FCS2.0 PWS v0.2 240319 - RFI.docx

C.1 Introduction

C.1.1 Purpose

This document describes the requirements for the services provided under the Federal Aviation Administration (FAA) Cloud Services 2.0 (FCS 2.0) contract.

C.1.2 Scope of Services

The scope of the FCS contract encompasses the commercial Cloud Service Provider (CSP) reseller services to support all FAA Lines of Business. The FAA requires access to two CSPs: Amazon Web Services (AWS) and Microsoft Azure. The CSPs own and control the underlying cloud infrastructure and services. The FAA cloud service consumers administer and utilizes CSP provided infrastructure and services via CSP provided consoles and Application Programming Interface (API). The FAA cloud service consumer also has control over deployed applications and the associated data.

The FCS 2.0 scope of services will support the operational mission of the FAA’s Mission Support Operating Environment (MSOE), Research and Development Operating Environment (RDOE), Mission Essential Operating Environment (MEOE), and Mission Critical Operating Environment (MCOE) associated with day-to-day agency operations.

CSP reseller services refer to capabilities provided by the Contractor to support the functions that rely upon computer processing that can be implemented in a cloud environment because they do not require on-site (local) processing and so they can utilize consolidated computing resources that are accessible via a wide area network. CSP reseller services provided for the FCS 2.0 contract includes, but are not limited to:

Core cloud computing services:

· AWS Infrastructure as a Service (IaaS) in which the Contractor provides processing, storage, networks, and other computing resources that enable the service consumer to deploy and run software applications.

· AWS Platform as a Service (PaaS) in which the Contractor provides programming languages, libraries, services, and tools for use by service consumers.

· Microsoft Azure Infrastructure as a Service (IaaS) in which the Contractor provides processing, storage, networks, and other computing resources that enable the service consumer to deploy and run software applications.

· Microsoft Azure Platform as a Service (PaaS) in which the Contractor provides programming languages, libraries, services, and tools for use by service consumers.

Ancillary cloud services:

· AWS Machine Images (AMIs) from third party sources through the AWS MarketPlace are in scope services as these AMIs are often only delivered through the AWS MarketPlace.

· Azure VM Images from third party sources through the Microsoft Azure MarketPlace are in scope services as these images are often only delivered through the Microsoft Azure MarketPlace.

· Other AWS services such as snow family devices.

· Other Microsoft Azure services such as data box family devices.

· AWS VMWare Cloud on AWS in which the Contractor provides software/hardware solution that enables service consumers to host business applications in a VMWare managed environment.

Professional services and training:

· AWS Professional Services

· Microsoft Azure Professional Services

· AWS Training

· Microsoft Training

Third party SaaS through the AWS or Microsoft MarketPlace are not in scope of this contract.

As defined by in accordance with NIST Special Publication 800-145, the services may be delivered via “private” cloud computing infrastructure dedicated to the delivery of FCS 2.0 services, shared Government Community Cloud (GCC) computing infrastructure, or “public” cloud computing infrastructure depending upon the FAA’s cloud architecture for individual FAA business applications and workloads. Within this contract, the term “private cloud computing infrastructure” refers to computing infrastructure that is provisioned for exclusive use by the FAA and does not have interconnectivity to other cloud computing infrastructure.

C.2 Applicable Documents

The following documents are referenced in other sections of the PWS and are applicable to the extent specified herein. The latest version of these documents as of the contract award date applies. If an applicable document is updated during the contract period of performance, the Contractor must identify any impact of the updates to the delivery of FCS services. In the event that listed applicable documents have been updated or superseded, the latest document must be referenced.

C.2.1 Government Documents

C.2.1.1 FAA Documents

C.2.2 Order of Precedence

a) When the requirements of this document and referenced applicable documents are in conflict, this document must have precedence over all documents referenced herein.

b) If two or more referenced applicable documents are in conflict or two or more sections of this document are in conflict, the FAA Contracting Officer must be notified to resolve the conflict.

C.2.3 Availability of Documents

Copies of FAA specifications, standards, and publications may be obtained from the FCS 2.0 Contracting Officer. Requests should clearly identify the desired material by number and state the intended use of the material.

Copies of other federal publications may be obtained from the U.S. Government Printing Office, 710 North Capitol Street, Washington DC, 20401, by calling (202) 512-0132, or through the web site http://bookstore.gpo.gov/.

C.3 Government-Furnished Items

C.3.1 Telecommunications Connectivity

At no cost to the Contractor, the Government will furnish all wide area network connectivity between:

a) the CSP’s data center facilities and the Government systems to which the tenant applications are associated; and

b) the CSP’s data center facilities and any remote operations control or security control centers used to remotely manage and monitor FCS cloud environments.

C.4 Requirements

This section defines the required work efforts that must be performed by the Contractor in conjunction with the delivery of the required computing services.

C.4.1 Program Management

The Contractor is responsible for acquiring and managing all of the facilities, third-party services, personnel, and resources necessary to perform FCS services that meet requirements and achieve scheduled milestones.

The Contractor must ensure that the required resources are assigned and provide the required level of management oversight to ensure on-timely transition of delivery orders and cloud hosting accounts from the current contract to this contract. When requested by the FAA, the Contractor must coordinate any changes to the transition timeline as defined by the appropriate points-of-contact within the Government’s Program Office for the FCS Program. The Contractor must identify risks to the successful completion of transition timeline and recommend mitigation strategies to ensure that the timeline is maintained and the transition is successful.

The contractor must implement processes for the delivery of services in accordance with the contract. The contractor must provide a single POC for the Government to communicate needs or information.

C.4.1.1 Post-Award Conference

The Contractor must hold a post-award conference within 15 calendar days of contract award. The Government will determine the date of the post-award conference within 5 calendar days of contract award. The Post-Award Conference must be held at a Contractor facility unless otherwise designated by the Government. The purpose of the conference will be for the Government and Contractor to:

· Identify team personnel and their roles;

· Reach a mutual understanding of the contract requirements and the Government’s expectations;

· Discuss administrative details of the contract; and

· Identify areas of risk and develop strategies for managing the risks.

C.4.1.2 Program Status Reporting and Program Management Reviews

The Contractor is responsible for reporting performance with respect to the accomplishment of identified requirements and objectives to the Government. The Contractor must inform the Government of any instances in which the Contractor has failed to meet identified requirements or objectives and of the actions taken to restore performance to the required level. The Contractor must also notify the Government of any risks to successful delivery of services and the actions taken to resolve them. The Contractor must provide a Monthly Status Report (CDRL F001) that summarizes the status of contract performance and cloud service consumption and spend.

The Contractor must be prepared to participate in monthly Program Management Reviews (PMRs). The Government will determine the exact date and location of PMRs. The purpose of a PMR will be to:

· Discuss the Contractor’s performance with respect to FAA requirements;

· Discuss the Contractor’s performance with respect to cloud service consumption and spend rates;

· Discuss the Contractor’s performance with respect to service quality; and

· Discuss the disposition of new and previously identified risks.

The Contractor must present cloud service consumption and spend data to support the discussion. The Contractor must also submit a Monthly Status Report regardless of whether a PMR is held.

C.4.1.3 Meeting Attendance

The Contractor must provide personnel at meetings and conferences when requested by the Government. The personnel provided by the Contractor must have the requisite knowledge and skills to discuss the topics identified on the meeting agenda. As requested by the Government, the Contractor must prepare and submit agendas, minutes, and presentation materials for all meetings and reviews.

C.4.2 Transfer of Existing CSP Hosting Accounts to Contract

The Contractor shall support the transfer of all existing FAA CSP hosting accounts (master payer accounts and member accounts) from the previous contract to this contract at time of award or when determined by the FAA. The Contractor must accept transfer of additional CSP hosting accounts over the life of the contract.

C.4.3 Cloud Hosting Services

The Contractor must provide access to cloud hosting services:

Core cloud computing services:

· AWS Infrastructure as a Service (IaaS) in which the Contractor provides processing, storage, networks, and other computing resources that enable the service consumer to deploy and run software applications.

· AWS Platform as a Service (PaaS) in which the Contractor provides programming languages, libraries, services, and tools for use by service consumers.

· Microsoft Azure Infrastructure as a Service (IaaS) in which the Contractor provides processing, storage, networks, and other computing resources that enable the service consumer to deploy and run software applications.

· Microsoft Azure Platform as a Service (PaaS) in which the Contractor provides programming languages, libraries, services, and tools for use by service consumers.

Ancillary cloud services:

· AWS Machine Images (AMIs) from third party sources through the AWS MarketPlace are in scope services as these AMIs are often only delivered through the AWS MarketPlace.

· Azure VM Images from third party sources through the Microsoft Azure MarketPlace are in scope services as these images are often only delivered through the Microsoft Azure MarketPlace.

· Other AWS services such as snow family devices.

· Other Microsoft Azure services such as data box family devices.

· AWS VMWare Cloud on AWS in which the Contractor provides a software/hardware solution that enables service consumers to host business applications in a VMWare managed environment.

C.4.3.1 CSP Account Management

In support of the ordering, provisioning, delivery, and consumption of cloud hosting services, the Contractor must provide the FAA with capability to first manage CSP hosting accounts. The Contractor must provide the FAA the ability to directly manage AWS and Microsoft Azure hosting accounts within the native CSP environments or using FAA specified tools and interfaces. This includes master payer accounts and member accounts. The FAA will retain all administrative access and responsibility for all CSP hosting accounts. The FAA will have ownership of the FAA CSP accounts and account root credentials. The Contractor will provide the FAA direct access to all CSP hosting account management functions. Account management functions using FAA specified access methods or tools include, but are not limited to:

a) Creating new AWS or Microsoft Azure hosting accounts.

b) Terminating existing AWS or Microsoft Azure hosting accounts.

c) Configuring new or reconfiguring existing AWS or Microsoft Azure hosting accounts.

d) Performing AWS or Microsoft Azure account management (e.g., password resets, updates to access privileges, etc.).

The Contractor must create and support dedicated CSP Master Payer Accounts for the exclusive use of the FAA that must contain billing and usage data for all FAA CSP member accounts and only FAA CSP member accounts. The Contractor must never provide any non-FAA entity or software tool access to CSP hosting account cost and usage information without written approval by the FAA CO.

The FAA will retain ownership of all data contained within CSP accounts. The FAA is solely responsible for entering and maintaining all FAA data (including back-up and restoration of data)

The FAA will provide the Contractor with Payer Account IAM Read Only access (or equivalent) to selected CSP Billing and Cost Management information for purposes of enabling the reseller to provide consolidated billing services to the FAA.

The Contractor must also provide the FAA the ability to directly manage the AWS and Microsoft Azure end user service access accounts within the native CSP environments or using FAA specified tools and interfaces. This includes end user service access accounts to master payer accounts and member accounts. The FAA will retain all administrative access and responsibility for all end user service access accounts. The Contractor will provide the FAA direct access to all end user service account management functions. Account management functions using FAA specified access methods or tools include, but are not limited to:

a) Creating new user profiles.

b) Terminating existing user profiles.

c) Configuring new or reconfiguring existing user profiles.

d) Performing AWS or Microsoft Azure account management (e.g., password resets, updates to access privileges, etc.).

C.4.3.2 Ordering and Provisioning of Cloud Hosting Services The Contractor must support and process the following types of FCS service ordering and provisioning actions:

a) New – The provisioning of a new cloud hosting service. Contractor must provide FAA capability to provision services via FAA specified access methods and/or tools (e.g., direct CSP console access to CSP APIs, etc.).

b) Change – The modification to an existing cloud hosting service that has been previously provisioned and is in operation. Changes may include the addition, removal, or modification to the quantity of cloud hosting services. Contractor must provide FAA capability to change services via FAA specified access methods and/or tools.

c) Start/Stop – The starting or stopping of cloud hosting services. Stopping services preserves data and configuration of the resource and incurs a small cost associated with persistent services. Starting services restores stopped services to resume operation. Contractor must provide FAA capability to start/stop services via FAA specified access methods and/or tools.

d) Terminate – The termination of cloud hosting services. Once terminated, cloud services cannot be restored. Termination results in the loss of data and configuration of the resource and effectively ends the accrual of any additional costs. Contractor must provide FAA capability to terminate services via FAA specified access methods and/or tools.

For any of the FCS CSP reseller services, the Contractor must support self-provisioning of FCS services by authorized FAA tenants. The self-service provisioning capability must include the allocation of the required computing resources and the de-allocation of those resources upon service discontinuation.

The Contractor must provide to the FAA unrestricted access to all offered CSP cost savings options including Reserved Instances, Savings Plans, and volume discounts. The Contractor must provide the FAA with access to all current and future CSP IaaS, and PaaS, resources in both Public Cloud domain and Government Community Cloud domain at time of award. The Contractor must provide CSP “resold” Enterprise Support which provides the FAA direct access to CSP Enterprise Support resources.

The Contractor must provide unrestricted access to all CSP provided billing and usage reports and tools without restriction.

C.4.3.3 CSP Service Level Agreements

The performance requirements for the CSP Reseller Services are defined in the CSPs’ published service level agreements as indicated below:

The Amazon Web Services Compute Service Level Agreement can be found:

https://aws.amazon.com/compute/sla/

The Microsoft Azure Service Level Agreement can be found here:

https://azure.microsoft.com/en-us/support/legal/sla/

In the event of a performance shortfall covered within the CSPs’ respective service level agreements, the Contractor must request the appropriate CSP service credits as specified in the CSP service level agreements and provide those service credits to the FAA.

C.4.3.4 CSP Service Maintenance

C.4.3.4.1 CSP Emergency Maintenance The Contractor must plan with the CSPs on behalf of FAA to ensure that any emergency maintenance that will affect FAA’s ability to use CSP services is reported to the FAA CO and COR as soon as practically possible but not to exceed 24 hours after the emergency maintenance. Information must be provided that enables FAA to effectively assess the planned activity for purposes of understanding which FAA-utilized CSP resources may be affected and for determining appropriate contingency mechanisms. To ensure timely updates subsequent to FAA notification, the Contractor must make arrangements with the CSPs to ensure (1) the FAA is kept informed of emergency maintenance progress, including notification when the activity is complete and (2) the FAA primary and/or alternate contacts (designated by FAA) associated with affected FAA CSP accounts can contact the CSPs directly for updates and assistance.

C.4.3.4.2 CSP Planned and Scheduled Maintenance The Contractor must make arrangements with the CSPs on behalf of FAA to ensure that any Planned Maintenance that will affect FAA’s ability to use CSP services is reported to the FAA CO and COR a minimum of five business days in advance, with as much lead time as possible. FAA will also monitor the appropriate CSP web pages to maintain an awareness of Scheduled Maintenance affecting FAA resources operating within the CSPs and will take the appropriate operational steps to minimize impact and accommodate the Scheduled Maintenance.

C.4.3.4.3 CSP Incident Reporting C.4.3.4.3.1 Incidents Not Involving a Security Threat or Compromise

The Contractor must ensure that incidents impacting FAA’s ability to use any CSP service is reported to FAA CO, COR, and any other FAA designated POC in a manner that is consistent with notification of CSP’s other commercial and federal account holders. Information must be provided that enables FAA to effectively assess the incident for purposes of understanding which FAA-utilized CSP resources may be affected and for determining appropriate contingency mechanisms. To ensure timely updates subsequent to FAA notification, the Contractor must make arrangements with the CSPs to ensure (1) that FAA is kept informed of problem resolution progress, and (2) FAA primary and/or alternate contacts (designated by FAA) associated with affected FAA CSP accounts can contact the CSPs directly for updates and assistance.

C.4.3.4.3.2 Incidents Involving a Security Threat or Compromise

The Contractor must ensure that a suspected or confirmed security incident or compromise affecting the FAA’s ability: to use any CSP service, to protect FAA applications operating within the CSPs, or to protect FAA information existing within CSPs is reported by the CSPs to the FAA CO, COP, and FAA Security Operations Center (SOC) at SOC@faa.gov and by calling 1-866-580-1852 immediately upon gaining knowledge which supports the suspicion, or provides confirmation, of a security threat or compromise, with the specific communications approach and protocol agreed upon in advance by FAA and the Contractor. Information must be provided that enables FAA to effectively assess the incident for purposes of understanding which FAA-utilized CSP resources may be affected and determining appropriate contingency mechanisms. To ensure timely updates subsequent to FAA notification, the Contractor must make arrangements with the CSPs to ensure (1) that FAA kept informed of problem resolution progress, and (2) FAA primary and/or alternate contacts (designated by FAA) associated with affected FAA CSP accounts can contact the CSPs directly for updates and assistance.

C.4.4 CSP Professional Services and Training

The Contractor must provide access to CSP professional services and training.

Professional services and training:

· AWS Professional Services

· Microsoft Azure Professional Services

· AWS Training

· Microsoft Training

The Contractor must coordinate with the FAA for ordering CSP professional services and CSP training.

C.4.5 FAA Invoice and Billing

The contractor must submit separate invoices for each delivery order. Each delivery order invoice must itemize charges per Contract Line Item Number (CLIN). Within each CLIN, the Contractor must also further itemize charges by AWS or Microsoft Azure hosting account and AWS or Microsoft Azure service type. The account and service type information can be included as a backup document (preferably in a Microsoft Excel spreadsheet) to the invoices.

Some CSP hosting accounts and services are designated as FCS 2.0 Enterprise Services. These services (such as centralized monitoring, logging, etc.) are required but are often not able to be billed back to individual CSP hosting accounts by the CSPs. When centrally billed by the CSPs, the contractor must support reallocating these CSP charges to individual delivery orders as designated by the FAA.

The Contractor must develop tailored billing and usage reports in support of FAA requirements. The Contractor must invoice the FAA’s actual utilization monthly in arrears. The Contractor must notify the FAA 85% of the FAA’s obligated funding for a given delivery order is expended in order to provide the FAA with sufficient time to, at its option, add incremental funding or discontinue service. The Contractor must not continue to provide service once a delivery order’s obligations are 100% consumed. If approaching 100%, the Contractor must not automatically terminate or suspend services. Service disruption must be determined by the FAA.

The Contractor must pass through to the FAA all CSP price changes at time of effectivity. The Contractor must apply their committed capacity discount as a reduction to the CSP’s total monthly billing. CSP’s total monthly billing is inclusive of Reserved Instances, Savings Plans, and volume discounts.

C.4.6 Transfer to Successor Contract

The Contractor must commit to promptly transfer at no additional cost FAA’s dedicated master payer account and member accounts to any successor contractor or to the FAA directly at FAA’s direction.

The Contractor must provide a Transition-Out Plan to facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the contract. The Contractor must provide a Transition-Out Plan within three months of the contract end date.

In the Transition-Out Plan, the Contractor must identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

a) The transfer of master payer accounts and member accounts.

b) The transfer of end user accounts.

c) Status of ongoing technical initiatives.

d) Actions requested by the contractor of the Government.

The Contractor must also establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings or as often as necessary to ensure a seamless transition-out. The Contractor must implement its Transition-Out Plan NLT three months prior to expiration of the contract.