MAS - Solution Guidance Corporation - GS00F304DA

GENERAL SERVICES ADMINISTRATION

FEDERAL SUPPLY SERVICE

AUTHORIZED FEDERAL SUPPLY SCHEDULE PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage!®, a menu-driven database system. The INTERNET address for GSA Advantage! ® is: GSAAdvantage.gov.

MULTIPLE AWARD SCHEDULE

Large Category: Office Management

Class: R408, R499 U006

CONTRACT NUMBER:

GS-00F-304DA

CONTRACT PERIOD:

September 22, 2021 – September 21, 2026

Solution Guidance Corporation (SGC) 14291 Park Meadow Drive, Suite 150

Chantilly, VA, 20151

Phone: 703-961-1602

Fax: 703-961-1607 www.solutionguidance.com

Point of Contact: Ms. Kelley Witmer

Phone: 703-961-1602 x 1050

Email: kwitmer@solutionguidance.com

BUSINESS SIZE:

Small, Disadvantaged, 8(a), Woman-Owned Business

Price list current as of Modification #PS-0026 effective February 1, 2023

Solicitation Refresh #0015

For more information on ordering from Federal Supply Schedules go to the GSA

Schedules page at GSA.gov http://www.gsaadvantage.gov/ http://www.solutionguidance.com/ mailto:kwitmer@solutionguidance.com

GSA AWARDED TERMS AND CONDITIONS

Solution Guidance Corporation (SGC)

1a. Table of awarded special item numbers with appropriate cross-reference to item descriptions.

SIN Recovery SIN Description

511210

(132-32)*

511210RC Software Licenses Includes both term and perpetual software licenses and maintenance.

518210C

(132-40)*

518210CRC Cloud and Cloud-Related IT Professional Services.

Includes commercially available cloud computing services such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a

Service (SaaS) and emerging cloud services. IT professional services that are focused on providing the types of services that support the Government’s adoption of, migration to or governance/ management of Cloud computing. Specific labor categories and/or fixed price solutions (e.g. migration services, etc.)

that support activities associated with assessing Cloud solutions, refactoring workloads for Cloud solutions, migrating legacy or other systems to Cloud solutions, providing management/ governance of Cloud solutions, DevOps, developing cloud native applications or other Cloud oriented activities.

54151S

(132-51)*

54151SRC Information Technology Professional Services IT

Professional Services and/or labor categories for database planning and design; systems analysis, integration, and design; programming, conversion, and implementation support; network services, data/records management, and testing.

54151ECOM

(132-52)*

54151ECOMRC Electronic Commerce and Subscription Services.

Includes value added network services, e-mail services, Internet access services, electronic subscription services, data transmission services, and emerging electronic commerce technologies.

OLM OLMRC Order-level Materials (OLMs). OLMs are supplies and/or services acquired in direct support of an individual task or delivery order placed against a

Schedule contract or BPA. OLM pricing is established at the order level.

541611 541611RC Management and Financial Consulting, Acquisition and Grants Management Support, and

Business Program and Project Management

Services. Provide operating advice and assistance on administrative and management issues. Examples include: strategic and organizational planning, business process improvement, acquisition and grants management support, facilitation, surveys, assessment and improvement of financial management systems, financial reporting and analysis, due diligence in validating an agency’s portfolio of assets and related support services, strategic financial planning, financial policy formulation and development, special cost studies, actuarial services, economic and regulatory analysis, benchmarking and program metrics, and business program and project management.

611430 611430RC Professional and Management Development

Training. Services include offering an array of short duration courses and seminars for management and professional development. Training for career development may be provided directly to individuals or through employers' training programs, and courses may be customized or modified to meet the special needs of customers. Instruction may be provided in diverse settings, such as the establishment's or agency's training facilities, and through diverse means, such as correspondence, television, the

Internet, or other electronic and distance-learning methods. The training provided may include the use of simulators and simulation methods. Proposed professional services shall be in support of planning, creating, and/or executing testing and test administration, learning management, internship, or development of new courses or subject matter delivered via an instructor-led (i.e., traditional classroom setting or conference/seminar) and/or web-based (i.e., Internet/Intranet, software packages and computer applications) system.

Examples include Training Services that are

Instructor Led Training or Web Based Training of

Education Courses, Course Development and Test

Administration, Learning Management, and

Internships; Environmental Training Services in order to meet Federal mandates and Executive Orders;

training of agency personnel to deal with media and media responses; Logistics Training Services related to system operations, automated tools for supply and value chain management, property and inventory management, distribution and transportation management, and maintenance of equipment and facilities; Audit & Financial training services related to course development and instruction required to support audit, review, financial assessment and financial management activities.

611512 611512RC Flight Training. Includes aviation and flight training.

493110RM 49311RMRC Physical Records Management Services. Includes capabilities to manage the movement, manipulation, archiving, security, and management of physical records, including any ancillary supplies and/or services necessary to provide a total physical records management solution.

518210DC 518210DCRC Document Conversion Services. Includes scanning of the original document's text and images, converting the information to digital data, transferring the data to a new media file, and formatting the information for use in a document imaging and storage system.

Customized coding and indexing options are also available as part of the document conversion process.

518210ERM 518210ERMRC Electronics Records Management Solutions.

Electronic Records Management Solutions provide a comprehensive capability to solve the complex challenges posed by the movement, manipulation, archiving, security, and management of electronic records. The vendor provides professional management and administrative support personnel with the necessary skills to perform effective record management services for both classified and/or unclassified records. The services are provided using either Government or vendor equipment and facilities or a combination of both. The objective of electronic records management services is to permit the access, maintenance, control, storage, disposition, and transfer of electronic records. Includes any ancillary supplies and/or services necessary to provide a total electronic records management solution.

541611LIT 541611LITRC Litigation Support Services. Includes a wide range of services that aid the customers in obtaining, organizing, analyzing, and presenting evidence or materials for legal matters. Services include, but are not limited to document acquisition, document preparation and organization, data extraction from forensic images, document analysis, technical support, and project management.

1b. Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract. See page 5.

1c. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles, experience, functional responsibility and education for those types of employees or subcontractors who will perform services shall be provided. See page 6.

2. Maximum Order: $1,000,000.00

3. Minimum Order: $100.00

4. Geographic Coverage (delivery area): Domestic only including Puerto Rico and US

Territories.

5. Point(s) of production: Same as Contractor address

6. Discount from list prices or statement of net price: Government net prices shown on pricing table provided on page 33. (discounts already deducted)

7. Quantity Discounts: None offered

8. Prompt Payment Terms: Net 30 days; Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

9. Foreign Items: N/A

10a. Time of Delivery: Specified on the Task Order

10b. Expedited Delivery: Contact Contractor

10c. Overnight and 2-day Delivery: Contact Contractor

10d. Urgent Requirements: Contact Contractor

11. F.O.B. Point(s): Destination

12a. Ordering Address: Same as Contractor address

12b. Ordering Procedures: For supplies and services, the ordering procedures and information on Blanket Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR)

8.405-3.

13. Payment Address: Same as Contractor address

14. Warranty Provision: Contractor’s standard commercial warranty

15. Export Packing Charges: N/A

16. Terms and conditions of rental, maintenance, and repair : N/A

17. Terms and conditions of installation: N/A

18a. Terms and conditions of repair parts indicating date of parts price lists and any discounts from list prices: N/A

18b. Terms and conditions for any other services (if applicable): N/A

19. List of service and distribution points: N/A

20. List of participating dealers: N/A

21. Preventive maintenance: N/A

22a. Environmental attributes, e.g., recycled content, energy efficiency, and/or reduced pollutants: N/A

22b. Section 508 compliance information: N/A

23. Unique Entity Identifier (UEI) Number: 612948138

24. Notification regarding registration in System for Award Management (SAM) database:

Contractor registered and active in SAM.

25. Notification that Government purchase cards are accepted up to the micro-purchase threshold: Government purchase cards are accepted up to the micro-purchase threshold.

26. Notification whether Government purchase cards are accepted or not accepted above the micro- purchase threshold: Government purchase cards are not accepted above the micro-purchase threshold. However, on occasion, Solution Guidance Corporation may accept the Government purchase card in accordance with GSAR 552.232-79(c) Payment by Credit

Card. Contract contractor for limit.

INFORMATION FOR ORDERING ACTIVITIES

Special Notice to Agencies: Small Business Participation

SBA strongly supports the participation of small business concerns in the Federal

Acquisition Service. To enhance Small Business Participation SBA policy allows agencies to include in their procurement base and goals, the dollar value of orders expected to be placed against the Federal Supply Schedules, and to report accomplishments against these goals.

For orders exceeding the micropurchase threshold, FAR 8.404 requires agencies to consider the catalogs/pricelists of at least three schedule contractors or consider reasonably available information by using the GSA Advantage!TM on- line shopping service (www.gsaadvantage.gov). The catalogs/pricelists, GSA Advantage!TM and the

Federal Acquisition Service Home Page (www.gsa.gov/fas) contain information on a broad array of products and services offered by small business concerns.

This information should be used as a tool to assist ordering activities in meeting or exceeding established small business goals. It should also be used as a tool to assist in including small, small disadvantaged, and women-owned small businesses among those considered when selecting pricelists for a best value determination.

For orders exceeding the micropurchase threshold, customers are to give preference to small business concerns when two or more items at the same delivered price will satisfy their requirement.

1. INSPECTION/ACCEPTANCE

The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The ordering activity reserves the right to inspect or test any software that has been tendered for acceptance. The ordering activity may require repair or replacement of nonconforming software at no increase in contract price. The ordering activity must exercise its post acceptance rights (1) within a reasonable time after the defect was discovered or should have been discovered; and (2) before any substantial change occurs in the condition of the software, unless the change is due to the defect in the software. Inspection of services is in accordance with 552.212-4

CONTRACT TERMS AND CONDITIONS–COMMERCIAL ITEMS (JAN 2017)

(DEVIATION – FEB 2007) (DEVIATION - FEB 2018) for Firm-Fixed Price orders;

or GSAR 552.212-4 CONTRACT TERMS AND CONDITIONS-COMMERCIAL

ITEMS (JAN 2017) (DEVIATION - FEB 2018) (ALTERNATE I - JAN 2017)

(DEVIATION - FEB 2007) for Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

2. COMMERCIAL SUPPLIER AGREEMENTS

Commercial Supplier Agreements to include Enterprise User License Agreements or

Terms of Service (TOS) agreements. The Contractor shall provide all Commercial

Supplier Agreements to include Enterprise User License Agreements or Terms of

Service (TOS) agreements in an editable Microsoft Office (Word) format for review prior to award.

TERMS AND CONDITIONS APPLICABLE TO TERM SOFTWARE

LICENSES

(SPECIAL ITEM NUMBER 511210 / 511210RC)

http://www.gsa.gov/fas)

3. GUARANTEE/WARRANTY

a. The Contractor’s commercial guarantee/warranty shall be included in the Commercial

Supplier Agreement to include Enterprise User License Agreements or Terms of Service

(TOS) agreements.

b. The Contractor warrants and implies that the items delivered hereunder are merchantable and fit for use for the particular purpose described in this contract. If no implied warranties are given, an express warranty of at least 60 days must be given in accordance with FAR

12.404(b)(2)

c. Limitation of Liability. Except as otherwise provided by an express or implied warranty, the

Contractor will not be liable to the ordering activity for consequential damages resulting from any defect or deficiencies in accepted items.

4. TECHNICAL SERVICES

The Contractor, without additional charge to the ordering activity, shall provide a hot line technical support number _____ for the purpose of providing user assistance and guidance in the implementation of the software. The technical support number is available from ____________ to ____________.

5. SOFTWARE MAINTENANCE

a. Software maintenance as it is defined: (select software maintenance type) :

(1) _______Software Maintenance as a Product (SIN 511210)

Software maintenance as a product includes the publishing of bug/defect fixes via patches and updates/upgrades in function and technology to maintain the operability and usability of the software product. It may also include other no charge support that is included in the purchase price of the product in the commercial marketplace. No charge support includes items such as user blogs, discussion forums, on-line help libraries and Frequently

Asked Questions (FAQ’s), hosted chat rooms, and limited telephone, email and/or web-based general technical support for user’s self-diagnostics.

Software maintenance as a product does NOT include the creation, design, implementation, integration, etc. of a software package. These examples are considered software maintenance services.

Software Maintenance as a product is billed at the time of purchase.

(2) ________Software Maintenance Services (SIN 54151)

Software maintenance services creates, designs, implements, and/or integrates customized changes to software that solve one or more problems and is not included with the price of the software. Software maintenance services includes person-to-person communications regardless of the medium used to communicate: telephone support, on- line technical support, customized support, and/or technical expertise which are charged commercially. Software maintenance services are billed in arrears in accordance with 31 U.S.C. § 3324.

b. Invoices for maintenance service shall be submitted by the Contractor on a quarterly or monthly basis, after the completion of such period. Maintenance charges must be paid in arrears (31 U.S.C. § 3324). PROMPT PAYMENT DISCOUNT, IF APPLICABLE, SHALL

BE SHOWN ON THE INVOICE.

6. PERIODS OF TERM LICENSES (SIN 511210) AND SOFTWARE

MAINTENANCE SERVICES (SIN 54151)

a. The Contractor shall honor orders for periods for the duration of the contract period or a lesser period of time.

b. Term licenses and/or software maintenance services may be discontinued by the ordering activity on thirty (30) calendar days written notice to the Contractor.

c. Annual Funding. When using annually appropriated funds are cited on an order for term licenses and/or software maintenance services, the period of the term licenses and/or software maintenance services shall automatically expire on September 30 of the contract period.

d. Cross-Year Funding Within Contract Period. Where an ordering activity’s specific appropriation authority provides for funds in excess of a 12 month (fiscal year) period, the ordering activity may place an order under this schedule contract for a period up to the expiration of the contract period, notwithstanding the intervening fiscal years.

e. Ordering activities should notify the Contractor in writing thirty (30) calendar days prior to the expiration of an order, if the term licenses and/or maintenance is to be terminated at that time. Orders for the continuation of term licenses and/or software maintenance services will be required if the term licenses and/or maintenance is to be continued during the subsequent period.

7. CONVERSION FROM TERM LICENSE TO PERPETUAL LICENSE

a. When a contractor commercially offers conversions of term licenses to perpetual licenses, and an ordering activity requests such a conversion, the contractor shall provide the total amount of conversion credits available for the subject software within ten (10) calendar days after placing the order.

b. When conversion credits are provided, they shall continue to accrue from one contract period to the next, provided the software has been continually licensed without interruption.

c. The term license for each software product shall be discontinued on the day immediately preceding the effective date of conversion from a term license to a perpetual license.

d. When conversion from term licenses to perpetual licenses is offered, the price the ordering activity shall pay will be the perpetual license price that prevailed at the time such software was initially ordered under a term license, or the perpetual license price prevailing at the time of conversion from a term license to a perpetual license, whichever is the less, minus an amount equal to a percentage of all term license payments during the period that the software was under a term license within the ordering activity.

8. TERM LICENSE CESSATION

a. After a software product has been on a continuous term license for a period of ______ months, a fully paid-up, non-exclusive, perpetual license for the software product shall automatically accrue to the ordering activity. The period of continuous term license for automatic accrual of a fully paid-up perpetual license does not have to be achieved during a particular fiscal year; it is a written Contractor commitment which continues to be available for software that is initially ordered under this contract, until a fully paid-up perpetual license accrues to the ordering activity. However, should the term license of the software be discontinued before the specified period of the continuous term license has been satisfied, the perpetual license accrual shall be forfeited. Contractors who do not commercially offer conversions of term licenses to perpetual licenses shall indicate that their term licenses are not eligible for conversion at any time.

b. The Contractor agrees to provide updates and software maintenance services for the software after a perpetual license has accrued, at the prices and terms of SIN 54151, if the licensee elects to order such services. Title to the software shall remain with the Contractor.

9. UTILIZATION LIMITATIONS - (SIN 511210, SIN 511210, AND SIN 54151)

a. Software acquisition is limited to commercial computer software defined in FAR Part 2.101.

b. When acquired by the ordering activity, commercial computer software and related documentation so legend shall be subject to the following:

(1) Title to and ownership of the software and documentation shall remain with the

Contractor, unless otherwise specified.

(2) Software licenses are by site and by ordering activity. An ordering activity is defined as a cabinet level or independent ordering activity. The software may be used by any subdivision of the ordering activity (service, bureau, division, command, etc.) that has access to the site the software is placed at, even if the subdivision did not participate in the acquisition of the software. Further, the software may be used on a sharing basis where multiple agencies have joint projects that can be satisfied by the use of the software placed at one ordering activity's site. This would allow other agencies access to one ordering activity's database. For ordering activity public domain databases, user agencies and third parties may use the computer program to enter, retrieve, analyze and present data. The user ordering activity will take appropriate action by instruction, agreement, or otherwise, to protect the Contractor's proprietary property with any third parties that are permitted access to the computer programs and documentation in connection with the user ordering activity's permitted use of the computer programs and documentation. For purposes of this section, all such permitted third parties shall be deemed agents of the user ordering activity.

(3) Except as is provided in paragraph 9.b(2) above, the ordering activity shall not provide or otherwise make available the software or documentation, or any portion thereof, in any form, to any third party without the prior written approval of the Contractor. Third parties do not include prime Contractors, subcontractors and agents of the ordering activity who have the ordering activity's permission to use the licensed software and documentation at the facility, and who have agreed to use the licensed software and documentation only in accordance with these restrictions. This provision does not limit the right of the ordering activity to use software, documentation, or information therein, which the ordering activity may already have or obtains without restrictions.

(4) The ordering activity shall have the right to use the software and documentation with the run-time computing environment (e.g. operating system, virtual machine, mobile operating system, processor etc.) to be specifically identified for which it is acquired at any other facility/user device to which that time computing environment may be transferred, or in cases of Disaster Recovery, the ordering activity has the right to transfer the software to another site/user device if the ordering activity site for which it is acquired is deemed to be unsafe for ordering activity personnel; to use the software and documentation with a backup time computing environment when the primary is inoperative; to copy computer programs for safekeeping (archives) or backup purposes; to transfer a copy of the software to another site/user for purposes of benchmarking new hardware and/or software; and to modify the software and documentation or combine it with other software, provided that the unmodified portions shall remain subject to these restrictions.

(5) "Commercial Computer Software" may be marked with the Contractor's standard commercial restricted rights legend, but the schedule contract and schedule pricelist, including this clause, "Utilization Limitations" are the only governing terms and conditions, and shall take precedence and supersede any different or additional terms and conditions included in the standard commercial legend.

(6) Licensee Data belongs exclusively to Licensee, regardless of where the Data may reside at any moment in time including, but not limited to Licensor hardware, networks or other infrastructure and facilities where Data may reside, transit through or be stored from time to time. Licensor makes no claim to a right of ownership in Licensee Data. Licensor agrees to keep the Licensee Data Confidential as that term is defined in the relevant FAR and DFARS provisions pertaining to Confidential Information and Confidentiality.

Licensor is not permitted to use Licensee’s data for a purpose that is not explicitly granted in writing by Licensee. Upon Licensee request, for any reason whatsoever, Licensor must promptly return all Licensee Data in Licensor’s possession in a format as may be designated at the time of request by Licensee.

(7) Licensee may create or hire others (including Licensor) to create modifications, customizations or other enhancements to the Software which might be classified as

“Derivative Works” of the software. Unless otherwise negotiated and mutually agreed upon at the order level, the intellectual property (IP) rights to the Derivative Works shall be owned by the owner of the underlying intellectual property. The Derivative Work[s] shall be made available to the Licensee through a royalty free, perpetual worldwide, no charge license to the Licensee.

(8) Software Asset Identification Tags (SWID) (Option 1 SIN 511210)

Option 1 is applicable when the Offeror agrees to include the International Organization for Standardization/ International Electrotechnical Commission 19770-2 (ISO/IEC 19770-

2:2015) standard identification tag (SWID Tag) as an embedded element in the software.

An ISO/IEC 19970-2 tag is a discoverable identification element in software that provides licensees enhanced asset visibility. Enhance visibility supports both the goals of better software asset management and license compliance. Offerors may use the National

Institute of Standards and Technology (NIST) document “NISTIR 8060: Guidelines for

Creation of Interoperable Software Identification (SWID) Tags,” December 2015 to determine if they are in compliance with the ISO/IEC 19770-2 standard.

Section 837 of The Federal Information Technology Acquisition Reform Act (FITARA) of 2014, requires GSA to seek agreements with software vendors that enhance government- wide acquisition, shared use, and dissemination of software, as well as compliance with end user license agreements. The Megabyte Act of 2016 requires agencies to inventory software assets and to make informed decisions prior to new software acquisitions. In June of 2016, the Office of Management and Budget issued guidance on software asset management requiring each CFO Act (Public Law 101-576 –

11/15/1990) agency to begin software inventory management (M-16-12). To support these requirements, Offerors may elect to include the terms of Option 1 and/or Option 2, which support software asset management and government-wide reallocation or transferability of perpetually licensed software.

(9) Reallocation of Perpetual Software (Option 2 SIN 511210)

a) The purpose of SIN 511210 OPTION 2 is to allow ordering activities to transfer software assets for a pre-negotiated charge to other ordering activities.

b) When an ordering activity becomes aware that a reusable software asset may be available for transfer, it shall contact the Contractor, identify the software license or licenses in question, and request that these licenses be reallocated or otherwise made available to the new ordering activity.

c) Contractors shall release the original ordering activity from all future obligations under the original license agreement and shall present the new ordering activity with an equivalent license agreement. When the new ordering activity agrees to the license terms, henceforth any subsequent infringement or breach of licensing obligations by the new ordering activity shall be a matter exclusively between the new ordering activity and the Contractor.

d) The original ordering activity shall de-install, and/or make unusable all of the software assets that are to be transferred. It shall have no continuing right to use the software and any usage shall be considered a breach of the Contractor’s intellectual property and a matter of dispute between the original ordering activity/original license grantee and the licensor.

e) As a matter of convenience, once the original licenses are deactivated, di- installed, or made otherwise unusable by the original ordering activity or license grantee, the

Contractor may elect to issue new licenses to the new ordering activity to replace the old licenses. When new licenses are not issued, the Contractor shall provide technical advice on how best to achieve the functional transfer of the software assets.

f) Software assets that are eligible for transfer that have lapsed Software Maintenance

Services (SIN 54151) may require a maintenance reinstatement fee, chargeable to the new ordering activity or license grantee. When such a fee is paid, the new ordering activity shall receive all the rights and benefits of Software Maintenance Services.

g) When software assets are eligible for transfer, and are fully covered under pre- paid

Software Maintenance Services (SIN 54151), the new ordering activity shall not be required to pay maintenance for those license assets prior to the natural termination of the paid for maintenance period. The rights associated with paid for current Software

Maintenance Services shall automatically transfer with the software licenses without fee. When the maintenance period expires, the new ordering activity or license grantee shall have the option to renew maintenance.

h) The administrative fee to support the transfer of licenses, exclusive of any new incremental licensing or maintenance costs shall be percentage (%) of the original license fee. The fee shall be paid only at the time of transfer. In applying the transfer fee, the Software Contractor shall provide transactional data that supports the original costs of the licenses.

10. SOFTWARE CONVERSIONS - (SIN 511210)

Full monetary credit will be allowed to the ordering activity when conversion from one version of the software to another is made as the result of a change in operating system, or from one computer system to another. Under a perpetual license (511210), the purchase price of the new software shall be reduced by the amount that was paid to purchase the earlier version. Under a term license (511210), if conversion credits had accrued while the earlier version was under a term license, those credits shall carry forward and remain available as conversion credits which may be applied towards the perpetual license price of the new version.

11. DESCRIPTIONS AND EQUIPMENT COMPATIBILITY

The Contractor shall include, in the schedule pricelist, a complete description of each software product including the operating systems on which the software can be used.

Also included shall be a brief, introductory explanation of the modules and documentation which are offered.

12. RIGHT-TO-COPY PRICING

The Contractor shall insert the discounted pricing for right-to-copy licenses, if commercially available.

1. SCOPE

The prices, terms and conditions stated under Special Item Number (SIN) 518210C /

518210CRC Cloud Computing Services apply exclusively to Cloud Computing

Services within the scope of this schedule. This SIN provides ordering activities with access to technical services that run in cloud environments and meet the NIST

Definition of Cloud Computing Essential Characteristics. Services relating to or impinging on cloud that do not meet all NIST essential characteristics should be listed in other SINs.

The scope of this SIN is limited to cloud capabilities provided entirely as a service.

Hardware, software and other artifacts supporting the physical construction of a private or other cloud are out of scope for this SIN. Currently, an Ordering Activity can procure the hardware and software needed to build on premise cloud functionality, through combining different services on other SINs (e.g. 54151S).

Sub-categories in scope for this SIN are the three NIST Service Models: Software as a

Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS).

Offerors may optionally select a single sub-category that best fits a proposed cloud service offering. Only one sub-category may be selected per each proposed cloud service offering. Offerors may elect to submit multiple cloud service offerings, each with its own single sub-category. The selection of one of three sub-categories does not prevent Offerors from competing for orders under the other two sub- categories. See service model guidance for advice on sub-category selection.

TERMS AND CONDITIONS APPLICABLE TO PURCHASE OF

CLOUD COMPUTING SERVICES

(SPECIAL ITEM NUMBER 518210C / 518210CRC)

Sub-category selection within this SIN is optional for any individual cloud service offering, and new cloud computing technologies that do not align with the aforementioned three sub-categories may be included without a sub-category selection so long as they comply with the essential characteristics of cloud computing as outlined by NIST.

See Table 1 for a representation of the scope and sub-categories.

Table 1: Cloud Computing Services SIN

SIN Description Sub-Categories

• Commercially available cloud computing services

• Meets the National Institute for Standards and Technology (NIST) definition of Cloud

Computing essential characteristics

• Open to all deployment models (private, public, community or hybrid), vendors specify deployment models

1. Software as a Service (SaaS): Consumer uses provider’s applications on cloud infrastructure.

Does not manage/control platform or infrastructure. Limited application level configuration may be available.

2. Platform as a Service (PaaS): Consumer deploys applications onto cloud platform service using provider- supplied tools. Has control over deployed applications and some limited platform configuration but does not manage the platform or infrastructure.

3. Infrastructure as a Service (IaaS): Consumer provisions computing resources. Has control over

OS, storage, platform, deployed applications and some limited infrastructure configuration, but does not manage the infrastructure

DESCRIPTION OF CLOUD COMPUTING SERVICES AND PRICING

a. Service Description Requirements for Listing Contractors

The description requirements below are in addition to the overall evaluation criteria described in SCP- FSS-001-N Instructions Applicable to New Offerors

(Alternate I – MAR 2016) or SCP-FSS-001-S Instructions Applicable to

Successful FSS Program Contractors, as applicable, SCP-FSS-004 and other relevant publications.

Refer to overall requirements for timelines related to description and other schedule updates, including but not limited to clauses 552.238-81 – section E and clause I-FSS-600.

Table 2 summarizes the additional Contractor-provided description requirements for services proposed under the Cloud Computing Services SIN.

All mandatory description requirements must be complete, and adequate according to evaluation criteria.

In addition there is one “Optional” reporting descriptions which exists to provide convenient service selection by relevant criteria. Where provided, optional description requirements must be complete and adequate according to evaluation criteria:

• The NIST Service Model provides sub-categories for the Cloud SIN and is strongly encouraged, but not required. The Service Model based sub-categories provide this

SIN with a structure to assist ordering activities in locating and comparing services of interest. Contractors may optionally select the single service model most closely corresponding to the specific service offering.

• If a sub-category is selected it will be evaluated with respect to the NIST Service

Model definitions and guidelines in “Guidance for Contractors".

Table 2: Cloud Service Description Requirements

# Description Requirement Reporting Type Instructions

1. Provide a brief written description of how the proposed cloud computing services satisfies each individual essential NIST

Characteristic

Mandatory The cloud service must be capable of satisfying each of the five NIST essential Characteristics as outlined in NIST Special Publication 800-145. See

‘GUIDANCE FOR CONTRACTORS: NIST

Essential

Characteristics’ below in this document for detailed overall direction, as well as guidance on inheriting essential characteristics.

2. Select NIST deployment models for the cloud computing service proposed.

Mandatory Contractors must select at least one NIST deployment model as outlined in NIST Special

Publication 800- 145 describing how the proposed cloud computing service is deployed. Select multiple deployment models if the service is offered in more than one deployment model.

See ‘GUIDANCE FOR CONTRACTORS: NIST

Deployment Model’ below in this document for detailed direction on how to best categorize a service for the NIST deployment models.

3. Optionally select the most appropriate NIST service model that will be the designated subcategory, or may select no sub-category.

Optional Contractor may select a single NIST Service model to sub-categorize the service as outlined in

NIST Special Publication 800-145. Sub-category selection is optional but recommended. See

‘GUIDANCE FOR CONTRACTORS: NIST

Service Model’ below in this document for detailed direction on how to best categorize a service for the NIST IaaS, PaaS, and SaaS service models.

b. Pricing of Cloud Computing Services

All current pricing requirements, including provision SCP-FSS-001-N (Section

III Price Proposal), SCP-FSS-001-S, SCP-FSS-004 (Section III Price Proposal), and clause I-FSS-600 Contract Price Lists, apply. At the current time there is no provision for reducing or eliminating standard price list posting requirements to accommodate rapid cloud price fluctuations.

In addition to standard pricing requirements, all pricing models must have the core capability to meet the NIST Essential Cloud Characteristics, particularly with respect to on-demand self-service, while allowing alternate variations at the task order level at agency discretion, pursuant to the guidance on NIST Essential

Characteristics.

2. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character.

a. Acceptance Testing

Any required Acceptance Test Plans and Procedures shall be negotiated by the

Ordering Activity at task order level. The Contractor shall perform acceptance testing of the systems for Ordering Activity approval in accordance with the approved test procedures

b. Training

If training is provided commercially the Contractor shall provide normal commercial installation, operation, maintenance, and engineering interface training on the system. Contractor is responsible for indicating if there are separate training charges.

c. Information Assurance/Security Requirements

The contractor shall meet information assurance/security requirements in accordance with the Ordering Activity requirements at the Task Order level.

d. Related Professional Services

The Contractor is responsible for working with the Ordering Activity to identify related professional services and any other services available on other SINs that may be associated with deploying a complete cloud solution. Any additional substantial and ongoing professional services related to the offering such as integration, migration, and other cloud professional services are out of scope for this SIN.

e. Performance of Cloud Computing Services

The Contractor shall respond to Ordering Activity requirements at the Task

Order level with proposed capabilities to Ordering Activity performance specifications or indicate that only standard specifications are offered. In all cases the Contractor shall clearly indicate standard service levels, performance and scale capabilities.

The Contractor shall provide appropriate cloud computing services on the date and to the extent and scope agreed to by the Contractor and the Ordering

Activity.

f. Reporting

The Contractor shall respond to Ordering Activity requirements and specify general reporting capabilities available for the Ordering Activity to verify performance, cost and availability.

In accordance with commercial practices, the Contractor may furnish the

Ordering Activity/user with a monthly summary Ordering Activity report.

3. RESPONSIBILITIES OF THE ORDERING ACTIVITY

The Ordering Activity is responsible for indicating the cloud computing services requirements unique to the Ordering Activity. Additional requirements should not contradict existing SIN Terms and Conditions.

Ordering Activities should include (as applicable) Terms & Conditions to address

Pricing, Security, Data Ownership, Geographic Restrictions, Privacy, SLAs, etc.

Cloud services typically operate under a shared responsibility model, with some responsibilities assigned to the Cloud Service Provider (CSP), some assigned to the

Ordering Activity, and others shared between the two. The distribution of responsibilities will vary between providers and across service models. Ordering activities should engage with CSPs to fully understand and evaluate the shared responsibility model proposed. Federal Risk and Authorization Management Program

(FedRAMP) documentation will be helpful regarding the security aspects of shared responsibilities, but operational aspects may require additional discussion with the provider.

a. Ordering Activity Information Assurance/Security Requirements Guidance

(1) The Ordering Activity is responsible for ensuring to the maximum extent practicable that each requirement issued is in compliance with the Federal Information Security

Management Act (FISMA) as applicable.

(2) The Ordering Activity shall assign a required impact level for confidentiality, integrity and availability (CIA) prior to issuing the initial statement of work.2 The Contractor must be capable of meeting at least the minimum security requirements assigned against a low-impact information system in each CIA assessment area (per FIPS 200) and must detail the FISMA capabilities of the system in each of CIA assessment area.

(3) Agency level FISMA certification, accreditation, and evaluation activities are the responsibility of the Ordering Activity. The Ordering Activity reserves the right to independently evaluate, audit, and verify the FISMA compliance for any proposed or awarded Cloud Computing Services.

(4) The Ordering Activity has final responsibility for assessing the FedRAMP status of the service, complying with and making a risk-based decision to grant an Authorization to

Operate (ATO) for the cloud computing service, and continuous monitoring. A memorandum issued by the Office of Management and Budget (OMB) on Dec 8, 2011 outlines the responsibilities of Executive departments and agencies in the context of

FedRAMP compliance. 3

(5) Ordering activities are responsible for determining any additional information assurance and security related requirements based on the nature of the application and relevant mandates.

b. Deployment Model

If a particular deployment model (Private, Public, Community, or Hybrid) is desired, Ordering Activities are responsible for identifying the desired model(s).

Alternately, Ordering Activities could identify requirements and assess

Contractor responses to determine the most appropriate deployment model(s).

c. Delivery Schedule

The Ordering Activity shall specify the delivery schedule as part of the initial requirement. The Delivery Schedule options are found in Information for

Ordering Activities Applicable to All Special Item Numbers.

d. Interoperability

Ordering Activities are responsible for identifying interoperability requirements.

Ordering Activities should clearly delineate requirements for API implementation and standards conformance.

e. Performance of Cloud Computing Services

The Ordering Activity should clearly indicate any custom minimum service levels, performance and scale requirements as part of the initial requirement.

f. Reporting

The Ordering Activity should clearly indicate any cost, performance or availability reporting as part of the initial requirement.

g. Privacy

The Ordering Activity should specify the privacy characteristics of their service and engage with the Contractor to determine if the cloud service is capable of meeting Ordering Activity requirements. For example, a requirement could be requiring assurance that the service is capable of safeguarding Personally

Identifiable Information (PII), in accordance with NIST SP 800-1224 and OMB memos M-06-165 and M- 07-166. An Ordering Activity will determine what data elements constitute PII according to OMB Policy, NIST Guidance and

Ordering Activity policy.

h. Accessibility

The Ordering Activity should specify the accessibility characteristics of their service and engage with the Contractor to determine the cloud service is capable of meeting Ordering Activity requirements. For example, a requirement could require assurance that the service is capable of providing accessibility based on

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

i. Geographic Requirements

Ordering activities are responsible for specifying any geographic requirements and engaging with the Contractor to determine that the cloud services offered have the capabilities to meet geographic requirements for all anticipated task orders. Common geographic concerns could include whether service data, processes and related artifacts can be confined on request to the United States and its territories, or the continental United States (CONUS).

j. Data Ownership and Retrieval and Intellectual Property

Intellectual property rights are not typically transferred in a cloud model. In general, CSPs retain ownership of the Intellectual Property (IP) underlying their services and the customer retains ownership of its intellectual property. The

CSP gives the customer a license to use the cloud services for the duration of the contract without transferring rights. The government retains ownership of the IP and data they bring to the customized use of the service as spelled out in the

FAR and related materials.

General considerations of data ownership and retrieval are covered under the terms of this schedule and the FAR and other laws, ordinances, and regulations

(Federal, State, City, or otherwise). Because of considerations arising from cloud shared responsibility models, ordering activities should engage with the

Contractor to develop more cloud- specific understandings of the boundaries between data owned by the government and that owned by the cloud service provider, and the specific terms of data retrieval.

In all cases, the Ordering Activity should enter into an agreement with a clear and enforceable understanding of the boundaries between government and cloud service provider data, and the form, format and mode of delivery for each kind of data belonging to the government.

The Ordering Activity should expect that the Contractor shall transfer data to the government at the government's request at any time, and in all cases when the service or order is terminated for any reason, by means, in formats and within a scope clearly understood at the initiation of the service. Example cases that might require clarification include status and mode of delivery for:

• Configuration information created by the government and affecting the government’s use of the cloud provider’s service.

• Virtual machine configurations created by the government but operating on the cloud provider’s service.

• Profile, configuration and other metadata used to configure SaaS application services or PaaS platform services.

The key is to determine in advance the ownership of classes of data and the means by which Government owned data can be returned to the Government.

k. Service Location Distribution

The Ordering Activity should determine requirements for continuity of operations and performance and engage with the Contractor to ensure that cloud services have adequate service location distribution to meet anticipated requirements. Typical concerns include ensuring that:

• Physical locations underlying the cloud are numerous enough to provide continuity of operations and geographically separate enough to avoid an anticipated single point of failure within the scope of anticipated emergency events.

• Service endpoints for the cloud are able to meet anticipated performance requirements in terms of geographic proximity to service requestors.

Note that cloud providers may address concerns in the form of minimum distance between service locations, general regions where service locations are available, etc.

l. Related Professional Services

Ordering activities should engage with Contractors to discuss the availability of limited assistance with initial setup, training and access to the services that may be available through this SIN.

Any additional substantial and ongoing professional services related to the offering such as integration, migration, and other cloud professional services are out of scope for this SIN. Ordering activities should consult the appropriate

GSA professional services schedule.

4. GUIDANCE FOR CONTRACTORS

This section offers guidance for interpreting the Contractor Description Requirements in Table 2, including the NIST essential cloud characteristics, service models and deployment models. This section is not a list of requirements.

Contractor-specific definitions of cloud computing characteristics and models or significant variances from the NIST essential characteristics or models are discouraged and will…