Ascend BPA - Pool 1 Performance Work Statement (PWS) r1 05 14 2024.pdf

CUI//SP – SSEL ASCEND BPA SOURCE SELECTION SENSITIVE -

SEE FAR 2 101 AND FAR 3 104

1. Background

2. Objectives

3. Scope

4. Performance Requirements

4.1. References

4.2. Personas (NEW 2024 05 01)

4.2.1. Administrative Agency (NEW 2024 05 01)

4.2.2. Authorized Assessment and Evaluation Entity (NEW 2024 05 01)

4.2.2.1. United States Federal Government (NEW 2024 05 01)

4.2.2.2. United States Department of Defense (NEW 2024 05 01)

4.2.3. Authorized Reseller (NEW 2024 05 01)

4.2.4. Cloud Service Provider (NEW 2024 05 01)

4.2.4.1. Cloud Service Provider - Infrastructure as a Service (NEW 2024 05 01)

4.2.4.2. Cloud Service Provider - Platform as a Service (NEW 2024 05 01)

4.2.4.3. Cloud Service Provider - Software as a Service (NEW 2024 05 01)

4.2.5. Contractor (NEW 2024 05 01)

4.2.6. Department of Defense Cloud Authorization Services (NEW 2024 05 01)

4.2.7. Eligible User (NEW 2024 05 01)

4.2.8. Federal Risk and Authorization Management Program (NEW 2024 05 01)

4.2.9. Law Enforcement (NEW 2024 05 01)

4.3. Acquisition Requirements - Baseline

4.3.1. Authorized Cloud Services

4.3.2. Section 508 Compliance

4.4. Business Requirements - Baseline

4.4.1. Invoicing

4.4.1.1. Cover Sheet

4.4.1.2. Prohibitions

4.4.1.2.1. Erroneous Calculations, Configurations, labeling, Settings

4.4.1.2.2. Incidents

4.4.1.2.3. Unauthorized Cloud Services

4.4.1.3. Automated Invoice Validation Service

4.4.1.4. Data Analysis

4.4.2. Service Catalogs

4.4.2.1. Service Packages

4.4.3. Utilization Based Discounts

4.5. Cybersecurity Requirements - Baseline

4.5.1. Accounts - Applications, Services, Systems, Tools

4.5.1.1. Account Requests - New

4.5.1.2. Account Requests - Changes

4.5.2. Accounts - Cloud Service Provider

4.5.2.1. Account Requests

4.5.2.2. Access and Permissions

4.5.2.3. Independent

4.5.2.4. Linking

4.5.2.5. New Accounts

4.5.2.6. Ownership

4.5.2.7. Sub-Accounts

4.5.2.8. Transfers

4.5.2.9. Transfers of Billing Ownership

4.5.3. Annual Cybersecurity Assessment (NEW 2024 04 18)

4.5.3.1. Annual Cybersecurity Assessment Documentation (NEW 2024 04 18)

4.5.3.2. Annual Cybersecurity Assessment Report (NEW 2024 04 18)

4.5.4. Assessments and Evaluations

4.5.4.1. Assessments and Evaluations Postures

4.5.4.2. Assessments and Evaluations Techniques

4.5.4.3. Findings and Recommendations

4.5.4.4. Mitigation and Remediation

4.5.4.5. Participation

4.5.4.6. Public Disclosure and Release

4.5.5. Authorization to Operate

4.5.5.1. Findings and Recommendations

4.5.5.2. Provisional Authority

4.5.5.3. Mitigation and Remediation

4.5.5.4. Participation

4.5.6. Banner and Consent to Monitor

4.5.7. Binding Operational Directives

4.5.8. Building, Facility, Property Access Identification

4.5.9. Clearance Levels - Facility

4.5.10. Clearance Levels - Persons

4.5.10.1. Suspended, Revoked

4.5.11. Credentials

4.5.11.1. Compromise, Loss, Theft

4.5.11.1.1. Costs

4.5.11.2. Issuance

4.5.11.3. Monitoring and Surveillance

4.5.11.4. Ownership

4.5.11.5. Presentation

4.5.11.6. Return

4.5.11.6.1. Costs

4.5.11.7. Unauthorized Duplication

4.5.11.7.1. Costs

4.5.12. Critical Infrastructure (NEW 2024 04 18)

4.5.13. Communications Security

4.5.14. Cryptographic Key Management (NEW 2024 04 18)

4.5.15. Cybersecurity Incident Categories

4.5.16. Cybersecurity Incident Reporting

4.5.16.1. Administrative Agency

4.5.16.2. United States Department of Homeland Security

4.5.16.3. United States Department of Defense

4.5.17. Cybersecurity Incident Response

4.5.18. Cybersecurity Information and Collaboration Programs

4.5.18.1. United States Department of Homeland Security

4.5.18.2. United States Department of Defense

4.5.19. Cybersecurity Logs

4.5.19.1. Application Programming Interfaces

4.5.19.2. Cybersecurity Logs Disclosure

4.5.19.3. Requests

4.5.20. Cybersecurity Technical Programs

4.5.20.1. United States Department of Homeland Security

4.5.20.2. United States Department of Defense

4.5.21. Cybersecurity Vulnerability Assessment Logs

4.5.21.1. Requests

4.5.22. Cybersecurity Vulnerability Reporting

4.5.22.1. National Institute of Standards and Technology

4.5.23. Digital Certificates

4.5.24. Geographic Location - Cloud Services

4.5.24.1. Geographic Location Waivers

4.5.25. Information Assurance Vulnerability Management

4.5.26. Information Classification Levels

4.5.27. Logical Access

4.5.27.1. Logical Access Logs

4.5.27.1.1. Logical Access Logs Requests

4.5.28. Middleware Disclosures

4.5.29. Multi-Factor Authentication

4.5.30. Physical Access

4.5.30.1. Physical Access Logs

4.5.30.1.1. Physical Access Logs Requests

4.5.31. Registration of Services

4.5.32. Restrictions - Cloud Services

4.5.33. Secure Software Development

4.5.34. Sensitive Compartmented Information Facility Access Identification

4.5.35. Software Bill of Materials

4.5.36. Supply Chain Risk Management

4.5.37. Testing - Eligible User Solutions

4.5.37.1. Testing Techniques

4.5.38. Timestamps

4.5.39. Training - Cybersecurity

4.6. Data Requirements - Baseline

4.6.1. Data Access - Eligible Users

4.6.2. Data Access - US Persons

4.6.3. Data At Rest Protection

4.6.4. Data Collection Disclosures

4.6.5. Data Compression

4.6.6. Data Decryption & Encryption

4.6.6.1. Post-Quantum Cryptography

4.6.7. File Formats

4.6.8. Data Location

4.6.8.1. Data Location Waivers

4.6.9. Data Management

4.6.9.1. Data Access - Unauthorized

4.6.9.2. Data Artificial Intelligence, Machine Learning

4.6.9.3. Data Containment

4.6.9.4. Data Destruction - Unauthorized

4.6.9.5. Data Isolation, Quarantine, Restricted Access

4.6.9.6. Data Mining, Scanning - Unauthorized

4.6.9.6.1. Cybersecurity, Operations and Maintenance, Performance

4.6.10. Data Monetization - Unauthorized

4.6.11. Data Release - Unauthorized

4.6.12. Data Removal - Unauthorized

4.6.13. Data Sharing - Unauthorized

4.6.14. Data Management Incident Reporting

4.6.15. Data Management Incident Response

4.6.16. Data Storage Device Management

4.6.16.1. Data Storage Device Deletion

4.6.16.2. Data Storage Device Removal

4.6.16.3. Data Storage Device Decommission and Disposal

4.6.17. Data Transceiving - Caching

4.6.18. Data Transceiving - Restrictions

4.6.19. Data Transceiving - Protection

4.6.19.1. Hypertext Transfer Protocol Secure

4.6.19.2. Post-Quantum Cryptography

4.6.19.3. Transport Layer Security

4.6.20. Judicial or Law Enforcement Orders

4.6.21. Software Ownership

4.7. Environmental, Sustainability Requirements - Baseline

4.7.1. Climate Risk Management Plans

4.7.1.1. Climate Risk Management Plan - Annual Updates

4.7.2. Electronic Waste Recycling

4.8. Operational Requirements - Baseline

4.8.1. Customer Management

4.8.2. Services Usage Summary Report

4.9. Technical Requirements - Baseline

4.9.1. Application Programming Interfaces

4.9.1.1. Application Programming Interfaces Disclosure

4.9.1.2. Accessibility, Use

4.9.1.3. Backward Compatibility

4.9.1.4. Error Notifications

4.9.2. Artificial Intelligence, Machine Learning

4.9.3. Networking and Routing

4.9.4. Technical Meetings, Reviews

4.9.4.1. Multi-Cloud Services Technical Exchange Meetings

4.9.4.2. Technical Exchange Meetings

4.9.4.3. Participants Information

4.9.4.4. Presentation Materials

4.9.4.5. Proprietary Information

4.10. Pool 1: Infrastructure as a Service, Platform as a Service

4.10.1. Acquisition Requirements - Pool 1

4.10.1.1. Transition-In

4.10.1.2. Transition-Out

4.10.2. Business Requirements - Pool 1

4.10.2.1. Financial Management

4.10.2.1.1. Budgets

4.10.2.1.1.1. Budget Notifications

4.10.2.1.2. Budget Containment

4.10.2.1.2.1.1. Activation, Deactivation

4.10.2.1.3. Financial Management Tags

4.10.2.1.4. Price Estimation

4.10.2.1.5. Financial Information

4.10.2.1.5.1. Application Programming Interfaces

4.10.2.1.5.2. Real-Time Financial Information

4.10.2.1.5.3. Archived Financial Information

4.10.2.1.6. Financial Optimization

4.10.3. Cybersecurity Requirements - Pool 1

4.10.3.1. Cybersecurity Management

4.10.3.1.1. Application Programming Interfaces

4.10.3.1.2. Cybersecurity Information

4.10.3.1.3. Cybersecurity Notifications

4.10.3.1.4. Cybersecurity Tags

4.10.3.2. Identity and Access Management

4.10.3.2.1. Application Programming Interfaces

4.10.3.2.2. Inactive Identities

4.10.4. Data Requirements - Pool 1

4.10.5. Environmental, Sustainability Requirements - Pool 1

4.10.5.1. Carbon Pollution-Free Electricity

4.10.5.1.1. Carbon Pollution-Free Electricity - Negative Performance

4.10.5.1.2. Declared Disasters and Emergencies

4.10.5.1.3. Service Catalogs - Carbon Pollution-Free Electricity

4.10.5.2. Energy Efficiency

4.10.5.2.1. Service Catalogs - Energy Efficiency

4.10.6. Operational Requirements - Pool 1

4.10.6.1. Operational Management

4.10.6.1.1. Application Programming Interfaces

4.10.6.1.2. Automation

4.10.6.1.2.1. Automatic Data Lifecycle Management

4.10.6.1.2.2. Automatic Load Balancing

4.10.6.1.2.3. Automatic Tagging

4.10.6.1.2.4. Automation Tags

4.10.6.1.2.5. Autoscaling

4.10.6.1.2.6. Scheduling

4.10.6.1.3. Operational Information

4.10.6.1.3.1. Application Programming Interfaces

4.10.6.1.3.2. Real-Time Operational Information

4.10.6.1.3.3. Historical Operational Information

4.10.6.1.3.4. Archived Operational Information

4.10.6.1.4. Orchestration

4.10.6.2. Operational Notifications

4.10.6.2.1. Application Programming Interfaces

4.10.6.3. Operational Support

4.10.6.3.1. Case Management

4.10.7. Technical Requirements - Pool 1

4.10.7.1. Data Centers, Control

4.10.7.2. Data Centers, High Availability

4.10.7.2.1. Geographically Diverse

4.10.7.3. Data Centers, Services Availability

4.10.7.4. Data Centers, Service Level Agreements

4.10.7.5. Networking and Routing

4.10.7.5.1. Private Network Connection

4.10.7.5.2. Domain Name System

4.10.7.5.3. Internet Protocol Address Access Control Lists

4.10.7.5.4. Internet Protocol Version 4

4.10.7.5.5. Internet Protocol Version 6

4.10.7.5.6. Load Balancing

4.10.7.5.7. Virtual Private Clouds

4.10.7.6. Technical Tags

4.10.8. Sub-Pool 1-1: Federal Risk and Authorization Management Program: Moderate / Department of Defense Impact Level: 2

4.10.8.1. Acquisition Requirements - Sub-Pool 1-1

4.10.8.1.1. Off-Ramping Contractors

4.10.8.1.1.1. Events

4.10.8.1.2. On-Ramping Procedures Contractors

4.10.8.1.2.1. Events

4.10.8.1.3. Special Item Numbers

4.10.8.1.4. Transition-In

4.10.8.1.5. Transition-Out

4.10.8.2. Business Requirements - Sub-Pool 1-1

4.10.8.2.1. Service Catalogs

4.10.8.3. Cybersecurity Requirements - Sub-Pool 1-1

4.10.8.3.1. Clearance Levels - Facility

4.10.8.3.2. Clearance Levels - Personnel

4.10.8.3.3. Cloud Service Offerings, Impact Level

4.10.8.3.4. Information Classification Levels

4.10.8.3.5. Supply Chain Risk Management (NEW 2024 05 01)

4.10.8.4. Data Requirements - Sub-Pool 1-1

4.10.8.5. Environmental, Sustainability Requirements - Sub-Pool 1-1

4.10.8.6. Operational Requirements - Sub-Pool 1-1

4.10.8.7. Technical Requirements - Sub-Pool 1-1

4.10.8.7.1. Cloud Service Offerings, Service Model Classification

4.10.9. Sub-Pool 1-2: Federal Risk and Authorization Management Program: High and Department of Defense Impact Levels: 4, 5

4.10.9.1. Acquisition Requirements - Sub-Pool 1-2

4.10.9.1.1. Off-Ramping - Contractors

4.10.9.1.1.1. Events

4.10.9.1.2. On-Ramping - Contractors

4.10.9.1.2.1. Events

4.10.9.1.3. Special Item Numbers

4.10.9.1.4. Transition-In

4.10.9.1.5. Transition-Out

4.10.9.2. Business Requirements - Sub-Pool 1-2

4.10.9.2.1. Service Catalogs

4.10.9.3. Cybersecurity Requirements - Sub-Pool 1-2

4.10.9.3.1. Clearance Levels - Facility

4.10.9.3.2. Clearance Levels - Personnel

4.10.9.3.3. Cloud Service Offerings, Impact Level

4.10.9.3.4. Information Classification Levels

4.10.9.3.5. Supply Chain Risk Management (NEW 2024 05 01)

4.10.9.4. Data Requirements - Sub-Pool 1-2

4.10.9.5. Environmental, Sustainability Requirements - Sub-Pool 1-2

4.10.9.6. Operational Requirements - Sub-Pool 1-2

4.10.9.7. Technical Requirements - Sub-Pool 1-2

4.10.9.7.1. Cloud Service Offerings, Service Model Classification

4.10.10. Sub-Pool 1-3: Department of Defense Impact Level: 6

4.10.10.1. Acquisition Requirements - Sub-Pool 1-3

4.10.10.1.1. Off-Ramping - Contractors

4.10.10.1.1.1. Events

4.10.10.1.2. On-Ramping - Contractors

4.10.10.1.2.1. Events

4.10.10.1.3. Special Item Numbers

4.10.10.1.4. Transition-In

4.10.10.1.5. Transition-Out

4.10.10.2. Business Requirements - Sub-Pool 1-3

4.10.10.2.1. Service Catalogs

4.10.10.3. Cybersecurity Requirements - Sub-Pool 1-3

4.10.10.3.1. Clearance Levels - Facility

4.10.10.3.2. Clearance Levels - Personnel

4.10.10.3.3. Cloud Service Offerings, Impact Level

4.10.10.3.4. Information Classification Levels

4.10.10.4. Supply Chain Risk Management (NEW 2024 05 01)

4.10.10.5. Data Requirements - Sub-Pool 1-3

4.10.10.6. Environmental, Sustainability Requirements - Sub-Pool 1-3

4.10.10.7. Operational Requirements - Sub-Pool 1-3

4.10.10.8. Technical Requirements - Sub-Pool 1-3

4.10.10.8.1. Cloud Service Offerings, Service Model Classification

4.11. Pool 2: Software as a Service

4.11.1. Acquisition Requirements - Pool 2

4.11.2. Business Requirements - Pool 2

4.11.3. Cybersecurity Requirements - Pool 2

4.11.4. Data Requirements - Pool 2

4.11.5. Environmental, Sustainability Requirements - Pool 2

4.11.6. Operational Requirements - Pool 2

4.11.7. Technical Requirements - Pool 2

4.11.8. Sub-Pool 2-X

4.11.8.1. Acquisition Requirements - Sub-Pool 2-X

4.11.8.2. Business Requirements - Sub-Pool 2-X

4.11.8.3. Cybersecurity Requirements - Sub-Pool 2-X

4.11.8.4. Data Requirements - Sub-Pool 2-X

4.11.8.5. Environmental, Sustainability Requirements - Sub-Pool 2-X

4.11.8.6. Operational Requirements - Sub-Pool 2-X

4.11.8.7. Technical Requirements - Sub-Pool 2-X

4.12. Pool 3: Cloud Related IT Professional Services

4.12.1. Acquisition Requirements - Pool 3

4.12.2. Business Requirements - Pool 3

4.12.3. Cybersecurity Requirements - Pool 3

4.12.4. Data Requirements - Pool 3

4.12.5. Environmental, Sustainability Requirements - Pool 3

4.12.6. Operational Requirements - Pool 3

4.12.7. Technical Requirements - Pool 3

4.12.8. Sub-Pool 3-X

4.12.8.1. Acquisition Requirements - Sub-Pool 3-X

4.12.8.2. Business Requirements - Sub-Pool 3-X

4.12.8.3. Cybersecurity Requirements - Sub-Pool 3-X

4.12.8.4. Data Requirements - Sub-Pool 3-X

4.12.8.5. Environmental, Sustainability Requirements - Sub-Pool 3-X

4.12.8.6. Operational Requirements - Sub-Pool 3-X

4.12.8.7. Technical Requirements - Sub-Pool 3-X

5. Performance Standards

6. Deliverables

7. Service Delivery Summary Example for your performance objectives

8. Contractor Performance Assessment Reporting- Federal Only - Task Order

9. Place of Performance

10. Period of Performance

11. Security Requirements (drill down as needed)

13. Other miscellaneous security requirements

14. Other information or special considerations

15. Comsec-? May not be needed

1. Background The Federal CIO Council issued the Cloud First, Federal Cloud Computing Strategy in 2010 and the superseding Cloud Smart, Federal Cloud Computing Strategy in 2019 that established the Federal Government's policy of leveraging commercial CSPs and cloud services. E.O. 14028 “Improving the Nation’s Cybersecurity” encourages agencies to move the cloud as part of their journey to a Zero Trust Architecture.

This created a governmentwide need for continuing and recurring cloud services that adhere to applicable legislation (e.g., U.S.C.), regulations (e.g., CFR, FAR), standards (e.g., ANSI, IETF, NIST), policies (e.g., EO, OMB, PMA), guidance, and government and industry best practices. It also created a need for recurring cloud related IT professional services to support adoption of, migration to, and governance and management of cloud services.

2. Objectives The ASCEND BPA will support the strategic sourcing of cloud services (i.e., IaaS, PaaS, SaaS) and cloud related IT professional services from authorized vendors, authorized vendors are defined as those that currently hold a multiple award schedule, that meet or exceed applicable legislation, regulations, standards, policies, guidance, and government and industry best practices. This will result in the procurement of compliant, secure, and efficiently / effectively managed cloud services and cloud related IT professional services.

The ASCEND BPA will establish baseline requirements for acquisition, business, data, environmental,sustainability, operational and technical requirements.

The BPA will also establish baseline cybersecurity requirements ensuring procured cloud services and cloud related IT professional services are continuously and securely operated and maintained for CIA, cybersecurity responsibilities and liabilities are appropriately allocated and assigned, and authorized vendors have appropriate cybersecurity incident coordination (e.g., CISA, DoD, FBI), mitigation, and remediation capabilities.

The BPA establishes baseline governance requirements ensuring procured cloud services and cloud related IT professional services are procured through streamlined acquisitions procedures, maximize cost avoidance and cost savings (e.g., BIC, CM), are effectively efficiently operated and managed (e.g., DevSecOps, FinOps), and leverage the full capabilities and investments of the Federal Government (e.g., EPA, FedRAMP, GSA, DCAS).

The BPA will support the administrative agency's General Services Administration(GSA) mission to provide a governmentwide acquisition vehicle (i.e., strategic source)that streamlines the acquisition process, leverages the buying power of the FederalGovernment, and procures compliant, secure, and effectively / efficiently managed services.

A bona fide need exists for a governmentwide BPA specifically focused on cloud services and cloud related IT professional services based on the complexity of the compliance, cybersecurity, and governance requirements and the continued adoption and usage of cloud services and cloud related IT professional services by eligible users.

3. Scope The BPA allows eligible users to procure cloud services and cloud related IT professional services. Cloud services throughout this BPA refers to Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) unless otherwise specified.

The BPA is partitioned into three (3) primary pools; Pool 1: Infrastructure as a Service, Platform as a Service (IaaS, PaaS), Pool 2: Software as a Service (SaaS), Pool 3: Cloud Related IT Professional Services) with each primary pools' scope further partitioned into discrete and defined sub-pools.

The administrative agency shall define sub-pools (e.g., requirements) and add sub-pools to the BPA over the lifetime of the BPA ordering period.

The sub-pools shall be independently solicited and competitively awarded based on the sub-pool's respective requirements (e.g., cybersecurity, evaluation criteria, technical) defined by the administrative agency.

Table XX: Primary Pools and Sub-Pools

Primary Pool Number

Sub-Pool Number

Title

1 — Infrastructure as a Service, Platform as a Service

1 1 FedRAMP: Moderate and DoD IL: 2

1 2 FedRAMP: High and DoD IL: 4, 5

1 3 DoD IL: 6

1 X TBD

2 — Software as a Service

2 1 TBD

2 X TBD

3 — Cloud Related IT Professional Services

3 1 TBD

3 X TBD

4. Performance Requirements Contractors shall provide IaaS and PaaS cloud services, SaaS cloud services, and / or cloud related IT professional services to eligible users that meet the requirements of the

BPA.

● Per contractors GSA MAS awards.

● Per contractors GSA MAS SIN 518210C Cloud Computing and Cloud Related IT

Professional Services awards.

● Per contractors Ascend BPA sub-pool awards.

● Per contractors Ascend BPA TO awards.

The BPA requirements are organized in a hierarchical structure with lower levels inheriting all higher level requirements.

4.1. References

Eligible users and contractors shall adhere to the references in:

● Appendix <<XX>>: Legislation, Regulations, and Policies,

● Appendix <<XX>>: Specifications and Standards,

● Appendix <<XX>>: Information, References, and Tools, and any future revisions or updates.

In the event that a future revision or update to references is perceived to create changes to the BPA, the eligible users or contractors shall notify [Deliverable X] the administrative agency.

Eligible users are authorized to identify additional references at the TO level.

4.2. Personas

4.2.1. Administrative Agency

The administrative agency is the GSA.

4.2.2. Authorized Assessment and Evaluation Entity

An authorized assessment and evaluation entity, is an explicitly identified government entity under this BPA, that is authorized to conduct and perform independent cybersecurity assessments and evaluations of CSPs.

4.2.2.1. United States Federal Government

The following US Federal Government agencies or subordinate agencies, components, and offices are authorized assessment and evaluation entities:

● CISA

● FedRAMP

● GAO

● NSA / CSS

● ODNI

4.2.2.2. United States Department of Defense

The following DoD agencies or subordinate agencies, components, and offices are authorized assessment and evaluation entities:

● DCAS

● DOT&E

● Marine Corps Forces Cyberspace Command

● Sixteenth Air Force (Air Forces Cyber)

● US Army Cyber Command

● US Cyber Command

● US Fleet Cyber Command

4.2.3. Authorized Reseller

An authorized reseller is an entity that has been explicitly authorized by a CSP to act as an authorized agent or intermediary (e.g., cloud broker) to offer, negotiate, and sell, on the behalf of the CSP, the CSP's cloud services.

4.2.4. Cloud Service Provider

A CSP is an entity that directly provides, operates, and maintains the cloud services technology (e.g., facilities, hardware, software).

4.2.4.1. Cloud Service Provider - Infrastructure as a Service An IaaS CSP generally provides, operates, and maintains the data center (e.g., physical security, environment monitoring), network (e.g., routing, switching), storage (e.g., archive, cache, primary, secondary), servers (e.g., CPU, RAM), and virtualization (e.g., hypervisor, virtual machines).

4.2.4.2. Cloud Service Provider - Platform as a Service

A PaaS CSP generally provides, operates, and maintains the data center, network, storage, servers, virtualization, operating system, database, and security (e.g., cybersecurity, IA)).

4.2.4.3. Cloud Service Provider - Software as a Service

A SaaS CSP generally provides, operates, and maintains the data center, network, storage, servers, virtualization, operating system, database, security, and applications (e.g., office productivity, accounting).

4.2.5. Cloud Related IT Professional Services Providers

A cloud related IT professional services provider is an entity that provides manpower with specialized knowledge, skills, and abilities of cloud services.

4.2.6. Contractor

A Contractor is an entity that has an Ascend BPA award(s) issued by the administrative agency.

4.2.7. Department of Defense Cloud Authorization Services

DCAS is a DoD program that provides a standardized approach to security assessments, authorizations, and continuous monitoring of CSOs.

4.2.8. Eligible User

An eligible user is any FSLTT government or other eligible entity that is authorized to use the GSA MAS FSS.

Authorization to use the GSA MAS FSS are per the following legislation, regulations, and policies:

Table XX: GSA MAS FSS Eligible Users

A 40 U.S.C. 502 PUBLIC BUILDINGS, PROPERTY, AND WORKS, Services for other entities1, 2, 3, 4, 5

B GSAM 538.70 Purchasing by Non-Federal Entities

C GSA Order 4800.2I "Eligibility to Use GSA Sources of Supply and Services"6

— Appendix A: Executive Agencies

— Appendix B: Other Eligible Users

— Appendix C: International Organizations and Others Determined Eligible under Section 607 of the Foreign Assistance Act

4.2.9. Federal Risk and Authorization Management Program

FedRAMP is a US Governmentwide program that provides a standardized approach to security assessments, authorizations, and continuous monitoring of CSOs.

4.2.10. Law Enforcement

A law enforcement entity is an entity with jurisdiction for the oversight or law enforcement of or for the administrative agency or eligible users.

4.3. Acquisition Requirements - Baseline

4.3.1. Authorized Cloud Services

Contractors shall provide the capability (e.g., configuration file, policy, ACL) for eligible users to restrict the usage of cloud services to only the authorized procured cloud services at the TO level.

1 Codified: E-Government Act of 2002 2 Codified: Federal Supply Schedules Usage Act of 2010 3 Codified: John Warner National Defense Authorization Act for Fiscal Year 2007 4 Codified: Local Preparedness Acquisition Act 5 Codified: Robert T. Stafford Disaster Relief and Emergency Assistance Act 6 Eligibility Determinations https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations

4.3.2. Section 508 Compliance

Contractors shall provide Section 508 compliant cloud services to ensure cloud services are accessible to all users per <<APPENDIX XX>>.

Contractors shall deliver ACRs or VPATs(™) [Deliverable X] for cloud services to the administrative agency documenting how cloud services comply with Section 508.

4.3.3. On-Ramping Procedures Contractors

Administrative agency is responsible for the on-ramping of pools, sub-pools, and authorized vendors during the BPA ordering period.

4.3.4. Off-Ramping Procedures Contractors

Administrative agency is solely (i.e., unilateral authority) responsible for the off-ramping of authorized vendors from the BPA (i.e., canceling of authorized vendors' BPA awards).

Contractors' shall continue performance under awarded TOs when authorized vendors' have been off-ramped. Authorized vendors' obligations under awarded TOs are not impacted by off-ramping.

Contractors shall not participate in TO solicitations (e.g., quote submissions, quote evaluations) after being off-ramped from the BPA.

Contractors shall not participate (e.g., compete, reapply) in BPA on-ramping solicitations after being off-ramped from the BPA.

4.4. Business Requirements - Baseline

4.4.1. Invoicing

Contractors shall invoice [Deliverable X] eligible users for payment of cloud services and cloud related IT professional services provided at the TO level.

● Invoices shall only include prices for cloud services and cloud related IT professional services provided (i.e., invoice and payment in arrears).

● Invoices may include prorated prices for prorated cloud services and cloud related IT professional services provided.

● Invoices total price shall be rounded to two (2) decimal places (e.g., $0.12).

4.4.1.1. Cover Sheet

RESERVED - Eligible users may define cover sheet requirements at the TO level.

4.4.1.2. Prohibitions

4.4.1.2.1. Erroneous Calculations, Configurations, labeling, Settings Contractors shall not invoice eligible users for payment of cloud services or cloud related IT professional services that resulted from contractors' erroneous calculations, configurations, labeling, settings, etc.

4.4.1.2.2. Incidents

Contractors shall not invoice eligible users for payment of cloud services or cloud related IT professional services that resulted from contractors' cybersecurity and physical security incidents.

4.4.1.2.3. Unauthorized Cloud Services

Contractors shall not invoice eligible users for payment of unauthorized cloud services or cloud related IT professional services provided at the TO level.

● Unauthorized cloud services are cloud services that are not included in the eligible users' services catalogs at the TO level.

4.4.1.3. Automated Invoice Validation Service

RESERVED

4.4.1.4. Data Analysis

Contractors shall provide copies of eligible users' paid invoices [Deliverable X] to the administrative agency for data analysis.

Standard(s) Acceptable Quality Level(s)

Applicable Document(s)

4.4.2. Services Catalogs - Cloud Services

Contractors shall provide service catalogs [Deliverable X] that identifies and provides prices for cloud services at the BPA level.

● Service catalog prices shall be fully-burdened accounting for all requirements (e.g., business, data, security, environmental, operational, technical).

● Service catalog prices shall be based on payment in arrears.

○ Service catalog prices shall not be based on prepayment, prepurchase, upfront payment, or other similar pricing.

○ <<RESERVED MAS REFRESH 21>>

● Service catalog prices shall be definitized.

○ Service catalog prices shall not be based on discount off of commercial list price, percent of cost, percent of spend, or other similar pricing.

○ Service catalog pricing shall not be based on credits, gift cards, tokens, vouchers, or other similar pricing.

Standard(s) Applicable Document(s)

● Service catalogs are accurate, complete, and up to date.

● Service catalogs issues (e.g., deficiencies, discrepancies, errors) are timely resolved.

● Attachment <<XX>>: Cloud Services Catalog Format

● 31 U.S.C. 3324

MONEY AND

● Service catalogs are correctly formatted.

● Service catalogs are machine readable.

● Service catalogs data is contained in the appropriate spreadsheet cells with the correct data type (e.g., number, text).

● Service Catalogs are not password protected.

FINANCE,

Advances

4.4.2.1. Service Packages

Contractors shall include the individual cloud services in their service catalogs if the cloud services are offered as part of a package in their service catalogs.

4.4.3. Utilization Based Discounts

Contractors shall provide accounting systems that support the accounting and management of cloud services UBDs at the TO level.

4.5. Cybersecurity Requirements - Baseline

4.5.1. Accounts - Applications, Services, Systems, Tools

4.5.1.1. Account Requests - New

Contractors shall submit new account requests [Deliverable X] to receive access and permissions to eligible users' applications, services, systems, tools, etc.

● New account requests shall be submitted in accordance with the eligible users' review and approval processes.

● New account requests shall identify the required account access and permissions.

● New account requests shall apply the principle of least privilege.

4.5.1.2. Account Requests - Changes

Contractors shall submit account change requests [Deliverable X] to change access or permissions to eligible users' applications, services, systems, tools, etc.

● Account change requests shall be submitted in accordance with the eligible users' review and approval processes.

● Account change requests shall apply the principle of least privilege.

4.5.2. Accounts - Cloud Service Provider

4.5.2.1. Account Requests

Contractors shall submit CSP account requests [Deliverable X] to receive access and permissions to eligible users' CSP accounts.

● CSP account requests shall be submitted in accordance with the eligible users' review and approval processes.

● CSP account requests shall identify the required account access and permissions.

● CSP account requests shall apply the principle of least privilege.

● CSP account requests shall be approved prior to any access or permissions being added or granted (e.g., no pre-population of contractors' persons).

4.5.2.2. Access and Permissions

Contractors shall provide continuous root-level access and permissions to eligible users' to ensure access to their CSP accounts.

4.5.2.3. Independent

Contractors shall provide CSP accounts that are individually distinct, independent, and isolated from other CSP accounts.

4.5.2.4. Linking

Contractors shall not link CSP accounts with other CSP accounts without the written approval of the eligible users for the respective awarded TOs.

4.5.2.5. New Accounts

Contractors shall coordinate the creation of new eligible users' CSP accounts at the TO level.

4.5.2.6. Ownership

Contractors shall register CSP accounts' ownership to eligible users.

4.5.2.7. Sub-Accounts

If required by eligible users, Contractors shall provide sub-accounts under CSP accounts to support hierarchical account structures.

● Sub-accounts shall be created only from the eligible users' CSP accounts.

● Sub-accounts shall be visible to the eligible users' CSP accounts.

● Sub-accounts shall be manageable from the eligible users' CSP accounts.

● Sub-accounts shall be configurable to inherit default, mandatory, and optional policies (e.g., IAM) from the eligible users' CSP accounts.

● Sub-accounts shall not be visible to other CSP accounts.

4.5.2.8. Transfers

Contractors shall coordinate the transfer of eligible users' CSP accounts at the TO level.

4.5.2.9. Transfers of Billing Ownership

Contractors shall allow the transfer of billing ownership for eligible users' CSP accounts without restrictions or limitations at the TO level.

4.5.3. Annual Cybersecurity Assessment

Contractors, issued or granted access to Federal contract information and / or GFI, shall perform an annual cybersecurity assessment, conducted by a third-party cybersecurity assessor using a government (e.g., NIST SP 800-53) or commercially recognized cybersecurity assessment standard, of their Information System (IS) and cybersecurity practices.

The government or commercially recognized cybersecurity assessment standard used shall at a minimum evaluate and assess the authorized vendors compliance with the requirements of FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems.

4.5.3.1. Annual Cybersecurity Assessment Documentation

Contractors shall deliver annual cybersecurity assessment documentation [Deliverable X] to the administrative agency documenting the CIA of contractors' IS.

At a minimum, the annual cybersecurity assessment documentation shall include:

● Identification of the third-party cybersecurity assessor with corresponding contact information.

● Identification of the cybersecurity assessment dates.

● A narrative executive summary of the cybersecurity assessment results and findings (e.g., issues, risks, vulnerabilities).

● An itemized list of any critical, high, or medium cybersecurity findings

● An indicator on the status (e.g., mitigated, resolved, POA&M) for each listed critical, high, or medium cybersecurity finding.

4.5.3.2. Annual Cybersecurity Assessment Report

Contractors shall deliver the complete annual cybersecurity assessment report and findings [Deliverable X] to the administrative agency when requested by the administrative agency.

4.5.4. Assessments and Evaluations

Contractors shall allow cybersecurity and operational (e.g., performance, SLAs) assessments and evaluations of the cloud services when performed by authorized assessment and evaluation entities.

● Assessments and evaluations shall include the cloud services architectures and security domains involved in the processing, transporting, and / or storing eligible users' data.

● Assessments and evaluations shall be coordinated between the contractors and authorized assessment and evaluation entities.

Standard(s) Acceptable Quality Level(s)

Applicable Document(s)

● Contractors shall coordinate and complete assessment and evaluation activities within 3 months of authorized assessment and evaluation entities requests.

● Contractors coordinate and execute assessment and evaluation activities 90% of the time within 3 months.

● James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Public Law 117-263, Division A Department of Defense Authorizations, Title XV Cyber and Information Operations Matters, Subtitle D Reports and Other Matters, Sec. 1553 Plan for Commercial Cloud Test and Evaluation

4.5.4.1. Assessments and Evaluations Postures

Contractors shall allow assessment and evaluation activities from the insider, nearsider, and outsider postures when performed by authorized assessment and evaluation entities

4.5.4.2. Assessments and Evaluations Techniques

Contractors shall allow active (e.g., ethical hacker, red team, penetration testing) and passive (e.g., emulation, scanning, simulation) assessment and evaluation techniques when performed by authorized assessment and evaluation entities.

4.5.4.3. Findings and Recommendations

Contractors shall review assessment and evaluation findings and recommendations when provided by authorized assessment and evaluation entities.

Contractors shall respond [Deliverable X] to assessment and evaluation findings and recommendations when provided by authorized assessment and evaluation entities.

4.5.4.4. Mitigation and Remediation

Contractors shall execute mitigation and remediation activities to resolve assessment and evaluation findings and recommendations identified by authorized assessment and evaluation entities.

4.5.4.5. Participation

Contractors shall participate in assessment and evaluation activities (e.g., planning, execution, remediations) when performed by authorized assessment and evaluation entities.

4.5.4.6. Public Disclosure and Release

Prior to any public disclosures, Contractors shall review the assessment and evaluation entities' public disclosures and releases for sensitive information (e.g., CUI, classified, proprietary) prior to release.

Authorized vendors shall notify [Deliverable X] authorized assessment and evaluation entities of any sensitive information in assessment and evaluation public disclosures and releases prior to release.

4.5.5. Authorization to Operate

Contractors shall provide any requested cybersecurity artifacts [Deliverable X] (e.g., audits, certifications, data, diagrams, documentation, information, inventories, logs, manuals, metadata, photographs, procedures, reports, scans, specifications, supply chain sourcing information) to eligible users to support eligible users' A&A activities, issuance of ATOs, and continuous monitoring for contractors cloud services.

Authorized vendors shall only provide cloud services to eligible users on the issuance of ATOs.

● ATOs are only valid for the explicitly identified eligible users and listed cloud services.

● ATOs are non-transferable unless the eligible users have a documented reciprocity agreement.

● DoD and FedRAMP authorizations are not ATOs and do not satisfy the ATO requirements.

4.5.5.1. Findings and Recommendations

Contractors shall review A&A findings and recommendations when provided by eligible users.

Contractors shall respond [Deliverable X] to A&A findings and recommendations when requested by eligible users.

4.5.5.2. Provisional Authority

Contractors shall provide limited (e.g., access, capabilities, test environment) cloud services to eligible users under a PA (e.g., ATT, P-ATO) to support eligible users A&A activities.

4.5.5.3. Mitigation and Remediation

Contractors shall execute mitigation and remediation activities to resolve A&A findings and recommendations identified by eligible users.

● Contractors shall mitigate and remediate A&A findings and recommendations prior to eligible users issuance of ATOs.

4.5.5.4. Participation

Contractors shall participate in A&A activities (e.g., planning, execution, remediations) when performed by eligible users.

4.5.6. Banner and Consent to Monitor

Contractors shall display a consent banner that informs eligible users of cloud services that they are consenting to being monitored by eligible users'.

● The banner shall be displayed post authentication (e.g., login, logon) but prior to eligible users accessing cloud services .

● The banner shall require affirmative / positive acknowledgement by designated action (e.g., click box, text entry box) prior to eligible users accessing cloud services .

Standard(s) Applicable Document(s)

● The banner is compliant with Section 508 of the Rehabilitation Act (29 U.S.C. 794d) and Section 255 of the Telecommunications Act of 1996 (47 U.S.C. 255).

● The banner is displayed and presents the appropriate information prior to eligible users accessing cloud services .

● 29 U.S.C. 794d

VOCATIONAL

REHABILITATIO

N AND OTHER

REHABILITATIO

N SERVICES,

Electronic and information technology

● Section 508 of the

Rehabilitation Act

● Telecommunicati ons Act of 1996

● 47 U.S.C. 255

TELECOMMUNI

CATIONS,

Access by persons with disabilities

● 36 CFR 1194

Information and Communications Technology Standards and Guidelines

● FAR 39.2

Information and Communication Technology

● CISA, Guidance on Consent Banners

4.5.7. Binding Operational Directives

RESERVED

4.5.8. Building, Facility, Property Access Identification

RESERVED - Eligible users may define building, facility, and property access identification requirements at the TO level.

4.5.9. Clearance Levels - Facility

FCL levels for the BPA are defined as follows:

Table XX: US Federal Government Facility Clearance Levels

Facility Clearance Level Definition

None Authorized vendor has been awarded a TO requiring no access to Confidential, Secret, or Top Secret information.

Confidential Authorized vendor has been awarded a Confidential TO requiring access to

Confidential information.

Secret Authorized vendor has been awarded a Secret TO requiring access to Secret information.

Top Secret Authorized vendor has been awarded a Top Secret TO requiring access to Top Secret information.

4.5.10. Clearance Levels - Persons

Personnel clearance levels for the BPA are defined as follows:

Table XX US Federal Government Personnel Clearance Levels

Clearance Level Investigations

Tier 1 (T1) Non-Sensitive Positions - Low Risk

National Agency Check and Inquiries (NACI)

Tier 2 (T2) Non-Sensitive Public Trust Positions - Moderate Risk

Moderate Risk Background Investigation

(MBI)

Tier 4 (T4) Non-Sensitive Public Trust Positions - High Risk

Background Investigation (BI)

Tier 3 (T3) National Security Positions - Secret / Confidential Clearance

National Agency Check with Law and Credit

(NACLC)

Tier 5 (T5) National Security Positions - Top Secret Clearance

Single Scope Background Investigation

(SSBI)

4.5.10.1. Suspended, Revoked

Contractors shall not provide contractors' persons to perform under this BPA and awarded TOs if their clearance level has been suspended or revoked.

Contractors shall immediately remove contractors' persons from performing under this BPA and awarded TOs if their clearance level has been suspended or revoked.

● Contractors' persons shall have their physical, logical, and data access to cloud services and computing equipment leveraged in the execution of this BPA and awarded TOs immediately terminated (e.g., disable accounts, revoke digital certificates).

● Contractors' persons shall have their physical, logical, and data access to eligible users' IS granted under this BPA and awarded TOs immediately terminated.

● Contractors' persons shall within 72 hours have all their issued physical credentials (e.g., CAC, HSPD-12, PIV, RFID key fob) returned to eligible users.

● Contractors' persons shall within 72 hours have all their issued GFE and GFI returned to eligible users.

4.5.11. Credentials

4.5.11.1. Compromise, Loss, Theft

Contractors shall report [Deliverable X] to eligible users the compromise, loss, or theft of eligible users credentials (e.g., CAC, HSPD-12, PIV, RFID key fob, username / password) within 24 hours.

4.5.11.1.1. Costs

Contractors shall reimburse eligible users' costs (e.g., labor, materials, services) associated with the replacement (e.g., reissuance) of compromised, lost, or stolen eligible users credentials.

4.5.11.2. Issuance

Contractors' persons (e.g., employees, representatives, sub-contractors) shall accept credentials issued by eligible users to ensure the CIA of eligible users' IS.

Contractors' persons shall secure credentials issued by eligible users to ensure the CIA of eligible users' IS.

4.5.11.3. Monitoring and Surveillance

Contractors' persons (e.g., employees, representatives, sub-contractors) shall consent to being monitored and surveilled when using credentials.

4.5.11.4. Ownership

Contractors' persons shall not own credentials issued by eligible users.

4.5.11.5. Presentation

Contractors' persons (e.g., employees, representatives, sub-contractors) shall present credentials (e.g., CAC, HSPD-12, PIV) to authorities (e.g., eligible users' persons, security officers) when requested.

4.5.11.6. Return

Contractors shall return credentials to eligible users when credentials are no longer authorized or required.

● Credentials shall be returned when directed by eligible users.

● Credentials shall be returned when no longer needed for performance (e.g., reassignment, resignation, retirement, terminated for cause).

● Credentials shall be returned at the completion or termination of TOs.

4.5.11.6.1. Costs

Contractors shall reimburse eligible users' costs (e.g., labor, materials, services) associated with the non-return of eligible users credentials.

4.5.11.7. Unauthorized Duplication

Contractors' persons (e.g., employees, representatives, sub-contractors) shall not duplicate (e.g., copy, reproduce, share) credentials.

Contractors shall immediately remove contractors' persons from performing under this BPA and awarded TOs if found in possession of unauthorized duplicated (e.g., copied, reproduced, shared) credentials.

● Contractors' persons shall have their physical, logical, and data access to cloud services and computing equipment leveraged in the execution of this BPA and awarded TOs immediately terminated (e.g., disable accounts, revoke digital certificates).

● Contractors' persons shall have their physical, logical, and data access to eligible users' IS granted under this BPA and awarded TOs immediately terminated (e.g., disable accounts, revoke digital certificates).

● Contractors' persons shall within72 hours have all their officially issued credentials (e.g., CAC, HSPD-12, PIV, RFID key fob) returned to eligible users.

● Contractors' persons shall within 72 hours have all their duplicate credentials (e.g., CAC, HSPD-12, PIV, RFID key fob) returned to eligible users.

● Contractors' persons shall within 72 hours have all their issued GFE and GFI returned to eligible users.

● Contractors' persons shall be referred to appropriate legal authorities (e.g., law enforcement) for prosecution.

4.5.11.7.1. Costs

Contractors shall reimburse eligible users' costs (e.g., labor, materials, services) resulting from the unauthorized duplication (e.g., coping, reproducing, sharing) of credentials (e.g., CAC, HSPD-12, keys, PIV, RFID key fob, username / password).

4.5.12. Critical Infrastructure

RESERVED

4.5.13. Communications Security

RESERVED

4.5.14. Cryptographic Key Management

Authorized vendors shall provide cryptographic key management services7, 8 (i.e., CKMS) for the generation, exchange, storage, use, crypto-shredding (e.g., destruction), and replacement of keys (e.g., certificates, cryptographic keys, decryption and encryption keys) and support third-party cryptographic key management services in their cloud services .

Authorized vendors' provided cryptographic key management services shall use keys with a minimum size of 1024 bits.

Authorized vendors’ provided cryptographic key management services shall allow eligible users to establish or provide their own keys.

4.5.15. Cybersecurity Incident Categories

Cybersecurity incident categories for the BPA include, but are not limited to:

Table XX: Cybersecurity Incident Categories

7 NIST SP 800-175B Rev 1: Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms 8 OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

Cybersecurity Incident Type Definition

Root Level Intrusion Unauthorized privileged access to an IS (e.g., cloud service). Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS (e.g., cloud service). Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources.

If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service (DoS) Activity that denies, degrades, or disrupts normal functionality of an IS (e.g., cloud service) or connectivity (e.g., network).

Malicious Logic Installation of software (e.g., malware) designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS (e.g., cloud services).

Ransomware Malware designed to encrypt data (e.g., files) on a device (e.g., cloud storage), rendering any IS (e.g., cloud services) that relies on the data unusable. Malicious actors then demand ransom in exchange for decryption.

Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

4.5.16. Cybersecurity Incident Reporting

Contractors shall report [Deliverable X] cybersecurity incidents for cloud services and authorized vendors' IS to eligible users to initiate cybersecurity incidents responses.

● Cybersecurity incidents shall be reported as soon as practicable.

● Cybersecurity incidents reporting timelines shall start when cybersecurity incidents are discovered by contractors or reported to contractors, contractors' persons (e.g., employees, representatives, sub-contractors), or contractors' cybersecurity entities responsible for providing cybersecurity monitoring and response for contractors.

Standard(s) Acceptable Quality Level(s)

Applicable Document(s)

● Cybersecurity incidents, involving US critical infrastructure, are reported within 72 hours (i.e., 3 calendar days).

● Ransomware payments, involving US critical infrastructure, are reported within 24 hours (i.e., 1 calendar day).

● Cybersecurity incidents are reported within 72 hours (i.e., 3 calendar days).

● Ransomware payments are reported within 24 hours (i.e., 1 calendar day).

● Cybersecurity Incident Reports are accurate and complete based on the…