DRAFT SAM 2023 12 Ascend BPA Attachment XX Service Catalog Formats.pdf

Attachment <<XX>>: Service Catalog Formats

1. Service Catalog Cloud Services

1.1. Required Data Elements

Authorized vendors' cloud services catalogs shall include the following required data elements as follows:

Data elements that have no value or are NA shall have a value of "NULL".

Table XX: Service Catalog Required Data Elements

Data Element Format Examples / [Valid Values]

Notes

GSA UEI Alphanumeric (12 Characters)

A1B2C3D4E5F6 1. The authoritative identifier for entities doing business with the federal government.

GSA MAS Contract Number

Alphanumeric (10 or 13 Characters)

GS-35F-XXXXX,

47QTCAXXXXXXX

Ascend BPA Award Number

Alphanumeric (13 Characters)

47QTCAXXXXXXX 1. The administrative agency will provide the "Ascend BPA Award Number" to the authorized vendor.

Ascend BPA Pool and Sub-Pool Number

Text 1-1, 2-1 1. The first character identifies the "Pool" number.

2. The second character identifies the "Sub-Pool" number.

Ascend BPA PoP Numerical 00, 01, 02, 03, NULL

1. Identifies the "Ascend BPA PoP" that the "Cloud Service Price" applies to.

2. "Ascend BPA PoP" is entered when establishing or updating Ascend BPA awarded "Cloud Service Prices"

3. "00" represents the base period.

4. "XX" represents an option period (e.g., 01, 99).

Ascend BPA PoP Start Date

YYYY MM DD 2022 01 01, NULL 1. "Ascend BPA PoP Start Date" is entered when establishing or updating Ascend BPA award "Cloud Service Prices" otherwise a value of "NULL" is entered.

Ascend BPA PoP End Date

YYYY MM DD 2022 12 31, NULL 1. "Ascend BPA PoP End Date" is entered when establishing or updating Ascend BPA award "Cloud Service Prices" otherwise a value of "NULL" is entered.

Ascend TO Number Alphanumeric (13 Characters)

A1B2C3D4E5F6G 1. The Eligible User will provide the "Ascend TO Number" to the authorized vendor.

2. "Ascend TO Number" is entered when establishing or updating Ascend TO prices.

Ascend TO PoP Numerical 00, 01, 02, 03, NULL

1. Identifies the "Ascend TO PoP" that the "Cloud Service Price" applies to.

2. "Ascend TO PoP" is entered when establishing or updating Ascend TO awarded "Cloud Service Prices"

3. "00" represents the base period.

4. "XX" represents an option period (e.g., 01, 99).

Ascend TO PoP Start Date

YYYY MM DD 2022 01 01, NULL 1. "Ascend TO PoP Start Date" is entered when establishing or updating Ascend TO award "Cloud Service Prices" otherwise a value of "NULL" is entered.

Ascend TO PoP End Date

YYYY MM DD 2022 12 31, NULL 1. "Ascend TO PoP End Date" is entered when establishing or updating Ascend TO award "Cloud Service Prices" otherwise a value of "NULL" is entered.

CSP Name Text Cloud Inc. 1. Identifies the full legal business name (e.g., no abbreviations, no marketing names).

Or

Application Marketplace Vendor Name

2. The "CSP Name" or "Application Marketplace Vendor Name" shall match with information in SAM.gov (i.e., entity information).

Or

3. The "CSP Name" or "Application Marketplace Vendor Name" shall match the registration information (i.e., business license) on file with a government (e.g., country, state).

Cloud Service Name

Or

Application Marketplace Service Name

Text General Compute, Large Server

1. Identifies the name of the "Cloud Service" or "Application Marketplace Service"

CSP Universal Identifier

Or

Application Marketplace Vendor Universal Identifier

Text, Numerical, Alphanumeric

ABCDEFGHI,

1234567890, A1B2C3D4E5F6

1. Identifies the CSPs' or Marketplace vendors' unique code (e.g., UPC) for each "Cloud Service".

2. The "Universal Identifier" shall be the CSPs' or Marketplace vendors' identifier without alteration (e.g., modification).

3. The "Universal Identifier" shall be universal across the CSPs' or Marketplace vendors' commercial and public (e.g., government) customers.

4. The "Universal Identifier" for each "Service" shall match the authorized vendors GSA MAS catalog, Ascend BPA service catalog, and Ascend TO service catalogs.

Cloud Service Description

Text Server, 4 vCPU, 64 GB RAM, 25 Gbps

Cloud Service Model

Text [IaaS, PaaS, SaaS] 1. The "Cloud Service Model" shall match the "Cloud Service Model" listed in the authorization issued by the "Authorizing Entity" for the "Cloud Service".

Metropolitan Statistical Area

(MSA)1

Text Montgomery, AL;

Southeast Alabama nonmetropolitan area;

Washington-Arlingto n-Alexandria, DC-VA-MD-WV;

Richmond, VA;

1. Identifies the geographical location of the CSPs' physical computing equipment (e.g., data center, servers).

2. If a "Cloud Service" or "Application Marketplace Service" is offered from more than one "Metropolitan Statistical Area (MSA)" there shall be a separate entry with a unique "CSP Universal Identifier" or "Application Marketplace Vendor Universal Identifier" in the service catalog for each "Metropolitan Statistical Area (MSA)".

Authorizing Entity Text [DCAS, FedRAMP] 1. If a "Cloud Service" is authorized by more than one "Authorizing Entity" the "Cloud Service" shall have a separate entry with a unique "CSP Universal Identifier" in the catalog for each applicable "Authorizing Entity".

Cloud Service Offering

Text Cloud.gov, USDA Digital Infrastructure Service Center, Workplace.gov Community (WC2)

1. Identifies the "Cloud Service Offering" authorized by the "Authorizing Entity".

2. Associates the "Cloud Service" with the "Cloud Service Offering" authorized by the "Authorizing Entity".

Impact Level Text [LI-SaaS, Low, Moderate, High, 2, 4, 5, 6]

1. If a "Cloud Service" is authorized at more than one "Impact Level" the "Cloud Service" shall have a separate entry with a unique "CSP Universal Identifier" in the catalog for each applicable "Impact Level".

Authorizing Entity Marketplace URL

URL [https://marketplac e.fedramp.gov/pro

1. Identifies the URL for the authorizing entities marketplace (i.e., DISA Storefront, FedRAMP Marketplace) that provides

1 BLS Occupational Employment and Wage Statistics, May 2022 Metropolitan and Nonmetropolitan Area Definitions ducts https://storefront.d isa.mil/kinetic/disa/ service-catalog#/fo rms/cloud-service-support] additional authorization information (e.g., authorization date).

Cloud Service Price

Or

Application Marketplace Service Price

Currency $5.4321 1. All currency values are to be denominated in US currency (i.e., US dollars).

2. Identifies the price for the "Service" out to four (4) decimal places (i.e., ten-thousandths).

3. No Cost "Service" shall have a "Service Price" of $0.0000.

Effective Price Date YYYY MM DD 2022 02 15

Unit of Measure Text Compute per Hour, GB, Subscription, Transaction

Software Bill of Materials (SBOM)2

URL URL 1. Identifies the URL for where the "Cloud Service" or "Application Marketplace Service" SBOM can be accessed and retrieved.

2. The "Software Bill of Materials (SBOM)" shall be associated with the "CSP Universal Identifier" or the "Application Marketplace Vendor Universal Identifier".

3. The SBOMs shall be in one of the following formats:

CycloneDX, SPDX®, or SWID.3

3 The Minimum Elements For a Software Bill of Materials (SBOM) Pursuant to Executive Order 14028 on Improving the Nation’s Cybersecurity

2 OMB M-22-18: Enhancing the Security of the Software Supply Chain through Secure Software Development Practices

EPEAT(™)

Registered4, 5

Text [Yes, No] 1. Identifies if the "Cloud Service" operates on EPEAT(™) Registered equipment (e.g., computers, networking, servers).

ENERGY STARⓇ

Certified6, 7

Text [Yes, No] 1. Identifies if the "Cloud Service" operates on ENERGY STARⓇ Certified equipment (e.g., servers, storage, networking equipment).

Electrical Energy Source8, 9

Text [CFE, Non-CFE] 1. Identifies if the "Cloud Service" is powered from electrical energy generated from CFE (e.g.,geothermal, hydroelectric, hydrokinetic, nuclear, solar, wind) or non-CFE (e.g., coil, oil, natural gas) sources.

2. If a "Cloud Service" has multiple "Electrical Energy Sources" available the "Cloud Service" shall have a separate entry with a unique "CSP Universal Identifier" in the service catalog for each applicable "Electrical Energy Sources" (i.e., CFE, non-CFE).

9 Executive Order 14057: Clean Energy Industries and Jobs; Efforts To Catalyze Through Federal Sustainability 8 Executive Order 14008: Tackling the Climate Crisis at Home and Abroad 7 Executive Order 14008: Tackling the Climate Crisis at Home and Abroad 6 GSAM 552.238-78 Identification of Products that Have Environmental Attributes 5 Executive Order 14008: Tackling the Climate Crisis at Home and Abroad 4 GSAM 552.238-78 Identification of Products that Have Environmental Attributes

1.2. Optional Data Elements

Authorized vendors' cloud services catalogs may include the following optional data elements as follows:

Data elements that have no value or are NA shall have a value of "NULL".

Table XX: Service Catalog Optional Data Elements

Data Element Format Examples / [Valid Values]

Notes

SKU Text, Numerical, Alphanumeric

ABCDEFGHI,

1234567890, A1B2C3D4E5F6

1. Is any text, numerical, or alphanumeric indicator that an authorized vendor uses to identify, track, and manage their "Cloud Service" internally.

ZTA Pillar Text [Application, Data, Device, Infrastructure, Orchestration and Automation, Network, User, Visibility and Analytics]

1. The "GSA Zero Trust Architecture (ZTA) Buyer's Guide" defines eight (8) foundational pillars of ZTA and the core components of each pillar.

2. The completion of the ZTA Pillar and ZTA Component data elements will assist eligible users in identifying "Cloud Service" that provide specific capabilities and functions

ZTA Component Text Application [Application Security, Any Device Access, Container Security, Isolation, Secure Access Cloud, Web Application Firewall]

Data [Classification, Data Loss

1. The "GSA Zero Trust Architecture (ZTA) Buyer's Guide" defines eight (8) foundational pillars of ZTA and the core components of each pillar.

2. The completion of the ZTA Pillar and ZTA Component data elements will assist eligible users in identifying "Cloud Service" that provide specific capabilities and functions.

3. The valid values for the ZTA Component are determined by the selected ZTA Pillar.

Prevention, Data Security, Encryption, Industry Compliance, Integrity]

Device [Device Authentication, Device Compliance, Device Identity, Device Inventory, Device Management, Device Security, Enterprise Mobility Management, Vulnerability Management]

Infrastructure [Cloud Access Security Broker, Cloud Workload Protection, SaaS Management Platform, Secure Access Service Edge]

Orchestration and Automation [Policy Administrator (PA), Policy Enforcement Point

(PEP), Policy Engine (PE), Security Policy Management]

Network [Network Access Control, Network Security, Segmentation, Session Protection, Software-Defined Networking, Transport Encryption, Zero Trust Architecture, Zero Trust Network Access]

User [Access Management, Authentication, Dynamic Risk Scoring, Conditional Access, Identity Management, User and Event Behavior Analytics]

Visibility and Analytics [Continuous Diagnostics and Mitigation (CDM)

System, Device Visibility, Threat Intelligence, Security Information and Event Management

(SIEM)]

AI Branch Text [Computer Vision, Fuzzy Logic, Expert Systems, Robotics, Machine Learning / Deep Learning, Neural Networks, Natural Language Processing (NLP)]

1.3. Example - BPA Service Catalog - Cloud Services

Data elements that have no value or are NA shall have a value of "NULL".

Cloud Services Catalog: ABC Worldwide

GSA UEI GSA MAS

Contract Num.

BPA Award Num.

BPA Pool and Sub-Pool Num.

BPA

PoP

BPA PoP Start Date

BPA Pop End Date

TO Award Num.

TO

PoP

TO PoP Start Date

TO PoP End Date

ABCDEF123456 47QTC123456789 01ABC123 1-2 0 2023 06 01 2026 05 31 NULL NULL NULL NULL …

ABCDEF123456 47QTC123456789 01ABC123 1-1 0 2023 06 01 2026 05 31 NULL NULL NULL NULL …

ABCDEF123456 47QTC123456789 01ABC123 1-1 0 2023 06 01 2026 05 31 NULL NULL NULL NULL …

ABCDEF123456 47QTC123456789 01ABC123 1-3 0 2023 06 01 2026 05 31 NULL NULL NULL NULL …

Cloud Services Catalog: ABC Worldwide - Continued

CSP Name App. Marketpl. Vendor Name

Cloud Serv. Name App. Marketpl. Serv. Name

CSP Univ. Id.

App. Marketpl. Vendor Univ. Id.

Cloud Serv. Description Cloud Serv.

Model

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Services Catalog: ABC Worldwide - Continued

Metropolitan Statistical Area

Auth.

Entity

Cloud Serv.

Offering

Impact Level

Auth. Entity Marketpl. URL Cloud Serv. Price App. Marketpl. Price

Effective Price Date

Unit of Meas. …

Fort Collins, CO FedRAMP Cloud Inc.

Environment

High https://marketplace.fedramp.gov/pro ducts

$2.0769 2023 06 01 Comp / per Hour …

Fort Collins, CO FedRAMP Cloud Inc.

Environment

Moderate https://marketplace.fedramp.gov/pro ducts

$1.2345 2023 06 01 Comp / per Hour …

Fort Collins, CO FedRAMP Cloud Inc.

Environment

Moderate https://marketplace.fedramp.gov/pro ducts

$1.4545 2023 06 01 Comp / per Hour …

Champaign-Urbana, IL DCAS Cloud Inc.

Environment

6 https://storefront.disa.mil/kinetic/disa/ service-catalog#/forms/cloud-service -support

$1.8999 2023 06 01 Comp / per Hour …

Cloud Services Catalog: ABC Worldwide - Continued

Software Bill of Materials

EPEAT(™)

Registered

ENERGY

STARⓇ Cert.

Electrical Energy Source

SKU ZTA

Pillar

ZTA

Component

AI Branch Optional Data Element X www.cloudInc.com/ SBOMs

Yes Yes CFE SKU-L-Sev Infrastructure NULL NULL NULL www.cloudInc.com/ SBOMs

Yes Yes CFE SKU-L-Sev Infrastructure NULL NULL NULL … www.cloudInc.com/ SBOMs

No No non-CFE SKU-L-Sev Infrastructure NULL NULL NULL www.cloudInc.com/ SBOMs

No Yes non-CFE SKU-L-Sev Infrastructure NULL NULL NULL

1.4. Example - TO Service Catalog - Cloud Services

Data elements that have no value or are NA shall have a value of "NULL".

Cloud Services Catalog: ABC Worldwide

GSA UEI GSA MAS

Contract Num.

BPA Award Num.

BPA Pool and Sub-Pool Num.

BPA

PoP

BPA PoP Start Date

BPA Pop End Date

TO Award Num.

TO

PoP

TO PoP Start Date

TO PoP End Date

ABCDEF123456 47QTC123456789 01ABC123 1-2 NULL NULL NULL 02DEF456 00 2024 01 01 2024 12 31 …

ABCDEF123456 47QTC123456789 01ABC123 1-2 NULL NULL NULL 02DEF456 01 2025 01 01 2025 12 31 …

ABCDEF123456 47QTC123456789 01ABC123 1-2 NULL NULL NULL 02DEF456 02 2026 01 01 2026 12 31 …

ABCDEF123456 47QTC123456789 01ABC123 1-2 NULL NULL NULL 02DEF456 00 2024 01 01 2024 12 31 …

ABCDEF123456 47QTC123456789 01ABC123 1-2 NULL NULL NULL 02DEF456 01 2025 01 01 2025 12 31 …

ABCDEF123456 47QTC123456789 01ABC123 1-2 NULL NULL NULL 02DEF456 02 2026 01 01 2026 12 31 …

Cloud Services Catalog: ABC Worldwide - Continued 1

CSP Name App. Marketpl. Vendor Name

Cloud Serv. Name App. Marketpl. Serv. Name

CSP Univ. Id.

App. Marketpl. Vendor Univ. Id.

Cloud Serv. Description Cloud Serv.

Model

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Inc. Large Server UPC-L-Ser Server, 16 vCPU, 128 GB RAM, 100 Gbps IaaS …

Cloud Services Catalog: ABC Worldwide - Continued 2

Metropolitan Statistical Area

Auth.

Entity

Cloud Serv.

Offering

Impact Level

Auth. Entity Marketpl. URL Cloud Serv. Price App. Marketpl.

Price

Effective Price Date

Unit of Meas. …

Fort Collins, CO FedRAMP Cloud Inc.

Environment

High https://marketplace.fedramp.gov/product s

$2.0099 2024 01 01 Comp / per Hour

Fort Collins, CO FedRAMP Cloud Inc.

Environment

High https://marketplace.fedramp.gov/product s

$2.0199 2025 01 01 Comp / per Hour

Fort Collins, CO FedRAMP Cloud Inc.

Environment

High https://marketplace.fedramp.gov/product s

$2.0299 2026 01 01 Comp / per Hour

Champaign-Urbana, IL DCAS Cloud Inc.

Environment

6 https://storefront.disa.mil/kinetic/disa/serv ice-catalog#/forms/cloud-service-support

$1.8999 2024 01 01 Comp / per Hour

Champaign-Urbana, IL DCAS Cloud Inc.

Environment

6 https://storefront.disa.mil/kinetic/disa/serv ice-catalog#/forms/cloud-service-support

$1.8999 2025 01 01 Comp / per Hour

Champaign-Urbana, IL DCAS Cloud Inc.

Environment

6 https://storefront.disa.mil/kinetic/disa/serv ice-catalog#/forms/cloud-service-support

$1.8999 2026 01 01 Comp / per Hour

Cloud Services Catalog: ABC Worldwide - Continued 3

Software Bill of Materials

EPEAT(™)

Registered

ENERGY

STARⓇ Cert.

Electrical Energy Source

SKU ZTA

Pillar

ZTA

Component

AI Branch Optional Data Element X www.cloudInc.com/ SBOMs

Yes Yes CFE SKU-L-Sev Infrastructure NULL NULL NULL … www.cloudInc.com/ SBOMs

Yes Yes CFE SKU-L-Sev Infrastructure NULL NULL NULL … www.cloudInc.com/ SBOMs

Yes Yes CFE SKU-L-Sev Infrastructure NULL NULL NULL … www.cloudInc.com/ SBOMs

No Yes non-CFE SKU-L-Sev Infrastructure NULL NULL NULL … www.cloudInc.com/ SBOMs

No Yes non-CFE SKU-L-Sev Infrastructure NULL NULL NULL … www.cloudInc.com/ No Yes non-CFE SKU-L-Sev Infrastructure NULL NULL NULL …

SBOMs