AWS-CSP IL2 DEV PWS final 3Jun21.pdf

PERFORMANCE WORK STATEMENT (PWS)

AMAZON WEB COMMERCIAL SERVICES (AWS)

FOR

DTIC HYBRID CLOUD (DHC) ‐ DEVELOPMENT ENVIRONMENT

1.0 PURPOSE

1.1 BACKGROUND

The Defense Technical Information Center (DTIC) serves the informational needs of the Defense community with Scientific and Technical Information (STI) that is easily discoverable, meaningful, and available to authorized users. DTIC’s core mission is to provide vital technical Research, Development, Testing, and Evaluation (RDT&E) information quickly, accurately, and continuously to support Department of Defense (DoD) customers’ needs. As such, DTIC’s responsibilities include:

• Preservation and dissemination of research that led to technologies our warfighters use today

• Deliver tools and collections which empower the research and engineering enterprise to accelerate the development of technologies that will help maintain U.S. technical superiority

• Stimulate innovation with public and industry access to DoD funded research and digital data

• Maximize the value of each dollar the DoD spends through the analysis of funding data, work in progress, and Internal Research and Development (IR&D) to identify gaps, challenges, and the way forward.

AWS GovCloud (US) is an isolated region designed to host sensitive workloads in the cloud. The DHC environment is currently operational in AWS GovCloud at Impact level 2 (IL2) under an Infrastructure as a Service (IaaS) model. DTIC has been utilizing the AWS Government Cloud as the cloud service provider for the unclassified (public), controlled unclassified Non‐Classified Internet Protocol Router Network (NIPR), knowledge management resources and grants access to authorized DoD employees, Federal Government employees, and industry contractors to search DoD funded scientific and technical information (STI) based on distribution statements.

DTIC continues to expand and standardize the tools and information on each platform for customers’ use to ensure the tools and information are available when and where needed. DTIC has migrated to the AWS Government Cloud infrastructure to better support the Warfighter, meet U.S. Government standards, reduce costs, and gain efficiencies. DTIC’s AWS GovCloud, also, known as the DTIC AWS Dev Cloud, environment is fully operational in AWS and accredited at Impact Level (IL) 2, with the ability to support IL4 (NIPR environment) under an Infrastructure as a Service (IaaS) cloud service model. AWS is the current Cloud Service Provider (CSP) for the DHC environment. The DHC environment has an approved Authority to Operate (ATO) IAW FedRAMP, the Defense Cloud Computing Security Requirements Guide (SRG), and Security Technical Implementation Guides (STIG) requirements.

1.2 SCOPE

DTIC has a requirement to continue usage of AWS cloud services and maintain ownership of the agency’s AWS Master Account for Commercial GovCloud services to support the DTIC AWS Dev Cloud. The AWS Reseller Services will:

• Provide continuity of operations for DTIC staff currently operating in AWS;

• Reduce training requirements;

and

• Enhance productivity by incorporating DHC’s virtual tools (DevOps) to automate cloud resources;

• Offer flexibility within environments for approximately 150 users, content managers and developers to create improved functional applications.

The AWS services shall align with the AWS Business Support Plan. The AWS Business Support Plan includes the following:

a. Technical Support: 24x7 access to AWS badged Cloud Support Engineers via email, chat, and phone

(plus AWS Documentation, whitepapers, and support forums)

b. Customer Contacts: An unlimited number of contacts may open an unlimited number of cases (IAM supported)

c. Case Severity & Response Times: General guidance: <24 hours; System impaired: <12 hours;

Production system impaired: < 4 hours, Production system down: < 1 hour

d. AWS Trusted Advisor ‐ Full Access to the full set of Trusted Advisor checks and guidance to provision your resources following best practices to help reduce cost, increase performance and fault tolerance, and improve security.

e. AWS Personal Health Dashboard: Access to the full set of Trusted Advisor checks and guidance to provision your resources following best practices to help reduce cost, increase performance and fault tolerance, and improve security.

f. Infrastructure Event Management: Architecture and scaling guidance, and real‐time operational support during the preparation and execution of planned events, product launches, and migrations.

g. Architecture Business: Contextual guidance on how services fit together to meet your specific use‐ case, workload, or application.

h. AWS Support API: Programmatic access to AWS Support Center features to create, manage, and close your support cases, and operationally manage your Trusted Advisor check requests and status.

i. AWS Support Plan: The Government requires Business Support Plan with the option to move to the Enterprise Support Plan, when required.

1.3 OBJECTIVES

To provide a set of services via a CSP that provides DTIC and its developers a mechanism to conduct distributed development, test, and production at the IL 2‐6 level via a commercial cloud.

2.0 APPLICABLE STANDARDS

All work will be accomplished using commercial practices and industry standards. DTIC will make maximum utilization of non‐government standards wherever practical. The cloud services themselves are identical to the same cloud services available in the CSP’s commercial cloud regions; the cloud services are, therefore, commercial items or COTS.

Cloud services utilized under this acquisition will be authorized by FedRAMP and DoD SRG and assessed as well as accredited under the Director of National Intelligence (DNI) Intelligence Community

Directive (ICD 503) and National Institute of Standards and Technology (NIST) Special Publication (SP) 800‐ 53 Revision 4.

3.0 PERFORMANCE REQUIREMENTS

To support DTIC’s mission, projects, and system requirements, the Government requires an IaaS commercial community cloud offering with various service level agreements as indicated herein and maintained with appropriate authorization‐to‐operate. The following section of the PWS describes the requirements and tasks that will be accomplished to meet these requirements.

3.1. The contractor shall provide services for DTIC’s AWS Hybrid Cloud in the Development environment. The

AWS Cloud Service shall include the following:

a. AWS Web Services Commercial Master account. The master account shall be commercial;

dedicated solely to DTIC; retain all current tagging and access permissions tied to the sub‐ accounts; and consolidate the billing and support tickets.

b. AWS Web Services Commercial Sub‐accounts. The sub‐accounts shall be commercial and for the GovCloud; shall be used to isolate services; contains compute; and may trust accounts from the master account.

c. AWS Web Services Post‐pay monthly billing model. The AWS Web Services monthly billing model provides monthly support and is billed on a monthly basis.

d. AWS Support Plan. The AWS Support Plan includes the Business Support Plan with the option to move to the Enterprise Support Plan, when required.

3.1.1. The contractor shall have the capability to transition DTIC’s AWS account from the incumbent without any interruption in service, logging, and tracking of usage and spend that is tied to the existing investment in tagging and tracking.

3.1.2. The contractor shall provide availability to all AWS services and purchasing options including reserved instances and savings plans directly to DTIC without restriction.

3.1.3. The contractor shall provide an IaaS that supports auto‐scaling, automation, elasticity, and high availability to the DTIC for provisioning, processing, storage, networks, databases, and other fundamental computing resources, as defined in NIST SP 800‐145, where the DTIC is able to deploy and run arbitrary software, which could include operating systems and applications. It is not expected that:

• DTIC will manage, control, or access any of the underlying cloud infrastructure, but the DTIC will have some control over operating systems, storage, and provisioning applications.

• DTIC must be able to unilaterally provision computing capabilities, such as server time and network storage, as needed and automatically without requiring human interaction with the CSP.

• DTIC must be able to elastically provision and release capabilities, in some cases automatically, to scale rapidly outward and inward commensurate with demand.

• The IaaS should automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts).

3.1.4. The contractor shall provide an IaaS that maintains Government Data within the United States or outlying areas, unless: (i) the Contractor receives written notification from the Contracting Officer to use another location, in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 239.7602‐2(a), or (ii) the DTIC provisions data egress to SIPRNET and directs data transfers outside of the United States or outlying areas.

3.1.5. The contractor shall provide self‐provisioning of cloud services, using a Web‐based graphical user interface (GUI) that serves as an Information Technology (IT) operations management console for the overall environment. DTIC (or its designated representative) is responsible for establishing and managing accounts and will retain ownership of each account and any data stored or processed in each account.

3.1.6. The contractor shall provide Application Programming Interface (API) access.

3.1.7. The contractor shall provide a logical extension of IPv4 addresses into the IaaS (i.e. storage and compute) virtual resources.

3.1.8. The contractor shall provide change and audit management tools for configuration management that provides a change control process to secure the functionality of the environment without hindering the ability of mission owners to efficiently add new functionality, integration, and content delivery mechanisms.

3.1.9. DTIC must retain the ability to allow and deny internal or external network traffic based on source and destination address and port. DTIC must also be able to group infrastructure elements and assign a set of ACLs/firewall to the group rather than to individual instances one at a time.

3.1.10. DTIC must retain the flexibility to immediately leverage new services and functionalities as they become authorized and available in the region.

3.1.11. The contractor shall provide a self‐service incident logging system for identifying, submitting, and tracking cloud service incidents.

3.1.12. The contractor shall provide services and capabilities that can be used by the Government to monitor, manage, and protect workloads in the cloud.

3.1.13. The contractor shall be an AWS Advanced Partner or higher with Government competency.

3.1.14. To reduce supply chain risk, the contractor shall purchase AWS Cloud capacity directly from AWS.

3.2. The following virtual services are required for continued usage in the AWS DHC:

Type Option

Elastic Compute Cloud (EC2) On‐ Demand//hour

Elastic Compute Cloud (EC2) Reserved Instance Billed monthly

Elastic Load Balancer (ELB) On‐ Demand/hour

Virtual Private Cloud (VPC) Endpoint On‐ Demand/hour

Virtual Private Network (VPN) Connection‐ hour

Simple Storage Service (S3) On‐ Demand/GB

Elastic Block Storage (EBS) On‐ Demand/GB

Relational Database Service (RDS) – MySQL/Oracle

On‐ Demand/hour

Other Resources shall be added based on future growth and enhancements

3.2.1. The required resources listed above will change with future growth and enhancements to the environment. The cloud service provider (CSP) must provide support for all DTIC software requirements and allow flexibility for future technology stacks. Data management capability must be able to provide encryption at rest capabilities.

3.3. The table below includes DTIC’s current environment that is already operational in the AWS DHC:

Service Description Quantity

Applications provisioned 32

EC2 Instances 206

Load Balancers 111

Auto scaling groups 142

Cloud Formation Templates (CFT) 52

Logging servers 2

Virtual Private Cloud (VPC) 12

Virtual Private Network (VPN) 1

Versions of Elasticsearch 1

3.4. Quantities and Description.

Item Quantity AWS Web Services Bundle – Base Year 415,000 units

AWS Web Services Bundle – Option Year 1 415,000 units

AWS Web Services Bundle – Option Year 2 415,000 units

AWS Web Services Bundle – 6 month extension IAW 52.217‐8 207,500 units

4.0 CONTRACT ADMINISTRATION

4.1 CONTRACT ADMINISTRATION DOCUMENTATION

Reports detailing monthly (and more frequent) and end‐of‐contract cloud usage will be available to the DTIC via a billing console. The Government will monitor its utilization of the cloud services (current spend and billing information) through the billing console. As Government spend approaches the total amount allotted to the order, the Government will ensure that either it allots additional funds, or the Contracting Officer will terminate any items for which additional funds will not be allotted pursuant to the clause of this order entitled “Termination for Convenience of the Government.” The Government may create billing alarm thresholds at such levels as it deems necessary (but no higher than 85 percent) to ensure the Government does not exceed the total amount then allotted to the order, and the Government will receive billing alerts that will notify the Government when its utilization of the cloud services reaches the thresholds.

4.2 QUALITY, INSPECTION AND ACCEPTANCE

4.2.1. Key performance measures will be described in the contractor’s existing Service Level

Agreements (SLAs) for the services available in the IL 2‐6 region. Inspection and acceptance will occur upon utilization of the cloud services, subject to the SLAs and excluding scheduled Government outages and outages resulting from any Government technology issues or incorrect application configurations.

Failure to maintain uptime percentages as stated in the respective SLA will result in the application of service credits in accordance with the SLA.

4.2.2. Quality Assurance: The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

5.0 PERIOD OF PERFORMANCE

The base period of performance will be 12 months from date of award with two one‐year options, and 6‐month extension IAW 52.217‐8 for a total of 42 months.

Base Year: 23 July 2021 – 22 July 2022 Option Period I: 23 July 2022 – 22 July 2023 Option Period II: 23 July 2023 – 22 July 2024 6‐Month Extension IAW 52.217‐8: 23 July 2024 – 22 Jan 2025

6.0 PLACE OF PERFORMANCE

All work will be accomplished at the contractor’s place of business. No Government facilities or equipment will be provided.

7.0 FACILITIES CLEARANCE (FCL)

The Contractor is required to have availability to the Non‐classified Internet Protocol Router

Network (NIPRNet) for Impact Levels 2‐4 data. The contractor must have a valid FCL at the SECRET level before accessing classified information; an FCL is not required for establishment of the cloud environment.

Interim FCLs are acceptable provided they are not expired. The DD254 is provided as an attachment. The final DD254 will be provided after contract award.

8.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

Performance Objective Reference Paragraph

Performance Threshold Method of Surveillance

PRS # 1.

The contractor shall provide services for DTIC’s AWS Hybrid Cloud in the Development environment.

3.1 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the COR

PRS # 2

The contractor shall have the capability to transition DTIC’s AWS account from the incumbent without any interruption in service, logging, and tracking of usage and spend that is tied to the existing investment in tagging and tracking.

3.1.1 Contractor is required to

transition the AWS account from incumbent contractor within 99% accuracy

Validated Customer Input and Feedback Received by the

COR

PRS # 3

The contractor shall provide an IaaS that supports auto-scaling, automation, elasticity, and high availability to the DTIC for provisioning, processing, storage, networks, databases, and other fundamental computing resources, as defined in

NIST SP 800-145

3.1.3 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the

COR

PRS # 4

The contractor shall provide an IaaS that maintains Government Data within the United States or outlying areas

3.1.4 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the COR

PRS # 5

The contractor shall provide self- provisioning of cloud services, using a Web-based graphical user interface (GUI) that serves as an Information Technology (IT) operations management console for the overall environment

3.1.5 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the

COR

PRS # 6

The contractor shall provide Application Programming Interface (API) access.

3.1.6 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the COR

PRS # 7

The contractor shall provide a logical extension of IPv4 addresses into the IaaS (i.e.

storage and compute) virtual resources.

3.1.7 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the COR

PRS # 8

The contractor shall provide change and audit management tools for configuration management that provides a change control process to secure the functionality of the environment

3.1.8 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the COR

PRS # 9

The contractor shall provide a self- service incident logging system for identifying, submitting, and tracking cloud service incidents.

3.1.11 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the COR

PRS # 10

The contractor shall provide services and capabilities that can be used by the Government to monitor, manage, and protect workloads in the cloud.

3.1.12 Contractor is required to

provide recommended cloud service within 98% accuracy

Validated Customer Input and Feedback Received by the COR