Final Draft Solicitation Attachment 1 Ascend BPA - Pool 1 Performance Work Statement.pdf

CUI//SP – SSEL ASCEND BPA SOURCE SELECTION SENSITIVE -

SEE FAR 2.101 AND FAR 3.104

1. Background 5

2. Objectives 5

3. Scope 6

4. Performance Requirements 7

4.1. References 7

4.2. Personas 7

4.2.1. Administrative Agency 8

4.2.2. Eligible User 8

4.2.3. Cloud Service Provider (CSP) 8

4.3. Business Requirements — Baseline 8

4.3.1.1. Authorized Cloud Services 8

4.3.1.2. Technical Review Meetings 8

4.3.1.3. Utilization Based Discounts (UBDs) 8

4.3.1.4. Building, Facility, Property Access Identification 8

4.3.1.5. Clearance Levels 8

4.3.1.6. Credentials 8

4.3.2. Cybersecurity and Information Security Requirements—Baseline 8

4.3.2.1. Account Requests—New 9

4.3.2.2. Account Requests—Changes 9

4.3.2.3. Account Action and Format 9

4.3.2.4. Sub-accounts 9

4.3.2.5. Annual Cybersecurity Assessment 9

4.3.2.6. Assessments and Evaluations 10

4.3.2.7. Assessments and Evaluations Postures 10

4.3.2.8. Assessments and Evaluations Techniques 10

4.3.2.9. Assessment and Evaluation Findings and Recommendations 10

4.3.2.10. Assessment and Evaluation Mitigation and Remediation 10

4.3.2.11. Participation In Assessment and Evaluation Activities 10

4.3.2.12. Public Disclosure and Release 10

4.3.2.13. Authorization to Operate (ATO) 11

4.3.2.14. A&A Findings and Recommendations 11

4.3.2.15. Provisional Authority (PA) 11

4.3.2.16. A&A Mitigation and Remediation 11

4.3.2.17. Participation in A&A Activities 11

4.3.2.18. Cryptographic Key Management 11

4.3.2.19. Cybersecurity Incident Categories 12

4.3.2.20. Cybersecurity Incident Reporting 12

4.3.2.21. Cybersecurity Incident Response 12

4.3.2.22. Cybersecurity Information and Collaboration Programs 12

SEE FAR 2.101 AND FAR 3.104

4.3.2.23. Cybersecurity Logs 12

4.3.2.23.1. Cybersecurity Logs Disclosure 12

4.3.2.24. Cybersecurity Technical Programs 12

4.3.2.25. Cybersecurity Vulnerability Assessment Logs and Disclosure 13

4.3.2.26. Cybersecurity Vulnerability Reporting 13

4.3.2.27. Geographic Location—Cloud Services 13

4.3.2.28. Information Assurance Vulnerability Management 14

4.3.2.29. Information Classification Levels 14

4.3.2.30. Logical Access 14

4.3.2.31. Logical Access Logs and Disclosure 14

4.3.2.32. Multi-Factor Authentication (MFA) 15

4.3.2.33. Physical Access and Physical Access Log Disclosure 15

4.3.2.34. Registration of Services 15

4.3.2.35. Restrictions—Cloud Services 15

4.3.2.36. Sensitive Compartmented Information Facility (SCIF) Access Identification 15

4.3.2.37. Testing—Eligible User Solutions and Techniques 15

4.3.2.38. Timestamps 15

4.3.2.39. Cybersecurity Training 16

4.4. Data Requirements—Baseline 16

4.4.1. Data Access—Eligible Users 16

4.4.2. Data At Rest Protection (DARP) 16

4.4.3. Data Collection Disclosures 16

4.4.4. Data Compression 16

4.4.5. Data Decryption and Encryption 16

4.4.6. Post-Quantum Cryptography 17

4.4.7. File Formats 17

4.4.8. Data Management 17

4.4.9. Data Management Incident Reporting 18

4.4.10. Data Management Incident Response 18

4.4.11. Data Transceiving—Caching 18

4.4.12. Data Transceiving—Restrictions 18

4.4.13. Data Transceiving—Protection 19

4.4.14. Data and Account Ownership 19

4.4.15. Judicial or Law Enforcement Orders that may Lead to Access or Seizure of Data 19

4.4.16. Software Ownership 19

4.4.17. Software Bill of Materials (SBOMs) 19

4.5. Environmental, Sustainability Requirements—Baseline 19

4.5.1. Climate Risk Management Plans 19

4.5.2. Electronic Waste Recycling 20

4.6. Operational Requirements—Baseline 20

SEE FAR 2.101 AND FAR 3.104

4.6.1. Customer Management 20

4.6.2. Services Usage Summary Report 21

4.6.3. Supply Chain Risk Management (SCRM) 21

4.6.4. Financial Management (FinOps) 21

4.6.5. Application Programming Interfaces (API) 21

4.7. Technical Requirements—Baseline 22

4.7.1. Networking and Routing 22

4.8. Pool 1: Infrastructure as a Service, Platform as a Service 22

4.8.1. Technical Requirements—Pool 1 22

4.8.2. Technical Transition In 22

4.8.3. Technical Transition Out 22

4.8.4. Business Requirements—Pool 1 22

4.8.4.1. Metering 22

4.8.4.2. Notification 23

4.8.4.3. Cost Containment 23

4.8.4.4. Activation, Deactivation 23

4.8.4.5. System Management Tags For Cloud Infrastructure and Cloud Services 23

4.8.4.6. Price Estimation 23

4.8.4.7. Financial Information 23

4.8.4.7.1. Financial Optimization 26

4.8.5. Cybersecurity Requirements—Pool 1 26

4.8.5.1. Cybersecurity Notifications 26

4.8.5.2. Identity and Access Management 26

4.8.5.3. Inactive Identities 26

4.8.6. Environmental, Sustainability Requirements—Pool 1 26

4.8.6.1. Greenhouse Gas Reduction Requirements 26

4.8.6.2. Carbon Pollution-Free Electricity (CFE) 27

4.8.6.3. Carbon Pollution-Free Electricity—Negative Performance 27

4.8.6.4. Declared Disasters and Emergencies 27

4.8.6.5. Service Catalogs—Carbon Pollution-Free Electricity 27

4.8.6.6. Energy Efficiency 27

4.8.6.7. Service Catalogs—Energy Efficiency 28

4.8.7. Operational Requirements—Pool 1 28

4.8.7.1. Operational Management 28

4.8.7.2. Automation 28

4.8.7.2.1. Automatic Data Lifecycle Management 28

4.8.7.2.2. Automatic Load Balancing 28

4.8.7.2.3. Automatic Tagging 28

4.8.7.2.4. Autoscaling 28

4.8.7.3. Scheduling 28

SEE FAR 2.101 AND FAR 3.104

4.8.7.4. Operational Information 28

4.8.7.4.1. Operational Information GUI Display 29

4.8.7.4.2. Operational Notifications 32

4.8.7.4.3. Operational Support 32

4.8.8. Technical Requirements—Pool 1 32

4.8.8.1. Data Centers, Control 32

4.8.8.2. Data Centers, High Availability (HA) 32

4.8.8.2.1. Geographic Diversity 32

4.8.8.2.2. Data Centers, Services Availability 33

4.8.8.3. Data Centers, Service Level Agreements (SLAs) 33

4.8.8.4. Networking and Routing 33

4.8.8.4.1. Private Network Connection 33

4.8.8.4.2. Domain Name System (DNS) 33

4.8.8.4.3. Internet Protocol (IP) Address Access Control Lists (ACLs) 33

4.8.8.4.4. Internet Protocol Version 4 (IPv4) 33

4.8.8.4.5. Internet Protocol Version 6 (IPv6) 33

4.8.8.4.6. Virtual Private Clouds (VPCs) 33

4.8.9. Sub-Pool 1-1: Federal Risk and Authorization Management Program:

Moderate/Department of Defense Impact Level: 2 33

4.8.10. Acquisition Requirements—Sub-Pool 1-1 33

4.8.10.1. Events 33

4.8.11. Business Requirements—Sub-Pool 1-1 34

4.8.11.1. Service Catalogs 34

4.8.12. Cybersecurity Requirements—Sub-Pool 1-1 34

4.8.12.1. Clearance Levels—Facility 34

4.8.12.2. Clearance Levels—Personnel 34

4.8.12.3. Information Classification Levels 34

4.8.12.4. Cloud Service Offerings, Service Model Classification 34

4.8.13. Sub-Pool 1-2: Federal Risk and Authorization Management Program: High and Department of Defense Impact Levels: 4, 5 34

4.8.13.1. Acquisition Requirements—Sub-Pool 1-2 34

4.8.13.1.1. Off Ramping—Contractors 34

4.8.13.2. Business Requirements—Sub-Pool 1-2 34

4.8.13.2.1. Service Catalogs 34

4.8.13.3. Cybersecurity Requirements—Sub-Pool 1-2. 35

4.8.13.3.1. Clearance Levels—Facility 35

4.8.13.3.2. Clearance Levels—Personnel 35

4.8.13.3.3. Information Classification Levels 35

4.8.13.3.4. Cloud Service Offerings, Service Model Classification 35

4.8.14. Sub-Pool 1-3: Department of Defense Impact Level: 6 35

4.8.14.1. Acquisition Requirements—Sub-Pool 1-3 35

SEE FAR 2.101 AND FAR 3.104

4.8.14.1.1. Off Ramping—Contractors 35

4.8.14.2. Business Requirements—Sub-Pool 1-3 35

4.8.14.2.1. Service Catalogs 35

4.8.14.3. Cybersecurity Requirements—Sub-Pool 1-3 35

4.8.14.3.1. Clearance Levels—Facility 35

4.8.14.3.2. Clearance Levels—Personnel 36

4.8.14.3.3. Information Classification Levels 36

4.9. Pool 2: Software as a Service (to be solicited separately from this PWS) 36

4.10. Pool 3: Cloud-Related IT Professional Services (to be solicited separately from this PWS) 36

5. Performance Standards 36 The Contractor shall… 37

6. Deliverables 37

7. Contractor Performance Assessment Reporting-Federal Only—Task Order 37

8. Place of Performance 37

9. Period of Performance 37

10. Invoicing 37

11. Prices Paid Transaction Report (PPTR) 38

12. Security Requirements 38

13. On Ramping 38

14. Off Ramping 38

15. Ascend BPA Pricing Catalog 38

16. Service Packages 39

16.1. Procedures to Add New Service Catalog Items (Eligible Users) 39

16.2. Procedures to Add New Service Catalog Items (Contractor) 39

16.3. Federal Risk and Authorization Management Program (FedRAMP) Authorization—Self-Attestation (New Items Request) 40

16.4. DCAS Authorization—Self-Attestation to Add New Services 40

17. Other Requirements or Special Considerations 40

17.1. Organizational Conflicts of Interest (OCI) 40

17.2. Non-Disclosure Requirements 41

17.3. Inspection and Acceptance 41

17.4. Transition In and Out 41

18. Section 508 Accessibility Standards 42

19. Indemnification, Insurance, and Law Enforcement Requirements 43

19.1. Indemnification 43

19.2. Insurance 44

19.3. Law Enforcement 44

20. Clauses and Prevailing Terms and Conditions 45

20.1. 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999) 45

20.2. 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) 46

1. Background

The Federal Chief Information Officer (CIO) Council issued the Cloud First Federal Cloud Computing Strategy in 2010 and the superseding Cloud Smart Federal Cloud Computing Strategy in 2019 that established the Federal Government's policy of leveraging commercial cloud service providers and cloud services. In addition, Executive Order (E.O.) 14028 “Improving the Nation’s Cybersecurity” encourages agencies to move the cloud as part of their journey to a Zero Trust Architecture.

This created a governmentwide need for continuous and recurring cloud services that adhere to applicable current legislation, regulations, standards, policies, guidance, and government and industry best practices at any moment in time. It also created a need for recurring cloud-related IT professional services to support adoption of, migration to, and governance, operations, and management of cloud services.

2. Objectives The overarching Ascend Blanket Purchase Agreement (BPA) supports the strategic sourcing of cloud services such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), and cloud-related IT professional services. Within this performance work statement (PWS), a contractor is defined as a company that currently holds a multiple award schedule (MAS) contract, and the contractor’s cloud services and cloud-related IT professional services have a current catalog on the MAS Special Item Number (SIN) 518210C. Contractors must meet or exceed applicable legislation, regulations, standards, policies, guidance, and government and industry best practices. The objective of the Ascend BPA is to establish a compliant, secure, and efficiently/effectively managed cloud services and cloud-related IT professional services contract vehicle. In addition, the Ascend BPA establishes baseline requirements for data, environmental, sustainability, operational, and technical aspects.

The BPA also establishes baseline cybersecurity requirements ensuring procured cloud services and cloud-related IT professional services are continuously and securely operated and maintained for confidentiality, integrity, and availability.

Additionally, the BPA covers cybersecurity responsibilities and liabilities, and ensures contractors have appropriate cybersecurity incident reporting, coordination, mitigation, and remediation capabilities.

The BPA establishes baseline governance requirements ensuring cloud services and cloud-related IT professional services are procured through streamlined acquisition procedures, maximizing cost avoidance and cost savings aligned with category management best practices and small business goals. The BPA ensures the services provided can be effectively and efficiently operated through DevSecOps and FinOps practices.

The Ascend BPA is aligned with GSA's mission to deliver the best customer experience and value in acquisition and technology services to the government and the American people. It also provides foundational best practices for category management and strategic sourcing by streamlining the acquisition process and leveraging buying powers of the federal government.

3. Scope

The Ascend BPA is partitioned into three (3) primary pools:

● Pool 1: Infrastructure as a Service, Platform as a Service (IaaS, PaaS)

● Pool 2: Software as a Service (SaaS)

● Pool 3: Cloud-Related IT Professional Services

Additional sub-pools may be added to the BPA over its lifetime. This request for quotes is for Pool 1 and its sub-pools only. Pools 2 and 3 will be released as separate RFQ’s on a future date to be determined.

The sub-pools are independently solicited and competitively awarded based on the sub-pool's respective requirements; however, once established, services can be procured in one task order (TO). Each primary pool’s scope is further partitioned into discrete and defined sub-pools. (Refer to Table 1.)

Table 1: Primary Pools and Sub-Pools

Primary Pool Number

Sub-Pool Number

Title

1 — Infrastructure as a Service, Platform as a Service

1 1 FedRAMP: Moderate and DoD IL: 2

1 2 FedRAMP: High and DoD IL: 4, 5

1 3 DoD IL: 6

2 — Software as a Service

2 1 Office Productivity and Collaboration Tools

2 2 Information Technology Service Management (ITSM)/Information Technology Asset Management (ITAM)

2 3 Customer Relationship Management

3 — Cloud-Related IT Professional Services

3 1 Application Rationalization Services

3 2 Multi-Cloud Management

3 3 Cloud Migration and Operations

SEE FAR 2.101 AND FAR 3.104

4. Performance Requirements The sections below that are not covering specific pools or sub-pools are considered core BPA requirements.

Contractors shall provide cloud services in accordance with their GSA MAS SIN 518210C Cloud Computing and Cloud-Related IT Professional Services contract and in accordance with current MAS solicitation.

4.1. Legislation and Standards

Eligible users and BPA contractors shall review and adhere to current legislation and standards at any given time.

4.2. Personas

The following defines the meaning of the personas in use for this BPA.

4.2.1. Administrative Agency

The administrative agency is the General Services Administration.

4.2.2. Eligible User

An eligible user is any federal, state, local, tribal, territorial (FSLTT) government or other eligible entity that is authorized to use the GSA MAS.

Authorization to use the GSA MAS are per FAR Part 8.401. Eligible ordering activities is available at: https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations

4.2.3. Cloud Service Provider (CSP)

A CSP is a contractor that directly provides, operates, and maintains the cloud services technology (for example: facilities, hardware, software).

4.3. Business Requirements — Baseline

The following requirements will be used as the baseline for all primary pools and sub-pools.

4.3.1.1. Authorized Cloud Services Administration

Contractors shall provide the capability for eligible users to grant, restrict, and limit the usage of cloud services through, for example, configuration file(s), policy(ies), or access control lists (ACLs).

4.3.1.2. Technical Review Meetings

Technical review meetings may be called for during the performance of any TOs issued against the BPA. Technical reviews and/or in-process reviews will be defined at the TO level.

4.3.1.3. Utilization-Based Discounts (UBDs)

UBD’s are authorized at the task order level and will be aggregated at the end of each period of performance (PoP) and applied to the next PoP, if the next PoP is executed by the eligible user.

Contractors shall ensure accounting systems can support the accounting and management of cloud services UBDs at the TO level.

https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations

SEE FAR 2.101 AND FAR 3.104

4.3.1.4. Building, Facility, Property Access Identification

The government may define building, facility, and property access identification requirements at the TO level.

4.3.1.5. Clearance Levels

Minimum Facility Security Clearance (FCL) and personnel clearance level requirements will be added at the TO level.

4.3.1.6. Credentials

Eligible user’s credentialing requirements for contractors will be determined at the TO level.

4.3.2. Cybersecurity and Information Security Requirements—Baseline Cybersecurity requirements are defined below; however, additional cybersecurity requirements may be added at the TO level.

4.3.2.1. Account Requests—New

The contractor shall verify with the government new account requests to eligible users in order to gain access and permission to eligible user's applications, services, systems, and tools. Requests shall be submitted in accordance with the eligible user’s review and approval processes, identifying the required account access and permissions and applying the principle of least privilege.

4.3.2.2. Account Requests—Changes

Contractors shall verify with the government account change requests to eligible users before modifying or revoking access or permissions to eligible user’s applications, services, systems, and tools. Requests shall be submitted in accordance with eligible user's review and approval processes and shall apply the principle of least privilege.

4.3.2.3. Account Action and Format

Contractors shall:

● Provide continuous root-level access and permissions to eligible user’s to ensure access to their CSP accounts.

● Provide CSP accounts that are individually distinct, independent, and isolated from other CSP accounts.

● Coordinate the creation of new eligible user’s CSP accounts at the TO level.

● Register ownership of CSP accounts to eligible users.

● Coordinate the transfer of eligible user’s CSP accounts at the TO level.

● Allow the transfer of billing ownership for eligible user’s CSP accounts without restrictions or limitations at the TO level.

Contractors shall not:

● Access eligible users accounts without prior approval from the eligible user’s designated representative.

● Link CSP accounts with other CSP accounts without the written approval of the eligible users for the respective awarded TOs.

4.3.2.4. Sub-accounts

If required by eligible users, contractors shall provide sub-accounts under CSP accounts to support hierarchical account structures.

SEE FAR 2.101 AND FAR 3.104

● Sub-accounts shall be created only from the eligible user’s CSP accounts.

● Sub-accounts shall be visible to the eligible user's CSP accounts.

● Sub-accounts shall be manageable from the eligible user’s CSP accounts.

● Sub-accounts shall be configurable to inherit default, mandatory, and optional policies (e.g., identity and access management [IAM]) from the eligible user’s CSP accounts.

● Sub-accounts shall not be visible to other CSP accounts.

4.3.2.5. Annual Cybersecurity Assessment

Contractors issued or granted access to federal contract information and/or government-furnished information (GFI) shall perform an annual cybersecurity assessment, conducted by a third-party cybersecurity assessor using a government (e.g., NIST SP 800-53) or commercially recognized cybersecurity assessment standard of their Information System (IS) and cybersecurity practices as required by eligible users.

The government or commercially recognized cybersecurity assessment standard used shall, at a minimum, evaluate and assess the contractor’s compliance with the requirements of FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems.

4.3.2.6. Assessments and Evaluations

Contractors shall allow cybersecurity and operational (e.g., performance, service level agreement [SLA]) assessments and evaluations of the cloud services when performed by authorized assessment and evaluation entities.

● Assessments and evaluations shall include, but are not limited to, the cloud services architectures and security domains involved in the processing, transporting, and/or storing of eligible user’s data.

● Assessments and evaluations shall be coordinated between the contractors and authorized assessment and evaluation entities.

4.3.2.7. Assessments and Evaluations Postures

Contractors shall allow assessment and evaluation activities from the insider, nearsider, and outsider postures when performed by authorized assessment and evaluation entities.

4.3.2.8. Assessments and Evaluations Techniques

Contractors shall allow active (e.g., ethical hacker, red team, penetration testing) and passive (e.g., emulation, scanning, simulation) assessment and evaluation techniques when performed by authorized assessment and evaluation entities.

4.3.2.9. Assessment and Evaluation Findings and Recommendations Contractors shall review assessment and evaluation findings and recommendations when provided by authorized assessment and evaluation entities.

Contractors shall respond to assessment and evaluation findings and recommendations when provided by authorized assessment and evaluation entities.

SEE FAR 2.101 AND FAR 3.104

4.3.2.10. Assessment and Evaluation Mitigation and Remediation Contractors shall execute mitigation and remediation activities to resolve assessment and evaluation findings and recommendations identified by authorized assessment and evaluation entities.

4.3.2.11. Participation in Assessment and Evaluation Activities Contractors shall participate in assessment and evaluation activities when performed by authorized assessment and evaluation entities.

4.3.2.12. Public Disclosure and Release

The government shall review the assessment and evaluation entity’s disclosure before official release to ensure the disclosure does not have any sensitive information (e.g., controlled unclassified information [CUI], classified, proprietary).

Prior to any public disclosures, contractors shall review the assessment and evaluation entity’s public disclosure release for sensitive information prior to release.

Contractors shall notify authorized assessment and evaluation entities of any sensitive information in assessment and evaluation public disclosures and releases prior to release.

4.3.2.13. Authorization to Operate (ATO)

Contractors shall provide requested cybersecurity artifacts (e.g., audits, certifications, data, diagrams, documentation, information, inventories, logs, manuals, metadata, photographs, procedures, reports, scans, specifications, supply chain sourcing information) to eligible users to support eligible user’s Assessment and Authorization (A&A) activities supporting the ATO approval process. Standard documentation or artifacts are allowed if agreed to be accepted by eligible users.

Contractors shall only provide cloud services to eligible users on the issuance of ATOs.

● ATOs are only valid for the explicitly identified eligible users and listed cloud services.

● ATOs are non-transferable unless the eligible users have a documented reciprocity agreement.

● DoD and FedRAMP authorizations are not ATOs and do not satisfy the ATO requirements.

4.3.2.14. A&A Findings and Recommendations

Contractors shall review A&A findings and recommendations when provided by eligible users.

Contractors shall respond to A&A findings and recommendations when requested by eligible users.

4.3.2.15. Provisional Authority (PA)

Contractors shall provide limited (e.g., access, capabilities, test environment) cloud services to eligible users under a PA (e.g., Authority to Test, Provisional Authority to Operate [P-ATO]) to support eligible users A&A activities.

4.3.2.16. A&A Mitigation and Remediation

Under government oversight, contractors shall execute mitigation and remediation activities to resolve A&A findings and recommendations identified by eligible users.

SEE FAR 2.101 AND FAR 3.104

Contractors shall mitigate and remediate A&A findings and recommendations prior to eligible users issuance of ATOs.

4.3.2.17. Participation in A&A Activities

Contractors shall participate in A&A activities (e.g., planning, execution, remediations) when performed by eligible users.

4.3.2.18. Cryptographic Key Management

Contractors shall provide cryptographic key management services1, 2 (i.e., CKMS) for the generation, exchange, storage, use, crypto-shredding (e.g., destruction), and replacement of keys (e.g., certificates, cryptographic keys, decryption and encryption keys) and support third-party cryptographic key management services in their cloud services.

The contractor's provided cryptographic key management services shall use keys with a minimum size of 1024 bits.

The contractor's provided cryptographic key management services shall allow eligible users to establish or provide their own keys.

4.3.2.19. Cybersecurity Incident Categories

Cybersecurity incident categories for the BPA include, but are not limited to, the following incident types:

● Root-level Intrusion

● User-level Intrusion

● Denial of Service

● Malicious Logic

● Ransomware

4.3.2.20. Cybersecurity Incident Reporting

Contractors shall notify the TO contracting officer (CO) immediately upon identification of a cybersecurity incident, but no later than 24 hours of identification of the cybersecurity incident. The contractor shall also follow standard practices regarding reporting of cybersecurity incidents as defined in the eligible user’s incident response plan. Additional requirements may be further required and shall be defined at the TO level.

4.3.2.21. Cybersecurity Incident Response

Contractors shall execute cybersecurity incident response to mitigate and remediate cybersecurity incidents to restore the confidentiality, integrity, and availability (CIA) of cloud services, and contractor’s IS.

4.3.2.22. Cybersecurity Information and Collaboration Programs Contractors shall provide information to cybersecurity information and collaboration programs, such as CISA and DHS, to proactively identify, prevent, and mitigate

1 NIST SP 800-175B Rev 1: Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms 2 OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

SEE FAR 2.101 AND FAR 3.104

cybersecurity incidents. Additional reporting to specific authorized assessment and evaluation entities will be identified at the TO level by eligible users.

Contractors shall receive information from cybersecurity information and collaboration programs to proactively identify, prevent, and mitigate cybersecurity incidents.

4.3.2.23. Cybersecurity Logs

Contractors shall enable cybersecurity logging for cloud services and Contractor’s IS to proactively identify, prevent, and mitigate cybersecurity incidents. Contractors shall provide access to logs upon eligible users request. Per OMB M-21-31:

Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents and commercial practices.

4.3.2.23.1. Cybersecurity Logs Disclosure

Contractors shall deliver cybersecurity logs to authorized assessment and evaluation entities, eligible users, and law enforcement when requested.

4.3.2.24. Cybersecurity Technical Programs

Contractors shall provide cloud services that are compatible and interoperable with cybersecurity technical programs (examples listed below subject to change) to help proactively identify, prevent, and mitigate cybersecurity incidents.

● United States Department of Homeland Security

○ DHS cybersecurity technical programs and services include:

■ Continuous Diagnostics and Mitigation (CDM) Program

■ The National Cybersecurity Protection System (NCPS)

● Cloud Log Aggregation Warehouse (CLAW)

● EINSTEIN (i.e., E1, E2, E3A)

■ Trusted Internet Connections (TIC) 3.x

● United States Department of Defense

○ DoD cybersecurity technical programs and services include:

■ Comply-to-connect (C2C)

Contractors shall not restrict, limit, or otherwise impede the functionality, operations, or performance of cybersecurity technical programs.

4.3.2.25. Cybersecurity Vulnerability Assessment Logs and Disclosure Contractors shall conduct cybersecurity vulnerability assessment logging for cloud services and contractor’s IS to help proactively identify, prevent, and mitigate cybersecurity vulnerabilities.

Contractors shall deliver cybersecurity vulnerability assessment logs to the authorized assessment and evaluation entities, eligible users, and law enforcement when requested, per OMB M-21-31: Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents and commercial practices.

4.3.2.26. Cybersecurity Vulnerability Reporting

Contractors shall report cybersecurity vulnerabilities for cloud services and contractor's IS to eligible users to initiate cybersecurity vulnerability responses.

SEE FAR 2.101 AND FAR 3.104

● Cybersecurity vulnerabilities shall be reported as soon as practicable.

● Cybersecurity vulnerabilities reporting timelines shall start when cybersecurity vulnerabilities are discovered by contractors or reported to contractors, contractor's persons (for example: employees, representatives, subcontractors), or contractor's cybersecurity entities responsible for providing cybersecurity monitoring and response for contractors.

4.3.2.27. Geographic Location—Cloud Services

Contractors shall offer cloud services and contractor’s IS physical computing equipment and software code within the sovereignty and jurisdiction of the US and shall be limited to the 50 states; Washington, DC; and territories so that physical computing equipment is not subject to foreign jurisdictions or foreign nations legislation, regulations, or policies. Specific geographic location requirements are addressed at the TO level.

● Physical computing equipment is inclusive of servers, data storage devices, edge computing, networking equipment, etc.

● Software code is inclusive of applications, virtualized environments, machine code, firmware, middleware, operating system (OS) software, software depositories, software management systems, software integrity systems, virtualization software, configurations, custom code or configurations, etc.

4.3.2.28. Information Assurance Vulnerability Management

Contractors shall monitor academic, commercial, and government Information Assurance Vulnerability Alert (IAVA) programs and services for IAVAs that could potentially impact cloud services and contractor's IS to help proactively identify, prevent, and mitigate cybersecurity vulnerabilities.

Contractors shall manage academic, commercial, and government IAVAs to mitigate and remediate cybersecurity vulnerabilities to cloud services and contractor's IS to help proactively identify, prevent, and mitigate cybersecurity vulnerabilities.

4.3.2.29. Information Classification Levels

Information classification levels for the BPA are defined as follows:

Table 2: US Federal Government Information Classification Levels

Information Classification Level Definition

Unclassified Information that is authorized for public disclosure.

Controlled Unclassified Information (CUI) Information that requires by a law, regulation, or governmentwide policy safeguarding or dissemination controls.

Confidential Information that the unauthorized disclosure of which reasonably could be expected to cause damage to national security.

SEE FAR 2.101 AND FAR 3.104

Table 2: US Federal Government Information Classification Levels

Information Classification Level Definition

Secret Information that the unauthorized disclosure of which reasonably could be expected to cause serious damage to national security.

Top Secret Information that the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to national security.

4.3.2.30. Logical Access

Contractors shall manage logical access to cloud services and contractor’s IS computing equipment and software code to ensure the CIA of cloud services and IS.

Requirements will be further defined at the TO level.

4.3.2.31. Logical Access Logs and Disclosure

Contractors shall conduct logical access logging for cloud services and contractor’s IS to proactively identify, prevent, and mitigate cybersecurity incidents per OMB M- 21-31: Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents and commercial practices.

Contractors shall provide logical access logs to the authorized assessment and evaluation entities, eligible users, and law enforcement when requested.

4.3.2.32. Multi-Factor Authentication (MFA)

Contractors shall enable phishing-resistant MFA solutions for accessing CSP accounts and cloud services to ensure the CIA of CSP accounts and cloud services.

4.3.2.33. Physical Access and Physical Access Log Disclosure

Contractors shall manage physical access to the cloud services and contractor's IS computing equipment and software code to ensure the CIA of cloud services and IS.

Requirements will be defined at the TO level.

Contractors shall conduct physical access logging for cloud services and contractor's IS to proactively identify, prevent, and mitigate cybersecurity incidents per OMB M- 21-31: Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents and commercial practices.

Contractors shall provide physical access logs to the authorized assessment and evaluation entities, eligible users, and law enforcement when requested.

4.3.2.34. Registration of Services

Contractors shall register cloud services in eligible user’s systems for eligible user’s IS (for example: allowlisting, whitelisting).

SEE FAR 2.101 AND FAR 3.104

4.3.2.35. Restrictions—Cloud Services

Contractors shall provide the capability for cloud services to be restricted (for example: deactivate, suspend, terminate) from CSP accounts in response to cybersecurity incidents. Access restrictions shall apply to sub-accounts such as hierarchical accounts.

4.3.2.36. Sensitive Compartmented Information Facility (SCIF) Access Identification Eligible users may add additional access identification requirements (eg. SCIF) at the TO level.

4.3.2.37. Testing—Eligible User Solutions and Techniques

Contractors shall allow eligible users to conduct cybersecurity and operational testing of the eligible user's solutions or environment deployed and operating within the contractor's cloud services that are processing, transporting, and/or storing eligible user's data.

Contractors shall allow active penetration testing and passive testing techniques (for example: emulation, scanning, simulation) to be performed by eligible users.

Techniques will be approved and coordinated by both the contractor and eligible users so as not to impose security risks or degradation of system’s performance.

4.3.2.38. Timestamps

Contractors shall record timestamps in cloud services files and logs (e.g., activity logs, audit logs, cybersecurity logs) per ISO 8601 and/or RFC 3339 formats.

● Contractors shall use GPS master station clock,and/or NIST Internet Time Service (ITS) as baseline references for timestamps.

● Contractors shall only use public, unauthenticated, and unencrypted Network Time Protocol (NTP) pools as an option of last resort, and only for as long as needed to begin leveraging preferred options.

4.3.2.39. Cybersecurity Training

Contractor’s persons (e.g., employees, representatives, subcontractors) shall complete eligible user's cybersecurity training when contractor's persons are issued eligible user’s credentials. Additional requirements may be established at the TO level.

4.4. Data Requirements—Baseline

Data requirements are defined below; however, additional data requirements may be added at the TO level.

4.4.1. Data Access—Eligible Users

Contractors shall provide eligible users unrestricted access to the eligible user's data in contractor’s cloud services.

● Unrestricted access includes accessing, downloading, or otherwise retrieving, partially or in full, the eligible user’s data.

● The eligible user’s data is inclusive of anonymized data, derivative data, metadata, logs, synthetic data, etc. generated in the execution of the eligible user’s TOs.

SEE FAR 2.101 AND FAR 3.104

4.4.2. Data At Rest Protection (DARP)

Contractors shall use DARP solutions for the eligible user’s data to ensure the CIA of the eligible user's data. Contractors shall follow the risk management framework for the protection of the eligible user’s data.

4.4.3. Data Collection Disclosures

Contractors shall receive pre-approval by the eligible user prior to collecting data, and deliver Data Collection Disclosures upon request that identifies the eligible user's data collected by contractors. The eligible user's data is inclusive of anonymized data, derivative data, metadata, logs, synthetic data, etc. generated in the execution of the eligible user's TOs.

4.4.4. Data Compression

Contractors shall provide lossless data compression services for the eligible user's data to reduce data size and retain data quality (for example: GIS, pictures, video).

● Contractors may use lossless data compression services to compress the eligible user's data.

● Contractors may use lossy compression services with the eligible user's authorization.

4.4.5. Data Decryption and Encryption

Contractors shall use data decryption and encryption services for the eligible user's data during processing, storage, and transport to ensure the CIA of the eligible user's data.

● Decryption and encryption services shall use Federal Information Processing Standards (FIPS) and NSA-approved cryptographic algorithms.

● Eligible users shall be able to provide their own cryptographic keys.

● Eligible user's data is inclusive of anonymized data, derivative data, metadata, logs, synthetic data, etc. generated in the execution of the eligible user's TOs.

● Methods may be determined at the TO level.

4.4.6. Post-Quantum Cryptography

Contractors shall utilize the current and future released NIST-standard post-quantum cryptography algorithms.

4.4.7. File Formats

Contractors shall ensure the availability of the user's data and files and shall seek prior authorization of the eligible user before converting files to different or proprietary formats. Contractors shall provide the services to revert the eligible user’s file formats back to their original file formats if they converted the file formats to different and/or proprietary file formats to ensure the availability of the eligible user’s data, metadata, and files. The eligible user’s files shall be reverted to the original or newest version of the original file format.

4.4.8. Data Management

Contractors shall manage the contractor’s data and the eligible user’s data securely to ensure the CIA of the contractor’s data and the eligible user’s data. The contractor’s data is inclusive of data, acquisition data (e.g., GFI), administrative data, support data, invoicing data, etc. generated in the execution of the eligible user's

SEE FAR 2.101 AND FAR 3.104

TOs. The eligible user's data is inclusive of anonymized data, derivative data, metadata, logs, synthetic data, etc. generated in the execution of the eligible user's TOs.

To ensure the CIA of the contractor’s data and the eligible user’s data, the contractors shall:

● Secure the contractor's data and the eligible user's data from unauthorized use to develop, optimize, research, train, etc. artificial intelligence (AI) and/or machine learning (ML) algorithms. Use of the contractor's data and/or eligible user's data without prior authorization by the eligible user may result in eligible users requiring the AI and/or ML algorithms to be deleted, purged, reset, and/or destroyed.

● Secure the contractor’s data and the eligible user’s data to designated security boundaries and domains.

● Secure the contractor’s data and the eligible user’s data from unauthorized destruction (for example: deletion, unreadability).

● Isolate, quarantine, and/or restrict access to the contractor’s data and the eligible user’s data when the contractor’s data and the eligible user’s data is, or suspected of being, compromised and/or infected with a cybersecurity vulnerability. Contractors shall not delete or destroy the eligible user’s data that is, or suspected of being, compromised or infected with a cybersecurity vulnerability.

● Secure the contractor’s data and the eligible user’s data from unauthorized data access, mining, scanning, interrogation, investigation, analysis, etc.

● Secure the contractor's data and the eligible user's data from unauthorized monetization (e.g., exchange, sell, trade).

● Secure the contractor's data and the eligible user's data from unauthorized release (e.g., privately, commercially, publicly).

● Secure the contractor's data and the eligible user's data from unauthorized removal (e.g., from facilities, from IS).

● Secure the contractor's data and the eligible user's data from unauthorized sharing (e.g., privately, commercially, publicly).

● Manage the contractor's IS and cloud services data storage devices securely.

● Sanitize the contractor's IS and cloud services data storage devices by nondestructive (e.g., cryptographic erase, overwrite) methods when the contractor's data and the eligible user's data is deleted. Nondestructive methods are determined by the information classification level. Data storage devices are sanitized when eligible users discontinue or terminate cloud services.

● Sanitize the contractor's IS and cloud services data storage devices (for example, cache, primary, secondary, backups, archives) by nondestructive methods when contractors remove data storage devices from operational usage and maintain logical and physical access and control of data storage devices. Nondestructive methods are determined by the information classification level.

● Sanitize the contractor's IS and cloud services data storage devices by destructive (for example: degaussing, grinding, shredding) and nondestructive methods when contractors relinquish logical and physical access and control, decommission, and/or dispose of data storage devices.

SEE FAR 2.101 AND FAR 3.104

Destructive and nondestructive methods are determined by the information classification level.

4.4.9. Data Management Incident Reporting

Contractors shall notify TO contracting officers no later than 24 hours upon identification of data management incidents for cloud services and the contractor’s

IS.

The contractor shall also follow standard practices regarding reporting of data management incidents as defined in the eligible users incident response plan.

Additional requirements may be further required and shall be defined at the TO level.

● Data management incidents shall be reported as soon as the contractor discovers an incident has occurred.

● Data management incidents reporting timelines shall start when incidents are discovered by contractors or reported to contractors, contractor’s persons (e.g., employees, representatives, sub-contractors), or contractor's data management entities responsible for providing data management and data CIA monitoring and response for contractors.

4.4.10. Data Management Incident Response

Contractors shall execute prior documented data management incident response to mitigate and remediate data management incidents to restore the CIA of the contractor's data and the eligible user's data.

4.4.11. Data Transceiving—Caching

Contractors shall secure (e.g., DARP, Hypertext Transfer Protocol Secure [HTTPS], Transport Layer Security [TLS]) the eligible user's data when temporarily caching (e.g., storage) the eligible user's data while transceiving (e.g., transporting, routing) the eligible user's data to or from authorized sources or authorized destinations to ensure the confidentiality and integrity of the eligible user's data.

4.4.12. Data Transceiving—Restrictions

Contractors shall not transceive an eligible user's data through countries identified as "state sponsors of terrorism" or countries subject to US economic and trade sanctions to ensure the confidentiality and integrity of the eligible user's data.

Contractors shall not transceive an eligible user's data through information systems owned or managed directly or indirectly by entities or persons subject to US economic and trade sanctions to ensure the confidentiality and integrity of eligible user's data.

● “State sponsors of terrorism" are identified by the DoS.

● Sanctions are identified by the DoS and Treasury, OFAC.

4.4.13. Data Transceiving—Protection

Contractors shall use data transceiving protection solutions (e.g., decryption and encryption, policies, protocols, secure communications, routing) for the eligible user's data.

SEE FAR 2.101 AND FAR 3.104

To ensure the confidentiality and integrity of the eligible user's data, the contractor shall use data transceiving protection solutions for both internal (e.g., within the CSP security boundary) and external data transceiving.

4.4.14. Data and Account Ownership

The contractor shall provide the eligible user full account, data, product, artifacts, and metadata ownership.

4.4.15. Judicial or Law Enforcement Orders that may Lead to Access or Seizure of Data Contractors shall notify eligible users of judicial or law enforcement orders (e.g., warrants, seizures, subpoenas) received that could result in the loss, removal, or unauthorized disclosure of the eligible user's data. Data loss, removal, or unauthorized disclosures shall be reported as data management incidents per Section 4.4.9 Data Management Incident Reporting. Contractors shall secure the eligible user's data from loss, removal, or unauthorized disclosure in the execution of judicial or law enforcement orders.

4.4.16. Software Ownership

Contractors shall enable eligible users to maintain autonomy of the eligible user’s sourced software hosted within the eligible user’s cloud environment. Autonomy includes accessing, downloading, or otherwise retrieving, partially or in full, the eligible user's software. The eligible user's software is inclusive of applications, binaries, commercial software, configuration files, functions, government software, infrastructure as code (IaC), licenses, scripts, software code, source code, subroutines, etc.

4.4.17. Software Bill of Materials (SBOMs)

Contractors shall deliver SBOMs upon request by eligible users.

4.4.18. Secure Software Attestations and Artifacts (SSA)

Contractors shall ensure SSA are on file within the CISA repository, or other specified repository, and provide links and access to the documents upon request from eligible users.

4.5. Environmental, Sustainability Requirements—Baseline

Environmental, sustainability requirements are defined below; however, additional requirements may be added at the TO level.

4.5.1. Climate Risk Management Plans

Administrative agency is seeking to better understand climate-related risks to its supply chain and the contractor’s ability to manage those risks. All other-than-small business concern contractors shall prepare a post-award Climate Change Risk Management Plan that identifies climate-related risks that could negatively impact performance of any resultant TOs; this plan must be submitted to the BPA CO within 12 months of their BPA award. At a minimum, the Climate Change Risk Management Plan shall address the following:

● What is your process for identifying, assessing, and responding to climate-related risks for successful performance or delivery (e.g., migration of smoke from wildfires, increases in precipitation-driven flooding, extreme heat events, https://softwaresecurity.cisa.gov/login?callbackUrl=https%3A%2F%2Fsoftwaresecurity.cisa.gov%2Fsoftware

SEE FAR 2.101 AND FAR 3.104

and inundation due to sea-level rise and storm surge, supply chain)?

● What inherent climate-related risks have you identified that may have a substantive financial or strategic impact on your business? Provide details of risks identified with the potential to have a substantive financial or strategic impact on your business.

● What is your business continuity plan?

■ Describe your disaster contingency, continuity plans, and response protocols for potential event-driven changes (e.g., hurricane, earthquake, flooding, wildfire, supply chain, pandemic, etc.) and chronic risks due to longer-term shifts in climate patterns (e.g., changes in precipitation, changes in average temperature, and sea-level rise).

■ Describe which assets, products, and services would most significantly disrupt operations if they experienced short-term acute impacts (e.g., degraded service, loss of service, equipment failure, loss of asset, or other unacceptable outcomes).

■ Describe which assets, products, and services would most significantly disrupt operations if they experienced gradual long-term cumulative impacts (e.g., degraded service, loss of service, equipment failure, loss of asset, or other unacceptable outcomes).

Within 24 months after award of the BPA, the contractor must submit to the BPA CO a Climate Change Risk Management Plan Follow-up Report consisting of an overview of actions taken or opportunities identified to adapt to the climate-related risks that may have a substantive financial or strategic impact, as identified in the Climate Change Risk Management Plan.

4.5.2. Electronic Waste Recycling

Contractors shall document the recycling of electronic waste (eWaste) using an e- StewardsⓇ or R2-certified electronic recycler to minimize pollution and negative environmental impacts. In the event that an existing recycler becomes unavailable, contractors can use recyclers that may not have certification, but are vetted and engaged, consistent with ISO14001-certified global environmental management plan (EMP), which aligns with the eWaste certification standards.

eWaste is inclusive of IT equipment (for example: laptops, printers, routers, servers, tablets), peripherals (such as batteries, cables, keyboards, monitors, sensors), data center equipment (for example: chemicals, racks, uninterruptible power supply [UPS], HVAC), etc.

4.6. Operational Requirements—Baseline

Operational requirements are defined as listed below. Additional requirements to items in this section may be added at the TO level.

4.6.1. Customer Management

Contractors shall provide a customer management solution that tracks and manages communications, concerns, inquiries, issues, etc. from eligible users.

4.6.2. Services Usage Summary Report

Contractors shall, upon request, provide the eligible user Services Usage Summary Reports, identifying the cloud services and/or cloud-related IT professional services

SEE FAR 2.101 AND FAR 3.104

used during each TOs' PoP. Service Usage Summary Reports shall only be delivered when cloud services and/or cloud-related IT professional services…