Attachment_2_-_SOO_Cloud.pdf

FA8903-19-R-0135

Attachment A

13 September 2019

Statement of Objectives – Cloud Services

Objective: to provide a set of services via Cloud Service Provider (CSP) that provides AFLCMC/HN, LevelUP and its developers a mechanism to conduct continuous development, testing, staging and deploying into production, also known as DevOps/DevSecOps, in order to integrate and test at multiple classification levels for government cloud and hybrid cloud architectures to include, but not limited to IL2, IL5, IL6, and other classification networks.

Unless otherwise noted, LevelUP requires a cloud service provider capable of processing workloads at DoD Cloud Commuting Security Requirements Guide (DoD SRG) Impact Level 5 (IL5), as well as other networks, impact levels and classifications. This will ensure the Air Force has the ability to push software artifacts from development environments to production environments at multiple classification levels and hybrid cloud architectures, that comply with DoD/Air Force policies and directives. The objective of this order is to obtain a secure, flexible, efficient, and cost effective commercial cloud service offering that enables scaling of infrastructure, application resources, IT capabilities and services to meet evolving application and user demand. The scope of work includes infrastructure as a service (IaaS) and Platform as a service (PaaS) services intended to streamline the migration, implementation, support, compute and storage of current and future LevelUP workloads and applications.

All work will be accomplished using commercial practices and industry standards. LevelUP will make maximum utilization of open source standards and various non-government standards wherever practical. Notwithstanding the classified network through which these IL6 and other classified cloud services are accessed, the cloud services themselves are identical to the cloud services available in the CSP’s commercial cloud regions; the cloud services are, therefore, commercial items or COTS.

Cloud services utilized under this Blanket Purchase Agreement will be authorized, assessed and accredited under the Director of National Intelligence (DNI) Intelligence Community Directive (ICD 503 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4. Additional potential classified networks will adhere to their respective security classification guides. Cyber security and incident reporting will occur in accordance with those guidelines/directives.

The contractor must have a valid facilities clearance (FCL) at the SECRET level before accessing classified information; an FCL is not required for establishment of the cloud environment. Interim FCLs are acceptable provided they are not expired.