SOL FINAL - Attachment 1 - Performance Work Statement - 7.20.26_Redacted.pdf

RFP No. 1333BJ26R00280002 Enterprise Cloud Modernization (ECM) Attachment 1 – Performance Work Summary (PWS)

Performance Work Summary (PWS)

1.0 BACKGROUND

The United States Patent & Trademark Office (USPTO), Office of Chief Information Officer (OCIO) has begun disruptive Information Technology (IT) transformation initiatives in Fiscal Year (FY) 2020 leading to an agile infrastructure, intelligent operations, and enabling flexibilities to decrease operating expenses. This ongoing transformation continues over the next two (2) fiscal years. A few of the modernization activities resulting from the transformation initiatives include:

• A multi-site, fully redundant hybrid cloud infrastructure

• A resilient application architecture in a hybrid cloud, with containerized solution

• Fully capable, mission critical applications running stand-alone in the disaster recovery site or external cloud

• Infrastructure consolidated into a reduced/dense and efficient data center space

The USPTO OCIO requires implementing these transformation initiatives to support the vision of conducting the majority of Agency business via digital means by 2027. To support this vision our organization requires:

• A multi-site, highly scalable, innovative and elastic infrastructure and technology platform

• Adapting current IT to support future digital needs with a multi-faceted approach

• Adapting to a public cloud computing service that is uniquely positioned to support our future strategic technology requirements with no need to undertake long-term capital investments

• Adapting to the Cloud Product to deliver capabilities to provide use-as-you-need compute, storage, and cloud native services

• The enabling of Highly Available, Disaster Recovery (HA/DR) infrastructure, engineering, and provisioning to include Datacenter, Network, Storage, Compute, and Cloud

• Provide capability to shift Datacenter centric Network, Storage, and Compute to Cloud Services to be fit for purpose

2.0 PURPOSE

The purpose of the Enterprise Cloud Modernization (ECM) contract is to acquire professional services from one vendor to support the Infra/Hosting - Cloud product, with public cloud enhancements for effective cost savings, streamlined efforts and a purposeful investment. All work performed under this contract must conform to applicable federal government regulations and policies, as well as other agency supplemental regulations and policies as appropriate. These include the Department of Commerce (DOC) and USPTO policies provided for reference as follows:

Attachment 3: OCIO-PRC-8 – IT Security Handbook Attachment 4: DOC IT Security Baseline Policy Attachment 5: OCIO-POL-63 - Cloud Services Usage Policy Attachment 6: OCIO-POL-36 - Rules of the Road (USPTO) Attachment 7: OCIO-PRC-003 - Information Security Continuous Monitoring Strategy Attachment 8: USPTO Java Coding Standards Attachment 9: USPTO JavaScript Coding Standard

Additionally, the ECM effort allows USPTO Product teams to assess, migrate, develop and deploy to the cloud using FEDRAMP approved commercial cloud services through a single vendor with established relationships (Authorized Reseller) with Amazon, Google and Microsoft, which are the three major public cloud providers. This effort also provides the following along with related capabilities and enhancements:

Hybrid Multi-Cloud

Single vendor with established relationships (Authorized Reseller) with Amazon, Google and Microsoft, which are the three major public cloud providers, to deliver the below capabilities while also upholding the listed architecture principles:

Cloud Support Capability

1. Perform data assessments and migrations

2. Develop/mature architecture

3. Develop and mature a financial model to track and allocate costs across product lines and products (e.g., chargeback model)

4. Develop enterprise approach to data tagging to be used across Product Lines to support financial reporting and optimal up time to reduce unnecessary cost incurred

5. Refine and implement cloud strategy recommendations at the USPTO

6. Determine security level based on USPTO data hosted in the cloud

Architecture Principles

• Cloud First and Cloud Smart

• Multi-Cloud Compute Ecosystem

• Reduced Data Center Footprint

• FedRAMP Certifications

• Delivering IT Solutions better, cheaper and faster

• Adopting cloud services with a cloud-first approach for both new and existing workloads when cost feasible

• Accelerating the decrease in data center footprint

• Becoming more agile and responsive to business demands by lowering the time to market for new projects and prototypes

• Enhancing our ability to react to scalability requirements

Unless otherwise annotated, the stated requirements, and metrics in the PWS apply across all Infra/Hosting products, to include Network, Data Center, Compute, Storage and Cloud components. Also, unless otherwise stated, all date ranges in the PWS are six (6) calendar days.

The Government understands that some Cloud Service Providers (CSPs) may propose functionality beyond anything specified in the PWS as part of their commercial cloud offerings.

The PWS must not be interpreted as limiting any potential functionality within the proposed solution.

3.0 SCOPE

The requirements of this procurement are to award a contract to a vendor for efficient and cost-effective support services resulting in three Agile Teams (contractor and government) utilizing Agile/DevOps methodologies to support USPTO Product teams to assess, migrate, develop and deploy to the cloud. The three Agile Teams consists of:

1. USPTO Amazon Cloud Services (UACS)/USPTO Google Cloud Services (UGCS) Team

2. USPTO Microsoft Azure Cloud Services (UMACS) Team

3. Assessment and Migration Team

The vendor engages with the external cloud providers specified in task area 4, on behalf of the USPTO, whereas the USPTO remains the master account holder/admin with the external cloud providers.

The proposed staffing allocations for these Agile Teams to manage their respective product backlogs are as follows:

USPTO has a vision to become fully automated by realizing the potential of Cloud by June 2027, and efforts to date have resulted in a high-level, enterprise-wide cloud computing strategy and an assessment tool to identify existing candidates, products and components to lead the charge. In addition to this vision, USPTO has also articulated a framework, architecture principles, business values, and the enablers required to realize this vision, and now needs knowledgeable industry partners that align the foundational work already completed to deliver a hybrid multi-cloud solution that meets both current and future-state requirements.

At a high level, there are eight (8) primary requirements envisioned to fully implement the USPTO Cloud Strategy as referenced below:

Requirement 1: Fully automated CI / CD environment with infrastructure as code (IaC) on all cloud workloads

Requirement 2: Usage-based invoicing of platform, infrastructure, and operations

Requirement 3: Cloud first, buy and host on cloud, then build on cloud (PaaS, then IaaS)

Requirement 4: New systems to be cloud-native and utilize microservices architecture (as appropriate) with API-first design

Requirement 5: Common standards for software development and technology stack

Requirement 6: End-to-end security using leading cybersecurity practices (e.g. data encryption, MFA, IAM, FedRAMP)

Requirement 7: Event-driven design

Requirement 8: Verify and test product recovery process to alternate cloud region for disaster recovery prior to production deployment with acceptable performance and with annual testing for Critical Level 0/1/2 applications

Other Direct Costs (ODC): According to FAR 15.408, direct costs typically include direct material, direct labor, and other direct costs (ODC). An ODC is a cost that can be identified specifically with a final cost requirement that is not treated as either a direct material or direct labor cost. The Government may require the offeror to purchase software related to the services being acquired under this contract. Such requirements may be identified during the performance of this contract by the Government or the offeror. If the offeror initiates a purchase within the scope of this contract, the offeror must submit to the USPTO Contracting Officer Representative (COR) and USPTO Contracting Officer (CO) a consent to purchase. This must include the purpose, specific items, estimated cost, cost comparison, and rationale. The offeror must not make any purchases without approval from USPTO COR.

4.0 REQUIREMENTS AND PERFORMANCE

At a detailed level, the contractor must perform to the requirements and performance tasks as follows:

4.1 Task Area 1: Cloud User and Admin Account Management

Provisioning of user accounts, cloud accounts, configuration of role policies, tracking, management, and upkeep.

4.1.1 Performance Requirement Task Area 1

Performance Standard: Account Management requests are tracked, reported, and completed based on tickets submitted through the Cloud Service Storefront or answered by the USPTO Cloud Supports group email inbox or via ServiceNow interface. Progress is reported in weekly Rally report delivered to USPTO.

Acceptable Quality Level: Completed based on defined Customer Facing Service Level Agreements as tracked during the ECM Weekly Meeting and weekly Rally report

4.1.2 Requirements Task Area 1

4.1.2.1 The contractor must provide support in Cloud account management through the USPTO change management process/system and modify the best practice guide as needed. The contractor must recommend efficiencies (and automation) where noted for Cloud account administration (create, modify, delete), password resets, managing access and secret keys, role administration, group administration, policy administration.

4.1.2.2 The contractor must track all Cloud account activities for management and upkeep in a centralized location/ platform on a monthly basis across multiple cloud platforms (USPTO AWS Cloud Services, USPTO Microsoft Azure Cloud Service, USPTO Google Cloud Platform).

4.1.2.3 The contractor must integrate Federated authentication across multiple cloud platforms with USPTO credentials.

4.1.2.4 The contractor must assist USPTO manage creation of roles and instance profiles so development teams have access to pre-created roles to where they can attach policies to instances.

4.1.2.5 The contractor must assist USPTO to manage Access Keys issued to users for programmatic access to APIs.

4.1.2.6 The contractor must provide support and development related to Identity Access Management (IAM) in Cloud Hosted Services to include billing, user, and service/principal accounts. IAM support ensures all tasks, processes, and objects conform to USPTO Security, compliance, and monitoring requirements.

4.2 Task Area 2: Financial Operations, Billing and Cost Analytics Framework, Dashboard, and Reports Billing and Cost Analysis, Usage Tracking, Recommendation and Implementation of Cost Reduction Methods and Strategies, Adapt to USPTO Data Analytic P latforms as needed.

4.2.1 Performance Requirement Task Area 2

Performance Standard:

• Detailed cost breakdown by each service CLIN and cloud usage CLIN is tracked against the funded amount and is delivered to the USPTO and reviewed at the ECM Weekly Meeting

• Detailed cost analysis for each cloud platform (UACS, UGCS, UMACS) and each Business Product line and individual linked account is also provided.

• Monthly spend for Compute and Database are delivered to FRMD by each individual linked account

• Cost reduction strategies are documented and communicated to Product Teams via the Best Practices page, monthly lunch and learn sessions, and through potential savings plan offered by the contractor.

Acceptable Quality Level: Reports are delivered by the contractor and reviewed by USPTO and tracked during the ECM Weekly and Monthly meetings and communicated to Product Teams.

4.2.2 Requirements Task Area 2

4.2.2.1 The contractor must provide detailed billing on all Cloud costs, to include infrastructure, project support services, and usage.

4.2.2.2 The contractor must develop a solution that automatically checks service usage against Cloud Service Limits (cost by account) to prevent resource creation failures when the usage approaches a defined threshold (e.g.

percentage of the associated service limit).

4.2.2.3 The contractor must provide a budget threshold setting alerts based on usage costs or caps against the monthly allocated budget to the Product team/Stakeholders.

4.2.2.4 The contractor must provide a billing dashboard with the capability to set up and

4.2.2.5 The contractor must assist USPTO manage budgeting caps and alerts in advance of caps being reached based on allocated funding provided for each account.

4.2.2.6 The contractor must provide a billing dashboard that tracks real-time (or near real- time) Cloud usage and cost by services and components used by Product Teams across multiple cloud platforms (USPTO AWS Cloud Services, USPTO Microsoft Azure Cloud Service, USPTO Google Cloud Platform).

4.2.2.7 The contactor must provide machine-learning to monitor spikes and drops in Cloud usage and costs across multiple cloud platforms (USPTO AWS Cloud Services, USPTO Microsoft Azure Cloud Service, USPTO Google Cloud Platform).

4.2.2.8 The contractor must display multi-level thresholds showing graphical data and allows for action to reduce resource usage cost for projected and usage at cap and providing recommendations for usage within budget caps.

4.2.2.9 The contractor must provide the ability to control access to different views, groups and permissions on the billing dashboard. The contractor configures authentication to the billing dashboard with USPTO credentials.

4.2.2.10 The contractor must provide the Product teams access to its own account billing information to see their Cloud usage and cost by a specified time period and resource ID or tag.

4.2.2.11 The contractor must provide recommendations to optimize Cloud usage costs by analyzing usage patterns and provide recommendations for consolidating instance types based on demand across all billing accounts.

The recommendations include Reserved and Spot Instance quantities as appropriate, changes to Application configurations, USPTO operational standards, and policy conditions for the creation of new instances.

4.2.2.12 The contractor must provide the capability for an authorized Cloud reseller partner to configure the Consolidated Billing for account administration services, which allows clients to create and own their own accounts, configured to allow Product teams to have full API and billing access.

4.3 Task Area 3: Operations, Maintenance, and Performance

The contractor must provide day-to-day monitoring support of operating an enterprise cloud implementation, vulnerabilities and findings, POAM remediations, assessment findings resolutions, implementation of monitoring to support infrastructure O&M, performance, capacity planning.

4.3.1 Performance Requirements Task Area 3

• O&M requests from Product Teams are tracked, reported, and completed based on tickets submitted through the Cloud Service Storefront or answered by the USPTO Cloud Supports group email inbox or via ServiceNow interface. Progress is reported in weekly Rally report delivered to USPTO.

• Vulnerabilities and findings, POA&M remediations, assessment findings resolutions are tracked via monthly calls with Cybersecurity, bi-monthly Cloud DISA STIG Working Group meetings

• Performance capacity planning is tracked and reported against in Rally via User Stories assigned to the team

Acceptable Quality Level: Completed based on defined Customer Facing Service Level Agreements and progress is tracked and discussed during the ECM Weekly Meeting and weekly Rally report

4.3.2 Requirements Task Area 3

4.3.2.1 The contractor must provide support for cloud services and cloud hosting of USPTO applications and systems, which may include various components and interfaces with the public and internal users.

4.3.2.2 The contractor must maintain availability of production systems deployed into USPTO Cloud platforms where there is no designated support through the Product Team. The contractor must provide communication, including responding to the CIO Command Center, Alert distributions, support team requests, system business area requests, requests within 30 minutes of receipt, during business hours and investigate reported and suspected outage issues, documenting issues, providing resolution, and maintaining a knowledge base of known issues. The contractor must provide support through resolution.

4.3.2.3 The contractor must have the ability to work remotely with current USPTO collaboration tools, with the presence indicator depicting daily status, in addition to being available as needed onsite and on-call support for production and development/testing environments 24x7, Monday through Sunday. The contractor may be required to work on an as-needed basis, other than normal business hours (off-hours), including on-call, evenings, weekends and holidays. USPTO production hours are defined as 5:30 a.m. to 7:00 p.m., after-hours 7:00 p.m. to 5:30 a.m. Monday through Friday and 24x2 on weekends (Saturday through Sunday). The contractor must provide responses within one-half hour of notification by email and personnel may be required to be "on call" in order to meet product-related deadlines.

4.3.2.4 The contractor must follow the USPTO’s Product Framework using agile methodologies and best practices, USPTO operational standards (OCIO Playbook), and USPTO Cloud Computing strategies and best practices.

The contractor supports change control activities related to system lifecycle; track defects due to non-compliance with standards, best practices or system/software bugs and provide a remediation plan for each.

4.3.2.5 The contractor must support the enhancement of monitoring and logging capabilities to include the identification, collection, and organization of data to provide a comprehensive view of the health of a system.

4.3.2.6 The contractor must assist in analyzing log data to provide intrusion detection and prevention capabilities by defining event thresholds and generating alert notifications for suspicious behaviors along with affected resources and associated data for incident response, mitigation, and integration with on-premise monitoring systems. The contractor must persist the log files according to USPTO retention requirements and make them accessible by the USPTO Security Information and Event Management (SIEM) system.

4.3.2.7 The contractor must be responsible for ensuring that the security and privacy posture is maintained for an organizational system and works in close collaboration with the system owner. The contractor must assist USPTO manage system security vulnerabilities in accordance with FISMA, NIST, DOC, and USPTO standards, policies, and guidelines. The contractor must have knowledge of security scan tools to ensure remediation of findings.

4.3.2.8 The contractor must establish and maintain advanced tag mapping and asset tracking, demonstrating in-depth knowledge, accounting for missing, duplicate tags, abbreviated, unsupported resource tagging, and mix-case tags. Tags are to be compliant with USPTO Cloud Strategy and have ability to display usage and assets across multiple Cloud providers.

4.3.2.9 The contractor must provide analysis, presentation, and processing of data to inform stakeholder decisions and actions to include: Unsuccessful login attempts, Network-level attacks or intrusion attempts, stack updates, instance inventory, Public facing endpoints, Disk and memory utilization of instances, resource usage costs, Non-US region activity, Application health monitors, HTTP access/request traceability as requested by the Government.

4.4 Task Area 4: Cloud Infrastructure Enhancements

Includes support improvements to cloud enterprise infrastructure implementation for HA/DR, automation.

4.4.1 Performance Requirements Task Area 4

Performance Standard: Progress against support improvements to cloud enterprise infrastructure implementation for HA/DR and automations is tracked in Rally on AOKR to EIPL leadership and daily progress is tracked in Rally via User Stories and CIO Organizational goals. Progress on support improvements is communicated to Product Teams via the Best Practices page, monthly lunch and learn sessions. Progress is also reported in weekly Rally report delivered to USPTO.

Acceptable Quality Level: Completed based on defined Platform Service Level Agreements and progress is tracked and discussed during the ECM Weekly Meeting and weekly Rally report.

4.4.2 Requirements Task Area 4

4.4.2.1 The contractor must provide specialized technical support in cloud-hosted services in relation to various Operating Systems (OS), Networking, Program languages, Databases, Web Services, Cloud services, change management, technical writing, analysis, and middleware as required.

The contractor provides the ability to provision all available Cloud Services to include infrastructure (Compute, Storage, and Networking) utilizing the various cloud service on demand, dedicated, or reserved instance model. Provisioning may include Cloud services, 3rd party services, GOTS, COTS, and custom app integrations, maintenance, and monitoring.

4.4.2.2 The contractor must be responsible for supporting configuration, change management, architecture, engineering, and administration of Cloud hosted Infrastructure as a Service. This also includes review and enhance Operational Service Plans (OSPs), Run books, known issues knowledge bases, log defects, and other artifacts as requested by USPTO staff.

4.4.2.3 The contractor must serve as subject matter experts who designs, develops, tests, and demonstrates working solutions that meet USPTO requirements for enhancing infrastructure capabilities within Cloud and deliver documentation to effectively plan and implement those solutions.

This includes step-by-step procedures and any supporting artifacts necessary to successfully deploy working systems and configurations.

4.4.2.4 The contractor must ensure the Confidentiality, Integrity, and Availability of all cloud resources in all regions and availability groups. The contractor must design, develop, test and implement automation and procedures for managing the configurations of guardrails, server baselines, blueprints, policies, tagging, dashboards, and reporting.

4.4.2.5 The contractor must design, develop, and tests an integration solution with the current Continuous Integration/Delivery/Deployment systems (i.e.

Subversion, GitHub, Jenkins, Ansible) and change control processes to deliver a seamless fully automated deployment capability. The deployment process, as the target procedure for automation, must be based on the Deployment Best Practices defined as part of the USPTO Operational Standards.

4.4.2.6 The contractor must ensure deployment automation standards are enhanced by integrating an authoritative source repository at the beginning of the deployment process to replace the manual step of copying and organizing sources files to the Cloud. Enhancements to Continuous Integration/Configuration Management tooling for deployment automation focuses on replacing the manual step of creating or updating a Cloud stack and rollback.

4.4.2.7 The contractor must develop and test configuration standards and adapts processes, tooling, and Cloud components to support container-based workloads. The overall solution must be portable across multiple cloud platforms (USPTO AWS Cloud Services, USPTO Microsoft Azure Cloud Service, USPTO Google Cloud Platform).

4.4.2.8 The contractor must develop baseline container images based on USPTO security configuration benchmarks and USPTO standards.

4.4.2.9 The contractor must develop configuration standards for container images and build files to meet USPTO defined deployment procedures.

4.4.2.10 The contractor must design, develop, test and implement Guardrails – automation for managing the configurations that grants access to cloud services and resources in accordance with Cybersecurity policy and other FISMA controls to address shared responsibilities as applicable/define d in the CSP’s FedRAMP accreditation package. This includes network topologies that support layered security architectures (e.g. restrict public access) and standard configurations (as appropriate to each CSP) to support separation of duties and resource isolation between projects/teams and environments (lab vs prod).

4.4.2.11 The contractor must develop server baseline(s) – Designs, create, develops, tests, implements, and adopts baseline images used to create servers based on approved security benchmarks and operational tools.

4.4.2.12 The contractor must transition from Center for Internet Security (CIS) Benchmarks to Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) benchmarks for securing products and components hosted in the Cloud.

4.5 Task Area 5: Storage, Data, Optimization

Recommends, performs, assists USPTO manage, S3, Glacier, data lifecycle implementations, provides policy updates recommendations to minimize cost while meeting needs for varying storage options. Includes auto data cleanup, de-duplications, Storage Migration (lower cost storage), inventory of ULs, PII considerations, long-term storage; low access; carving out structure and be able to manage storage in cloud; Actual migration of the application and data; work with storage & server admin team and assists USPTO manage back-end process

4.5.1 Performance Requirements Task Area 5

Performance Standard: Progress on Storage, Data, Optimization is tracked in Rally Features and daily progress is tracked in Rally via User Stories. Progress on improvements is communicated to Product Teams via the Best Practices page, monthly lunch and learn sessions. Progress is also reported in weekly Rally report delivered to

USPTO.

Acceptable Quality Level: Progress is tracked and discussed during the ECM Weekly Meeting and weekly Rally report.

4.5.2 Requirements Task Area 5

4.5.2.1 The contractor must provide support for operation, monitoring, troubleshooting, configuration, upgrade, storage architecture designs, and maintenance of data storage in the Cloud. These tasks include the following and related tasks: Storage Administration (software and components) support for all external cloud storage equipment (e.g.

Amazon Snowball and Snowball Edge), disk space monitoring, integration and testing of storage-related scripts.

4.5.2.2 The contractor must support the archival efforts of USPTO data (e.g. image files) to a cloud storage service for data archiving and long-term backup.

4.5.2.3 The contractor must secure the cloud storage solution and supports cost analysis to determine cost savings compared to on-premises solutions.

4.5.2.4 The contractor must support the migration for data storage from on-premise to a cloud provider.

4.5.2.5 The contractor must ensure storage containing personally identifiable information is protected in transit from on-premise to a cloud provider.

4.5.2.6 The contractor must support a solution for long-term cloud storage where there is no immediate need for retrieval of the data.

4.5.2.7 The contractor must support a solution that provides bulk storage of data from on-premise to a cloud provider.

4.5.2.8 The contractor must assist USPTO manage storage utilization in the Cloud and supports the actual migration of the application data.

4.5.2.9 The contractor must work with the storage & server admin team and assists USPTO to manage the process for storage migration to the cloud.

4.5.2.10 The contractor must provide technical writing skills and requirements/procedural documentation associated with, the following and related efforts: Storage as a Service requirements, Storage processes and procedures for Cloud, Service Catalogs.

4.6 Task Area 6: End to End Security Solutions (Security & Compliance Support) - Cloud Compliance Support

What a general service system ATO (UACS, UMACS, UGCP) needs to be compliant to, supporting infrastructure team in recommending compliant solutions to meet cyber assessment/audit expectations. Zero Trust implementation, CASB, Provide ISSO services.

4.6.1 Performance Requirements Task Area 6

Performance Standard:

• Assessment related activities are discussed via monthly calls with Cybersecurity, bi-monthly Cloud DISA STIG Working Group meetings. Progress is reported in weekly Rally report delivered to USPTO.

• Zero Trust implementation support is done in conjunction with ZTA working group

• Cloud Access Security Broker progress is done via Security Hub integration on

UACS

• ISSO services are provided by contractor

• Other End to End security solution needs is done via data calls as required by Department of Commerce

Acceptable Quality Level: Completed based on defined Customer Facing and Platform Service Level Agreements and progress is tracked and discussed during the ECM Weekly

4.6.2 Requirements Task Area 6

4.6.2.1 The contractor must be responsible for ensuring that the security and privacy posture is maintained for an organizational system and works in close collaboration with the system owner. The contractor serves as a principal advisor on all matters, technical and otherwise, involving the controls for the system. The contractor must have the knowledge and expertise to assist USPTO manage the security or privacy aspects of an organizational system and may be assigned responsibility for the day-to-day system security or privacy operations.

4.6.2.2 The contractor must be responsible for the development, management, and maintenance of System Security and Privacy Plans (SSPP). The Contractor also assists in preparing system-level policies, guidelines, and standards for USPTO information systems and system users in order to implement USPTO security directives and policies and assist the system owner develop and maintain an IT security program that addresses implementation of Federal Information Security Modernization Act (FISMA 2014) requirements as mandated by the White House Office of Management and Budget (OMB), in accordance with NIST Standards and special publications, Security Technical Implementation Guide (STIG), and DOC and USPTO Security policies and procedures.

4.6.2.3 The contractor must implement USPTO cloud services in accordance with FISMA, NIST, FedRAMP, DOC, and USPTO standards, policies, and guidelines as follows:

• Perform security compliance activities associated with the requirements identified in NIST 800-37 (current version), “Guide for Applying the Risk Management Framework to

• Federal Information Systems” and NIST 800-53 (current version), “Security and Privacy Controls for Federal Information Systems and Organizations.” The Contactor also develops specific documentation that meets the USPTO requirements for Security Authorization Program and Continuous Monitoring and Activities including assessment of the impacted controls and scan of the systems/applications.

• The Contractor must comply with all Federal, Department of

• Commerce (DOC) and USPTO security and privacy guidelines are in effect at the time of the award of this contract. The Contractor performs periodic reviews to ensure compliance with existing information security and privacy requirements. The Contractor makes all system information and documentation produced in support of the contract available to the agency and agency auditors upon request.

4.6.2.4 The contactor must provide Information System Security Officer (ISSO) services.

4.6.2.5 The contractor must have the following certifications: Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM), and Certified Authorization Professional (CAP). The Certified Cloud Security Professional (CCSP) certification is highly desired.

4.7 Task Area 7: Application Assessment, Migration and Modernization

Migration readiness, TCO, business case analysis, playbook for migration and ability to migrate and handoff.

4.7.1 Performance Requirements Task Area 7

Performance Standard: Contractor supports all related activities with Application Assessment, Migration and Modernization through Cloud Intake Process, Cloud Advisory Team Meetings and Cloud Express route for migration. Progress is reported in weekly Rally report delivered to USPTO.

4.7.2 Requirements Task Area 7

4.7.2.1 The contractor must establish a Cloud Adoption and Migration Guideline with Training materials, the guidelines and training indicate how and why the cloud is cheaper, faster and better.

4.7.2.2 The contractor must ensure guideline/training has business justification and application lifecycle information.

4.7.2.3 The contractor must ensure guideline/training provides business use cases for each cloud service provider to include AWS, Azure, and Google.

4.7.2.4 The contractor must ensure guideline/training indicates the development type; new, upgrade, lift and shift.

4.7.2.5 The contractor must ensure guideline/training covers application architecture (N- tier, Microservices, Service oriented) technology (OS, COTS, codebase, database, etc.).

4.7.2.6 The contractor must ensure guideline/training includes staff resources and knowledge about cloud developments.

4.7.2.7 The contractor must ensure guideline/training has business continuity and disaster recover requirements.

4.7.2.8 The contractor must establish a Self-Assessment Cloud Migration

Checklist; the solution automatically generates evaluation report to determine if the migration is mutually beneficial.

4.7.2.9 The contractor must ensure the self-assessment includes application lifecycle information.

4.7.2.10 The contractor must ensure the assessment includes the cloud deployment type (public/hybrid), cloud tier (AWS, Azure, and Google).

4.7.2.11 The contractor must ensure the assessment includes OS, COTS, codebase, database, cloud services, etc.

4.7.2.12 The contractor must ensure the assessment includes application dependencies and disaster resilience requirements.

4.7.2.13 The contractor must provide migration options.

4.7.2.14 The contractor must perform migration, modernization of USPTO custom developed applications, to include refactoring, re-architecting components, products, and re-deploy to USPTO enterprise cloud environments, including product CI/CD pipeline if available, in alignment with USPTO Cloud Strategy, USPTO Cloud best practices.

4.7.2.15 The contractor must provide knowledge transfer, run-book hand-off, updates to DOSPs, GEARS, and other relevant records systems to Product DevSecOps team and other USPTO teams.

4.8 Task Area 8: Authorized Reseller Capabilities

The contractor must maintain reseller relationship with the following public cloud vendors.

Provide reach back to Public Cloud vendor specialized professional services.

4.8.1 Performance Requirements Task Area 8

• Contractor coordinates monthly calls or more frequently as needed with cloud vendors.

• Contractor provides ability for USPTO to obtain direct cloud vendor resources if needed. Progress if applicable reported in weekly Rally report delivered to USPTO and new offerings are communicated at Monthly Cloud Lunch and Learn sessions.

4.8.2 Task Area 8

4.8.2.1 UACS Requirements:

• AWS Public Sector Partner - The AWS Public Sector Partner (PSP) Program recognizes APN Partners with solutions and experience in delivering government, education, and nonprofit customer missions around the world. We enable partners to accelerate their business growth on AWS through alignment with our public sector sales, marketing, capture and proposal, and funding teams. Partners also receive designation as a Public Sector Partner in our APN Partner Solutions Finder, and access to additional differentiation programs

• AWS Public Sector Solution Provider - The AWS Solution Provider Program is designed for systems integrators, managed service providers, value-added resellers, and public sector partners to resell AWS Services to end customers as part of their differentiated solution. Under this program, Authorized Solution Providers manage, service, support, and bill Amazon Web Services (AWS) accounts for end customers.

• The AWS Solution Provider Program provides Authorized Solution

• Providers a tiered discount structure based on partners' technical capabilities and success in driving new business, has flexible contracting options to meet the unique needs of end customers, and

• provide partners multiple AWS Support models that align to a partners' AWS practice.

• Advanced Consulting Partner - APN Consulting Partners are professional services firms that help customers of all types and sizes design, architect, build, migrate, and assist USPTO manage their workloads and

• applications on AWS, accelerating their journey to the cloud. These professional services firms include system integrators, strategic consultants, agencies, managed service providers (MSPs), and value-added resellers.

• Direct passthrough inclusive of the master account, master billing account, full administrative access, any discounts applicable, and include any accrued credits by usage of the account to be managed by USPTO team.

4.8.2.2 UMACS Requirements:

• Microsoft Direct-Bill Partner - Direct-bill partners are partners with a direct billing relationship with Microsoft. As a direct-bill partner, you can purchase first-party offers and third-party offers directly from the Microsoft marketplace, then sell them to your customers. You need to fulfill certain programmatic requirements for the role of direct-bill partner. This includes the ability to integrate with Microsoft using APIs. You also need to be able to provide billing, support, and managed services to customers on an on-going basis. For more information, please see Enroll as a direct-bill partner.

• Direct passthrough inclusive of the master account, master billing account, full administrative access, any discounts applicable, and include any accrued credits by usage of the account to be managed by USPTO team.

4.8.2.3 UGCP Requirements:

• Google Cloud Platform Partner, Reseller – Google Cloud Partners are partners that have a direct relationship with Google with proven technical mastery, reach back to Google resources, and the ability to provide Cloud Usage management as a reseller.

• Direct passthrough inclusive of the master account, master billing account, full administrative access, any discounts applicable, and include any accrued credits by usage of the account to be managed by USPTO team.

4.9 Task Area 9: Cloud Intake Process

Onboarding of teams, training material, best practices, communications, managing cloud knowledge portal content.

4.9.1 Performance Requirements Task Area 9

• Contractor supports all related activities with Cloud Intake through Cloud Intake Process, Cloud Advisory Team Meetings and Cloud Express route for migration.

Progress is reported in weekly Rally report delivered to USPTO.

• Contractor delivers and maintains best practices, communications, managing cloud knowledge portal content. Progress is communicated at Monthly Cloud Lunch and Learn sessions

Meeting and weekly Rally report

4.9.2 Requirements Task Area 9

4.9.2.1 The contractor must establish intake guideline and on-boarding procedure.

4.9.2.2 The contractor must review current on-boarding process, if any, and provide process improvements.

4.9.2.3 The contractor must ensure the intake guideline and on-boarding procedure includes detailed steps regarding dependencies, targeted cloud, hybrid cloud design, cloud cost estimations including detailed calculator, requests and approval processes.

4.9.2.4 The contractor must provide training materials to guide cloud adoption and migration.

4.9.2.5 The contractor must provide communication and promote industry and

ESSD / EIPL Infra/Hosting cloud best practices along with continuous process improvements.

4.9.2.6 The contractor must ensure that new DevSecOps teams moving to cloud have completed intake process guidelines, set cloud usage budgets, tagging, and budget management expectations, monitor adherence to cloud best practices and guardrails, and take administrative action to ensure notification and compliance.

4.10 Task Area 10: Software Services Product Operations Support

4.10.1 Performance Requirements Task Area 10

Performance Standard: Patent requests from UACS are tracked, reported, and completed based on tickets submitted through the Cloud Service Storefront or answered by the USPTO Cloud Supports group email inbox or via upcoming ServiceNow interface.

Progress is reported in weekly Rally report delivered to USPTO.

Acceptable Quality Level: Completed based on defined Customer Facing Service Level Agreements and progress is tracked and discussed during the ECM Weekly Meeting, UACS Daily Stand-Up meetings, and weekly Rally report.

4.10.2 Requirements Task Area 10

Patent Cloud Consulting

4.10.2.1 The contractor must establish a discovery workshop, for use by selected product team components, to enable the assessment and provide a recommendation that accelerates the migration and implementation to the cloud, addressing identified technical concerns and potential roadblocks.

This work results in a design review and implementation plan. Weekly Status Report provided.

4.11 Task Area 10: Cloud Governance (Optional)

Optional CLIN for Support of CCoE, CCAC, and CTO/enterprise infrastructure in establishing guardrails, Cloud Usage policies, SLAs, SLCs, implementation patterns, converting cloud strategy into implementation and assist with policies and recommendations.

4.11.1 Performance Requirements Task Area 11

• Contractor supports all related activities and discussions Cloud Center of Excellence, Cloud Advisory Team Meetings. Progress is reported in weekly Rally report delivered to USPTO.

• Contractor delivers and maintains Service Level Agreements on UACS infrastructure.

Acceptable Quality Level: Completed based on defined Customer Facing Service Level

Agreements and progress is tracked and discussed during the ECM Weekly Meeting, UACS Daily Stand-Up meetings, weekly Rally report

4.11.2 Requirements Task Area 11

4.11.2.1 The contractor must deploy a Cloud Portal as part of the Cloud Center of Excellence. The portal must be the one stop shop for learning about cloud, developing on cloud, cloud governance, assessment, migrations, deployments, and implementation patterns (Containers, cloud vendor usage, cloud native deployment, multi-cloud).

4.11.2.2 The contractor must support the development of Cloud Training material, in alignment with current USPTO cloud best practices and future cloud enhancements that supports onboarding product teams to the cloud. The training includes FedRAMP, USPTO implementation, usage of non- FedRAMP services, security process, migration to the cloud, cloud readiness checklist, and the delineation between Cloud Infrastructure support and Product Team.

4.11.2.3 The contractor must support the development of a formal cloud implementation strategy and program with a defined set of capabilities, processes and tools to enable modern end-to-end cloud monitoring and observability.

4.11.2.4 The contractor must support monitoring product evaluations, and proof of concepts in collaboration with internal IT and business teams (the technologies and tools used to support the program and processes)

4.11.2.5 The contractor must define program key performance indicators (KPI) to monitor program effectiveness and progress towards improvements

4.11.2.6 The contractor must support communications, key stakeholder collaboration, to roll out Cloud Team implementation of a chosen recommendation.

4.11.2.7 The contractor must develop a Cloud Roadmap, encapsulating all related

Cloud Computing, Cloud Modernization with a visual graphic that can be modified and expanded as new work streams are identified.

4.12 Task Area 12: Vendor Professional Service (Optional)

Optional CLIN - pass-through ODC access to direct Proserv resources (i.e., AWS Professional Service)

4.12.1 Performance Requirements Task Area 12

Performance Standard: Contractor provides ability for USPTO to obtain direct cloud vendor resources if needed. Progress if applicable reported in weekly Rally report delivered to USPTO and new offerings are communicated at Monthly Cloud Lunch and Learn sessions.

4.12.2 Requirements Task Area 12

4.12.2.1 The contractor must provide cloud service provider professional services personnel to leverage knowledge of cloud vendor specific technologies in collaboration with cloud service provider, hybrid solution technologies, and partner teams to propose, architect, and implement transformational solutions for customers.

4.12.2.2 The contractor must provide professional services for architecture, design; coding, integration, performance, security, user experience design, and governance for cloud hosted applications and systems following Federal Cloud Computing Strategy.

4.12.2.3 The contractor must conduct a current state assessment of the on-premise systems and applications; assessment includes cost benefit analysis for hosting the applications and systems in the cloud vs. on premise and determines areas of readiness of systems and applications to host in the cloud-based platform to include the following and related tasks:

• Organizational Readiness

• Technical Readiness

• Process Readiness

4.12.2.4The contractor must provide target state roadmap to migrate on premise systems and application to a cloud-based platform. Target state alternative solutions under consideration considers:

• Software as a Services (SaaS) solution

• Platform as a Service (PaaS) solution

• Infrastructure as a Service (IaaS) solution

4.12.2.5The contractor must identify what existing or planned future capabilities and functionalities USPTO relies on for conducting business supported by the target state solution(s) (i.e. SaaS, PaaS, or IaaS).

4.13 Task Area 13: Cloud Application, Architect Support (Optional)

Optional - support and assist USPTO personnel leading product teams in designing, architecting, development, for USPTO products in USPTO managed cloud / alignment with Cloud Strategy.

4.13.1 Performance Requirements Task Area 13

• Contractor must provide the ability for USPTO to obtain direct cloud vendor resources if needed. Progress if applicable reported in weekly Rally report delivered to USPTO and new offerings are communicated at Monthly Cloud Lunch and Learn sessions.

• Contractor must deliver product prototype and demonstration of concept, new services adoption, templates, and runbook to help product team to onboard cloud solutions. Deliverables are posted to TEAMS site and progress is reported in weekly Rally report delivered to USPTO.

• Contractor must support all applicable governance bodies such as CCoE, CAT, applicable lunch and learns and provides reviews as needed. Progress is reported in weekly Rally report delivered to USPTO.

• Contractor must support all related activities with Application Assessment, Migration and Modernization through Cloud Intake Process, Cloud Advisory Team Meetings and Cloud Express route for migration. Progress is reported in weekly Rally report delivered to USPTO

• Contractor must deliver on automation throughout entire cloud operation to optimize cost, operation, and improve architecture visibility. Deliverables are posted to TEAMS site and progress is reported in weekly Rally report delivered to USPTO.

Code automation is posted to USPTO code repositories as needed

Meeting, ECM Monthly Status Review and weekly Rally report, applicable documentation such as UACS SSP is updated as needed

4.13.2 Requirements Task Area 13

4.13.2.1 The contractor must provide professional services for architecture design on specific solutions for product team, include the following and related efforts: cloud provider and services selection, sizing and choices of those services, integration with other cloud or no cloud services and data, information security consideration and implementation, and automation.

4.13.2.2 The contractor must provide proper product prototype and demonstration of concept, new services adoption, templates, and runbook to help product team to onboard cloud solutions.

4.13.2.3 The contractor must assist USPTO government cloud team with other governance body (Cyber security, data officers, CCoE members, etc.) to conduct design review, architecture walk through, and deep dive discussion to approve product team’s design artifacts. Conduct potential launch review before rollout to approve product team’s implementation artifacts. Assist USPTO government cloud team and compliance body (Cyber security, C3, etc.,) to conduct post- launch audit and remediate architecture deficiencies and implementation flaws when requested by management.

4.13.2.4 The contractor must participate with the USPTO cloud team internal architecture review and improvement activities. Provide and implement approved solutions to enhance the overall USPTO cloud foundation.

Update SSP and other required documents upon completion.

4.13.2.5 The contractor must assist with the USPTO cloud team to collaborate with partners from application development, technology officers and key stakeholders (business and IT) on subjects related to cloud architecture.

4.13.2.6 The contractor must maximize automation throughout entire cloud operation to optimize cost, operation, and improve architecture visibility.

Participate and assist implementation of 3rd part cloud operation tools if requested. Develop customized USPTO Cloud team operation tools if requested.

4.14 Task Area 14: Optional Surge Capability

4.14.1 Performance Requirements Task Area 14

The Contractor must provide Optional Surge Capability in a timely, responsive, and professional manner when directed by the Government through a written modification

No. Deliverable Due Date Delivery Method

5.1 Service guide for

Cloud account management in draft and final versions

Initial draft within 30 days of award and monthly thereafter until final

Electronic to LPO

5.2 • Billing Dashboard Standard Operating Procedures in…