FY25 Esri - Statement of Objectivbe SOO - Esri EA and Cloud Services_Final.pdf

1 | P a g e

ADMINISTRATION FOR STRATEGIC PREPAREDNESS AND RESPONSE’S (ASPR)

COORDINATION OPERATIONS RESPONSE ELEMENT (HCORE)

STATEMENT OF OBJECTIVES (SOO)

June 18, 2025

1. Introduction

This Statement of Objectives (SOO) outlines the high-level goals and desired outcomes for acquiring cloud hosting infrastructure and associated professional services. The objective is to establish a secure, scalable, reliable, and cost-effective cloud environment that supports The Office of Data, Analytics, and Information Advantage (ODAIA), part of the Health and Human Services (HHS) Administration for Strategic Preparedness and Response’s (ASPR) Coordination Operations Response Element (HCORE), mission and strategic objectives.

The objective of this contract is to consolidate and enhance support for ASPR’s Geospatial Infrastructure, which includes the Geospatial Health Systems (GHS) and related Geographical Information Systems (GIS) software and tools. This encompasses software licensing, professional services, training, cloud hosting, and the development of custom-made tools to ensure optimal functionality, scalability, and accessibility for preparedness and response activities. The contractor must ensure there are no breaks in service from the current levels of support and functionality being provided.

2. Background

The Office of Data, Analytics, and Information Advantage (ODAIA), part of the Health and Human Services (HHS) Administration for Strategic Preparedness and Response’s (ASPR) Coordination Operations Response Element (HCORE), delivers innovative and interoperable technology solutions and analyzes data and information to enable data-driven decision-making for public health, cyber, and all hazards’ emergencies. We aim to leverage cloud technologies to enhance agility, reduce operational overhead, and improve service delivery."

3. Scope

• Cloud Hosting Infrastructure: Secure, scalable, and highly available cloud resources (e.g., compute, storage, networking, databases, security services) to host critical applications and data.

• Professional Services: Expert support, guidance, and hands-on assistance for cloud development, maintenance, and migration, architecture, optimization, security, and ongoing management. Additionally, project and tool-based services and support to include, but not limited to new geospatial tools, dashboards, software, etc.

2 | P a g e

4. Overall Objectives

The primary objectives of this acquisition are to:

• Enhance Agility and Scalability: Establish a cloud environment that can rapidly scale resources up or down based on demand, enabling quicker deployment of new applications and services.

• Improve Reliability and Resilience: Implement a highly available and fault-tolerant cloud architecture that minimizes downtime and ensures business continuity.

• Strengthen Security Posture: Leverage advanced cloud security capabilities and best practices to protect sensitive data and applications from evolving cyber threats.

• Optimize Cost Efficiency: Achieve a cost-effective solution through efficient resource utilization, "pay-as-you-go" models, and continuous cost optimization strategies.

• Modernize IT Infrastructure: Transition from legacy on-premise infrastructure to a modern, cloud-native architecture that supports future innovation.

• Streamline Operations: Reduce operational burden on internal IT staff by leveraging managed cloud services and expert professional support.

• Ensure Compliance: Maintain compliance with all relevant federal, state, and industry regulations (e.g., FedRAMP, HIPAA, FISMA, NIST, GDPR) within the cloud environment.

• Foster Innovation: Provide a platform that encourages experimentation, rapid prototyping, and the adoption of new technologies.

5. Specific Objectives

5.1. Cloud Hosting Infrastructure Objectives:

• Provisioning of Core Cloud Services: Obtain access to a comprehensive suite of cloud services including, but not limited to:

o Virtual Machines/Compute instances (e.g., IaaS, PaaS options) o Storage solutions (e.g., object storage, block storage, file storage, data archiving) o Networking capabilities (e.g., Virtual Private Clouds (VPCs), VPNs, direct connect options, load balancers, DNS) o Database services (e.g., relational databases, NoSQL databases, data warehousing)

3 | P a g e o Identity and Access Management (IAM) o Monitoring and Logging services o Security services (e.g., WAF, DDoS protection, intrusion detection) o Containerization services (e.g., Kubernetes, Docker) o Serverless computing

• High Availability and Disaster Recovery: Implement an architecture that supports high availability (e.g., multi-Availability Zone deployment) and robust disaster recovery capabilities with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical applications.

• Performance: Ensure the cloud environment meets performance requirements for various applications, including low latency and high throughput.

• Scalability: The cloud environment must be capable of scaling dynamically to accommodate fluctuating workloads and future growth.

• Security: The cloud provider must demonstrate robust security controls and processes, with a strong emphasis on data encryption (at rest and in transit), access control, network security, and vulnerability management. The solution must adhere to [specify relevant security frameworks/certifications, e.g., FedRAMP High, DoD IL5].

• Cost Management: Provide tools and capabilities for transparent cost reporting, budgeting, and cost optimization.

• Interoperability: Ensure the ability to integrate with existing on-premise systems and other cloud services as needed.

• Support for Diverse Workloads: The cloud environment must support a variety of workloads, including [list examples: web applications, analytical databases, development/test environments, mission-critical systems].

• Data Residency: [If applicable, state specific data residency requirements, e.g., "All data must reside within the continental United States."]

5.2. Professional Services Objectives:

• Cloud Strategy and Roadmapping: Obtain expert assistance in developing a comprehensive cloud strategy, migration roadmap, and future-state architecture.

• Cloud Architecture Design: Leverage expertise for designing optimal cloud architectures (e.g., secure, scalable, cost-effective, resilient) for new and existing applications.

4 | P a g e

• Cloud Migration Services: Receive hands-on support for migrating on-premise applications and data to the chosen cloud environment with minimal disruption.

This includes:

o Application assessment and dependency mapping.

o Migration planning and execution.

o Data migration strategies.

o Post-migration validation and optimization.

• Cloud Security Consulting: Access specialized security consulting services to implement and maintain a robust cloud security posture, including:

o Security assessments and gap analysis.

o Implementation of security controls and policies.

o Compliance mapping and auditing support.

o Incident response planning and support.

• Cloud Optimization Services: Engage in ongoing optimization efforts to ensure efficient resource utilization and cost management within the cloud environment. This may include:

o Performance tuning.

o Cost analysis and recommendations.

o Resource right-sizing.

o Automation of operational tasks.

• Cloud Governance and Policy Development: Receive assistance in establishing effective cloud governance frameworks, policies, and best practices.

• Training and Knowledge Transfer: Ensure comprehensive training and knowledge transfer to internal staff to enable independent management and operation of the cloud environment.

• Ongoing Technical Support: Access to responsive and knowledgeable technical support for troubleshooting, problem resolution, and general inquiries.

• Online Training Support: Conduct training sessions to enhance staff proficiency with Esri tools. Up to 100 training days annually with flexibility for instructor-led and self-paced training.

• Open Market Training pass with guaranteed pricing.

5 | P a g e

• Develop and provide training materials and documentation.

• DevOps and Automation Support: Support for implementing DevOps practices and automation tools for continuous integration/continuous delivery (CI/CD) pipelines.

• Provide subject matter experts (SMEs) for technical and project consulting.

6. Performance Metrics and Success Criteria

The success of this acquisition will be measured against the following key performance indicators (KPIs) and success criteria:

• Availability/Uptime: Achieve [e.g., 99.99%] uptime for critical applications hosted in the cloud.

• Performance: Meet defined latency and throughput targets for key applications.

• Security Compliance: Achieve and maintain compliance with [specify standards, e.g., FedRAMP High, NIST 800-53].

• Cost Savings/Optimization: Demonstrate measurable cost savings or cost avoidance compared to previous on-premise operations, or achieve cost efficiency targets.

• Migration Completion: Successful migration of identified applications and data within defined timelines and budget.

• Reduced Operational Overhead: Quantifiable reduction in manual IT tasks or staff hours dedicated to infrastructure management.

• Customer Satisfaction: Positive feedback from end-users on application performance and availability.

• Training Effectiveness: Internal staff demonstrate proficiency in managing and operating the cloud environment.

• Incident Response Time: Adherence to defined Service Level Agreements (SLAs) for incident response and resolution.

7. Constraints and Assumptions

• Existing Systems: The cloud solution must be able to integrate with existing on-premise systems and applications (e.g., Active Directory, enterprise applications).

• Budget: The solution must remain within the allocated budget [if comfortable, specify a range or state "cost-effective"].

• Timeline: The initial migration and setup phase is anticipated to be completed within [specify timeframe, e.g., 12-18 months].

6 | P a g e

• Data Sensitivity: A significant portion of the data to be hosted is [specify sensitivity level, e.g., "Controlled Unclassified Information (CUI)" or "personally identifiable information (PII)"].

• Vendor Agnostic Approach (Desired but not mandatory): While a specific cloud provider may be preferred based on capabilities and existing investments, the solution should ideally promote a vendor-agnostic or multi-cloud approach where feasible to avoid vendor lock-in.

• Government Furnished Information/Property: [Specify any GFI/GFP that will be provided to the contractor.]

8. Deliverables

Potential deliverables may include:

• Cloud Architecture Design Documents

• Migration Plans and Schedules

• Security Assessment Reports

• Cost Optimization Reports

• Training Materials

• Standard Operating Procedures (SOPs) for Cloud Operations

• Regular Progress Reports

• Provide a draft Quality Assurance Surveillance Plan (QASP) that includes key Performance Parameters (KPPs) consistent with these additional metrics as appropriate.

9. Government Responsibilities

The Government will be responsible for:

• Providing timely access to relevant information, systems, and personnel.

• Making timely decisions and approvals.

• Designating a primary point of contact for the duration of the project.

• Providing necessary funding.

10. Future State Vision

The ultimate vision is to establish a dynamic, secure, and resilient geospatial cloud environment that serves as the foundation for the Administration for Strategic Preparedness and Response (ASPR) digital transformation. This cloud platform will

7 | P a g e enable faster innovation, improve operational efficiency, and enhance our ability to deliver critical services to ASPR and its response partners.

11. Period and Place of Performance

The period of performance will include one 12-month base period and four 12-month options period.

12. Other Direct Cost (ODC)

Are expenses other than the direct labor hours listed in the vendor’s pricelist. All ODCs proposed must be directly related to a service being offered under Esri GSA schedule contract and can only be purchased in conjunction with the Schedule service. Possible ODCs may include, but are not limited to items such as software, Esri ArcGIS credits, and license etc.