staff onboarding or offboarding each month. Additional administrative information for each member of the Contractor’s staff may be requested, such as contact information, onboarding process details, and/or tracking of FCC-issued property.

f. Transition-Out/Termination Strategy Plan

The Contractor shall develop a Transition-Out/Termination Strategy Plan that shall facilitate the accomplishment of a seamless transition from the Contractor to an incoming contractor and/or Government personnel at the expiration of the contract. The Contractor shall submit a plan that provides the approach for a transition from the software provided by the Contractor and, if applicable, the hosted services, to new software or hosted services and/or close of the contract. The plan shall provide an impact statement outlining the potential impact of the transition to the FCC. The plan shall describe any software and associated documentation needed to maintain the product. The Contractor shall submit its Transition-

Out/Termination Strategy Plan no later than 90 days prior to expiration of the contract. Upon approval and implementation of the plan, Contractor shall submit weekly status reports.

g. Final Contract Report

The Contractor shall submit a Final Contract Report upon completion of all components of each item in this SOW. The Contractor shall maintain up-to-date records of all work results, developments, and accomplishments for the preparation of the report. The Final Contract Report shall include descriptions of all documentation, processes, techniques, models, studies, code and procedures developed under this contract.

2. Activity 2: Software, Maintenance, and Other Support

Activity 2: Software, Maintenance, and Other Support is an FFP CLIN under which the Contractor shall provide the auction bidding software and service in support of this SOW and the services required therein.

Under Activity 2, the Contractor shall provide to the FCC a software solution, to include maintenance for updates, upgrades, and newer versions/releases. See Appendix 10 for information on refreshing technology.

The Contractor shall provide for the core auction bidding system/service capable of meeting the scope of this SOW and the requirements in Appendix 1, and shall provide maintenance and software updates and enhancements covering the core auction bidding service. The “core auction bidding service” is defined as software that provides for various FCC auction formats, to include, upon proposal due date, ascending SMR auctions (e.g., FCC Auction 112) and clock auctions, which are either ascending with an assignment phase (e.g., FCC Auction 110) or ascending without an assignment phase (e.g., FCC Auction 108) or descending (e.g., FCC Auction 904), and in the future, with system modifications if needed, single-round auctions, which are either ascending- or descending-bid auctions, SMR and clock auctions with package bidding, and any additional modifications, that are added during period of performance of this contract.

The Contractor shall provide technical support and documentation for the core auction bidding service.

the Contractor shall also provide a software bill of materials (SBOM) and test for threats in compiled software binaries, in accordance with the National Institute of Standards and Technology (NIST) guidance on secure software development practices. See Appendix 8 for additional information regarding the SBOM.

The Contractor shall provide full-lifecycle support for all systems and services delivered including full accountability of equipment and data throughout the contact and the property’s life cycle regardless of its status (acquisition, in-service, unserviceable, obsolete, excess, surplus, etc.) or physical location, including end-of-life equipment and systems.

3. Activity 3: Software Delivery Method – Hosting

Activity 3: Software Delivery Method (hosting) is an FFP CLIN, under which the Contractor shall provide a cloud-based hosting service in support of this SOW and the services required therein. Under Activity 3, the Contractor shall provide the hosting service such that it will allow FCC the flexibility to meet future requirements. The Contractor shall provide all of the technology, architecture, and infrastructure that serve as the foundation for running the software application and the services on that infrastructure. The Contractor shall also provide the software and services for running and managing access to the software and systems that transfer data or provide integrations with the FCC. All data (in-transit and at-rest) must reside in the United States.

The Contractor shall provide all software, hardware, and environments needed to develop, test, host, and use the service. The environment(s) and/or auction instances need to allow for multiple testing groups to test the system simultaneously and independently from one another. The FCC expects new environments and/or auction areas to be able to be created quickly, and then shut down when no longer needed.

The cloud-based hosting service (including the services required to make it run) shall be with a CSP that is FedRAMP authorized for the IaaS and PaaS service models, at a minimum level of moderate. The hosting service shall meet all requirements set forth as detailed in Appendix 1.

The Contractor shall provide documentation of the hosting and application management services.

4. Activity 4: Technical Support

Activity 4: Technical Support is an FFP CLIN, under which the Contractor shall provide all operations and maintenance (O&M) for the hosting service and all systems within the hosted service, to include all IT security related updates and reviews and help desk services, in support of this SOW and the services required therein. Under Activity 4, the Contractor shall provide ongoing support for the operations, maintenance, and security (in accordance with FCC Security Policy and federal guidelines) of the deployed system infrastructure, which includes, but is not limited to:

• Network operations

• System administration

• Host-based intrusion detection

• Network-based intrusion detection

• Backup and recovery

• Monitoring of operating system, database, applications, and network

• Support for installation of application patches and service packs

• Physical database support and management

• User IDs and passwords resets and general end user technical support

• Install and provide support for patches and upgrades. Unless otherwise coordinated with the

COR for different timeframes for specifics patches and/or updates, all critical updates and/or patches are applied within 15 days of publication (immediately if directed by the CIO/CISO).

All high updates and/or patches are applied within 30 days of publication. All medium updates and/or patches are applied within 60 days of publication, and all low updates and/or patches are applied within 90 days of publication.

• Security for the hosted service and system.

Although support for Activity 4 will not begin in full force until the bidding system and hosting are in a production/deployed state, some level of support under Activity 4 may nonetheless be needed during the base period prior to the time the system is in production. The bidding system and environments require authorization through the ATO process and acceptance by the FCC after passing testing to be in a production environment.

a. Operations and Maintenance (O&M) Support

The Contractor shall provide ongoing support for the operations and maintenance (O&M) of the deployed application, which includes, but is not limited to:

• Application break-fix

• Patch/Update management

• Application database support and management

• Instance management/change control

• Version/release upgrades for underlying code/technologies

• Interface support

• Functional support

• Application end-user security

• Batch job management

• Application and database performance tuning and capacity planning

• Documentation updates

• Trainings

b. IT Security Support

The hosting service shall be on a secure platform that meets the FCC’s requirements for system reliability, accessibility, security, and traceability. The detailed requirements include compliance with the security standards in the Federal Information Security Modernization Act of 2014 (FISMA), including any amendments thereto. The system shall have or be able to receive an FCC ATO, and the hosting service provider shall have a FedRAMP authorization, prior to the use of the service in production and in accordance with the schedule under this SOW. All applicable references can be found in Appendix 3.

See Appendix 9 for additional information regarding the FCC ATO.

The FCC CISO is responsible for validating the system meets the defined IT security standards as presented by the vendor.

The Contractor shall be responsible for producing documentation in support of an annual review and continuous monitoring process to maintain an ATO. The Contractor shall be responsible for having a third party FedRAMP-recognized assessment organization (3PAO), with active accreditation by the American Association for Laboratory Accreditation (A2LA), validate that the security controls in place are conforming to the NIST Special Publication 800-53 (current and future versions), Security and Privacy Controls for Information Systems and Organizations, and that the requirements, including ongoing continuous monitoring are in accordance with the FCC Information Security Continuous Monitoring (ISCM) Strategy and Plan, which is expected to be in place by the end of 2023. The Contractor is required to provide the FCC with an annual assessment report from a third-party assessor.

Security assessors are responsible for independently verifying and validating the control implementation and test results for the FCC in the continuous monitoring phase. The ISCM process begins on an information system after the issuance of an ATO. Timelines for the annual testing cycle of a system in the continuous monitoring phase are driven by the date the original ATO was completed, and as coordinated with the FCC. The number of controls reviewed each year is dependent upon the guidelines provided by NIST FIPS PUB 199 categorization, and the FCC’s determination of which controls are the highest priority from an FCC perspective. Control baselines will be reviewed on an ongoing assessment cycle. The total number of control baselines will be divided by 3 and scheduled for testing in Year 1, Year 2, and Year 3 based on operational risk and process maturity.

c. Other Required Assessments

The FCC, with support from contractor assigned Information System Security Officer(s) (ISSOs) to this effort, shall conduct a Security Impact Analysis (SIA), NIST FIPS PUB 199 categorization, Initial Privacy Assessment (IPA), Privacy Impact Assessment (PIA), and System of Records Notice (SORN) and review/update those documents as required by the FCC.

The SIA process articulates how changes to the system may affect the security posture of the system.

Documentation chronicling the SIA provides insight to the development team, ISSO, Business/System Owner, and other key stakeholders.

An IPA is a tool used to determine if a PIA or SORN is required for an information system or service.

The FCC provides a template IPA for the information system(s) and the Contractor shall contribute to the creation and review of the IPA.

A PIA is an analysis of how information is handled: (i) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (ii) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and

(iii) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Any information system or service that handles PII from 10 or more members of the public must have a PIA in accordance to the E-Government Act of 2002, sec. 208, and the Privacy Act of 1974. The FCC provides a template PIA for the information system(s) and the Contractor shall contribute to the creation and review of the PIA.

A system of records is a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifier assigned to the individual. The Privacy Act requires each agency to publish notice of its SORN in the Federal Register. The Contractor shall contribute to the creation and review of the SORN.

d. Service Support

The Contractor shall provide service support – from basic end-user application support to resolution of complex software issues – as documented below. . The Contractor shall supply support to internal users at the FCC, and external users with prior notification as needed. Tier 1 support is generally provided to external users by FCC Telephonic Bid Assistants, Tier 2 support is provided by FCC Auction Program staff, and Tier 3 support shall be provided by Contractor staff with expert knowledge in the bidding service, auction design and mechanics. At a minimum, such support shall include:

Internal Bidding System Support

• Telephone and email service support from Monday to Friday 8:00 a.m. to 5:30 p.m. (ET) on all business days that are non-Federal holidays. Support shall be available and staffed to handle call volume in accordance with proposed performance metrics and as agreed upon between the FCC and the Contractor.

• The ability to support requests for additional support outside of normal hours with advance notice of five (5) business days from the FCC. After hours, weekend, and holiday support are planned in advance and mutually agreed upon, although emergencies may arise requiring immediate support.

Auction Support

• Telephone service support, at the Tier-3 level only, shall be provided for technical issues beginning 30 minutes before the start of the first bidding round of the day through 30 minutes after the last bidding round of the day during the course of (1) an external bidding system training session, (2) an external mock auction, and (3) a live auction, as requested by the FCC.

Support shall be available and staffed to handle call volume in accordance with mutually agreed upon performance metrics in advance of the auction or activity.

• Tier 3 support provided to external users during a live auction shall be coordinated in advance and mutually agreed upon. Any Tier 3 support provided to external users (non-FCC users) via phone shall use the FCC’s recorded auction phone line.

e. Operational Uptime

The hosting service shall be engineered to sustain a 99.999% uptime during auction operation. Outside of auction operation, the production environment shall be continuously available 24 x 7, except that the Contractor is permitted not more than two (2) short-term (less than two hours) planned or unplanned outages in any given performance quarter, and not more than one (1) single major planned or…