MAS - Solution Guidance Corporation - GS35F198AA

GENERAL SERVICES ADMINISTRATION

FEDERAL SUPPLY SERVICE

AUTHORIZED FEDERAL SUPPLY SCHEDULE PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage!™, a menu-driven database system. The INTERNET address for GSA Advantage! ™ is: http://www.GSAAdvantage.gov.

MULTIPLE AWARD SCHEDULE

Federal Supply Group: General Purpose Commercial Information Technology

CONTRACT NUMBER:

GS35F198AA

CONTRACT PERIOD:

February 13, 2013 – February 12, 2023

Solution Guidance Corporation (SGC) 14291 Park Meadow Drive, Suite 150 Chantilly, VA, 20151 Phone: 703-961-1602 Fax: 703-961-1607 www.solutionguidance.com

Point of Contact: Ms. Kelley Witmer Phone: 703-961-1602 x 1050 Email: kwitmer@solutionguidance.com

BUSINESS SIZE:

Small, Disadvantaged, 8(a), Woman Owned Business

For more information on ordering from Federal Supply Schedules click on the FSS Schedules button at http://www.fss.gsa.gov

GSA AWARDED TERMS AND CONDITIONS

Solution Guidance Corporation (SGC)

1a. Table of awarded special item numbers with appropriate cross-reference to item descriptions.

511210 (132-32)*

518210C (132-40)*

54151S (132-51)*

54151ECOM

(132-52)*

* Items in parenthesis are the SIN under the pre-MAS format

14291 Park Meadow Drive, Suite 150 Chantilly, VA, 20151 Kwitmer@solutionguidance.com

14291 Park Meadow Drive, Suite 150 Chantilly, VA, 20151 Kwitmer@solutionguidance.com

INFORMATION FOR ORDERING ACTIVITIES

Special Notice to Agencies: Small Business Participation SBA strongly supports the participation of small business concerns in the Federal Acquisition Service. To enhance Small Business Participation SBA policy allows agencies to include in their procurement base and goals, the dollar value of orders expected to be placed against the Federal Supply Schedules, and to report accomplishments against these goals.

For orders exceeding the micropurchase threshold, FAR 8.404 requires agencies to consider the catalogs/pricelists of at least three schedule contractors or consider reasonably available information by using the GSA Advantage!TM on- line shopping service (www.gsaadvantage.gov). The catalogs/pricelists, GSA Advantage!TM and the Federal Acquisition Service Home Page (www.gsa.gov/fas) contain information on a broad array of products and services offered by small business concerns.

This information should be used as a tool to assist ordering activities in meeting or exceeding established small business goals. It should also be used as a tool to assist in including small, small disadvantaged, and women-owned small businesses among those considered when selecting pricelists for a best value determination.

For orders exceeding the micropurchase threshold, customers are to give preference to small business concerns when two or more items at the same delivered price will satisfy their requirement.TERMS AND CONDITIONS APPLICABLE TO TERM SOFTWARE LICENSES

(SPECIAL ITEM NUMBER 511210 / 511210RC)

INSPECTION/ACCEPTANCE

The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The ordering activity reserves the right to inspect or test any software that has been tendered for acceptance. The ordering activity may require repair or replacement of nonconforming software at no increase in contract price. The ordering activity must exercise its post acceptance rights (1) within a reasonable time after the defect was discovered or should have been discovered; and (2) before any substantial change occurs in the condition of the software, unless the change is due to the defect in the software. Inspection of services is in accordance with 552.212-4 CONTRACT TERMS AND CONDITIONS–COMMERCIAL ITEMS (JAN 2017) (DEVIATION – FEB 2007) (DEVIATION - FEB 2018) for Firm-Fixed Price orders; or GSAR 552.212-4 CONTRACT TERMS AND CONDITIONS-COMMERCIAL ITEMS (JAN 2017) (DEVIATION - FEB 2018) (ALTERNATE I - JAN 2017) (DEVIATION - FEB 2007) for Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

COMMERCIAL SUPPLIER AGREEMENTS

Commercial Supplier Agreements to include Enterprise User License Agreements or Terms of Service (TOS) agreements. The Contractor shall provide all Commercial Supplier Agreements to include Enterprise User License Agreements or Terms of Service (TOS) agreements in an editable Microsoft Office (Word) format for review prior to award.

GUARANTEE/WARRANTY

a. The Contractor’s commercial guarantee/warranty shall be included in the Commercial Supplier Agreement to include Enterprise User License Agreements or Terms of Service (TOS) agreements.

b. The Contractor warrants and implies that the items delivered hereunder are merchantable and fit for use for the particular purpose described in this contract. If no implied warranties are given, an express warranty of at least 60 days must be given in accordance with FAR 12.404(b)(2)

c. Limitation of Liability. Except as otherwise provided by an express or implied warranty, the Contractor will not be liable to the ordering activity for consequential damages resulting from any defect or deficiencies in accepted items.

TECHNICAL SERVICES

The Contractor, without additional charge to the ordering activity, shall provide a hot line technical support number _____ for the purpose of providing user assistance and guidance in the implementation of the software. The technical support number is available from ____________ to ____________.

SOFTWARE MAINTENANCE

a. Software maintenance as it is defined: (select software maintenance type) :

(1) _______Software Maintenance as a Product (SIN 511210) Software maintenance as a product includes the publishing of bug/defect fixes via patches and updates/upgrades in function and technology to maintain the operability and usability of the software product. It may also include other no charge support that is included in the purchase price of the product in the commercial marketplace. No charge support includes items such as user blogs, discussion forums, on-line help libraries and Frequently Asked Questions (FAQ’s), hosted chat rooms, and limited telephone, email and/or web-based general technical support for user’s self-diagnostics.

Software maintenance as a product does NOT include the creation, design, implementation, integration, etc. of a software package. These examples are considered software maintenance services.

Software Maintenance as a product is billed at the time of purchase.

(2) ________Software Maintenance Services (SIN 54151) Software maintenance services creates, designs, implements, and/or integrates customized changes to software that solve one or more problems and is not included with the price of the software. Software maintenance services includes person-to-person communications regardless of the medium used to communicate: telephone support, on- line technical support, customized support, and/or technical expertise which are charged commercially. Software maintenance services are billed in arrears in accordance with 31 U.S.C. § 3324.

b. Invoices for maintenance service shall be submitted by the Contractor on a quarterly or monthly basis, after the completion of such period. Maintenance charges must be paid in arrears (31 U.S.C. § 3324). PROMPT PAYMENT DISCOUNT, IF APPLICABLE, SHALL BE SHOWN ON THE INVOICE.

PERIODS OF TERM LICENSES (SIN 511210) AND SOFTWARE MAINTENANCE SERVICES (SIN 54151)

a. The Contractor shall honor orders for periods for the duration of the contract period or a lesser period of time.

b. Term licenses and/or software maintenance services may be discontinued by the ordering activity on thirty (30) calendar days written notice to the Contractor.

c. Annual Funding. When using annually appropriated funds are cited on an order for term licenses and/or software maintenance services, the period of the term licenses and/or software maintenance services shall automatically expire on September 30 of the contract period.

d. Cross-Year Funding Within Contract Period. Where an ordering activity’s specific appropriation authority provides for funds in excess of a 12 month (fiscal year) period, the ordering activity may place an order under this schedule contract for a period up to the expiration of the contract period, notwithstanding the intervening fiscal years.

e. Ordering activities should notify the Contractor in writing thirty (30) calendar days prior to the expiration of an order, if the term licenses and/or maintenance is to be terminated at that time. Orders for the continuation of term licenses and/or software maintenance services will be required if the term licenses and/or maintenance is to be continued during the subsequent period.

CONVERSION FROM TERM LICENSE TO PERPETUAL LICENSE

a. When a contractor commercially offers conversions of term licenses to perpetual licenses, and an ordering activity requests such a conversion, the contractor shall provide the total amount of conversion credits available for the subject software within ten (10) calendar days after placing the order.

b. When conversion credits are provided, they shall continue to accrue from one contract period to the next, provided the software has been continually licensed without interruption.

c. The term license for each software product shall be discontinued on the day immediately preceding the effective date of conversion from a term license to a perpetual license.

d. When conversion from term licenses to perpetual licenses is offered, the price the ordering activity shall pay will be the perpetual license price that prevailed at the time such software was initially ordered under a term license, or the perpetual license price prevailing at the time of conversion from a term license to a perpetual license, whichever is the less, minus an amount equal to a percentage of all term license payments during the period that the software was under a term license within the ordering activity.

TERM LICENSE CESSATION

a. After a software product has been on a continuous term license for a period of ______ months, a fully paid-up, non-exclusive, perpetual license for the software product shall automatically accrue to the ordering activity. The period of continuous term license for automatic accrual of a fully paid-up perpetual license does not have to be achieved during a particular fiscal year; it is a written Contractor commitment which continues to be available for software that is initially ordered under this contract, until a fully paid-up perpetual license accrues to the ordering activity. However, should the term license of the software be discontinued before the specified period of the continuous term license has been satisfied, the perpetual license accrual shall be forfeited. Contractors who do not commercially offer conversions of term licenses to perpetual licenses shall indicate that their term licenses are not eligible for conversion at any time.

b. The Contractor agrees to provide updates and software maintenance services for the software after a perpetual license has accrued, at the prices and terms of SIN 54151, if the licensee elects to order such services. Title to the software shall remain with the Contractor.

UTILIZATION LIMITATIONS - (SIN 511210, SIN 511210, AND SIN 54151)

a. Software acquisition is limited to commercial computer software defined in FAR Part 2.101.

b. When acquired by the ordering activity, commercial computer software and related documentation so legend shall be subject to the following:

(1) Title to and ownership of the software and documentation shall remain with the Contractor, unless otherwise specified.

(2) Software licenses are by site and by ordering activity. An ordering activity is defined as a cabinet level or independent ordering activity. The software may be used by any subdivision of the ordering activity (service, bureau, division, command, etc.) that has access to the site the software is placed at, even if the subdivision did not participate in the acquisition of the software. Further, the software may be used on a sharing basis where multiple agencies have joint projects that can be satisfied by the use of the software placed at one ordering activity's site. This would allow other agencies access to one ordering activity's database. For ordering activity public domain databases, user agencies and third parties may use the computer program to enter, retrieve, analyze and present data. The user ordering activity will take appropriate action by instruction, agreement, or otherwise, to protect the Contractor's proprietary property with any third parties that are permitted access to the computer programs and documentation in connection with the user ordering activity's permitted use of the computer programs and documentation. For purposes of this section, all such permitted third parties shall be deemed agents of the user ordering activity.

(3) Except as is provided in paragraph 9.b(2) above, the ordering activity shall not provide or otherwise make available the software or documentation, or any portion thereof, in any form, to any third party without the prior written approval of the Contractor. Third parties do not include prime Contractors, subcontractors and agents of the ordering activity who have the ordering activity's permission to use the licensed software and documentation at the facility, and who have agreed to use the licensed software and documentation only in accordance with these restrictions. This provision does not limit the right of the ordering activity to use software, documentation, or information therein, which the ordering activity may already have or obtains without restrictions.

(4) The ordering activity shall have the right to use the software and documentation with the run-time computing environment (e.g. operating system, virtual machine, mobile operating system, processor etc.) to be specifically identified for which it is acquired at any other facility/user device to which that time computing environment may be transferred, or in cases of Disaster Recovery, the ordering activity has the right to transfer the software to another site/user device if the ordering activity site for which it is acquired is deemed to be unsafe for ordering activity personnel; to use the software and documentation with a backup time computing environment when the primary is inoperative; to copy computer programs for safekeeping (archives) or backup purposes; to transfer a copy of the software to another site/user for purposes of benchmarking new hardware and/or software; and to modify the software and documentation or combine it with other software, provided that the unmodified portions shall remain subject to these restrictions.

(5) "Commercial Computer Software" may be marked with the Contractor's standard commercial restricted rights legend, but the schedule contract and schedule pricelist, including this clause, "Utilization Limitations" are the only governing terms and conditions, and shall take precedence and supersede any different or additional terms and conditions included in the standard commercial legend.

(6) Licensee Data belongs exclusively to Licensee, regardless of where the Data may reside at any moment in time including, but not limited to Licensor hardware, networks or other infrastructure and facilities where Data may reside, transit through or be stored from time to time. Licensor makes no claim to a right of ownership in Licensee Data. Licensor agrees to keep the Licensee Data Confidential as that term is defined in the relevant FAR and DFARS provisions pertaining to Confidential Information and Confidentiality. Licensor is not permitted to use Licensee’s data for a purpose that is not explicitly granted in writing by Licensee. Upon Licensee request, for any reason whatsoever, Licensor must promptly return all Licensee Data in Licensor’s possession in a format as may be designated at the time of request by Licensee.

(7) Licensee may create or hire others (including Licensor) to create modifications, customizations or other enhancements to the Software which might be classified as “Derivative Works” of the software. Unless otherwise negotiated and mutually agreed upon at the order level, the intellectual property (IP) rights to the Derivative Works shall be owned by the owner of the underlying intellectual property. The Derivative Work[s] shall be made available to the Licensee through a royalty free, perpetual worldwide, no charge license to the Licensee.

(8) Software Asset Identification Tags (SWID) (Option 1 SIN 511210) Option 1 is applicable when the Offeror agrees to include the International Organization for Standardization/ International Electrotechnical Commission 19770-2 (ISO/IEC 19770- 2:2015) standard identification tag (SWID Tag) as an embedded element in the software. An ISO/IEC 19970-2 tag is a discoverable identification element in software that provides licensees enhanced asset visibility. Enhance visibility supports both the goals of better software asset management and license compliance. Offerors may use the National Institute of Standards and Technology (NIST) document “NISTIR 8060: Guidelines for Creation of Interoperable Software Identification (SWID) Tags,” December 2015 to determine if they are in compliance with the ISO/IEC 19770-2 standard.

Section 837 of The Federal Information Technology Acquisition Reform Act (FITARA) of 2014, requires GSA to seek agreements with software vendors that enhance government- wide acquisition, shared use, and dissemination of software, as well as compliance with end user license agreements. The Megabyte Act of 2016 requires agencies to inventory software assets and to make informed decisions prior to new software acquisitions. In June of 2016, the Office of Management and Budget issued guidance on software asset management requiring each CFO Act (Public Law 101-576 – 11/15/1990) agency to begin software inventory management (M-16-12). To support these requirements, Offerors may elect to include the terms of Option 1 and/or Option 2, which support software asset management and government-wide reallocation or transferability of perpetually licensed software.

(9) Reallocation of Perpetual Software (Option 2 SIN 511210)

a) The purpose of SIN 511210 OPTION 2 is to allow ordering activities to transfer software assets for a pre-negotiated charge to other ordering activities.

b) When an ordering activity becomes aware that a reusable software asset may be available for transfer, it shall contact the Contractor, identify the software license or licenses in question, and request that these licenses be reallocated or otherwise made available to the new ordering activity.

c) Contractors shall release the original ordering activity from all future obligations under the original license agreement and shall present the new ordering activity with an equivalent license agreement. When the new ordering activity agrees to the license terms, henceforth any subsequent infringement or breach of licensing obligations by the new ordering activity shall be a matter exclusively between the new ordering activity and the Contractor.

d) The original ordering activity shall de-install, and/or make unusable all of the software assets that are to be transferred. It shall have no continuing right to use the software and any usage shall be considered a breach of the Contractor’s intellectual property and a matter of dispute between the original ordering activity/original license grantee and the licensor.

e) As a matter of convenience, once the original licenses are deactivated, di- installed, or made otherwise unusable by the original ordering activity or license grantee, the Contractor may elect to issue new licenses to the new ordering activity to replace the old licenses. When new licenses are not issued, the Contractor shall provide technical advice on how best to achieve the functional transfer of the software assets.

f) Software assets that are eligible for transfer that have lapsed Software Maintenance Services (SIN 54151) may require a maintenance reinstatement fee, chargeable to the new ordering activity or license grantee. When such a fee is paid, the new ordering activity shall receive all the rights and benefits of Software Maintenance Services.

g) When software assets are eligible for transfer, and are fully covered under pre- paid Software Maintenance Services (SIN 54151), the new ordering activity shall not be required to pay maintenance for those license assets prior to the natural termination of the paid for maintenance period. The rights associated with paid for current Software Maintenance Services shall automatically transfer with the software licenses without fee. When the maintenance period expires, the new ordering activity or license grantee shall have the option to renew maintenance.

h) The administrative fee to support the transfer of licenses, exclusive of any new incremental licensing or maintenance costs shall be percentage (%) of the original license fee. The fee shall be paid only at the time of transfer. In applying the transfer fee, the Software Contractor shall provide transactional data that supports the original costs of the licenses.

SOFTWARE CONVERSIONS - (SIN 511210)

Full monetary credit will be allowed to the ordering activity when conversion from one version of the software to another is made as the result of a change in operating system, or from one computer system to another. Under a perpetual license (511210), the purchase price of the new software shall be reduced by the amount that was paid to purchase the earlier version. Under a term license (511210), if conversion credits had accrued while the earlier version was under a term license, those credits shall carry forward and remain available as conversion credits which may be applied towards the perpetual license price of the new version.

DESCRIPTIONS AND EQUIPMENT COMPATIBILITY

The Contractor shall include, in the schedule pricelist, a complete description of each software product including the operating systems on which the software can be used. Also included shall be a brief, introductory explanation of the modules and documentation which are offered.

RIGHT-TO-COPY PRICING

The Contractor shall insert the discounted pricing for right-to-copy licenses, if commercially available.

TERMS AND CONDITIONS APPLICABLE TO PURCHASE OF

CLOUD COMPUTING SERVICES

(SPECIAL ITEM NUMBER 518210C / 518210CRC)

1. SCOPE

The prices, terms and conditions stated under Special Item Number (SIN) 518210C / 518210CRC Cloud Computing Services apply exclusively to Cloud Computing Services within the scope of this schedule. This SIN provides ordering activities with access to technical services that run in cloud environments and meet the NIST Definition of Cloud Computing Essential Characteristics. Services relating to or impinging on cloud that do not meet all NIST essential characteristics should be listed in other SINs.

The scope of this SIN is limited to cloud capabilities provided entirely as a service. Hardware, software and other artifacts supporting the physical construction of a private or other cloud are out of scope for this SIN. Currently, an Ordering Activity can procure the hardware and software needed to build on premise cloud functionality, through combining different services on other SINs (e.g. 54151S).

Sub-categories in scope for this SIN are the three NIST Service Models: Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). Offerors may optionally select a single sub-category that best fits a proposed cloud service offering. Only one sub-category may be selected per each proposed cloud service offering. Offerors may elect to submit multiple cloud service offerings, each with its own single sub-category. The selection of one of three sub-categories does not prevent Offerors from competing for orders under the other two sub- categories. See service model guidance for advice on sub-category selection.

Sub-category selection within this SIN is optional for any individual cloud service offering, and new cloud computing technologies that do not align with the aforementioned three sub-categories may be included without a sub-category selection so long as they comply with the essential characteristics of cloud computing as outlined by NIST.

See Table 1 for a representation of the scope and sub-categories.

Table 1: Cloud Computing Services SIN

· Commercially available cloud computing services

· Meets the National Institute for Standards and Technology (NIST) definition of Cloud Computing essential characteristics

· Open to all deployment models (private, public, community or hybrid), vendors specify deployment models

1. Software as a Service (SaaS): Consumer uses provider’s applications on cloud infrastructure. Does not manage/control platform or infrastructure. Limited application level configuration may be available.

2. Platform as a Service (PaaS): Consumer deploys applications onto cloud platform service using provider- supplied tools. Has control over deployed applications and some limited platform configuration but does not manage the platform or infrastructure.

3. Infrastructure as a Service (IaaS): Consumer provisions computing resources. Has control over OS, storage, platform, deployed applications and some limited infrastructure configuration, but does not manage the infrastructure

DESCRIPTION OF CLOUD COMPUTING SERVICES AND PRICING

a. Service Description Requirements for Listing Contractors The description requirements below are in addition to the overall evaluation criteria described in SCP- FSS-001-N Instructions Applicable to New Offerors (Alternate I – MAR 2016) or SCP-FSS-001-S Instructions Applicable to Successful FSS Program Contractors, as applicable, SCP-FSS-004 and other relevant publications.

Refer to overall requirements for timelines related to description and other schedule updates, including but not limited to clauses 552.238-81 – section E and clause I-FSS-600.

Table 2 summarizes the additional Contractor-provided description requirements for services proposed under the Cloud Computing Services SIN. All mandatory description requirements must be complete, and adequate according to evaluation criteria.

In addition there is one “Optional” reporting descriptions which exists to provide convenient service selection by relevant criteria. Where provided, optional description requirements must be complete and adequate according to evaluation criteria:

· The NIST Service Model provides sub-categories for the Cloud SIN and is strongly encouraged, but not required. The Service Model based sub-categories provide this SIN with a structure to assist ordering activities in locating and comparing services of interest. Contractors may optionally select the single service model most closely corresponding to the specific service offering.

· If a sub-category is selected it will be evaluated with respect to the NIST Service Model definitions and guidelines in “Guidance for Contractors".

Table 2: Cloud Service Description Requirements

Characteristics’ below in this document for detailed overall direction, as well as guidance on inheriting essential characteristics.

See ‘GUIDANCE FOR CONTRACTORS: NIST Deployment Model’ below in this document for detailed direction on how to best categorize a service for the NIST deployment models.

b. Pricing of Cloud Computing Services All current pricing requirements, including provision SCP-FSS-001-N (Section III Price Proposal), SCP-FSS-001-S, SCP-FSS-004 (Section III Price Proposal), and clause I-FSS-600 Contract Price Lists, apply. At the current time there is no provision for reducing or eliminating standard price list posting requirements to accommodate rapid cloud price fluctuations.

In addition to standard pricing requirements, all pricing models must have the core capability to meet the NIST Essential Cloud Characteristics, particularly with respect to on-demand self-service, while allowing alternate variations at the task order level at agency discretion, pursuant to the guidance on NIST Essential Characteristics.

1. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character.

a. Acceptance Testing Any required Acceptance Test Plans and Procedures shall be negotiated by the Ordering Activity at task order level. The Contractor shall perform acceptance testing of the systems for Ordering Activity approval in accordance with the approved test procedures

b. Training If training is provided commercially the Contractor shall provide normal commercial installation, operation, maintenance, and engineering interface training on the system. Contractor is responsible for indicating if there are separate training charges.

c. Information Assurance/Security Requirements The contractor shall meet information assurance/security requirements in accordance with the Ordering Activity requirements at the Task Order level.

d. Related Professional Services The Contractor is responsible for working with the Ordering Activity to identify related professional services and any other services available on other SINs that may be associated with deploying a complete cloud solution. Any additional substantial and ongoing professional services related to the offering such as integration, migration, and other cloud professional services are out of scope for this SIN.

e. Performance of Cloud Computing Services The Contractor shall respond to Ordering Activity requirements at the Task Order level with proposed capabilities to Ordering Activity performance specifications or indicate that only standard specifications are offered. In all cases the Contractor shall clearly indicate standard service levels, performance and scale capabilities.

The Contractor shall provide appropriate cloud computing services on the date and to the extent and scope agreed to by the Contractor and the Ordering Activity.

f. Reporting The Contractor shall respond to Ordering Activity requirements and specify general reporting capabilities available for the Ordering Activity to verify performance, cost and availability.

In accordance with commercial practices, the Contractor may furnish the Ordering Activity/user with a monthly summary Ordering Activity report.

1. RESPONSIBILITIES OF THE ORDERING ACTIVITY

The Ordering Activity is responsible for indicating the cloud computing services requirements unique to the Ordering Activity. Additional requirements should not contradict existing SIN Terms and Conditions.

Ordering Activities should include (as applicable) Terms & Conditions to address Pricing, Security, Data Ownership, Geographic Restrictions, Privacy, SLAs, etc.

Cloud services typically operate under a shared responsibility model, with some responsibilities assigned to the Cloud Service Provider (CSP), some assigned to the Ordering Activity, and others shared between the two. The distribution of responsibilities will vary between providers and across service models. Ordering activities should engage with CSPs to fully understand and evaluate the shared responsibility model proposed. Federal Risk and Authorization Management Program (FedRAMP) documentation will be helpful regarding the security aspects of shared responsibilities, but operational aspects may require additional discussion with the provider.

a. Ordering Activity Information Assurance/Security Requirements Guidance

(1) The Ordering Activity is responsible for ensuring to the maximum extent practicable that each requirement issued is in compliance with the Federal Information Security Management Act (FISMA) as applicable.

(2) The Ordering Activity shall assign a required impact level for confidentiality, integrity and availability (CIA) prior to issuing the initial statement of work.2 The Contractor must be capable of meeting at least the minimum security requirements assigned against a low-impact information system in each CIA assessment area (per FIPS 200) and must detail the FISMA capabilities of the system in each of CIA assessment area.

(3) Agency level FISMA certification, accreditation, and evaluation activities are the responsibility of the Ordering Activity. The Ordering Activity reserves the right to independently evaluate, audit, and verify the FISMA compliance for any proposed or awarded Cloud Computing Services.

(4) The Ordering Activity has final responsibility for assessing the FedRAMP status of the service, complying with and making a risk-based decision to grant an Authorization to Operate (ATO) for the cloud computing service, and continuous monitoring. A memorandum issued by the Office of Management and Budget (OMB) on Dec 8, 2011 outlines the responsibilities of Executive departments and agencies in the context of FedRAMP compliance. 3

(5) Ordering activities are responsible for determining any additional information assurance and security related requirements based on the nature of the application and relevant mandates.

b. Deployment Model If a particular deployment model (Private, Public, Community, or Hybrid) is desired, Ordering Activities are responsible for identifying the desired model(s). Alternately, Ordering Activities could identify requirements and assess Contractor responses to determine the most appropriate deployment model(s).

c. Delivery Schedule The Ordering Activity shall specify the delivery schedule as part of the initial requirement. The Delivery Schedule options are found in Information for Ordering Activities Applicable to All Special Item Numbers.

d. Interoperability Ordering Activities are responsible for identifying interoperability requirements. Ordering Activities should clearly delineate requirements for API implementation and standards conformance.

e. Performance of Cloud Computing Services The Ordering Activity should clearly indicate any custom minimum service levels, performance and scale requirements as part of the initial requirement.

f. Reporting The Ordering Activity should clearly indicate any cost, performance or availability reporting as part of the initial requirement.

g. Privacy The Ordering Activity should specify the privacy characteristics of their service and engage with the Contractor to determine if the cloud service is capable of meeting Ordering Activity requirements. For example, a requirement could be requiring assurance that the service is capable of safeguarding Personally Identifiable Information (PII), in accordance with NIST SP 800-1224 and OMB memos M-06-165 and M- 07-166. An Ordering Activity will determine what data elements constitute PII according to OMB Policy, NIST Guidance and Ordering Activity policy.

h. Accessibility The Ordering Activity should specify the accessibility characteristics of their service and engage with the Contractor to determine the cloud service is capable of meeting Ordering Activity requirements. For example, a requirement could require assurance that the service is capable of providing accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

i. Geographic Requirements Ordering activities are responsible for specifying any geographic requirements and engaging with the Contractor to determine that the cloud services offered have the capabilities to meet geographic requirements for all anticipated task orders. Common geographic concerns could include whether service data, processes and related artifacts can be confined on request to the United States and its territories, or the continental United States (CONUS).

j. Data Ownership and Retrieval and Intellectual Property Intellectual property rights are not typically transferred in a cloud model. In general, CSPs retain ownership of the Intellectual Property (IP) underlying their services and the customer retains ownership of its intellectual property. The CSP gives the customer a license to use the cloud services for the duration of the contract without transferring rights. The government retains ownership of the IP and data they bring to the customized use of the service as spelled out in the FAR and related materials.

General considerations of data ownership and retrieval are covered under the terms of this schedule and the FAR and other laws, ordinances, and regulations (Federal, State, City, or otherwise). Because of considerations arising from cloud shared responsibility models, ordering activities should engage with the Contractor to develop more cloud- specific understandings of the boundaries between data owned by the government and that owned by the cloud service provider, and the specific terms of data retrieval.

In all cases, the Ordering Activity should enter into an agreement with a clear and enforceable understanding of the boundaries between government and cloud service provider data, and the form, format and mode of delivery for each kind of data belonging to the government.

The Ordering Activity should expect that the Contractor shall transfer data to the government at the government's request at any time, and in all cases when the service or order is terminated for any reason, by means, in formats and within a scope clearly understood at the initiation of the service. Example cases that might require clarification include status and mode of delivery for:

· Configuration information created by the government and affecting the government’s use of the cloud provider’s service.

· Virtual machine configurations created by the government but operating on the cloud provider’s service.

· Profile, configuration and other metadata used to configure SaaS application services or PaaS platform services.

The key is to determine in advance the ownership of classes of data and the means by which Government owned data can be returned to the Government.

k. Service Location Distribution The Ordering Activity should determine requirements for continuity of operations and performance and engage with the Contractor to ensure that cloud services have adequate service location distribution to meet anticipated requirements. Typical concerns include ensuring that:

· Physical locations underlying the cloud are numerous enough to provide continuity of operations and geographically separate enough to avoid an anticipated single point of failure within the scope of anticipated emergency events.

· Service endpoints for the cloud are able to meet anticipated performance requirements in terms of geographic proximity to service requestors.

Note that cloud providers may address concerns in the form of minimum distance between service locations, general regions where service locations are available, etc.

l. Related Professional Services Ordering activities should engage with Contractors to discuss the availability of limited assistance with initial setup, training and access to the services that may be available through this SIN.

Any additional substantial and ongoing professional services related to the offering such as integration, migration, and other cloud professional services are out of scope for this SIN. Ordering activities should consult the appropriate GSA professional services schedule.

1. GUIDANCE FOR CONTRACTORS

This section offers guidance for interpreting the Contractor Description Requirements in Table 2, including the NIST essential cloud characteristics, service models and deployment models. This section is not a list of requirements.

Contractor-specific definitions of cloud computing characteristics and models or significant variances from the NIST essential characteristics or models are discouraged and will not be considered in the scope of this SIN or accepted in response to Factors for Evaluation. The only applicable cloud characteristics, service model/subcategories and deployment models for this SIN will be drawn from the NIST 800-145 special publication. Services qualifying for listing as cloud computing services under this SIN must substantially satisfy the essential characteristics of cloud computing as documented in the NIST Definition of Cloud Computing SP 800-1457 .

Contractors must select deployment models corresponding to each way the service can be deployed. Multiple deployment model designations for a single cloud service are permitted but at least one deployment model must be selected.

In addition, contractors submitting services for listing under this SIN are encouraged to select a subcategory for each service proposed under this SIN with respect to a single principal NIST cloud service model that most aptly characterizes the service. Service model categorization is optional.

Both service and deployment model designations must accord with NIST definitions. Guidance is offered in this document on making the most appropriate selection.

a. NIST Essential Characteristics General Guidance

NIST’s essential cloud characteristics provide a consistent metric for whether a service is eligible for inclusion in this SIN. It is understood that due to legislative, funding and other constraints that government entities cannot always leverage a cloud service to the extent that all NIST essential characteristics are commercially available. For the purposes of the Cloud SIN, meeting the NIST essential characteristics is determined by whether each essential capability of the commercial service is available for the service, whether or not the Ordering Activity actually requests or implements the capability. The guidance in Table 3 offers examples of how services might or might not be included based on the essential characteristics, and how the Contractor should interpret the characteristics in light of current government contracting processes.

Table 3: Guidance on Meeting NIST Essential Characteristics

· This characteristic is typically implemented via a service console or programming interface for provisioning Government procurement guidance varies on how to implement on-demand provisioning at this time.

Ordering activities may approach on-demand in a variety of ways, including “not-to-exceed” limits, or imposing monthly or annual payments on what are essentially on demand services.

Services under this SIN must be capable of true on-demand self-service, and ordering activities and Contractors must negotiate how they implement on demand capabilities in practice at the task order level:

· Ordering activities must specify their procurement approach and requirements for on-demand service

· Contractors must propose how they intend to meet the approach

· Contractors must certify that on-demand self- service is technically available for their service should procurement guidance become available

· Service can be accessed and consumed using standard devices such as browsers, tablets and mobile phones

· Broad network access must be available without significant qualification and in relation to the deployment model and security domain of the service

· Contractors must specify any ancillary activities, services or equipment required to access cloud services or integrate cloud with other cloud or non-cloud networks and services. For example a private cloud might require an Ordering Activity to purchase or provide a dedicated router, etc. which is acceptable but should be indicated by the Contractor

· Ordering activities draw resources from a common pool maintained by the Contractor

· Resources may have general characteristics such as regional location

· The cloud service must…