FA3300-17-R-0011-0002.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to incorporate Appendix 2a, Cloud Managment Support Requirements and Appendix 2b, Hosting Requirements, into the SOW.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 8

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 21-Mar-2017

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X FA330017R0011

X 9B. DATED (SEE ITEM 11)

10-Mar-2017

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

20-Mar-2017

CODE

42 CONS SQD

ATTN: LGCB-1

50 LEMAY PLAZA SOUTH

BLDG 804

MAXWELL AFB AL 36112-5948

FA3300 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

FA330017R0011

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

STATEMENT OF WORK

STATEMENT OF WORK (SOW)

COMMERCIAL CLOUD SERVICES

STUDENT INFORMATION SYSTEM (SIS) AND LEARNING MANAGEMENT SYSTEM (LMS)

HOSTING

10 March 2017

1.0. DESCRIPTION OF SERVICES

Commercial Government Cloud services are required to support the operational deployment of Air University’s Student Information System (SIS) and Learning Management System (LMS). The Commercial Government Cloud is required for enabling the cloud-based SIS/LMS while supporting Federal Risk and Authorization Management Program (FedRAMP) Level 4 and DoD Authority to Operate (ATO) security control requirements.

This contracting effort is required to support and execute Air University’s educational mission. This is for non-personal services.

2.0. PERIOD AND PLACE OF PERFORMANCE

The base Period of Performance will be twelve (12) months from date of award with three (3), one (1) year options.

Services will be provided at the vendor location.

2.1. BACKGROUND

Air University (AU) is implementing a new, integrated Student Information System (SIS) and Learning Management System (LMS) solution to support over 220,000 users worldwide. The purpose of the integrated SIS/LMS is to increase the capability and capacity of the AU learning environment. Commercially hosting the integrated solution will improve security, integrity and reliability of active and archival records.

The proposed hosting environment will consist of integrated environments designated as Development, Testing and Production that support development, integration, acceptance testing, training, staging, troubleshooting and all pre-production, as well as production, activities. The Commercial Government Cloud environment will contain all required security, service delivery and hosting capabilities necessary to support the development, testing, quality assurance, and production needs. All services delivered will be effectively required to meet vendor-offered Service Level Agreement (SLA) as well as the performance criteria described later in the SOW.

3.0. Objectives

The Contractor shall provide access to a turn-key cloud-based platform with various service level guaranties as indicated herein and maintain appropriate certification as indicated herein:

3.1.1. Generic Objectives

In accordance with DoD CIO Memorandum, Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services, release on 15 December 2014, Appendix 1, the Contractor shall provide direct access to a FedRAMP Impact Level 4 Compliant Cloud Service Provider (CSP), with the ability to support Level 5, offering customers the means to leverage cloud computing Infrastructure as a Service (IaaS). The IaaS must have a documented FedRAMP Level 4 and DoD ATO commercial government cloud environment that covers the entire base period of performance which is 12 months from contract award. Additionally, the contractor must provide a documented FedRAMP Level 4 and DoD ATO covering the entire option year period at least 120 days before the option year is to be exercised. If sub-applications are required to be migrated to FedRAMP Level 5 due to sensitivity of data, contractor must provide proof the cloud environment is approved for FedRAMP Level 5 and has DoD ATO within 30 calendar days of notification from the Contracting Officer. The ATO must cover the remaining contract period of performance. The hosting environment to include Development, Testing and Production must be available within 14 calendar days of contract award. The hosting environment must be accessible to the diverse Air University student population which consists of military, non-military, and civilian personnel including some international students from both .com and .mil networks. The forms of authentication required to access the hosting environment will include both PKI and user name and password.

3.1.2. Management support

Contractor shall offer access to a FedRAMP Impact Level 4 Cloud Service Provider (CSP), with the ability to support Level 5, offering customers the means to leverage cloud computing Infrastructure as a Service (IaaS), run government workloads in the cloud, and monitor their cloud security controls and posture on a continuous basis. The contractor shall also offer program management support to government customers on the utilization of cloud-based resources and provision for programmatic overview of cloud service usage and related financial spending of CSP cloud services and will specifically describe the customer/provider responsibilities for maintenance.

3.1.3. Tasks

3.1.3.1. Provide access to cloud computing IaaS based on current and evolving industry standards and best practices over the course of the contract duration. The cloud computing IaaS will provide the best value to Government while at the same time allowing AU the flexibility to meet current and future requirements. The cloud computing IaaS shall meet all requirements set forth in this section and in the attached Appendix.

3.1.3.2. Access to cloud computing IT infrastructure supporting web applications shall enable the combination of reserved resources for predictable workloads with on-demand resources for unexpected spikes, ensuring low costs and great application performance even during intense demand peaks.

3.1.3.3. Contractor shall provide access to CSP business level support resources to include capability to add, delete, enable, and/or disable cloud services as desired.

3.1.3.4. On the basis of elasticity of selected cloud services the contractor shall provide the means to remove resources when demand subsides, ensuring high asset utilization and cost-efficient web applications.

3.1.3.5. Recovery Time Objective (RTO) and Recovery Point Object (RPO) in the event of loss of operation for the hardware.

3.1.3.6. Points and methods of contact for communicating service outages, technical issues, and security issues with tiered response times.

3.1.3.7. Methodology for ensuring that the SLA is met.

3.1.4. CSP technical cloud services. The Contractor shall provide access to:

a. Application Gateway: both external and internal load balancing of websites

b. Backup Services: backup of application data and databases

c. Data Transfers: bandwidth that will be utilized by the hosted application

d. IP Addresses: Public facing IP addresses

e. Site Recovery: recovering instances to another Commercial Government Cloud facility

f. Storage: multiple storage options from Page Blob and Disk to Premium SSD

g. Virtual Machines: Virtual Machines to support Windows, Ubuntu, Linux and SQL Server Enterprise Edition

h. Monitoring Services: Monitoring for Virtual Machines and website availability

3.1.5. Persistent Cloud Virtual Environment: High available and demand applications and services

a. Provide a virtual environment supporting SIS and LMS servers and services with high availability and demand

a. Environment will be comprised of virtual machines supporting Linux and Windows Servers with load balanced web applications and database servers

b. Provide cloud based storage solutions to support production, backup, and disaster recovery

c. Provide site recovery for virtual machines at alternate Commercial Government Cloud facilities

d. Provide bandwidth to support SIS and LMS

3.1.6. Pay as You Go Virtual Environment: Low demand and Testing/Development applications and services

a. Provide virtual machines and services to support low demand SIS and LMS servers and services

a. Environment will be comprised of virtual machines supporting Linux and Windows Servers with load balanced web applications and database servers

b. Environment will also support Testing/Staging and Development logically isolated enclaves

b. Provide cloud based storage solutions to support backup and recovery

3.1.7. Contracted Support to Manage Commercial instance: Contracted support personnel

a. Provide personnel to support implementation in the Commercial Government Cloud environment

a. Contractors will provide System Administration support for Virtual Machines (Windows, Ubuntu, and RHEL) and ensure they meet security requirements

b. Contractors will support implementation of commercial network related services, i.e. load balancing and IP address

c. Contractors will support Security Reviews (DoD STIG and SRG) related to Operating System, Web, and Databases

d. Contractors will provide support with installing and maintaining(Quarterly Patches and Remediation) Database servers

e. Commercial Government Cloud Expert/Integrator support also required for initial implementation and as needed when additional services are implemented

3.1.8. Generic tasks

3.1.8.1 Infrastructure scalability, capacity and evolution: The Contractor Shall:

a. Assist customer with solutions that meets or exceed the day-1 minimum capacity that serve the needs of the AU SIS and LMS Program as well as provide the ability to expand and reduce capacity based on need and demand of the AU supported community.

3.1.8.2 Customer support: The Contractor Shall:

a. Serve as liaison with the Commercial Government Cloud Professional Direct support

b. Provide Service and Support to the AU solution based on the projected Man Hours forecasted with the option of expanding based on demand and need.)

3.1.8.3 Availability and Usage monitoring: The Contractor Shall:

a. Make available usage and availability metrics

b. Notify the government when limits are approaching thresholds established in Service Level Agreements

3.1.8.4 Data Retention and Backup: The Contractor Shall:

a. Assist with developing Cloud based data retention strategies based on the commercial cloud backup and recovery services.

b. Cloud backup and retention solutions will be implemented meeting security and regulatory requirements.

3.1.8.5 Cyber Security compliance: The Contractor Shall:

a. Maintain compliance with Federal Information Security Management Act (FISMA)

b. Perform Security Reviews and provide reports on results of those review so findings can be remediated

c. Ensure patches and best security practices are maintained, followed and applied on a scheduled and coordinated basis

d. Provide migration planning and support, such as configuring external connections to the hosted infrastructure and the ability to upload database backups and virtual machine (VM) images to the hosting environment.

e. Coordinate all impacts to system availability impacts during the migration and subsequent cutover to the service provider infrastructure and secure approval from the Contracting Officer Technical Representative (COTR) before execution.

f. Comply with directed mandates to protect and defend information systems from recurring security threats or in response to real-time vulnerabilities

4.0. SECURITY REQUIREMENTS FOR UNCLASSIFIED SERVICES ONLY No CAC REQUIRED

4.1. Contractor Notification Responsibilities: The contractor shall notify the contracting office within 30 days before on-base performance of the service. The notification shall include:

a. Name, address, and telephone number of contractor representatives.

b. The contract number and contracting agency.

c. The location(s) of service performance and future performance, if known.

d. The service performance begins.

e. Any change to information previously provided under this paragraph.

4.2. Installation Access Requirements: As prescribed by the AFFAR 5352.242-9000, Contractor access to Air Force installations, AFI 31-218, Motor Vehicle Traffic Supervision, and AFMAN 31-113, Installation Perimeter Access Control.

The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

The contractor shall submit a written request on company letterhead to the contracting officer listing the following:

contract number, location of work site, start and stop dates, and names of employees and subcontractor employees needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The contracting officer will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver’s license, current vehicle registration, valid vehicle insurance certificate to obtain a vehicle pass. Government ID card holders may not use their credentials to sponsor an individual on to the base to perform work that’s been contracted to an official contractor.

During performance of the service, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials for any employee who no longer requires access to the work site.

All commercial vehicles will be directed to Gate 3 (Kelly St) or Gate 4 (Congressman Dickenson for Gunter) for processing through the Commercial Vehicle Inspection (CVI) Area, when operational. During non-duty hours and holidays, commercial vehicle inspections will be conducted at Gate 1 (Maxwell Blvd) or Gate 4 only. Inspection members will conduct thorough inspections of the interior and exterior of the vehicle for items prohibited from the installation such as explosive devices, weapons and ammunition, drugs, and open or closed alcohol containers.

Upon completion or termination of the contract or expiration of the identification passes, the prime contractor shall ensure that all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

Failure to comply with these requirements may result in withholding of final payment.

4.3. Reporting Requirements: The contractor shall comply with AFI 71-101, Volume-1, Criminal Investigations, and Volume-2, Protective Service Matters, requirements. Contractor personnel shall report to 42d Security Forces Information Protection Office, any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information.

Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

4.4. Traffic Laws: The contractor and their employees shall comply with base traffic regulations set forth in AFI 31-218, Motor Vehicle Traffic Supervision and AFMAN 31-113, Installation Perimeter Access Control. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket.

4.5. Random Installation Entry/Exit Checks: Entry/exit vehicle checks are conducted by order of the 42 ABW Commander. These checks are conducted for the purpose of safeguarding the base and protecting government property by discovering and seizing stolen property, classified information and contraband. Refusal to submit to an installation (entry/exit) vehicle check may result in the loss of base driving privileges, revocation of base registration, or debarment action.

4.6. Cellular Phone Operation Policy: The use of cellular phones while operating a motorized vehicle is prohibited on Maxwell-Gunter. Although discouraged, drivers are authorized to use devices, i.e. ear bud or ear boom, which allows their cellular phone to be operated hands-free. The device must not cover both ears. This policy applies to everyone driving on Maxwell AFB and Gunter Annex. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket.

4.7. Wireless Electronic Devices: The contractor will not establish their own Information Technology (IT) systems or networks (Local Area Networks [LAN], Wide Area Network [WAN], Cellular phone/USB Modem as WAN, Wi- Fi as WAN, etc.), or camera system without the direct permission of the Program Manager and governing communications and responsible information systems office (42 CS).

4.8. Firearms and Ammunition: Transporting weapons or ammunition, concealed or otherwise, IS NOT permitted by any non-law enforcement personnel on Maxwell AFB/Gunter Annex at any time regardless of state issued concealed weapons/LEOSA permits. Violations may result in criminal prosecution under the applicable federal laws.

4.9. Illegal Weapons. The below weapons are considered illegal, unless specifically authorized by competent authority, and are prohibited on Maxwell AFB/Gunter Annex. Violations may result in criminal prosecution under the applicable federal laws.

a. Switchblade knives or knives with any type of automatic blade release.

b. An incendiary/explosive weapon (e.g., grenades, flash bangs).

c. Fireworks

d. Homemade mortars, aka "tennis ball launchers" or similar devices.

APPENDIX I

PUBLICATIONS

Publications and forms applicable to the PWS are listed below. The Contractor is obligated to follow these publications. These publications are available at http://www.e-publishing.af.mil/ and maintained by AF publishing.

The government has coded publications as mandatory (M) or advisory (A). The contractor shall follow those publications coded as mandatory to the extent (that is, the specific procedure in a paragraph, section, chapter or volume) specified in the PWS. The contractor shall be guided by those coded advisory to the extent necessary to meet requirements in this PWS. The government may issue supplements or amendments to listed publications from any organizational level during the life of the contract. It is the responsibility to use the most current version of all publications. The contractor shall immediately implement those changes in publications that result in a decrease or no change in the contract price. Before implementing any such revision, supplement, or amendment that will result in an increase in contract price, the contractor shall submit to the CO a price proposal for approval. Price proposals shall be submitted within thirty (30) calendar days from the date the contractor receives notice of the revision, supplement, or amendment giving rise to the increase in cost of performance. The government will consider changes in the contract price due to supplements and amendments shall be considered under the FAR 52.212-4 "Contract Terms and Conditions-Commercial Items" clause. The government will continue to supply the government forms needed for daily operations. Upon completion of the contract, the contractor shall return to the government all issued publications and unused forms.

M = Mandatory Guidance, A = Advisory or Supplemental Information The following documentation will provide all needed background to offer insight and direction.

Reference Number

Title (and Website, if applicable) Date M/A Applicable Paragraph

AETCI 36-3001 Issue and Control of AETC Civilian ID Cards 30 Sep 1999 M All AFI 10-701 Operations Security (OPSEC) Instructions 8 Jun 2011 M All AFI 31-401 Information Security Program Management 1 Nov 2005 M All AFI 31-501 Personnel Security Program Management 27 Jan 2005 M All AFI 31-601 Industrial Security Program Management 29 Jan 2005 M All AFI 36-3026 Identification Cards for Members of the Uniformed

Service, Their Family Members, and Other Eligible Personnel

29 Jul 1999 M All

DoDD 5220.22 Industrial Security Regulation 24 Sep 2004 M All DoDM 5200.01 Information Security Program 1 Nov 2005 M All

DoDD 5200.2-R Personnel Security Program 19 Jan 1993 M All DODD 5500.07 Standards of Conduct 29 Nov 2007 M All AFPD 31-6 Industrial Security 1 Apr 2000 M All AFMAN 31-116 Air Force Motor Vehicle Traffic Supervision 9 May 2012 M All

APPENDIX II

Cloud Mangagement Support and Hosting Requirements

Because of technical issues, this appendix cannot be directly incorporated into this document. Please see separate attachments SOW Appendix 2a – Cloud Management Support Requirements and SOW Appendix 2b – Hosting Requirements.

(End of Summary of Changes)