J.1 Judiciary Cloud PWS Final.pdf

REPRESENTATIVE DOCUMENT FOR DISCUSSION PURPOSES

Page i of 13

1. BACKGROUND

2. OVERVIEW

3. SCOPE OF SERVICES

3.1 PERIOD OF PERFORMANCE

3.2 PLACE OF PERFORMANCE

4. GENERAL REQUIREMENTS

4.1 REFERENCED DOCUMENTS

4.2 BPA ADMINISTRATION AND MANAGEMENT

5. PERFORMANCE REQUIREMENTS

5.1 CSP SERVICES

5.2 FUNCTIONAL CATEGORIES

6. TECHNICAL SUPPORT

6.1 PROFESSIONAL SERVICES

6.1.1 Infrastructure Engineering

6.1.2 Software Engineering

6.1.3 Security Engineering

6.2 TRAINING SUPPORT

6.3 CCE ENVIRONMENT CYBERSECURITY AND COMPLIANCE

6.4 OPERATIONAL PROGRAM MANAGEMENT SERVICES

6.5 FINANCIAL MANAGEMENT

6.6 TRANSITION SUPPORT

6.6.1 Transition-In

6.6.2 Transition-Out

6.7 DELIVERABLES

6.8 PERFORMANCE STANDARDS

6.9 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

PERFORMANCE WORK STATEMENT

1. BACKGROUND

The Judiciary operates a Cloud Service which is a court-specific private cloud, a multi-tenant cloud computing environment hosted in commercial IDC(s) on AO owned and operated infrastructure.

Through the hosted services, courts can independently manage system resources, build, deploy, modify, decommission, backup, and restore servers, as well as implement virtual desktops. The cloud services are currently designed around VMWare and utilizes vRealize Automation (vRA) to manage resources and deploy vRA catalog of services.

The Judiciary currently operates in a hybrid cloud environment with some Software as a Services (SaaS) in commercial cloud environments as well as the private cloud operations.

2. OVERVIEW

The Administrative Office of the U.S. Courts (AOUSC) needs to obtain cloud services to support the U.S. Judiciary.

The Common Computing Environment (CCE) will be an interconnected, virtualized, hybrid, information technology infrastructure hosting mission systems, applications, services, and data. The CCE will serve the AOUSC and the Federal Judiciary hereafter referred to as the Judiciary. The CCE facilitates the Judiciary’s efforts to migrate applications to a cloud environment and allows for increased efficiencies across the entire spectrum of the Judiciary’s IT operations.

Strategically, the Judiciary seeks to continue the transition of its information technology (IT) capabilities to commercial cloud environments. This transition could include the migration of all appropriately rationalized enterprise applications currently hosted in an on-premises cloud environment to commercial clouds and elastic purchasing of computing and services and, employ automation to deploy, operate, and sustain these capabilities in a government commercial cloud. The data categorized with these applications align to the Judiciary Information Security Framework (JISF) Low, Moderate, and High. JISF controls align closely with FedRAMP controls with some deviations, and it is intended that FedRAMP controls will be used as a baseline to obtain full JISF authorization.

3. SCOPE OF SERVICES

The objective of this BPA is to obtain a secure, flexible, efficient, and cost effective, cloud service offering that enables scaling of infrastructure, application resources, IT capabilities or services to meet evolving application and user demand. The Contractor shall be the owner and operator of a public, hybrid and/or Government Community Cloud (GCC) cloud service provider (CSP) to provide cloud services that meets or exceeds established service-level agreement standards and adheres to commercial best practices within the confines of Government policies and regulations. The Contractor shall ensure that the Judiciary will have daily visibility into resource usage and performance of all systems.

The Contractor shall provide the professional implementation support, and program administrative activities as specified in this Performance Work Statement.

3.1 PERIOD OF PERFORMANCE

The ordering period for the BPA is 10 years.

3.2 PLACE OF PERFORMANCE

Work on the PWS will be primarily done at the contractor’s site with potential for occasional need for professional service individuals required to attend meetings at the AOUSC in Washington, DC as necessary. Further Place of Performance instructions will be determined at the BPA Call level.

4. GENERAL REQUIREMENTS

4.1 REFERENCED DOCUMENTS

4.1.1. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974

4.1.2. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the

Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

4.1.3. Judiciary Information Security Framework (JISF) Version2.2 October 2021

4.2 BPA ADMINISTRATION AND MANAGEMENT

All Offices will submit requests to CHNO, and CHNO will serve as broker for all services under this BPA. The Contractor shall provide all services necessary to manage and oversee all aspects of the BPA and task order(s). At a minimum, the Contractor shall:

4.2.1. Institute and maintain a process that ensures problems and action items discussed with the Government are tracked through resolution and shall provide timely status reporting.

4.2.2. Track all actions taken to improve performance and update all applicable processes with the lessons learned from their commercial and government support experiences.

4.2.3. Establish and maintain a documented set of disciplined, mature, and continuously improving processes for administering all BPA and task order efforts with an emphasis on cost-efficiency, schedule, performance, responsiveness, resource management, and consistently high-quality delivery.

4.2.4. Provide the Judiciary team Cloud Service Management capabilities to centrally manage, track and report cost and performance data for applications hosted, or the performance requirements as listed under section 5.

4.2.5. Provide a Monthly Service Utilization, Capacity, Outage and Upgrade Status and Forecast Report.

4.2.6. Support all kickoff meetings as scheduled by the CO after award(s) to provide and review account access information and other procedural details for obtaining and managing cloud services under this BPA.

4.2.7. Implement risk and issue management in accordance with ISO 31000:2018, Risk management – Principles and guidelines. The Contractor shall proactively manage risks to include at a minimum identification, analysis, monitoring and control, response planning, tracking, reporting, and systematic reduction of risks that could impact the technical, cost and schedule objectives for all performance requirements.

5. PERFORMANCE REQUIREMENTS

The Contractor shall provide access to the full suite of IaaS, PaaS, and SaaS cloud service offerings within their operational qualifying Public/Hybrid/GCC Cloud including any CSP Application Programming Interfaces (APIs). This shall include third party products and services directly supporting CSP utilization and optimization available through each CSP marketplace and directly from the supplier. The cloud service offerings shall be available via all current and future CSP locations within their respective Public/Hybrid/GCC Clouds. The AO shall have access to all new features and services offered by each CSP upon availability as listed in their publicly online catalogs, that are within scope of this BPA. The Contractor shall ensure that all data and all data elements stored or created by the Judiciary or its contractors within the CSP environment is the exclusive property of Judiciary organization issuing the BPA call. At all times throughout this BPA, the Judiciary organization and its designated representatives shall have access to the data and be permitted to export, extract, or otherwise transfer the data to another hosting location at the sole discretion of the Judiciary organization. Judiciary organization data shall be comprised of all information stored in the CSP environment.

5.1 CSP SERVICES

Throughout the entire period of performance, the CSP shall maintain control, as defined in this section, over the following parts of AO Cloud environments:

5.1.1. Underlying hardware infrastructure, including networking components within the data centers

5.1.2. Underlying software layer, including the hypervisor(s) and networking components

5.1.3. Software platform offerings (including third-party marketplace offerings)

5.1.4. Hardware and software components of all points of presence.

5.2 CSP FUNCTIONAL CATEGORIES

Requiring agencies may order the full range of IT solutions and services necessary from one or more of the following functional categories indicated below:

5.2.1 Infrastructure as a Service (IaaS):

Infrastructure as a service are online services that provide high-level APIs used to dereference various low-level details of underlying network infrastructure like physical computing resources, location, data partitioning, scaling, security, backup etc.

5.2.2 Platform as a Service (PaaS):

Platform or platform-based service is a category of cloud computing services that provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an application.

5.2.3 Software as a Service (SaaS):

Software as a Service is a software licensing and delivery model in which software is licensed on a subscription basis and is centrally hosted. It is sometimes referred to as "on-demand software". SaaS has become a common delivery model for many business applications, including office, messaging, payroll processing, database, virtualization, collaboration, content management (CM), Geographic Information Systems (GIS), and service desk management software.

5.2.4 Security as a Service (SECaaS):

Security as a service is a business model in which a service provider integrates their security services into a corporate infrastructure on a subscription basis more cost effectively than most individuals or corporations can provide on their own when total cost of ownership is considered.

5.2.5 Network as a Service (NaaS):

Network as a service describes services for network transport connectivity. NaaS involves the optimization of resource allocations by considering network and computing resources as a unified whole.

5.2.6 Content as a Service (CaaS):

Content as a service or managed content as a service (MCaaS) is a service-oriented model, where the service provider delivers the content on demand to the service consumer via web services that are licensed under subscription. The content is hosted by the service provider centrally in the cloud and offered to a number of consumers that need the content delivered into any applications or system, hence content can be demanded by the consumers as/when required.

5.2.7 Function as a Service (FaaS):

Function as a service (FaaS) is a category of cloud computing services that provides a platform allowing customers to develop, run, and manage application functionalities without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app. Building an application following this model is one way of achieving a "serverless" architecture, and is typically used when building microservices applications.

5.2.8 Mobile Backend as a Service (MBaaS):

Mobile backend as a service is a model for providing web app and mobile app developers with a way to link their applications to backend cloud storage and APIs exposed by back-end applications while also providing features such as user management, push notifications, and integration with social networking services.

These services are provided via the use of custom software development kits (SDKs) and application programming interfaces (APIs).

5.2.9 Data as a Service (DaaS):

Data as a service is data provided on demand to the user regardless of geographic or organizational separation of provider and consumer.

5.2.10 Disaster Recovery as a Service (DRaaS):

Disaster Recovery as a Service is when the provider manages server image and production data replication to the cloud, disaster recovery run book creation, automated server recovery within the cloud, automated server failback from the cloud, and network element and functionality configuration, as needed.

5.2.11 Container as a Service (CONaaS):

Containers as a service (CONaaS) is a cloud service model that allows users to manage and deploy containers, applications, and clusters through container-based virtualization.

5.2.12 Anything as a Service (XaaS):

Any other product, tool, and/or technology that is delivered to users as a service through the cloud service providers environment.

5.3 CSP Minimum Requirements

5.3.1 FedRAMP Status: Authorized

5.3.2 FedRAMP Service Models: IaaS, PaaS and/or IaaS, PaaS, SaaS

5.3.3 FedRAMP Deployment Model: Public, Hybrid and/or GCC Cloud

5.3.4 FedRAMP Impact Level: High

5.3.5 Criminal Justice Information Services (CJIS) Compliant (as listed in section 6.3.3)

6. TECHNICAL SUPPORT

The Contractor shall provide their CSP’s standard level technical support. The AO shall be provided the ability to communicate directly with the respective CSP technical support staff.

Technical support shall be provided in accordance with the individual CSP’s standard for technical support. This support shall include, at a minimum:

• 24x7x365 access to CSP technical support staff (system administrators, architects, and engineers) via phone, email and/or chat.

• Real time access to available CSP documentation, white papers, information papers, FAQs, and user forums.

• Presenting technical information in a concise manner, to include written decision papers, informational papers, and briefing slides, that can be understood by non- engineers and gives decision-makers the context and key points necessary to make necessary decisions.

• CSP consultative architectural support (review and guidance); and

• Third-party tools interoperability guidance, configuration guidance and troubleshooting support.

6.1 PROFESSIONAL SERVICES

The Judiciary requires professional services in the following areas to ensure a successful migration to a public, hybrid and/or GCC cloud environment and for the operation of cloud services by the Judiciary. Specific requirements will be detailed on individual BPA Calls. No professional services will be ordered independent from an order for cloud services. Review briefings and other informational documents with an emphasis on accuracy, quality, and timeliness.

6.1.1 Infrastructure Engineering

The Contractor shall provide Infrastructure Engineering support for AO activities in support of this BPA. Tasks include, but are not limited to, the following:

1. Technical subject matter experts (SME) to develop architectural designs for cloud implementation with AO.

2. Recommendations to enhance technologies utilized to increase efficiencies.

3. Support analysis and preparatory activities for migrations including the documentation of those activities.

4. Support execution of migration in and out of AO environments.

5. Produce Engineering Artifacts (e.g., Network/System Diagrams) related to infrastructure engineering.

6.1.2 Software Engineering

The Contractor shall provide Software Engineering support for AO activities in support of this BPA. Tasks include, but are not limited to, providing technical subject matter expertise on software engineering with an emphasis on modern, cloud services and application portability, as well as producing Engineering Artifacts that capture software engineering details.

6.1.3 Security Engineering

The Contractor shall provide Security Engineering support for AO activities in support of this BPA, including expert level security engineering services to all technical aspects of the program using a combination of AO Policy and Industry best practice.

Tasks include:

1. Support security engineering efforts related to IaaS, PaaS, SaaS (including marketplaces, if any) offerings provided on this BPA.

2. Support security engineering effort for networking equipment needed to connect existing AO networks to the cloud service provider.

3. Support design and review for high assurance/high security one-way file transfer solutions.

4. Produce Engineering Artifacts (e.g., Network/System Diagrams) related to security engineering.

5. Respond, investigate, and remediate any breach or potential security issues reported by the cloud service provider.

6. Monitor logs from AO managed hardware and software along with cloud service provider data to identify and remediate potential breaches or misconfigurations.

7. Risk Management Framework Activities for Assessment and Authorization: The

Contractor shall provide risk management framework support for assessment and authorization support for AO. Tasks may include:

a. Provide Information Security support for all AO Risk Management Framework requirements following NIST SP 800.53 standards.

b. Support the evaluation of security controls against the IaaS, PaaS, SaaS offerings provided on the BPA.

c. Review and update all Risk Management documentation to ensure all documentation matches our current operating posture.

6.2 TRAINING SUPPORT

The Contractor shall provide commercially available CSP cloud training modules on the use, implementation, security, and architecture of the CSP offerings at no additional cost to the government.

6.3 CCE ENVIRONMENT CYBERSECURITY AND COMPLIANCE

The Contractor shall define security processes and practices in compliance with the referenced documents as listed in Section 4.1 of the PWS. The Contractor shall provide risk and recommended mitigations to reduce the risks of identified vulnerabilities and weaknesses. The Contractor shall support reviews and analysis of system changes to determine any security impacts. The Contractor shall support security assessments and the resolution of concerns/issues identified by assessment team(s) including security reviews, test, and exercises.

The Contractor shall include robust cybersecurity protections and features to protect the U.S.

Courts data. Services provided shall adhere to the following:

6.3.1. Comply with all FedRAMP requirements, Federal Statutes, Standards, and Guidelines.

6.3.2. Meet JISF Low, Moderate and High authorized compliance. The contractor shall utilize a

FedRAMP recognized Third Party Assessment Organization (3PAO) to validate that any gaps between JISF and FedRAMP controls are met.

6.3.3. Meet CJIS compliance. The contractor shall demonstrate how, with the use of the CJIS Security Policy, Requirements Companion Document, they meet or have the ability to become CJIS complaint at the time of award.

6.3.4. Provide a Continuous Monitoring Plan that complies with current NIST and AO guidance.

6.3.5. Comply with IPv4/IPv6 requirements.

6.3.6. Maintain all data within the United States.

6.3.7. Provide access to the CSP PaaS and SaaS implemented products FedRAMP Security

Plan within 10 days of award with updates not less than quarterly.

6.3.8. Provide monthly, continuous monitoring reports for all systems that support AO. The report will be in NIST Security Content Automation Protocol (SCAP) format.

6.3.9. Incident Response Plan. The Contractor must have and Incident Response Plan that meets the Judiciary requirements in place within 30 days after BPA Award.

6.3.10. System Security Plan. The contractor shall create a System Security Plan (SSP) for JISF

Low, Moderate, High environments. The SSP can utilize FedRAMP controls where appropriate.

6.4 OPERATIONAL PROGRAM MANAGEMENT SERVICES:

The Contractor shall ensure that the COR has complete visibility into all operational program management and reporting across all BPA Calls issued. The Contractor shall provide the following operational program management services:

6.4.1. Account Management

1. Root Account Creation based on standard CSP structures with Identity and Access Management (IAM) access.

2. Sub-Account Creation under CSP-Specific Root Accounts with capability to transfer accounts to/from any other Root Account.

3. As directed by AO, transferring existing AO and third-party (other reseller or integrator) owned accounts to the Contractor provided Dedicated Root Account.

4. Establishing separate AO billing accounts as required.

5. Creating additional AO CSP specific Public/Hybrid/GCC Cloud accounts within 96 hours from the date of the AO request for such specific accounts.

6.4.2. Detailed Reporting Capability

1. AO plans to use CSP specific tagging and/or grouping mechanisms for granular cost and other reporting within all CSP Accounts. The Contractor shall provide direct access to each CSPs standard, secure web-based reporting interface and/or APIs to enable AO to generate, view, and download in at least one standard format (i.e., comma separated values, MS Excel, Adobe PDF) detailed reports that identify service usage by each account, sub account, and/or by AO defined tags.

2. The Contractor shall provide Usage Reports in a near real-time portal, in a format that includes a detailed breakdown of daily cloud service usage and cost by AO designated tags, subtotaled for each tag along with a monthly grand total. The Contractor shall also provide the monthly usage report in MS Excel. Excel documents shall be formatted and contain data so that data is easily manageable and extractable by AO using standard Excel features for use in other artifacts and systems.

3. The Contractor shall notify the Contracting Officer’s Representative (COR) in writing when spend for CSP usage/consumption reaches 75% and 90% of the total funded amount for each active CLIN. The Government will not be obligated to pay the Contractor any amount in excess of the funded amount.

As each CSP releases new features/services, those features/services shall become available upon publishing to the catalog. All CSP features and services accessed via this order shall adhere to the underlying CSP’s published Service Level Agreements (SLAs).

The Contractor shall create and establish CSP account(s) providing the Judiciary the ability to manage their resources. The Contractor shall monitor resource usage of each account and provide monthly metrics reports to the Government PM by the 10th day of each month unless otherwise specified by the COR. The AO will own the Master Account.

The Contractor shall provide the AO with access to the initial administrative user account(s) that have the necessary access to the approved accredited CSP. The COR and other AO authorized personnel can then generate user accounts for engineers and other authorized Judiciary personnel to utilize the CSP resources. The COR and AO authorized personnel will manage all policy for the usage of the cloud resources and user accounts. The Contractor will have no access to the Judiciary account resources other than utilization and visibility of financial and billing information to be used for reporting and accounting purposes.

6.5 FINANCIAL MANAGEMENT

6.5.1 The Contractor shall provide the COR and AO authorized personnel a tool for clear access and visibility to the automated Financial Management Reporting for all services consumed via role-based account to allow the Judiciary to bill each customer separately. At a minimum, the tool shall include:

1. The ability to configure price allocation for charge-back.

2. The ability to see financial consumption per service with at least 24-hour accuracy.

3. A generally available price calculator or simulator so that customers can forecast the amount of financial spend for customer defined use cases or projects. The calculator or simulator shall account for all cloud costs that a customer might consume. Contractor shall offer this tool as a Web-based calculator or as a downloadable Microsoft Excel spreadsheet with built-in instructions, formulas, and logic.

6.5.2 The Contractor shall meet the following pricing and billing requirements.

1. The Contractor shall allow Judiciary to download or receive electronic detailed

BPA Call bill reports that list costs by specified BPA Call number(s) on a line-by-line basis. The detailed bill shall itemize each individual billable item so to allow customers the ability to perform analytics on which cloud assets are contributing to cloud costs.

2. The Contractor shall offer the Judiciary bills/invoices that are itemized based on groups or metadata tags.

3. The Contractor shall ensure that customers could know within five (5) business days of the end of the billing period how much spend has been accrued to allow customers’ the ability to scale and meet financial targets during the billing period.

4. The Contractor shall provide a self-service capability for customers to generate email or SMS alerts based on the AO-defined financial thresholds.

5. The Contractor shall ensure all customer access be approved by the Judiciary Cloud

COR.

6.6 TRANSITION SUPPORT

6.6.1 Transition-In

During the transition-in period, the Contractor, in consultation with the COR and AO authorized personnel, will develop and deliver a Standard Operating Procedure (SOP) manual and Ordering Guide for all Contractor and CSP services offered within this BPA within 60 days of the contract award.

6.6.2 Transition-Out

The Contractor shall provide transition-out plan within 60 days of Transition-in respective of the BPA first call requirement. When requested by the COR and AO in conjunction with the Contracting Officer, the Contractor will have up to 60 days to provide a Transition-Out Plan encompassing all active BPA Calls. The purpose of the Transition-Out Plan is to explain to the Judiciary the procedures necessary to transition-out either all, or a part of the services under this BPA, as instructed by the COR. This includes the ability to completely sever all existing assets, deployments and spend with the Contractor. This shall be a process that terminates all cost-accruing assets rather than making the customer individually terminate each asset.

The Transition-Out Plan shall describe detailed recommendations for maintaining continuity of CSP services and preventing degradation of CSP services during the transition period. The Transition-Out Plan shall provide recommendations on how account holders may efficiently extract their application(s) and user data in a manner that is consistent with concept of data portability from one CSP to another.

Further, the Contractor shall explain the process to provide knowledge transfer to the Government in order to successfully transition the CSP environment to the new hosting environment. The Transition-Out Plan shall include a process for identifying and destroying all controlled unclassified information (CUI) including but not limited to CJIS information and personal information.

Upon receiving COR acceptance of the Transition Out plan and direction through the appropriate BPA Call vehicle, the Contractor shall perform all activities described. The Contractor shall exercise its best efforts and cooperation to affect an orderly and efficient transition-out to a successor Contractor/CSP environment. The Contractor shall deliver all technical data, computer software, and computer software documentation generated in the performance of this BPA and subsequent BPA Calls, to which the Judiciary has rights. The Contractor shall execute knowledge transfer in accordance with the Transition-Out Plan. The Contractor shall return any Government Furnished Property (GFP) or Government Furnished Information.

6.7 DELIVERABLES

The Government has provided below a list of documents that will be that basis for all deliverables under each BPA call. All deliverables listed below correspond with the key program milestones, activities, and deliverables listed below. Individual BPA Calls will have additional deliverables as dictated by their individual requirements.

All written deliverables shall be submitted to the COR with an accompanying letter describing all deliverable product. The COR will accept or reject the deliverables within five (5) business days from receipt. A deliverable is not considered acceptable until the COR’s approval is provided stating acceptance. If a deliverable is rejected, the contractor shall make corrections as specified and resubmit the deliverable to the COR within three

(3) business days for review and approval. Unless otherwise stated, all deliverables and work products shall be produced using Microsoft Office Professional products.

TASK

NUMBER

DELIVERABLE NAME

FORMAT

DUE DATE

FREQUENCY

6.1 – 6.6 White Papers, Information Papers, and Decision Papers

Contractor Determined

Format

Within 10 business days after assignment

6.1 – 6.6

Briefing Slides

Contractor Determined

Format 30 Calendar Days after TO Execution

As required

6.1 Engineering Artifacts (e.g., Network/System Diagrams)

Contractor Determined

Format

Within 10 business days after assignment

6.3

Continuous Monitoring Plan NIST

SCAP

format

Within 30 days after award

Monthly

Incident Response Plan (Data Loss Prevention and Countermeasures Plan)

Contractor Determined

Format Within 30 days after award

As required and with each new service offering

System Security Plan Contractor Determined

Format Within 30 days after award As required and with each new service offering

6.4 Service Utilization, Capacity, Outage and Upgrade Status and Forecast Report.

Contractor Determined

Format Monthly on the 5th

Workday

6.4 Task Order Status and Progress

Report Contractor Determined

Format Monthly on the 5th workday

6.8 PERFORMANCE STANDARDS

Performance Standards define the level of service required under the BPA and subsequent task orders to successfully meet the performance objectives. Performance standards are the benchmark against which actual performance is measured. Performance standards to be met during BPA performance will be identified in each Task Order issued under the AO Cloud Services IDIQ. As a minimum, all work shall be accomplished using the best commercial practices and current acceptable industry standards. The Government will determine performance standards to be monitored and perform surveillance.

The Performance Measurement Management Plan (PMMP) defines all performance standards required under performance of the AO Cloud Services BPA. The Contractor can be held accountable for meeting any or all the performance standards identified in Section 3 of the PMMP. Performance standards to be met during task order performance will be identified in each Task Order issued under the BPA. The Government will determine performance standards to be monitored and perform surveillance as described in the PMMP to determine if the

Contractor exceeds, meets, or does not meet the defined performance standards.

The hosting environment provisioned by the service Contractor must demonstrate an appropriate level of security by meeting the requirements of the Federal Information Security and Management Act (FISMA) for moderate-impact systems and related the Judiciary-specific policies. This includes a formal agency security authorization review covering security controls, continuous monitoring, and identification of risks. The continuous monitoring provided must comply with the NIST Special Publication 800-137 framework.

The Performance Standards Summary Matrix (Section 3 of the PMMP) defines performance standards to which the Contractor must comply, as well as the methods that will be used to measure the quality of services provided under this BPA. The Government will compare Contractor performance to the Service Level Agreement (SLA).

This section identifies additional support and service levels to support hosting requirements.

6.8.1. The Contractor shall offer the following support services for the cloud service:

1. 24 hours a day, 7 days a week, 365 days a year (to include holidays) support with a maximum response time of 2 hours for all service requests. Any incident events shall be processed via the timelines based on those incident types. Incidents can either be cybersecurity or IT services impacting business functions.

2. SELF-SERVICE INCIDENT LOGGING SYSTEM:

Contractor shall provide an incident management system for identifying, submitting, and tracking cloud service incidents. The system must be available online and accessible via API to paying customers. It shall also include the capability to submit incidents and track incident status.

6.8.2. The Contractor shall make the contracted SLAs for standard service accessible for review by the Judiciary at any time and include versioning control as well as revision history of all SLA changes for proper auditing and continuous assessment.

6.8.3. The Contractor shall offer a dashboard or snapshot of service health and standard SLA status for customers to view at any time. The dashboard shall contain at least 60 days of trailing health history so that customers may have more than one billing period to review health and SLA status against the prior month's billing reports.

6.8.4. During the time that a service is unavailable, customers shall not be charged for the use of that service. SLA deductions shall be negotiated and applied as mutually agreed between the parties in accordance with the terms of the Order and underlying BPA. The Contractor shall count all non-customer-initiated down-time events as outages, no matter how the downtime occurs. This means that any scheduled, announced, planned, unplanned or malicious events all count against documented SLAs. The Contractor shall ensure that downtime calculations begin immediately when the downtime starts.

6.9 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

The Contractor shall comply with all of the following requirements related to individual

Contractor Personnel operating under this BPA and all subsequent BPA Calls.

6.9.1. Ensure completion of all mandatory and specialized IT security training as stipulated by AO.

6.9.2. Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the government facility.

6.9.3. Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the Contractor will not be able to provide service on this BPA/order.

6.9.4. The Contractor shall not divulge any information, classified or unclassified, about AO files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the AO facility. Identification shall be worn and displayed as required.