RFI_and_Draft_SOW_SAM_1.pdf

Auction SaaS Page 1 of 31

1. REQUEST FOR INFORMATION

This is NOT a request for proposal or quote. This posting is to support market research about a potential future requirement to see if the capabilities exist via the commercial market for providing a full cloud stack, including IaaS, PaaS, and a cloud based “Software as a Service (SaaS)” lease auction application services to conduct and support auction operations for individual offshore lease sales. Interested vendors can provide capability statements if they believe they can perform the requirement as described on the following pages.

In your response, please provide the following information on the cover page (cover page is not included in the 4-page limit response):

1) Company Name.

2) Address.

3) Unique Entity ID (UEI) from SAM.gov.

4) Business Size: Small, HUBZone, Woman Owned, SDB, Other than Small, etc...

5) If the capabilities described in your response exist as a complete commercial solution

6) If portions of the work will have to be subcontracted out

Please submit a response to william.rilee@bsee.gov before the listed response date and time on the SAM.gov posting and include “DOIMFBO250001” in the subject line of the email.

This Request for Information (RFI) is issued for informational and planning purposes only. The information will be used in conducting market research to identify qualified, experienced, and interested potential sources in support of the Government's requirements. This is NOT a Request for

Proposal (RFP) and this is NOT a Request for Quote (RFQ). It is not to be construed as a formal solicitation or an obligation on the part of the Government to acquire any products or services. Any information provided to the Government and/or solution demonstration/evaluation is strictly voluntary and will be provided at no cost to the Government. Responders are advised that the U.S.

Government will not pay for any information, solution demonstration/evaluation or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the responding party's expense.

In accordance with Federal Acquisition Regulation (FAR) 52.215-3 - Request for Information or

Solicitation for Planning Purposes (Oct 1997):(a) The Government does not intend to award a contract on the basis of this solicitation or to otherwise pay for the information solicited except as an allowable cost under other contracts as provided in subsection 31.205-18, Bid and proposal costs, of the Federal Acquisition Regulation.(b) Although "proposal" and "offeror" are used in this Request for

Information, your response will be treated as information only. It shall not be used as a proposal. (c)

This announcement is issued for the purpose of gathering market research information.

Auction SaaS Page 2 of 31

2.0 DRAFT SPECIFICATIONS/REQUIREMENTS

2.1 INTRODUCTION AND BACKGROUND

The Bureau of Ocean Energy Management (BOEM) has the authority to issue leases, easements, and rights-of-way on the Outer Continental Shelf (OCS) using a competitive or a non-competitive process. When BOEM uses a competitive process, it awards offshore lease areas through a simultaneous ascending clock auction format using a configurable web-based application in a cloud hosted environment.

For each lease sale, the number and configuration of lease areas to be offered is determined by

BOEM. BOEM anticipates up to five sales each year within this effort and resulting Period of

Performance, however, no number of auctions are guaranteed.

For each lease sale, BOEM publishes a Proposed Sale Notice (PSN) in the Federal Register, followed by a 60-day comment period. The PSN includes a statement of the proposed auction format and related parameters and procedures. During the PSN comment period, BOEM and the auction services provider host a public auction seminar to discuss the auction process and format.

After an undetermined period of comment review, BOEM publishes a Final Sale Notice (FSN) in the Federal Register, followed by a 30-day waiting period before an auction may take place.

The FSN provides the detailed auction rules, parameters, and procedures, and it reflects any changes to the PSN in response to public comments received or further internal review by

BOEM.

Bidders at BOEM’s offshore auctions are required to be legally, technically, and financially qualified in advance of the auction. Bidders submit their qualification applications directly to

BOEM. A list of qualified bidders is transmitted by BOEM to the auction services provider approximately five days after the FSN is published in the Federal Register.

The auction services provider configures the auction system based on information provided by

BOEM and conducts the lease sale auction. Following the conclusion of the auction, the auction services provider closes the auction and provides final data and reporting services to BOEM.

Winning bidders are notified in writing by BOEM of bid acceptance in writing following the auction.

BOEM seeks auction services and auction software to hold ascending auctions for outer continental shelf acreage, including both cloud web hosting and Infrastructure as a Service

(IaaS)/Platform as a Service (PaaS) technical support with the requisite IT security services..

Auction SaaS Page 3 of 31

2.2 SCOPE AND OBJECTIVES

BOEM requires a vendor to provide a full cloud stack, including IaaS, PaaS, and a cloud based

“Software as a Service (SaaS)” lease auction application services to conduct and support auction operations for individual offshore lease sales.

The SaaS operations include pre-auction support, including auction expertise and consultation services, reporting, system configuration and administration, security confirmation and training.

2.3 SPECIFIC TASKS

The following requirements pertain to expectations of the system and services provided by the

Contractor under this indefinite delivery/indefinite quantity via task orders. It is anticipated there will be one overall task order that will cover Tasks 1, 3 and 4. While Tasks 2 and 5 will be issued as separate task orders when needed.

2.3.1 Task 1: Contract Management

2.3.1.1 Contract Kickoff Meeting

The Contractor’s Project Manager shall hold a post-award meeting within one week of award at the location approved by the Government. The meeting shall provide an introduction between the

Contractor personnel and Government personnel who will be involved with the contract. The purpose of this meeting is to discuss roles, responsibilities, working relationships, major milestones, and deliverables.

2.3.1.2 Project Management Plan (PMP) and Project Plans

The Contractor shall document all support requirements in a PMP. The PMP shall describe the proposed management approach for each of the items in the Contract. The PMP shall detail

Standard Operating Procedures (SOPs) for all items, to include the methodology for the design, development, integration, testing, and training. At a minimum, the PMP shall:

• Provide for information on the Contractor’s management organization and internal management policies and procedures.

• Describe the approach and method for the identification, assessment, and mitigation of program risks.

• Identify milestones, tasks, and subtasks required for all supplies and services.

• Identify all documentation to be produced as part of the project

• Provide a Project Plan.

The Contractor shall provide the Government with a draft PMP within 10 business days after contract award. BOEM shall have an opportunity to comment and the final PMP shall be completed within 20 business days after contract award. The PMP is evolutionary documents and shall be reviewed monthly and weekly.

Auction SaaS Page 4 of 31

The Contractor shall provide sufficient detail in its Project Plans to demonstrate that all sections of the work are appropriately resourced, thoroughly planned, proceeding according to requirements, and documented. Upon submission and approval by BOEM, the schedule(s) shall be become the baseline project plan. Project plan updates shall be made frequently, or as designated by the COR. Changes to scheduled baseline milestones shall be documented by the

Contractor and formally authorized by BOEM.

The Contractor shall provide a Project Plan to the COR within 10 business days of the award of a project. The COR will review submitted and resubmitted Project Plan(s) within 5 business days and will either accept the Plan as delivered, or request changes. When applicable, the

Contractor must incorporate the COR's changes within 2 business days of receipt, and then resubmit the Plan to the COR.

2.3.1.3 Contract Management Reports

On a monthly basis prepare a Contract Management Report (CMR) along with a Contract

Funds Attachment. The report will be a consolidation of all currently exercised options with work reported separately by tasks. The purpose of the CMRs shall be for BOEM to review

Contractor performance and the contract status.

2.3.1.4 Contract Funds Attachment

For other than fixed price tasks, as an attachment to the invoice (Contract Funds Attachment), the Contractor shall provide a monthly detailed breakdown of expenditures on the contract. At a minimum, this shall include a breakdown of labor hours (by labor category) used by the

Contractor and any subcontractors, associated labor costs, and any other direct costs incurred.

The report shall include both reporting period and cumulative expenditures.

2.3.1.5 Project Management/Auction Services Meetings

The Contractor shall convene on a bi-weekly basis, or as directed by the COR as necessary, project management/auction services meetings with the BOEM COR and other key Government stakeholders. The purpose of these meetings is to ensure all stakeholders are informed of the project’s activities and status report, provide opportunities to identify other activities, establish priorities, and coordinate resolution of identified problems or opportunities. The Contractor shall report all work and resource assignments of projects, activities, and deliverables on a continuing basis. The Contractor shall provide the following bi-weekly status documentation for these meetings:

• Updates to the Project Plan

• Updated Risk Report for all open risks. The Contractor shall use common Project

Management Institute (PMI) risk management practices and tools, as agreed to with the

BOEM COR.

• Updated Issues Report for all open issues. The Contractor is obligated to escalate issues for resolution before impact on cost or schedule baseline.

• Updated Action Item Report for all open action items

Auction SaaS Page 5 of 31

• Meeting minutes

2.3.2 Task 2: Auction Services

Each auction service will be issued as a separate task order. The steps required for each lease sale under this task are:

2.3.2.1 PSN Consultation

BOEM will consult with the Contractor and request an initial auction rules and system configuration recommendation prior to the publication of the Proposed Sale Notice (PSN). In its request, BOEM may explain any key auction issues that might affect the recommendations.

Within 7 days of being provided the electronic draft PSN by BOEM, the Contractor will provide written comments about any auction-related issue in it, reflecting their knowledge of auction implementation, helping to ensure against omissions of key information, and preventing misunderstanding among bidders.

2.3.2.2 Auction Application Configuration

The contractor will configure its auction system to accommodate the auction format and the corresponding rules determined by BOEM, the auction configuration recommendation and any addition information provided by BOEM (such as list of qualified bidders or the asking price increments).

2.3.2.3 Public Seminar

The Contractor will help to provide a public seminar about the auction with BOEM. This will take place during the PSN comment period, at a place and time announced by BOEM in the

PSN. The purpose of the seminar is to introduce potential stakeholders to the auction format provided in the PSN, explain the auction rules, and demonstrate the auction process through examples. The Contractor will work closely with BOEM staff to coordinate the agenda, speaking assignments, and presentation materials to be provided, which will be posted to BOEM’s website.

2.3.2.4 Auction Configuration and Rules Report

Following the conclusion of the comment period for the PSN, the Contractor will write detailed auction rules for inclusion in the FSN consistent with the stipulated format identified by BOEM and provide additional consulting on any auction issues raised in the PSN. The Contractor will identify any potential issues with the proposed auction format presented in the PSN or revised by

BOEM reflecting comments and will recommend alternatives to address with BOEM.

2.3.2.5 Configuration Verification

BOEM may request a live interactive demonstration of the configured auction software to

Auction SaaS Page 6 of 31 confirm it works correctly. The interactive demonstration will include functions such as verification of the rules, configuration, or server and communications performance. This demonstration will be based on the auction specification provided in either a past lease sale or a

PSN or FSN for an upcoming sale, at BOEM’s discretion. The Contractors’ demonstration will include a scripted trial auction with at least ten (10) government personnel participating as surrogate bidding agents or monitors.

The Contractor can lead the demonstration remotely or from either its own facility or BOEM’s offices depending on specific needs. The demonstration auction must be conducted using the same cloud platform as will be used in the actual auction with BOEM staffers logging into the system via the internet from multiple locations. Examples of phone bids must be included in the demonstration. Following the demonstration auction, BOEM will notify the Contractor of any problems or concerns identified during the demo. The Contractor must resolve these matters prior to the upcoming auction. BOEM may request another demonstration auction to verify the revised system works as needed.

2.3.2.6 Review Draft FSN

Within 7 days of being provided the electronic draft FSN by BOEM, the Contractor will provide written comments about any auction-related issue in it, reflecting their knowledge of auction implementation, helping to ensure against omissions of key information, and preventing communication issues with bidders.

2.3.2.7 Mock Auction for Bidders

The Contractor will conduct a mock auction for bidders shortly before the monetary auction to:

• give qualified bidders a hands-on opportunity to learn based on realistic bidder specifications and conditions using the same auction software to be used in the actual auction.

• ensure qualified bidders can connect to the auction system from multiple locations/devices prior to the start of the mock auction.

• provide the opportunity for BOEM to gain experience in monitoring the auction environment in real time.

Scripted bidding scenarios are preferred, and any scripts for the bidders will be developed by the

Contractor. The mock auction must follow format and procedures specified in the FSN.

2.3.2.8 Conduct Monetary Auction

The Contractor is expected to conduct the lease sale monetary auction, with participation of designated government personnel, and determine provisional winning bids and prices based on all the specifications provided in the FSN, including the auction format, parameter specifications, and bidding procedures.

The auction will be directed and conducted in a secure, cloud environment following criteria described in section 2.3.4.3 – Security, 2.4 – Auction Software Requirements, and 2.8 Security

Auction SaaS Page 7 of 31

Objectives and Service Level Agreements.

The Contractor shall also provide a secure room to conduct the auction.

2.3.2.9 Auction Reports and Data Files

Following the sale, the Contractor must complete and provide the following:

• Auction Validation Report

Validate the auction results are consistent with the inputs received from bidders at the conclusion of the auction. The deliverable will be a letter or short report certifying the provisional winning bid results and providing analysis to assist BOEM in identifying issues that could provide cause to reject bids, such as anti-competitive behavior, auction system errors, or the presence of unusual bidding patterns.

• Complete Auction Data File

The Contractor will provide an electronic file to BOEM with all auction data including all data inputs provided by the bidders (including telephone recordings or transcripts), bidder information, bid data, results, and audit tracking data collected during the auction by the auction environment, including but not limited to data and time stamps for each bid. This electronic file will be used to fulfill records management purposes. The file must be provided in common office automation format agreed upon by the Contractor and

BOEM.

This file will be delivered following any security protocols defined in section 2.3.4.3 -

Security and 2.4 – Auction Software Requirements.

• Auction Final Report

The Contractor will provide a summary of auction operations, confirm auction results are authentic and accurate, and identify any lessons learned or potential best practices based on the conduct of the auction within 10 business days.

• Auction Close-Out

All data are property of the government. The Contractor is to restrict Bid Representative access to the auction online site within 24 hours of the completion of the auction. BOEM is to continue to have access to the auction cloud site for 30 days following the completion of the auction for purposes such as downloading reports. The Contractor is not permitted to disseminate any BOEM information beyond what is permitted in this order without explicit written notice from the Contracting Officer’s Representative

(COR).

• Auction Shut-Down

After the 30 days, the Contractor will shut down access to the lease sale cloud system and ensure no information is accessible after this time. Upon completion of the work related to the contract, the Contractor must provide evidence that all government (bureau) data has been purged from any systems used. Auction data must be permanently removed

Auction SaaS Page 8 of 31 from the cloud system, from all development or test systems and any backups or images wiped according to criteria in 2.4 – Auction Software Requirements.

2.3.2.10 Ad Hoc Reports and Review

BOEM may request that the Contractor provide additional reports/information on an as-needed basis before and/or after the completion of the auction as well as review any related documents.

2.3.2.11 Overlapping Schedules

The Contractor must be able to conduct multiple tasks at the same time in the event BOEM has overlapping sales schedules. An example of this is performing Pre-PSN Consultation tasks for one auction in the same week of a Mock Auction for another auction.

2.3.2.12 Additional Consulting Services

The Contractor may be called upon from time to time to provide subject matter expert consulting services and other activities necessary to support an active auction process not anticipated at the time this SOW was prepared.

2.3.2.13 Request to Halt Work

The potential tasks supporting a single sale are covered in this section. However, BOEM may request to stop work on an auction task if the corresponding lease sale is cancelled.

2.3.3 Task 3: Software and Hosting Services

Contractor shall provide a license for the Software as a Service (SaaS) capable of meeting the requirements in Section 2.3.4 and 2.4 below. Contractor shall provide maintenance and software updates and enhancements.

Contractor shall propose and provide one of two solutions as follows:

1) A full SaaS stack that is FedRAMP authorized, hosted and maintained on the

Contractor’s IT infrastructure and provides a fully elastic and on-demand SaaS environment at the Federal Information Security Modernization Act (FISMA) Moderate level.

2) If a FedRAMP authorized full SaaS stack is not available, Contractor shall propose a customized private SaaS solution on a FedRAMP IaaS/PaaS that includes a plan to coordinate with BSEE/BOEM Security Branch personnel to achieve and maintain an

Agency ATO. The Contractor shall include in their quote an optional task to provide a third-party assessor to validate that the security controls in place are conforming to the latest version of NIST 800-53 requirements including annual NIST continuous monitoring.

A reference table is below with the breakout of the cloud environment.

Auction SaaS Page 9 of 31

2.3.4 Task 4: Technical Support

2.3.4.1 Operation and Maintenance

The Contractor shall perform all operations and maintenance (O&M) activities for the hosting service and all systems within the hosted service. The Contractor shall provide ongoing support for all the operations, maintenance, and security of the deployed infrastructure, which includes, but is not limited to:

• Facilities Infrastructure as a Service Network and Server Operations Platform as a

Service

• System and Environment administration

• Host-based intrusion detection

• Network-based intrusion detection

• Backup and recovery

• Monitoring of operating system, database, applications, and network

• Support for installation of application patches and service packs

• Physical database support and management

• User IDs and passwords resets

• System software patches and upgrades

• Hardware life cycle replacement

• Maintaining Environment to qualify for Authority to Operation (ATO) certification

• Guaranteeing system availability

• Reporting service level metrics

2.3.4.2 Ongoing Support

The Contractor shall submit recurring monthly, quarterly and annual reports, including security assessments, in accordance with NIST SP-800 37 rev2, NIST SP-800 53 rev 5 (or latest version), and the requirements of this contract.

Contractors must provide Ongoing Reports and their frequency according to the FedRAMP CSP

Continuous Monitoring Strategy Guidance. See Appendix B in the FedRAMP CSP Continuous

Monitoring Strategy Guide

Cloud Stack Cloud Stack Component System Component

Software Application -

FedRAMP SaaS

Data Data is owned by BOEM

Application Simultaneous Ascending Clock Auction

Software

Application Platform -

FedRAMP PaaS

Middleware

Operating System

Infrastructure -

FedRAMP IaaS

Virtualization

Servers

Storage

Networking

Auction SaaS Page 10 of 31

(https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_

Guide.pdf) for control reporting requirements grouped by frequency, and Appendix C for additional information on monthly reporting requirements. For controls that do not have a check in either the CSP authored deliverable or 3PAO authored deliverable columns in Table 2, the

CSP is required to provide evidence of compliance minimally during annual assessment and upon request.

2.3.4.3 Security

The auction application and supporting system must meet or exceed all security requirements.

See Section 2.4, 2.6, and 2.8 for further details on requirements. This auction application is a

FISMA Moderate system according to its FIPS-199 classification. At all times, Contractor shall comply with the FedRAMP, FISMA, NIST, DHS and OMB Circular A-130 as applicable.

Contractor shall provide an experienced Information System Security Officer (ISSO) to oversee security activities, assessments, and reports, as well as work with the BOEM's Chief Information

Security Officer on developing methodologies and procedures for security necessary to validate

IT systems, infrastructure, and data as required and provide security documentation.

Contractor shall provide the following:

• The Control Implementation Summary (CIS) showing control responsibility in each cloud platform level

• Provide the Customer Responsible Matrix of controls BOEM is responsible for

• Provide Max.gov and/or alternate secure location where the cloud ATO package documentation is stored for access by the BOEM Information System Security Officer

2.3.5 Task 5: Special Projects

When special situations arise, this task allows BOEM to obtain additional auction implementation services, such as software modification for additional auction designs or functionality. This Special Project services do not include work on or related to software to provide the capabilities described in SOW Section 2.3 and 2.4 that the Contractor promised to provide upon award. Payment under this item shall be determined by Time and Materials Labor

Categories and Rate schedule.

2.4 AUCTION SOFTWARE REQUIREMENTS

The software security controls must meet or exceed FISMA requirements for information systems categorized as FIPS-199 defined Moderate. A complete Authority To Operate (ATO) package shall be ready for signing official review by September 30, 2023 or a date approved by the contracting officer or contracting officer’s representative. In the event the contractor fails to meet minimum requirements, the correction of such failure shall not be rectified via a change request, request for equitable adjustment, or other mechanism in which additional funding is https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf

Auction SaaS Page 11 of 31 anticipated to be provided via the contract. The risk relies on the contractor to correct the failure under this FFP CLIN.

Minimum Software Requirements

1 General Parameters/Auction Configuration

1.1 The system shall provide the ability to handle simultaneous ascending clock auction format (SACA) without package bidding and support multiple factor auctions, including BOEM’s current formulation of bidding credits using second pricing.

1.2 The system shall provide the ability to run an auction containing one or more lease areas as well as lease areas having a regional component where restrictions can be placed on the number of lease areas bidders can win within a region.

Scale: The system shall accommodate the submission of bids by at least 25 qualified bidders (companies), 10 lease areas, and be able to handle 2 regions at a time.

Any maximum constraints on the number of bidders, lease areas, and regions shall be set forth by the Contractor in their quote.

1.3 The Contractor shall provide their auction and economic expertise and work with

BOEM to identify and configure the auction parameters and bidding rules. The

Contractor is also expected to have processes and algorithms in place to determine how to ethically, fairly, and legally resolve any bidding situations that may arise during or after the auction.

1.4 Business rules regarding on the bidding for lease areas will be defined and agreed upon by BOEM and the Contractor.

1.5 The system shall provide the ability to display and organize lease data for an auction.

These data may include but are not limited to:

● Number of lease areas in the auction

● Cash bonus price bid (for each lease)

● Bidding credit and/or discount percentage (for each lease)

● Number of rounds

● Number of bids placed in round

● Qualified Bidders/Bidder Representatives that can bid on each lease sale (see

Section 2 Bidder Configuration for more details)

2 Bidder Configuration

Auction SaaS Page 12 of 31

2.1 “Qualified Bidders” refer to the companies that have undergone a review process by

BOEM and are eligible to participate in a lease sale auction.

“Bid Representative” is a Qualified Bidder company representative with an authorized user id to the auction application for the purposes of participating in the bidding process.

The Contractor will use the following information provided by BOEM to configure the

Qualified Bidders/Bid Representatives in the auction application:

● List of Qualified Bidders.

● For each Qualified Bidder, their Bid Representative’s contact information.

● The number of lease areas the Bid Representative for each Qualified Bidder can bid on.

● Qualified Bidders’ credit and/or discount percentages.

2.2 The Contractor is responsible for creating and securely delivering a unique log-in ID

(i.e., named account) and corresponding information to the specified Bid

Representatives.

2.4 The Contractor is responsible for verifying with the Bid Representative that the log-in is configured correctly prior to the auction. This is to be done with sufficient time for

BOEM and the Contractor to remedy any discrepancies noted by the Bid

Representative.

2.5 Each Qualified Bidder (Company) must have at least one Bid Representative participating in a lease sale auction. Bidders must have flexibility to bid from different locations and different computers. Contractor may propose alternative bidder participation arrangements or auction software configurations.

2.6 The system shall provide the ability for the Contractor to remove a Qualified Bidder and corresponding log-in IDs from an auction. For instance, the Contractor may be requested by the BOEM to do this if an otherwise qualified bidder fails to submit a required bid deposit.

3 Auction and Bidding Process

3.1 Bidding will be conducted on the bid price for each lease area offered.

3.2 The system will provide an opening bid for each lease area. The admin user inputs the amount of the opening bid prior to the auction day.

3.3 Each Qualified Bidder can submit bids on one or more lease areas based on the bidder’s eligibility and auction rules at the opening of each round. As the auction continues, a bidder’s eligibility is determined by the number of bids it submitted in the round prior to the current round.

3.4 For any number of lease areas included in the auction, provide the ability for a

Qualified Bidder to submit exit or intra-round bids for each of the lease areas bid on.

3.5 The auction application must validate bids to ensure they do not violate auction parameters and bidding rules.

Auction SaaS Page 13 of 31

3.6 In the event auction parameters and/or bidding rules are violated, the system shall return an accurate, relevant error message to the Bid Representative. If possible, the message will provide suggestions how to make the bid valid.

3.7 The system will provide confirmation when a valid bid has been entered.

3.8 When a bidding phase of a round ends, the system must prevent Bid

Representatives from modifying the bid for their Qualifying Bidder.

3.9 The system shall provide the ability for the Auction Manager to temporarily block access to the system for bidders. This is used in an emergency where the Auction

Manager needs to ensure all bidders have access to the same information.

3.11 The system shall provide a timer to provide Bid Representatives and monitoring accounts alerts of auction timeframes (e.g., how much time is left in a round). The system shall provide bidding status updates consistent with the auction rules.

3.12 All events shall be noted in a comprehensive audit log.

3.13 If bidding credits or discounts are used in the auction, the bidder’s display should show the asking price, cash bid component, and the credit/discount component.

• In the event of a credit, the credit is calculated as a percentage of the cash bid, which is then added to the cash bid to make the asking price. The display should be able to show the calculated cash portion and awarded credit.

• In the event of a discount, the discount is calculated as a percentage of the asking price, which is then subtracted from the asking price to calculate the cash bid.

The display should show the cash portion as bid price minus discount amount.

3.14 The system shall allow for configuration to meet auction rules and procedures, such revisions to the bidding credit or discount calculations.

3.15 The Contractor will be involved in setting up, running, and closing out the auction on the auction application. The Contractor will be monitoring the state of the auction application and systems and perform the necessary support services should any system issues arise.

4 Determining the Winning Bids/Offers

4.1 The system shall provide the ability for winner assignment/determination:

• As appropriate to auction design, the Contractor shall determine the appropriate algorithm and optimizing software to determine the provisional winning bid.

• Taking into account bidding credits and other adjustments to bids.

5 Determining the Prices

5.1 The system shall determine the price for each winning bid/offer according to the auction design, which includes second pricing.

6 Interface Requirements - Browsers

6.1 At a minimum, Contractor shall ensure compatibility with most current versions of

Microsoft Edge, Google Chrome, and Safari.

6.2 The system shall not require installation of any special software or plug-ins.

7 Interface - User Access/Data Display

Auction SaaS Page 14 of 31

7.1 The system shall provide the ability for users to be configured with different access, functionality and viewing options. This may include but is not limited to:

● Bid Representative for each Qualifying Bidder

● Government Personnel

● Auction Managers

The Contractor will work with BOEM to determine varying access levels allowed by User Roles.

7.2 At least 10 Department of the Interior Government Personnel log-in credentials are required with access sufficient to enable live monitoring of the auction, including access to bid information, auction round summaries, and lease area prices.

Any maximum constraints on the number of Bid Representatives or monitoring accounts shall be set forth by the Contractor in their quote.

7.3 The information the auction bidding interface must convey to all users includes, but is not limited to:

● needed information for each lease area pertaining to the current and previous rounds’ auction prices

● the number of bids received in the previous round for each lease area

● time to the start of the next round

● deadline to submit a bid in the current round

● The Contractors’ contact information (for bidders to communicate with the

Contractor on issues or questions during the auction).

7.4 The auction bidding interface needs to include the following information specific to each

Bid Representative for a Qualifying Bidder. This information should not be viewable to

Bid Representatives of other Qualifying Bidders.

● Bid Representative’s name and contact information

● Qualifying Bidder’s most recent bid for the current round without applicable unique percentage discount.

● Qualifying Bidder’s percentage discount or credit (established prior to the auction)

● Qualifying Bidder’s most recent exit or intra-round bid(s)

● Qualifying Bidder’s most recent final cash bonus offer (last bid(s) for one or more lease areas depending on eligibility)

7.5 Government personnel shall be granted access for live monitoring of the auction, including:

● Access to bid information

● Auction round summaries

● Lease area prices

Auction SaaS Page 15 of 31

7.6 Auction Manager(s) shall be granted access for live monitoring and running of the auction, including:

● Access to bid information

● Auction round summaries

● Lease area prices

● Receiving and responding to questions and comments from bidders.

● Creating and storing notes relevant to the auction and the bidders.

7.7 The system shall provide the ability for Auction Managers to communicate with one, multiple, or all Bid Representatives or Government monitors who are logged onto the auction application, whether or not a live auction is in progress. The communication may take the form of, but is not limited to, alerts, notifications and/or messages

7.8 The system shall log auction activity in a format acceptable to BOEM. The auction audit logs will be available to Auction Managers and BOEM during and after the auction. It will record all events pertinent to the outcome of the auction, such as bidding information and any user notes.

7.9 Contractor shall provide a process for submitting unlimited support requests and questions from authorized users.

8 Telephonic bidding/support

8.1 The system shall allow the Auction Manager to be able to access the auction system on behalf of a bidder to place bids or perform other system actions for that bidder during an auction. The system’s data files shall separately identify any bids placed or other actions completed using telephonic bid access.

8.2 Telephone support for Bid Representatives shall be made available starting the last full business day prior to the auction and on the day(s) of the auction, or as provided in the FSN. This support must allow bidders the option to submit their bids by phone in the event their internet connection to the auction is disrupted.

Telephone support calls will be recorded and logged.

Auction SaaS Page 16 of 31

Reliability, Accessibility, Security, and Traceability Requirements

9 Reliability (including Recoverability)

9.1 The system needs to be available for a predefined auction period according to the following:

Pre-Auction (for 30 days before auction is scheduled to take place)

≥ 98% application availability for BOEM and Bid Representatives during pre-auction activities, with a financial backed penalty schedule. These activities include but are not limited to:

• Mock Auction

• Verifying login IDs

Auction

≥ 98% application availability for BOEM and Bid Representatives during live auction activities, with a financial backed penalty schedule.

A live auction may span a specific time period over multiple days. System availability

‘during’ an auction is the time stated for the start of auction login in the FSN to one hour after the auction is closed for each day the auction is running.

If the system is not available during the published times, the auction may need to be rescheduled at BOEM’s discretion.

Post-Auction (for 30 days after auction is completed)

≥ 98% application availability for BOEM with a financial backed penalty schedule to perform Auction Close-Out activities (see section 2.3.2.10 – Auction Close-Out)

Between Auction Periods

No Availability for BOEM or Bidders is required between auctions. The Contractor will maintain the infrastructure in a minimal capacity that allows the system to be become readily available (i.e., includes required scanning and patching) for the next auction without incurring additional setup costs.

9.2 The approximate target throughput the system should handle at least 25 Qualified

Bidders simultaneously submitting bids and at least 10 BOEM auction monitors during an auction period.

System response time during a mock and/or live auction is required to be within 3 seconds.

9.3 A contingency plan is to be provided which covers risks in the auction process (e.g., auction delay due to power outage or system failure).

9.4 Ability to take a secured snapshot of the auction at each stage, and store snapshots on a backup server. In addition, the Contractor must have the option of moving to a backup server using one of these backup saves of the auction state.

9.5 No additional storage needs outside the storage necessary for the successful completion of pre-auction, auction and post auction activities are required.

Auction SaaS Page 17 of 31

10 Authentication and Security

10.1 The Contractor's solution shall require secure authentication of the auction bidders using the BOEM’s two factor authentication over the Internet. The proposed auction bidder authentication architecture must be approved by BOEM.

10.2 The authentication mechanism must use a phishing-resistant MFA solution as identified in OMB Memorandum M-22-09 to meet upcoming Federal Zero Trust

Architecture requirements for internal and public-facing services. This applies to both development and production systems and services.

There is no need for the Contractor to access any systems inside the DOI network, but the Contractor shall use two factor authentications on development systems.

10.3 The proposed solution must be routed through the DOI Trusted Internet Connection

(TIC):

The overall purpose of the Trusted Internet Connection (TIC) Initiative as outlined in

OMB Memorandum M-08-05 is to optimize and standardize the security of individual external network connections, to include connections to the Internet, currently in use by the federal government.

The CSP can provide this service by procuring Managed Trusted Internet Protocol

Services (MTIPS) for application connectivity.

10.4 Software shall use Role Based Access Control (RBAC) or similar means to ensure that only authorized individuals have access to service data and features. Roles to be defined by the BOEM.

10.5 If user authentication fails, the system shall not allow access and shall also provide a reason for the failed authentication. Further, the system will log failed events and provide alerts to the BOEM system owner after a BOEM-defined threshold has been breached.

10.6 The application shall be accessible to users utilizing a secure transport (HTTPS protocol) that is required to be TLS 1.2 and become compatible with TLS 1.3 when approved. Encryption must be FIPS 140-3 certified.

Bidder Representatives and BOEM staff monitoring the auction must be able to log-in to the auction system remotely through a secure internet portal.

Cloud Platform firewalls and traffic should be hardened to eliminate inappropriate access.

11 General and Information Security Requirements

11.1 Contractor shall agree to complete the FedRAMP Authorization to Operate (ATO) package for all computer systems and services provided by Contractor or propose a customized SaaS solution based on a FedRAMP IaaS/PaaS that includes a plan to coordinate with BSEE Security Branch personnel to achieve and maintain an

Agency ATO.

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2008/m08-05.pdf

Auction SaaS Page 18 of 31

11.2 Contractor shall complete the Assessment and Authorization process on or before providing Service Ready Notice.

11.3 Contractor will provide a FedRAMP authorized secure cloud platform that prevents loss of, or tampering with, DOI data, service degradation, and/or service disruption to the hosted environment.

11.4 Contractor will ensure all services/environments meet Government security requirements.

If during the term of this contract there are changes to the data protection and privacy laws and regulations, including FISMA, or if there are new US Federal

Government requirements applicable to the Government, Contractor and the

Government will address these changes in a mutually agreed upon Change

Management Process.

11.5 The auction application and supporting system must meet or exceed all security requirements for a FISMA Moderate system.

BSEE Information Security Branch (ISB) performs all IT security functions for

BOEM and is responsible for ensuring all IT security related services are performed and reported to the OCIO Security Compliance Section for incorporation into quarterly Foundation Cloud Hosting Services (FCHS) Authorizing Official (AO) briefings. This includes security operations and security compliance activities to include all aspects of Continuous Monitoring as described by the BSEE Information

System Continuous Monitoring Plan (ISCMP).

11.6 The system shall follow the NIST 800-160 volumes 1 and 2 for Systems Security

Engineering and Developing Cyber Resilient Systems, and the most current version of

NIST 800-161 Cyber Supply Chain Risk Management Practices for Systems and

Organizations.

11.6 Contractor shall not host any portion of the environment or store any government data in facilities outside the contiguous United States, Alaska, Hawaii, and other

U.S. Territories.

11.7 IPv6 Requirements - Contactor systems and services used for BOEM lease sale auctions must be compliant with federally mandated IPv6 requirements for public facing services (see Section 2.8 for more detail).

11.8 Backup Retention Period - All information for the auction shall be backed up and retained (i.e., pre-auction, auction and post auction). The backup retention period for that information is no later than 3 years after cutoff once the second backup of the data has been verified as successful or determined to be no longer needed.

11.9 Recovery Time Objective (RTO) - Band 1– 0 minutes to 5 minutes. Note that access is only needed during pre, post, and auction activities. Recovery should be to the start of the bidding round, if there is a need for recovery during a bidding round.

Auction SaaS Page 19 of 31

11.10 Recovery Point Objective (RPO) - Band 1– 0 minutes to 5 minutes. Note that access is only needed during pre, post, and auction activities. Recovery should be to the start of the bidding round, if there is a need for recovery during a bidding round.

11.12 The infrastructure shall provide the ability to create a Virtual Private Cloud network that allows complete control over the virtual networking environment.

11.13 IP Addressing – The CSP is required to provide public IP address space to all systems that need to be accessed by the end users and application support users as needed.

11.14 The application shall allow configuration for elastic demand usage to minimize costs during inactivity and increase during bidding periods. Usage requires minimal bandwidth usage yet high reliability of data communication services.

2.5 DELIVERABLES

Task 1 – Contract Management

No. Title Description/Format Due Date

1-1 Kick-Off Meeting The Contractor Program Manager shall schedule and coordinate a Contract or Project

Contract Kick-Off Meeting within one week of award at the location approved by the

Government.

Within 5 business days of award

1-2 Project

Management Plan and Project Plans

The contractor shall provide a project management plan and project plan with sufficient detail to demonstrate that all the sections of the work are appropriately resourced and thoroughly planned. The project plan shall consist of timelines with milestones, tasks, and subtasks.

Within 10 business days of award or within 5 days of request from COR

1-3 Contract

Management

Report

The contractor shall prepare a Contract

Management Report that includes: a description and schedule of the work performed during the reporting period, a description and schedule of the work to be performed during the next reporting period, and the identification of any technical or administrative problems, the status of all personnel, including any additions or subtractions, and any changes to the project plan.

Monthly

Auction SaaS Page 20 of 31

No. Title Description/Format Due Date

1-4 Project

Management

/Auction Services

Meetings

The Contractor shall convene project management/auction services meetings with the BOEM COR and other key Government stakeholders.

Bi-weekly or as directed by COR.

Documentation of meeting minutes, etc. to be delivered within 3 days of meeting.

1-5 Ad Hoc Meetings and Analyses

These deliverables may include analysis memos, reports, presentations, teleconferences, meetings, etc. as directed by the COR

As requested by

COR

Task 2 – Auction Services

2-1 PSN Review COR email transmittal and report in digital file

Within seven (7) calendar days of BOEM issuing the Contractor a draft copy of the PSN

2-2 Inputs for Public

Seminar

Provided in a format and manner to be mutually agreed upon by BOEM and the

Contractor

Inputs due not less than seven (7) calendar days prior to the seminar

2-3 FSN Consistency

Review Report

COR email transmittal and report in digital file

Within seven (7) calendar days of

BOEM issuing the Contractor a draft copy of the FSN

2-4 Mock Auction

Test Scripts

COR email transmittal and report in digital file

As requested by COR

2-5 Mock Auction

Summary Report

COR email transmittal and report in digital file

As appropriate

2-6 Auction

Validation Report

COR email transmittal and report in digital file

Within three (3) calendar days of the conclusion of the auction

2-7 Complete Auction

Data File

Provided in a format and manner to be mutually agreed upon by BOEM and the

Contractor

Within fourteen (14) calendar days of the conclusion of the auction

2-8 Auction Final

Report

COR email transmittal and report in digital file

Within fourteen (14) calendar days of the conclusion of the auction

Auction SaaS Page 21 of 31

2-9 Auction Close-

Out

Provided in a format and manner to be mutually agreed upon by BOEM and the

Contractor

COR one (1) copy; paper copy for any signed documents

Within thirty (30) calendar days of the conclusion of the auction

2-10 Correspondence COR one (1) copy As appropriate

Task 3 – Software and Hosting Services

No. Title Description/Format Due Date

3-1 Provision of

Software as a

Service

The Contractor shall provide a feature complete auction bidding system to BOEM that fully meets the requirements defined in

Section 2.3, 2.4, and 2.8

Upon award

3-2 Service

Documentation

The Contractor shall provide all service documentation, including detailed system components and connections.

Upon award and at the request of the

Government

3-3 Security

Documentation

The Contractor shall provide all security documentation as directed by BSEE Security

Personnel and Security requirements.

At the request of the

Government

3-4 Contingency Plan Develop and document contingency plan At the request of the

Government

3-5 Bidder and User

Manuals

The Contractor shall provide bidder and user manuals that describes the major system functions

At the request of the

Government

3-6 Certification of

Data Sanitization

Statement that the contractor has appropriately sanitized BOEM data from its system

At the request of the

Government

3-7 Hosting Services The Contractor shall provide a hosting service that fully meets all the requirements in Sections

2.3, 2.4, and 2.8.

Upon award

Auction SaaS Page 22 of 31

Task 4 – Technical Support

4.1 Technical Support The Contractor shall provide all Technical and

Security Support that fully meets the requirements in Sections 2.3, 2.4, and 2.8

Upon award

Task 5 – Special Projects

Project Plan The contractor shall provide a project plan with sufficient detail to demonstrate that all the sections of the work are appropriately resourced and thoroughly planned. The project plan shall consist of timelines with milestones, tasks, and subtasks.

Within 5 business days of the request from the COR

2.6 PRIVACY REQUIREMENTS

The Contractor shall comply with the Privacy Act and all other applicable Federal Laws, Regulations, Executive Orders, and agency policies, directives, and rules of behavior regarding privacy during the design, build, testing, operation,…