LSJ 2021-05 - Increase AWS BPA Value Redacted.pdf

This acquisition is conducted under the authority of the Multiple Award Schedule Program. This Limited threshold to a brand name product or feature of a product peculiar to one manufacturer.

The SEC intends to a Federal Supply Schedule for

______________________________________________________________________________ to

This is a contract action.

This requirement is for

Item description:

Where it’s to be used:

Who is to use it:

SEC Form 2872 ( / )

2021-0005 the expanded use of cloud computing services by Amazon Web Services (AWS) meet the goals - in conjunction with other providers' services - of the SEC's enterprise cloud strategy

The use of the Amazon Web Services (AWS) such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and professional Consulting services to plan, design, build, migrate and operate SEC on-premise services to AWS Cloud.

Selected SEC on-premise services will be migrated to AWS utilizing a phased approach. A road map and implementation plan for the deployment of the AWS development platform and full migration of applications has been developed.

The Office of Information Technology and primarily the SEC AWS Cloud Environment (ACES) team.

SEC requires the following key features from CSP for the Cloud migration and operation of system applications and data: (1) The ability to meet compliance with key government/security standards including: Federal Risk and Authorization Management Program (FedRAMP) at the moderate level (required); Service Organizational Controls (SOC) 1-3 Compliant; and International Organization of Standards (ISO) 27001 Certified. (2) Compatibility with existing applications hosted by the SEC and SEC partners in order to reduce application refactoring during migration. This includes: AWS EC2, AWS RDS, AWS S3, AWS EKS, AWS Elasticache, Oracle Databases, and FINRA Consolidated Audit Trail. (3) Compatibility with the SEC's Information Security Controls Manual including (but not limited to): Ability to classify, label, and tag data to ensure it is handled with the appropriate level of security; Ability to encrypt data at rest (DAR)(Federal Information Processing Standard Publication 140-2), Ability to encrypt data in transit (DIT)(FIPS PUB 140-2); Availability of user-controlled firewalls; Availability of user-controlled VPC/VPN; and Availability of user-controlled IDS/IPS. (4) Availability and resiliency requirements: Bi-coastal locations within CONUS with at least two redundant processing centers in each; Storage availability of greater or equal: 99.99%; Data durability of greater or equal: 99.999999999% and Compute availability of greater or equal: 99.95%.

Describe the market research conducted among schedule holders and the results, or a statement of the

Type any information that explains the circumstances, history, or other reasons not already stated that

What are the barriers that would need to be removed and the cost involved?

SEC Form 2872 ( / ) 3

2021-0005

The SEC conducted market research including industry leading Cloud Service Providers (CSPs) based on SEC requirements and business needs. This included a comparison of the Gartner Magic Quadrant "Visionary" and "Leader" CPSs (AWS, Century Link, CSC, Google Cloud Platform, IBM Softlayers, Microsoft Azure and Verizon ECFE). Through market research, SEC confirmed that AWS is the only CSP that satisfies all of the SEC's key requirements as identified in paragraph 4 of this LSJ, including but not limited to: a) FedRamp compliance, b) existing applications compatibility and reduction in refactoring, c) compliance with SEC Information Security Control and FIPS PUB140-2, and d) Cloud service availability and reliability.

None.

AWS is not the only cloud platform that will be deployed as part of the enterprise cloud strategy, one of the tenants of which is: "Cloud Smart: Multi-cloud strategy to adopt cloud solutions, where appropriate to streamline transformation and embrace modem capabilities for multiple clouds and missions with overall cost savings." [SEC Enterprise Cloud Strategy Version 1.5 October 28, 2020]. Accordingly, the SEC intends to establish multiple GSA schedule BPAs with multiple cloud providers to deliver enterprise cloud computing capabilities, thus meeting the requirements under FAR 16.505(b)(1)(i) for fair opportunity.

There are no barriers precluding establishment of additional cloud providers to deliver enterprise cloud computing capabilities. This contract action applies only to services from AWS; additional contract actions will be required for other cloud providers.

Not Applicable

2021-0005