J.4 TSO BPA Call PWS - Final.pdf

Attachment J.4 T S O BPA Call PWS

COMMERCIAL CLOUD SERVICES - PILOT

1.0 STATEMENT OF WORK

1.1 REQUIREMENT:

The Administrative Office of the United States Courts (AOUSC) has a requirement to pilot in unclassified CSP Hybrid Cloud service. AOUSC requires a contract for services consisting of integrated environments designated as development, test, and production that support all pre-production and production activities for a system. This hybrid cloud environment will contain all required security, service delivery and capabilities necessary to effectively support development, testing, quality assurance, and production needs.

1.2 USE CASES

These use cases are not necessarily finalized or all-inclusive but are submitted to provide the offeror with an idea of types of requirements for the proof-of-concept.

The scope of the use cases under this Pilot are as follows:

1.2.1 USE CASE 1 - Critical Need: Rapid infrastructure provisioning

Demonstrate the ability to self-provision infrastructure including Virtual Machine(s) (VMs) and containers both on premise and in the cloud.

1. VM control

a. Allocate VM instance

b. Manage VM instance

2. Container control

a. Deploy container instance

b. Manage container instance

1.2.2 USE CASE 2 - Core Mission: Rapid deployment and maintenance of court website content

1. PUBLIC FACING:

Office of Public Affairs (OPA) and Courts want to transition the public websites to the commercial cloud, with a consistent look and feel.

a. Shared court site template (sub-sites, managed by OPA and CHNO)

b. Court site template (stand-alone websites).

c. Primary public website: www.uscourts.gov

2. INTERNAL FACING:

OPA would like to explore feasibility and implications of transitioning the internal websites (JNet, AOWeb) to the cloud.

3. SERVER-LESS COMPUTING:

The 9th Circuit wants to move to server-less computing for hosting their public websites.

4. STREAMING SERVICES:

Courts want to ability to stream videos for oral argument capable of immediately ramping up to satisfy demand when needed http://www.uscourts.gov/

1.2.3 USE CASE 3 - Operational Efficiency: Cloud development environment

Program offices and the Courts want to move development and testing environments to the cloud using containers and/or VMs. The following use cases demonstrate variations in development toolsets available for use in the cloud. As additional tools become available for use natively in the cloud, developers no longer need to install and maintain development packages

1. CLOUD DEVELOPMENT USING VMS:

Demonstrate virtual machines for development on private and public cloud infrastructure

2. CLOUD BASED DEVELOPMENT TOOLS:

Demonstrate commercial cloud can provide and support development tool suites needed for building and compiling code off-premise.

3. CONTAINER DEPLOYMENT USING PAAS:

Demonstrate the ability to run container images from the developer laptop to cloud test environment and ultimately deploy

4. DEVELOP AND DEPLOY CLOUD-NATIVE APPLICATIONS:

Using microservice-based architecture develop an application built as a set of services. Each service runs its own processes and communicates through applications programming interfaces (API).

1.2.4 USE CASE 4 - Critical Need: High Availability and Disaster Recovery

Demonstrate that an AOUSC program office or court application/system can properly failover and recover from the on-premise environment (AOUSC hosting environment) to the off-premise environment (commercial cloud) leveraging vendor services such as:

1. BACKUP, RESTORE, AND RECOVERY:

Demonstrate commercial cloud provider can provide on-demand backup, restore, and recovery options across various sites to support its DR components. For example, show user can exercise off-premise backup/storage options to restore critical data.

2. MULTI-SITE REPLICATION:

Demonstrate commercial cloud provider can provide higher availability than current on-premise solution by replicating to geographically dispersed sites. For example, show user can fully restore critical data from a replicated site.

3. DISASTER RECOVERY PLANS/APPLICATION FAILOVER:

Demonstrate user can configure and successfully initiate disaster recovery plans resulting in a full application/system recovery at the off-premise location.

2.0 PERIOD OF PERFORMANCE

The period of performance for the pilot shall be one (1) year commencing date of award, and two

(2) 1-year option periods.

3.0 PLACE OF PERFORMANCE/DELIVERY

The place of performance for CSP services shall primarily be the contractor site.

4.0 TYPE OF CONTRACT

A time and material task order is contemplated under this SOW. The government understands this is a pay per use service; therefore, monthly invoices will fluctuate based on government usage along possible with UP price fluctuations from the CSPs. UP price fluctuations shall not, however, exceed the contractor’s schedule rates, if the rates are reduced during the term of this contract, those rate reductions will be passed to the AOUSC as of the date of the CSP setting the new rate. The contractor shall, and the government will track the spend rates to ensure we do not exceed obligated amounts.

5.0 SCOPE OF WORK

This section addresses the types of service required for cloud services sought under this SOW. Although services are expected to continue at initial levels, storage and virtual machines may be reconfigured and modified as necessary throughout the life of the contract to support the mission needs of the

AOUSC.

5.1 METER CATEGORY SERVICES

The contractor shall provide the following category of metered services:

• Analysis Services

• API Management

• App Services

• Application Insights

• Automation and Control

• App Service

• Bot Service

• Data Factory

• IoT Hub

• Lab Services

• Maps

• Monitor

• Backup

• Business Analytics

• Cache

• CDN

• Cloud Services

• Cognitive Services

• Container Instances

• Container Registry

• Cortana Intelligence

• Data Management

• Data Services

• Dynamics

• Event Grid

• Functions

• Genomics

• Identity

• Insight and Analytics

• Integration

• IoT Central

• IoT Hub Device Provisioning

• Key Vault

• Logic Apps

• Media

• Mobile Services

• Network Watcher

• Networking

• Notification Hubs

• Power BI

• Power BI Embedded

• Recovery Services

• Red Hat OpenShift Container Platform

• RemoteApp

• Scheduler

• Security Center

• Service Bus

• Service Fabric

• SignalR

• Site Recovery

• SQL Data Warehouse

• SQL Database

• Storage

• StorSimple

• Time Series Insights

• Virtual Machines

• Visual Studio

• Windows 10 IoT Core Services

5.2 SECURITY

Services provided shall adhere to the following security guidelines:

• Judiciary Information Security Framework (JISF) moderate compliance, or higher, and have an active Federal Risk and Authorization Management Program (FedRAMP) certification

• The contractor shall ensure that services and hosting facilities and environments proposed for this contract be compliant with JISF controls at the moderate level, or higher and have an active FedRAMP certification

• The contractor will provide access to FedRAMP Security System Plan (SSP) as well as authorization to operate (ATO) documentation to the government within 10 days of award with updates provided on a quarterly basis. The contractor shall create a JISF SSP within 20 days of award.

• The contractor shall maintain all data within the United States, which means the 50 States, the District of Columbia, and outlying areas

• The contractor shall provide the government a list of the physical locations which may contain government data within 20 days with updates provided on a quarterly basis

• The contractor shall ensure that all personnel administering, maintaining, and managing or that are in contact with US Courts hosting, including but not limited to facilities, systems, or environments are cleared for background checks at a Public Trust level.

• The contractor shall record all logical access to the government data as specified in the Schedule. This may include the entrant’s name, role, purpose, account identification, entry and exit time(s). Such records shall be provided to the Contracting Officer or designee in accordance with the Schedule or upon request to comply with federal authorities.

• As specified by the Contracting Officer, the contractor shall provide immediate access to all government data and government-related data impacting government data for review, scan, or conduct of a forensic evaluation and physical access to any contractor facility with government data. If the government data is co-located with non-government data, the contractor shall isolate the government data into an environment where it may be reviewed, scanned, or forensically evaluated in a secure space with access limited to authorized government personnel identified by the Contracting Officer, without the contractor’s involvement.

5.3 ADMINISTRATIVE

The contractor shall provide on-line reporting capability/portal that will allow designated account holders to see the status of their usage and costs corresponding with their usage daily.

5.4 USE CASE ENVIRONMENT TECHNICAL REQUIREMENTS

5.4.1 Environment must be capable of supporting:

1. Windows Operating Systems to include Windows 7, Windows 8.x, Windows

10, and Windows 2012 R2

2. CentOS 6.3+, 7.0+

3. RHEL 6.7+, 7.1+

5.4.2 Solution must provide the following analytics:

1. Application and Server Response Time.

2. Number of connections.

3. Page load times.

4. Resource Utilization.

5. Network/Bandwidth Utilization.

5.4.3 Cloud environments must be capable of setting environment uptime/downtime schedules.

1. The categories of Cloud Services that the AOUSC initially plans to use are:

a. Compute

b. Storage & Database

c. Networking

d. Security & Identity

e. Miscellaneous, which includes all other services

2. CLOUD INFRASTRUCTURE MANAGEMENT:

Cloud infrastructure management must not be accessible by contracting agent after procurement. Subscription ID‘s must be transferred with complete administrative rights and keys. The procuring agent may utilize RBAC (Role Based access) to delegate SU (Super User) credential in which the AOUSC may take administrative control over all subscription ID’s and username accounts. In the event the service provider cannot hand over access and subscription access to the AOUSC, signify provider is unable to fulfill services.

3. CLOUD SERVICES PRODUCTS:

The Contractor shall provide to AO the following:

a. Access to Cloud Services through a single business account owned (root access) by the AO.

b. Access to the entire suite of CSP offerings to include all service categories. The contractor shall add or modify these groups of service categories as CSPs add to or modify them during the life of the contract.

4. SUPPORT SERVICES:

The Contractor shall provide necessary Support Services with US Citizens to the AO.

The contractor shall provide CSP Business Level Support.

5. Contractor shall provide a Cloud Management Platform (CMP):

a. The contractor shall provide:

i. Full access to a Cloud Services Cost, Billing and Usage management software tool or CMP interface.

ii. CMP integration support, technical assistance, and orientation for system configuration and usage.

b. Contractor shall provide a Cloud Management Platform (CMP) or similar tool that supports browser-based consoles, dashboards, portals, or interfaces for providing extensive self-service capabilities to support service monitoring and utilization as well as aggregate billing information.

c. Contractor shall provide integration support with a CMP tool.

d. Contractor shall provide configuration and user training on the product to improve AOUSC’s effectiveness in using it.

5.5 CONTRACTOR’S CLOUD SERVICE PROVIDER (CSP) RESPONSIBILITIES.

5.5.1 The CSP must maintain FedRAMP Provisional Authorization throughout the period of performance of the contract.

5.5.2 Personnel Access. The CSP will require all employees who will have access to government data, the architecture that supports government data, or any physical or logical devices/codes to pass the appropriate background investigation required by the government in compliance with HSPD-12. At a minimum, all CSP employees with access to the government data, the architecture that supports government data, or any physical or logical devices/codes will pass a National Agency Check with Inquiries (NACI) investigation or greater and be a US person as defined in Executive Order 12333 and OMB Memorandum M-05-24, Section C. CSP shall furnish documentation reflecting favorable adjudication of background investigations for all personnel supporting the system(s).

5.5.3 Non-disclosure Agreements. Per FAR 9.5, all commercial cloud contracts must mitigate against Organizational Conflicts of Interest via implementation of the non- disclosure agreement that prohibits a contractor from using government data for commercial needs.

CSP shall not access, use, or disclose government data unless specifically authorized by the terms of this Contract or a task order issued hereunder. If authorized by the terms of this Contract or a task order issued hereunder, any access to, or use or disclosure of, government data shall only be for purposes specified in this Contract or task order. CSP shall ensure that each of its employees and representatives, and any others (e.g., subcontractor employees) performing duties hereunder shall, prior to obtaining access to any government data, sign a contract or task order-specific nondisclosure agreement.

5.5.4 CSP shall use government-related data only to manage the operational environment that supports the government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting Officer.

5.5.5 Asset Availability. CSP must inform the government of any interruption in the availability of the cloud services.

1. Whenever there is an interruption in service, CSP must inform the government of the estimated time that the system or data will be unavailable. The estimated timeframe for recovery of the service must be related to the FIPS 199 system categorization for the availability of the system and, if specified, agreed upon SLA and system availability requirements. CSP must provide regular updates to the government on the status of returning the service to an operating state according to the agreed upon SLAs and system availability requirements.

2. CSP shall be responsible for maintaining and ensuring continued compatibility and interoperability with the government’s systems, infrastructure, and processes for the term of the contract. In the event of an unavoidable compatibility and interoperability issue, CSP shall be responsible for providing timely notification to the government and shall be responsible for working with the government to identify appropriate remedies and, if applicable, work with the government to facilitate a smooth and seamless transition to an alternative solution and/or provider.

5.5.6 Misuse of Government Data and Metadata. CSP shall not access, use, or disclose government data unless specifically authorized by the terms of this task order issued hereunder. If authorized by the terms of this Contract or a task order issued hereunder, any access to, or use or disclosure of, government data shall only be for purposes specified in this task order. CSP shall ensure that each of its employees and representatives, and any others (e.g., subcontractor employees) performing duties hereunder shall, prior to obtaining access to any government data, sign a task order-specific nondisclosure agreement.

5.5.7 Data Breach and Incident Reporting.

1. CSP must report all computer security incidents to the United States Computer Emergency Readiness Team (US-CERT) in accordance with US-CERT “Incident Categories and Reporting Timeframes” in Appendix J, Table J-1 of NIST SP 800- 61, as amended. Any incident that involves compromised personally identifiable information (PII) must be reported to US-CERT within one hour of detection regardless of the incident category reporting timeframe. The NIST SP800-86, Guide to Integrating Forensic Techniques into Incident Response, may be referenced for more precise guidance on incident resolution.

2. Any breach of PII, or a potential breach of PII, CSP will report to the Contracting Officer’s Representative within 60 minutes of the discovery of any data breach. CSP shall provide the government with all information and cooperation necessary to enable compliance by CSP and/or the government with data breach reporting and mitigation actions required by applicable law, regulation, policy, and this Contract.

5.5.8 CSP shall retain operational configuration and control of data repository systems used to process and store government data to include any remote work. CSP shall not subcontract the operational configuration and control of any government data.

5.5.9 Identification and Multi-Factor Authentication (Organizational and Non- Organizational Users). CSP will support a secure, multi-factor method of remote authentication and authorization to identified government administrators that permit government-designated personnel the ability to perform management duties on the system(s). At a minimum, CSP shall provide a multi-factor one-time password or PKI certificate technology solution. CSP shall support a secure, multi-factor method of remote authentication and authorization to identified internal administrators that will allow internally-designated personnel the ability to perform management duties on the system(s).

5.5.10 Notification. CSP shall notify the government within 60 minutes of any warrants, seizures, or subpoenas it receives, including those from another federal agency that could result in the loss or unauthorized disclosure of any government data. CSP shall cooperate with the government to take all measures to protect government data from any loss or unauthorized disclosure that might reasonably result from the execution of any such warrant, seizure, subpoena, or similar legal process.

5.5.11 Records. CSP shall provide the Contracting Officer all government data and government-related data in the format specified in the schedule or as directed by the Contracting Officer.

1. CSP shall dispose of government data and government-related data in accordance with the schedule and provide the confirmation of disposal to the Task Order in accordance with contract closeout procedures.

2. When the government is using CSP’s software, CSP shall provide the agency with access and the ability to search, retrieve, and produce government data in a standard commercial format.

3. The contractor shall provide the contracting officer all government data and government-related data in the format specified in the schedule or as directed by the contracting officer.

4. The contracting officer may at any time issue a hold of notification in writing to the contractor. At such time, the contractor may no dispose of any government data or government-related data described in the hold notification until such time as the contractor is notified in writing by the contracting officer, and shall preserve all such data in accordance with AOUSC instructions

5. The contractor shall provide the contracting officer within 10 business days of receipt of any requests from a third party for government-related data

6. When the government is using a contractor’s software, the contractor shall provide the AOUSC with access and the ability to search, retrieve, and produce government data in a standard commercial format.