PWS Data Center Facility.pdf

Performance Work Statement (PWS)

07/30/2025

Vision Statement

1 General Information

1.1 Scope of Work

1.2 Background

1.3 Constraints

1.3.1 Project Planning and Management

1.4 Non-Personal Services

1.5 Period of Performance

1.6 Place of Performance

1.7 Hours of Operation

1.8 Special Qualifications

1.9 Post Award/Kickoff Conference

1.10 Status Meetings

1.11 Contractor Travel

1.12 Transition In

1.13 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials and Information

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Materials

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

5 Specific Tasks

5.1 Transition In

5.1.1 External Disaster Recovery Colocation Data Center (EDRC Data Center)

5.1.2 Program and Project Management Support Services

5.2 Facility Operations and Performance

5.2.1 Service Outage and Postmortem Report

5.2.2 External Disaster Recovery Colocation Data Center Security Services

5.2.3 Secure Storage Facilities

5.2.4 Secure Contractor Personnel Responsibilities

5.2.5 Monthly Status and Financial Reporting

5.2.6 Monthly Performance Status Meetings

5.3 Transition Out

5.3.1 Lessons Learned Report

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Related Documents

8 Performance Requirements Summary………………………………………………………………..…………………36

Vision Statement

To ensure a safe, secure, and trusted facility to house the Department of Housing and Urban Development (HUD) and its customers critical Information Technology (IT) Infrastructure to maintain 100% operational capabilities during time of crisis and non-crisis.

1 General Information

1.1 Scope of Work

The US Department of Housing and Urban Development (HUD), of the Deputy Chief

Information Officer for Infrastructure and Operations Office (DCIO IOO) in support of the Office of the Chief Information Officer (OCIO) requires an External Disaster Recovery Colocation Data

Center (EDRC Data Center) to ensure HUD’s critical IT infrastructure, portfolio of capabilities and investments, and services are able to continue to operate when HUD’s primary data center, Denver, Colorado experiences an outage, degradation of operational services, weather event, and/or natural disaster.

Example: The Department of Housing and Urban Development (HUD), Office of the Chief

Information Officer (OCIO) requires contractor support to strengthen its Information Technology

(IT) planning and operations function. Services shall include analyzing current OCIO policies and procedures and providing recommendations to assist with the modernization of those policies and procedures. In addition, support is needed to train HUD staff on all new processes.

The Contractor shall provide Independent Verification and Validation (IV&V) support services to monitor and validate the quality and effectiveness of out-sourced infrastructure managed services through program oversight and analysis and subsequent recommendations to the

Government. The IV&V support services shall include:

• Project Management

• Technical Analysis and Assessments

• Infrastructure Monitoring and Testing

• Training

Detailed descriptions of specific tasks are provided in Section 5 – Specific Tasks and

Deliverables.

1.2 Background

The EDRC Data Center is a centralized facility to house HUDs and its customers’ critical IT infrastructure to mitigate the risk of failure in the event of natural disasters, outages, or other unforeseen events.

HUD’s primary EDRC Data Center, National Center for Critical Information Processing and

Storage (NCCIPS), is in southern Mississippi. The facility has a footprint of twenty-two (22) forty-four-unit (44U) racks (non-contiguous) with a power draw of approximately eighty-five (85) kilowatts (KWs) at 3-phase. HUD provides and maintains the internet service provider point of presence (ISP PoP)/circuits required to connect the disaster recovery colocation data center.

1.3 Constraints

The Contractor shall have an office within twenty-five (25) miles of the Contractor’s external colocation data center facility or on-site at the external colocation data center facility.

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

Reference: Title: Link:

CIO

Handbook ok 3410.1

HUD Policy For IT

Project Planning and Management

(PPM)

https://www.hud.gov/sites/documents/34101CIOH.pdf

CIO

Handbook

3400.1

HUD Policy for IT

Management

Framework https://www.hud.gov/sites/dfiles/OCHCO/documents/34001

CIOH.p df

48 CFR

1552.21

1-72

Monthly Progress

Reports https://www.govinfo.gov/content/pkg/CFR-

2005-title48-vol6/pdf/CFR-2005-title48-vol6-sec1552-211-72.pdf

CIO

Handbook

3415.1

HUD Policy for

Information

Technology

Governance https://www.hud.gov/sites/dfiles/OCHCO/documents/34151

CIOH.p df

CIO

Handbook

3435.1

HUD OCIO Risk

Management Policy https://www.hud.gov/program_offices/administration/hudclips

/handb ooks/cio/3435.1

ISO

31000

Risk

Management -

Guidelines https://www.iso.org/obp/ui/#iso:std:iso:31000:ed-2:v1:en

CIO

Handbook

2400.1

Information

Resources

Management (IRM)

Policies https://www.hud.gov/program_offices/administration/hudclips

/handb ooks/cio/2400.1

Digital

Govern ment

Strategy

Digital Government:

Building a 21st

Century Platform to

Better Serve the

American People https://obamawhitehouse.archives.gov/sites/default/files/om b/egov/ digital-government/digital-government-strategy.pdf https://www.hud.gov/sites/documents/34101CIOH.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/34001CIOH.p https://www.hud.gov/sites/dfiles/OCHCO/documents/34001CIOH.p https://www.govinfo.gov/content/pkg/CFR-2005-title48-vol6/pdf/CFR-2005-title48-vol6-sec1552-211-72.pdf https://www.govinfo.gov/content/pkg/CFR-2005-title48-vol6/pdf/CFR-2005-title48-vol6-sec1552-211-72.pdf https://www.govinfo.gov/content/pkg/CFR-2005-title48-vol6/pdf/CFR-2005-title48-vol6-sec1552-211-72.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/34151CIOH.p https://www.hud.gov/sites/dfiles/OCHCO/documents/34151CIOH.p https://www.hud.gov/program_offices/administration/hudclips/handb https://www.hud.gov/program_offices/administration/hudclips/handb https://www.iso.org/obp/ui/#iso:std:iso:31000:ed-2:v1:en https://www.hud.gov/program_offices/administration/hudclips/handb https://www.hud.gov/program_offices/administration/hudclips/handb https://obamawhitehouse.archives.gov/sites/default/files/omb/egov/ https://obamawhitehouse.archives.gov/sites/default/files/omb/egov/

Section

508.Gov

Section 508

Standards http://www.gpo.gov/fdsys/pkg/PLAW-

105publ220/pdf/PLAW-105publ220.pdf

NARA CFR NARA Code of

Federal Regulations https://www.ecfr.gov/current/title-36/chapter-XII/subchapter- B

Federal

Records Act

Federal

Records Act https://www.archives.gov/files/about/laws/p-l-113-187.pdf

5 USC 552a Privacy Act of 1974 https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf

CIO

Handbook

2400.13

Word Processing and Microcomputer

Technology Policies and Procedures https://www.hud.gov/program_offices/administration/hudclip s/handb ooks/cio/2400.13

CIO

Handbook

2400.25

Information

Technology Security

Policy https://www.hud.gov/program_offices/administration/hudclip s/handb ooks/cio/2400.25

Internati onal

Building

Codes

2021 International

Building Codes

(IBC)

https://codes.iccsafe.org/content/IBC2021P1

NFPA

National Fire

Protection (NFPA)

– 70 National

Electrical Code https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=70

NFPA

National Fire

Protection (NFPA) –

75 Standard for https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=75 http://508.gov/ http://www.gpo.gov/fdsys/pkg/PLAW-105publ220/pdf/PLAW-105publ220.pdf http://www.gpo.gov/fdsys/pkg/PLAW-105publ220/pdf/PLAW-105publ220.pdf https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B https://www.archives.gov/files/about/laws/p-l-113-187.pdf https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf https://www.hud.gov/program_offices/administration/hudclips/handb https://www.hud.gov/program_offices/administration/hudclips/handb https://www.hud.gov/program_offices/administration/hudclips/handb https://www.hud.gov/program_offices/administration/hudclips/handb https://codes.iccsafe.org/content/IBC2021P1 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=70 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=70 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=70 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=75 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=75 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=75

Fire Protection of

Information

Technology

Equipment

NFPA

National Fire

Protection (NFPA) -

76 Standard for the

Fire Protection of

Telecommunic ation

Facilities https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=76

NFPA

National Fire

Protection (NFPA) –

92 Standard for

Smoke Control

System https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=92

NFPA

National Fire

Protection

Association (NFPA)

– 780 Standard for the Installation of

Lightning Protection

Systems https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=780

EIA/TIA-

Generic

“Telecommuni cations Bonding and

Grounding

(Earthing)” https://standards.globalspec.com/std/13390187/tia-607

CIO

Handbook

Cybersecurity

Incident Response https://www.hud.gov/sites/dfiles/OCHCO/documents/Cyber securityI ncidentResponsePlan2.0.pdf https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=76 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=76 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=76 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=92 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=92 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=92 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=780 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=780 https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=780 https://standards.globalspec.com/std/13390187/tia-607 https://www.hud.gov/sites/dfiles/OCHCO/documents/CybersecurityI https://www.hud.gov/sites/dfiles/OCHCO/documents/CybersecurityI

2400.35 Plan

CIO

Handbook

2400.45

Vulnerability

Disclosure https://www.hud.gov/sites/dfiles/OCHCO/documents/OCIO

HBK240 0.45.pdf

CIO

Handbook

3150.1

Breach

Notification

Policy and

Response

Plan https://www.hud.gov/sites/dfiles/OCHCO/documents/3150.1 cioh.pdf

NIST

SP 800- 37

Risk Management

Framework for

Information Systems and Organizations: A

System Life Cycle

Approach for

Security and Privacy https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

NIST

SP 800-

Information Security

Continuous

Monitoring (ISCM) for

Federal Information

Systems and

Organizations https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublic ation80 0-137.pdf

OMB A-

Circular No. A- 127

– Financial

Management

Systems https://obamawhitehouse.archives.gov/omb/circulars_a127/ https://www.hud.gov/sites/dfiles/OCHCO/documents/OCIOHBK240 https://www.hud.gov/sites/dfiles/OCHCO/documents/OCIOHBK240 https://www.hud.gov/sites/dfiles/OCHCO/documents/3150.1cioh.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/3150.1cioh.pdf https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication80 https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication80 https://obamawhitehouse.archives.gov/omb/circulars_a127/

OMB A-

Circular No. A- 130

– Managing

Information as a

Strategic Resource https://www.cio.gov/policies-and-priorities/circular-a-130/

FISMA Federal Information

Security

Modernization Act https://www.cisa.gov/federal-information-security-modernization-act

FedRamp Federal Risk and

Authorization

Management

Program (FedRamp) https://www.gsa.gov/technology/government-it-initiatives/fedramp

E-Govt Act E-Government Act of https://www.archives.gov/about/laws/egov-act-section- 207.html

Clinger-

Cohen Act

Clinger Cohen Act of https://www.cio.gov/handbook/it-laws/clinger-cohen-act/?clickEvt

NIST

FIPS

140-3

Requirements for

Cryptographic

Modules https://csrc.nist.gov/publications/detail/fips/140/3/final

NIST

SP 800- 18

Guide for Developing

Security Plans for

Federal Information

Systems https://csrc.nist.gov/publications/detail/sp/800-18/rev-1/final

NIST

SP 800- 30

Guide for

Conducting

Risk https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.cisa.gov/federal-information-security-modernization-act https://www.cisa.gov/federal-information-security-modernization-act https://www.gsa.gov/technology/government-it-initiatives/fedramp https://www.gsa.gov/technology/government-it-initiatives/fedramp https://www.archives.gov/about/laws/egov-act-section-207.html https://www.archives.gov/about/laws/egov-act-section-207.html https://www.cio.gov/handbook/it-laws/clinger-cohen-act/?clickEvt https://www.cio.gov/handbook/it-laws/clinger-cohen-act/?clickEvt https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/publications/detail/sp/800-18/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final

Assessments

NIST

SP 800- 35

Guide to Information

Technology Security

Services https://csrc.nist.gov/publications/detail/sp/800-35/final

NIST

SP 800- 47

Managing the

Security of

Information

Exchanges https://csrc.nist.gov/publications/detail/sp/800-47/rev-1/final

NIST

SP 800- 53

Security and Privacy

Controls for

Information Systems and Organizations https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

NIST

SP 800- 55

Performance

Measurement Guide for Information

Security https://csrc.nist.gov/publications/detail/sp/800-55/rev-2/draft

NIST

SP 800- 60

Guide for

Mapping

Types of

Information and

Information

Systems to

Security

Categories https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev- 1/final

ISO/IEC

27000

Information

Technology –

Security Techniques

– Information https://www.itgovernanceusa.com/iso27000-family https://csrc.nist.gov/publications/detail/sp/800-35/final https://csrc.nist.gov/publications/detail/sp/800-47/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-55/rev-2/draft https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://www.itgovernanceusa.com/iso27000-family

Management

Systems

NIST

SP 800- 34

Contingency

Planning Guide for

Federal

Information

Systems https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublic ation80 0-34r1.pdf

ISO/IEC

27031

Information

Technology –

Security Techniques

– Guidelines for

Information and

Communicatio n

Technology

Readiness for

Business Continuity https://www.iso.org/obp/ui/#iso:std:iso-iec:27031:ed-1:v1:en

NIST

SP 800- 61

Supply Chain Risk

Management

Practices for Federal

Information Systems and Organizations https://csrc.nist.gov/publications/detail/sp/800-161/rev- 1/final

CIO

Handbook

3260.1

Enterprise Data

Management

(EDM) Policy https://www.hud.gov/sites/documents/32601CIOH.pdf

CIO

Handbook

3500.1

HUD Source Code

Policy https://www.hud.gov/program_offices/administration/hudclips

/handb ooks/cio/3500.1 https://www.iso.org/obp/ui/#iso:std:iso-iec:27031:ed-1:v1:en https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final https://www.hud.gov/sites/documents/32601CIOH.pdf https://www.hud.gov/program_offices/administration/hudclips/handb https://www.hud.gov/program_offices/administration/hudclips/handb

1.3.1 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT

Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUD’s PPM Life Cycle Website:

http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME

PPM was designed based on the best practices from Capability Maturity Model Integration

(CMMI) for systems development and PMBok for project management. While at the foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development and delivery of useable functionality within 6-9 month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, includes prototypes or pilots, Commercial Off the Shelf (COTS)/

Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the

HUD Project Manager(s), the Contractor will tailor PPM to take advantage of contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all of the work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring, or omitting specific artifacts applicable to the project, as well as adjust project control gate reviews to be consistent with the

Reference: Title: Link:

CIO Handbook

3300.1

Total

Information

Quality

Management https://www.hud.gov/sites/documents/33001CIOH.pdf

NISPOM National

Industrial

Security

Program

Operating

Manual https://www.federalregister.gov/documents/2020/12/21

/2020-27698/national-industrial-security-program-operating-manual-nispom

CMMI Capability

Maturity Model

Integration https://cmmiinstitute.com/ http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME https://www.hud.gov/sites/documents/33001CIOH.pdf https://www.federalregister.gov/documents/2020/12/21/2020-27698/national-industrial-security-program-operating-manual-nispom https://www.federalregister.gov/documents/2020/12/21/2020-27698/national-industrial-security-program-operating-manual-nispom https://www.federalregister.gov/documents/2020/12/21/2020-27698/national-industrial-security-program-operating-manual-nispom tailoring. All tailoring of PPM must be approved by HUD’s Deputy Chief Information Officer

(DCIO) for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be for one (1) twelve (12)-month base period and four

(4) twelve (12)-month option periods.

1.6 Place of Performance

The Places of Performance for the contract will be at the Contractor’s external colocation data center facilities and the Contractor’s offices.

1.7 Hours of Operation

The EDRC Data Center shall be available and operational 24 hours, seven days a week, 365 days a year. Core business hours are defined as Monday through Friday (excluding Federal holidays) 8 am to 5 pm, Eastern Standard Time.

The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

Non-applicable (N/A)

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award.

1.10 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR) and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.11 Contractor Travel

Travel is not authorized.

1.12 Transition-In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services as required. As a successor, the Contractor shall have sufficient personnel on board during the 90-calendar day Transition-In period to ensure a smooth transition with the incumbent Contractor, if required. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements to commence full performance of services by the end of the contract Transition-In period. Transition-In is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition-Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 90-calendar day Transition-Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period.

2 Definitions and Acronyms

2.1 Definitions

Business Day – Every official day of the week which are days between and including Monday to Friday. This does not include federal holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer’s Representative (COR) – An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable - Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property is property in the possession of, or directly acquired by, the Government and subsequently furnished to the

Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification.

Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Hot Disaster Recovery Colocation Migration Data Site - a portion of the data center that hosts the lower environment (development/test) infrastructure and services

On-Premise Hosting Services - the ability of the contractor to provide rack space for HUD’s on-premise servers, switches, routers, firewalls, and other items as required.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor’s performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The

Government does not have privity of contract with a subcontractor.

Warm Disaster Recovery Colocation Data Site - computing site which contains all the elements of a "cold” disaster recovery site while adding to them additional elements including storage hardware such as tape of disk drives along with both servers and switches

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level

CCTV - Closed-Circuit Television

CFR - Code of Federal Regulations

CIO or OCIO - Office of the Chief Information Officer of HUD

CMMI - Capability Maturity Model Integration

CO - Contracting Officer

COB – Close of Business

COOP - Continuity of Operations Plan

COR – Contracting Officer’s Representative

COTS - Commercial Off-the-Shelf

DCIO IOO - Deputy Chief Information Officer for Infrastructure and Operations Office

EDRC Data Center - External Disaster Recovery Colocation Data Center

EST - Eastern Standard Time (U.S.)

FAR – Federal Acquisition Regulation

FIPS - Federal Information Processing Standards

FISMA - Federal Information Security Management Act

GFP - Government Furnished Property

HIPAA - Health Insurance Portability and Accountability Act of 1996

HUD - U.S. Department of Housing and Urban Development

HUDAR - HUD Acquisition Regulation

HVAC – Heating, Ventilation, and Air Conditioning

IBC - International Building Code

IEC - International Electrotechnical Commission

ISO - International Organization for Standardization

ISP PoP - Internet Service Provider Point of Presence

IT - Information Technology

KW - Kilowatt

MFR – Monthly Financial Report

MSR – Monthly Status Report

NARA - National Archives and Records Administration

NCCIPS - National Center for Critical Information Processing and Storage

NFPA - National Fire Protection Association

NISPOM - National Industrial Security Program Operating Manual

NIST - National Institute of Standards and Technology

NIST SP - National Institute of Standards and Technology Special Publication

NLT – No later than

OMB - Office of Management and Budget

OY – Option Year

PIV - Personal Identity Verification

PM - Project Manager

POC - Point of Contact

POP – Period of Performance

PPM - Project Planning and Management

PWS – Performance Work Statement

QA - Quality Assurance

QASP - Quality Assurance Surveillance Plan

QCP - Quality Control Plan

SIRT - Security Incident Response Team

TPOC – Technical Point of Contact

UPS - Uninterruptable Power Supply

WSR – Weekly Status Report

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished

Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

The Government will provide and maintain the internet service provider point of presence (ISP PoP)/circuits required to connect the EDRC Data Center.

3.2 Facilities

The Government will not provide facilities.

3.3 Equipment

The Government will provide the Contractor all critical systems infrastructure hardware, software, applications, etc. to be integrated into the racks and disaster recovery colocation data center environment within sixty (60) calendar days after contract award.

3.4 Materials and Information

Copies of the following materials will be provided to the Contractor in hard copy or soft copy within 10 business days after contract kickoff, if the Contractor is not the incumbent:

• Manuals

• HUD policy, procedures documents and handbooks (including Continuity of

Operations and Disaster Recovery Guides)

• Equipment specifications and documentation related to all critical systems infrastructure, hardware, software, applications, etc.

• Access list which identifies HUD government personnel, vendors, and contractor personnel who are authorized to access the disaster recovery colocation data center facility and the HUD EDRC Data Center racks.

All materials (e.g., government data) will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all facilities required to perform the services stated within the PWS.

4.2 Equipment

The Contractor shall furnish all equipment required to perform the services stated within the PWS.

4.3 Materials

The Contractor shall furnish all material required to perform the services stated within the PWS.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the

COR.

4.5 Contractor Personnel

The Contractor shall provide a Contract/Project Manager who shall be responsible for the performance of work. An alternate shall also be designated to act in the absence of the

Contract/Project Manager. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel.

The Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to receive assignment, guidance, and direction from the COR, PM, and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to the requirement to ensure successful performance. These points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 8:00am to 4:30pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks

5.1 Transition In (Optional, only if awardee is not the incumbent)

The Contractor shall submit to the COR a draft Transition-In Plan and separate Transition-in Schedule no later than 20 business days after the Post Award/Kickoff Conference, if the awardee is not the incumbent. The Contractor shall execute the Transition-In Plan within 90 calendar days. The Transition-in Schedule shall be updated weekly during the transition-in period. The Transition-In Plan shall address the following:

• A seamless transition of services from the Government and/or incumbent contractor that does not impact EDRC Data Center services.

• A detailed schedule outlining the day-to-day transition activities and timeline.

• Facility Drawings that depict the floor and location of HUD EDRC Data Center:

o locations of the loading docks and freight elevators as applicable o racks, floor space square footage, cable tray runs, raised decking, ethernet/fiber plant runs, HVAC & cooling, power plant, generator connections, power whips, power panel with breaker assignments, ground bus bars, and rack elevations which depict power strips, grounding, cooling fans, etc.

The Contractor shall submit a final Transition-In Plan no later than 5 business days after receipt of COR comments. Any changes to the Facility Drawings shall be provided to the

COR and TPOC within ten (10) business days of the change.

Performance Standards

a) Standard: Draft Transition-In Plan and Transition-In Schedule submitted to the COR no later than 20 business days after the Post Award/Kickoff Conference.

AQL: Zero deviation

Deliverables

A001 Draft Transition-In Plan A002 Final Transition-In Plan A003 Transition-In Schedule

5.1.1 External Disaster Recovery Colocation Data Center (EDRC Data Center)

The Contractor shall provide and maintain, within 90 calendar days after contract award, a secure commercial facility for an External Disaster Recovery Colocation Data Center (EDRC Data Center) to house HUD’s IT infrastructure. The EDRC Data Center shall have a full N+1 component redundancy consistent with NIST SP 800-47 for conditioned power uptime to the racks, power whips, uninterruptable power supply (UPS), and hardware investments. The Contractor shall verify the internet service provider point of presence (ISP PoP)/circuits are connected to HUD disaster recovery hardware and racks and that it can support redundant telecommunication circuits. The Contractor shall provide a copy of the rack keys to the COR and make the facility accessible 24 hours, seven (7) days a week, 365 days a year to authorized HUD staff, partners, vendors, and contractors. The facility shall comply with all policies and regulations listed in section 1.3 of the PWS. The EDRC Data Center shall be fully operational at the end of the transition-in period.

The Contractor shall provide comprehensive full-scale on-premises hosting services to support the Department of Housing and Urban Development’s (HUD) mission-critical IT infrastructure. This includes secure, purpose-built rack space to accommodate HUD’s on-site servers, network switches, routers, firewalls, and other associated hardware components necessary for continuous operations.

All facilities and installations shall be designed, constructed, and maintained in strict compliance with the International Building Code (IBC), as well as all applicable state and local building code regulations. In instances of conflicting requirements among these codes, the Contractor shall defer to the jurisdictional authority having code enforcement authority, specifically following the direction of the local building inspector regarding code precedence.

The physical environment shall include and support the following infrastructure elements and specifications:

• An robust reliable and scalable electrical power grid infrastructure with sufficient capacity to support the entirety of HUD’s IT systems without any service degradation of service.

• Industrial-grade equipment racks engineered for high-density server and network device installations.

• A fully integrated fiber optic and Ethernet cabling system (cable plant) designed to ensure optimal network performance and physical layer integrity.

• Cable management solutions such as overhead cable trays or raised floor decking systems to promote safety, airflow management, and organized routing of power and data cabling.

• Commercial-grade materials for equipment cabinets and cages that meet federal physical security standards for controlled access areas.

• Freight-capable service elevators and dedicated loading docks to accommodate the transportation and staging of IT hardware and large freight deliveries from transport vehicles, including vans and trucks.

The facility shall be resilient to natural and environmental hazards. Accordingly, it shall be engineered to withstand a wide range of natural disasters, including but not limited to:

flooding, hurricanes, tornadoes, seismic activity, forest fires, straight-line winds, windstorms, and lightning strikes. The design must reflect continuity-of-operations planning and disaster recovery requirements.

In support of these objectives, the facility shall include the following safety and environmental control systems:

• A certified and code-compliant fire suppression system suitable for IT environments, including clean-agent or inert gas-based solutions that minimize equipment damage.

• A smoke dispersion and evacuation system engineered for rapid smoke clearance and safe egress.

• A lightning arrestor system integrated into the building’s grounding infrastructure to mitigate the risk of electrical surges caused by lightning strikes.

• A water ingress detection and alerting system capable of identifying and notifying personnel of water leaks that could endanger IT equipment.

• Environmental monitoring tools such as temperature and humidity sensors for precise control of conditions within the data center.

• Implementation of hot and cold aisle containment systems to ensure efficient thermal management and airflow control, inclusive of contingency cooling capabilities in the event of primary system failure.

• Rack-level physical security, including lockable enclosures for all racks to prevent unauthorized access and ensure compliance with federal information security standards.

The Contractor is responsible for ensuring that all facilities, equipment, and services meet or exceed HUD’s operational, environmental, and security requirements throughout the period of performance.

Performance Standards

a) Standard: EDRC Data Center complies with all standards listed in 5.1.1 within 90 calendar days after contract award.

AQL: Zero deviation

b) Standard: EDRC Data Center includes all core requirements and complies with all policies and regulations listed in section 1.3 of the PWS.

AQL: Zero deviation

Deliverables A004 EDRC Data Center

5.1.2 Program and Project Management Support Services (Transition-In) (Optional, if award does not go to incumbent)

The Contractor shall provide transition-in program and project management support services to include the performance, management, and oversight of all activities performed by the contractor personnel, including subcontractors, to satisfy the transition-in requirements identified in this PWS. The following support services include:

• Coordinate and facilitate weekly program meetings to discuss transition-in issues no later than close of business (COB) Tuesday of each week.

o Prepare briefing materials (due to all meeting attendees no less than (1) business day (24 hours) prior to meeting)

Prepare meeting minutes (due to COR and TPOC no later than two (2) calendar days (48 hours) after the meeting)Prepare and disseminate Weekly Status Report (WSR) showing progress (i.e., setting up of EDRC Data Center) against transition-in plan, including information on staffing, technical progress, and any program risks. The WSR shall be submitted to the COR no later than COB Friday of each week during the transition-in period.

Performance Standards

a) Standard: Meeting conducted NLT COB Tuesdays of each week to discuss transition-in progress and issues.

AQL: One (1) business day from deviation.

b) Standard: WSR submitted to the COR no later than COB Friday of each week. AQL: Zero deviation

Deliverables A005 Briefing Materials A006 Meeting Minutes A007 Weekly Status Report

5.2 Facility Operations and Performance

The Contractor shall maintain the EDRC Data Center and have an annual facility uptime performance of 99.982%. The Contractor shall submit to the COR a monthly Facility Uptime

Performance Report for the previous month by the 5th calendar day of each month. The

Contractor shall ensure the EDRC Data Center power capacity is backed up by generators and

UPSs. The generators and UPSs shall be capable of supporting the HUD racks capabilities, and the EDRC Data Center operational environment. The EDRC Data Center shall be operational and available to assume full operations consistent with industry standard Tier Three (3) Data Center of

99.982% annual uptime performance. The Contractor shall notify the COR via email of all maintenance activities at least five (5) business days prior to the scheduled maintenance.

Performance Standards

a) Standard: Annual facility uptime performance of 99.982%.

AQL: Zero deviation.

b) Standard: Notification to the COR of all maintenance activities at least five (5) business days prior to the scheduled maintenance.

AQL: Zero deviation

A008 Facility Uptime Performance Report

5.2.1 Service Outage and Postmortem Report

In the event of a service disruption not attributed to a declared disaster recovery scenario, the Contractor shall formally notify both the Contracting Officer’s Representative (COR) and the Technical Point of Contact (TPOC) via electronic mail within a maximum of three (3) hours from the time the service outage or emergency condition is identified. The notification must comprehensively include the following details:

• The precise time the outage commenced.

• The current status of network connectivity and the operational status of affected facilities;

• An estimate of the number of equipment racks impacted; and

• The projected timeframe for restoration of full service functionality.

In circumstances involving an active disaster recovery event, the Contractor is required to notify the COR and TPOC within twenty (20) minutes of the onset of any condition that results in degradation of network connectivity and/or disruption of facility operations. This notification shall be transmitted via both electronic mail and direct telephone communication. At a minimum, the message must specify the time the issue was detected and an estimate of its duration.

For all service outages, regardless of origin, the Contractor shall conduct a formal root cause analysis. A Postmortem Report shall be submitted to both the COR and TPOC within five (5) business days following the initial notification. This report shall provide a detailed examination of the event and shall, at a minimum, include the following components:

• A clear identification and explanation of the underlying technical problems;

• Documentation of any operational issues or stakeholder concerns raised during or after the event;

• A description of proposed solutions aimed at immediate containment and long-term prevention;

• A summary of corrective actions executed; and

• An in-depth risk mitigation assessment evaluating potential future vulnerabilities and associated response strategies.

This reporting and analysis process is integral to maintaining transparency, ensuring accountability, and facilitating continuous service improvement within the operational environment. The Contractor shall not deploy Government’s data and/or customer data within the disaster recovery colocation data center environment unless requested by the COR and TPOC.

Performance Standards

a) Standard: Notify the COR and TPOC via email within three (3) hours of a service outage or any emergencies that occur outside of a disaster recovery event.

AQL: Zero deviation.

b) Standard: Notify the COR and TPOC within 20 minutes of outage caused by a disaster recovery event.

AQL: Zero deviation.

Deliverables

A009 Service Outage/Incident Notification A010 Postmortem Report

5.2.2 External Disaster Recovery Colocation Data Center Security Services

The Contractor shall deliver uninterrupted, comprehensive security services for the

EDRC Data Center facility, operating continuously 24 hours per day, (7) seven days per week, 365 days per year. These services shall be fully aligned with all applicable federal and departmental security mandates, including, but not limited to: the

National Industrial Security Program Operating Manual (NISPOM); National Institute of Standards and Technology (NIST) Special Publication 800-53, Security and

Privacy Controls for Federal Information Systems and Organizations; the Federal

Information Security Modernization Act (FISMA); and the Federal Risk and

Authorization Management Program (FedRAMP) Moderate baseline. All security operations shall further comply with current and future HUD-specific security standards, policies, and procedural guidance.

The Contractor’s security support shall include, at a minimum, continuous physical security personnel coverage and a fully operational closed-circuit television (CCTV) surveillance system. This system must provide high-resolution monitoring with a video retention capability of not less than thirty (30) calendar days, enabling post-incident review, compliance verification, and investigative support.

Access control protocols must be strictly enforced by the Contractor. Only authorized individuals—specifically HUD personnel, vetted vendors, and approved contractors— shall be granted facility access, contingent upon verification against HUD’s official facility access list. All entrants must present either a government-issued Personal

Identity Verification (PIV) card or a valid state-issued driver’s license. Entry shall be denied to any individual not appearing on the approved list or…