Sources Sought Notice_NCPO NCloud (v.5.0).docx.pdf

Department of Commerce (DOC) National Oceanic and Atmospheric Administration (NOAA)

Sources Sought Notice NOAA Cloud Program Office (NCPO)

INTRODUCTION

THIS IS A SOURCES SOUGHT NOTICE ONLY.

This Sources Sought Notice is issued solely for information and market research planning purposes; it does not constitute a solicitation or a promise to issue a solicitation. This notice does not commit the Government to contract for any supply or service. The National Oceanic and Atmospheric Administration (NOAA) is NOT seeking proposals at this time. Respondents are advised that the U.S. Government will not pay any costs incurred in response to this notice. All costs associated with responding to this notice will be solely at the interested party’s expense. Not responding to this notice does not preclude participation in any future solicitation.

The information provided in this notice is subject to change and is not binding on the Government. All submissions become the property of the Federal Government, and will not be returned. Any information that the vendor considers proprietary should be clearly marked as such.

BACKGROUND

The NOAA Office of the Chief Information Officer through the NOAA Cloud Program Office (NCPO) requires cloud services to support the NOAA Cloud Strategy, which involves multi-cloud, multi-tenant, FedRAMP certified commercial cloud computing environments and related capabilities. The aim is to enable direct access to hyperscale cloud services at all organizational levels, from strategic levels to operation in field offices.

This multi-vendor cloud solution must be a direct contract with each Cloud Service Provider, as the CSP must demonstrate direct control over infrastructure changes to allow implementation of changes that meet NOAA requirements. NOAA intends to enhance its mission by leveraging advanced cloud technologies such as elastic computing, storage, and network infrastructure, providing resilient services with broad geographic accessibility, centralized management with distributed control, enhanced security measures, advanced data analytics capabilities, strong marketplace and partner networks, support for scientific research, data collaboration, and the utilization of composable multi-cloud and collective capabilities from various cloud service providers. NOAA’s acquisition strategy to achieve these goals is to pursue a multi-award Indefinite Delivery Indefinite Quantity (IDIQ) contract vehicle.

KEY CAPABILITIES

The objective of this notice is to identify sources, including small and socioeconomic small business concerns, with the following capabilities in support of NOAA mission:

1. Extensive Infrastructure Presence: NOAA requires cloud service providers with extensive infrastructure presence within the United States to ensure stringent control and compliance with US federal regulations, guaranteeing data sovereignty and security. Geographic diversity and multiple availability zones are critical to enhancing resilience, reducing latency, and supporting NOAA’s nationwide data collection and dissemination efforts. Furthermore, robust disaster recovery solutions with multi-region failover capabilities, along with architectures designed for high availability with redundancy and failover mechanisms, are essential to maintaining NOAA's operational continuity and data integrity in the face of potential disruptions.

● US-Based Operations and Direct Control: Be headquartered in the United States with its primary data centers and critical infrastructure located within the US. Demonstrate direct control over infrastructure changes to meet government requirements efficiently.

● Regions: Presence of multiple data centers across various geographical regions with at least 5 distinct geographical regions within the USA.

● Availability Zones: At least 10 availability zones spread across these regions.

● Disaster Recovery: Robust disaster recovery solutions with multi-region failover capabilities within the

USA.

● High Availability: Architectures designed for high availability with redundancy and failover mechanisms.

2. Data Center and Network Capacity: NOAA's mission involves extensive data processing, storage, and real-time data collection, necessitating significant data center and network capacity. High compute and storage capacities are essential for handling NOAA’s intensive computational tasks, such as weather modeling and climate simulations, while a robust national network ensures fast and reliable data transfer. Additionally, redundancy and extensive peering locations are critical to maintaining efficient and timely data dissemination.

● Data Centers:Multiple large-scale data centers in each region, with a total of at least 20 data centers across the USA.

● Total Compute Capacity: Capable of supporting hundreds of thousands of servers nationwide and supporting hundreds of thousands to millions of virtual machines and containers.

● Storage Capacity: Capable of handling petabytes to exabytes of data within the USA.

● National Network: High-bandwidth, low-latency network with extensive interconnectivity across the

USA.

● Peering Locations: Dozens of peering locations nationwide with at least 10 Gigabits per second to peer with the Government at the provided network locations to ensure fast and reliable data transfer.

3. Comprehensive Service Portfolio: To enable NOAA’s diverse and complex computational needs, CSPs must offer a comprehensive service portfolio that includes a wide range of cloud services, centralized management, and distributed control capabilities. These offerings support commercial innovation, advanced AI/ML capabilities, and facilitate efficient resource management.

● Service Variety: Offering at least 100 different cloud services spanning a wide range of “Anything as a Service” (XaaS) offerings, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Offerings should support commercial innovation, advanced data analytics and AI/ML capabilities at scale.

● Managed Services: Comprehensive managed service offerings, including databases, containers, serverless computing, etc.

● Ease of Use: The CSP must offer efficient self-service options for cloud services, enabling rapid development and deployment of new applications and advanced capabilities. Additionally, the platform must support the portability of data and applications both into and out of their infrastructure.

● Centralized Management and Distributed Control: Capabilities to enable NOAA to exert necessary oversight and management of cloud services. This includes the ability to apply security policies, monitor network security compliance and service usage, promulgate standardized service configurations, and automate and distribute the account provisioning process.

○ The solution must have a mechanism for activating and/or deactivating any cloud service offering for NOAA workspaces.

○ There must be a mechanism to provision cloud services based on standardized, templated configurations and security policies, as well as a user-friendly mechanism to deprovision any and/or all services.

○ The solution must also provide object and resource access control management, including data and resource tagging for billing tracking, access control, and technical policy management.

○ To facilitate the automation of central management and distributed control, there must be an actively maintained, versioned, and documented Application Programming Interface (API) providing the ability to perform any operation supported by the CSP portal/user interface.

4. Scalability and Elasticity: NOAA's dynamic workload requires a cloud service provider capable of efficiently handling fluctuating demands while optimizing resource usage and cost. The solution must enable provisioning of compute, storage, and network infrastructure that is constantly updated, including processing architectures, servers, storage options, and platform software, at scale to meet consumption and rapid development needs. Additionally, the CSP must own, or provide proof of complete control over, and unmitigated access to, the proposed cloud environment.

● Auto-Scaling: Advanced auto-scaling capabilities to dynamically adjust resources based on demand.

● Elasticity: Ability to quickly scale resources up or down.

● Constant Updates: Ensure infrastructure is constantly updated to meet consumption and mission needs.

● Control and Access: CSP must have complete control and unmitigated access to its cloud environments.

5. Security and Compliance: Ensuring the security and compliance of NOAA’s data is paramount. The CSP must provide fortified security capabilities that enable enhanced cyber defenses from the application layer through the data layer. This includes continuous monitoring and auditing, automated threat identification, resilience, encryption at rest and in transit, secure data transfer capabilities, and operating environments that meet or exceed NOAA information security requirements.

● Advanced Security Features:

○ Identity and Access Management: Securely verify user identity using modern authentication protocols, including multi-factor authentication (MFA) and public key infrastructure (PKI) at each classification level, and support federated identity.

○ Automated Information Security and Access Control Tools: Provide tools for patching and vulnerability management, supply chain risk management, automated breach incident identification, threat detection and response, and granular control over marketplace offerings.

○ Continuous Monitoring and Logging: Provide human and machine-readable logs for monitoring service provisioning, configuration changes, service access, and audit trail events. All actions must be loggable to a read-only, non-overwritable destination within the cloud offering but external to all NOAA workspaces.

○ Automated Threat Identification and Response: Include automated breach identification and notification capabilities, self-service tools to access threat detection data and analytics, and provide notifications and findings of threats to system owners.

○ Secure Data Transfer Capability: Provide a secure data transfer capability using a cross-domain solution consistent with the 2018 Raise the Bar Cross Domain Solution Design and Implementation Requirements. Ensure highly deterministic one-way data transfer capability between the CSP’s logical enclaves, environments within its own cloud offerings, and external destinations, including multi-environment peering gateways and across all FISMA security levels.

○ Encryption: Support logical separation with cryptographic certainty of processing between tenants, and provide the ability to encrypt data at rest and in transit.

● Compliance Certifications: Adherence to major federal compliance standards, including FedRAMP (Federal Risk and Authorization Management Program), FISMA (Federal Information Security Management Act), NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems and Organizations), and NIST SP 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations).

RESPONSE DEADLINE AND REQUESTED INFORMATION

Vendors are encouraged to submit their response that addresses the capabilities identified above. Responses to this notice should be submitted in the form of Microsoft Word and/or PDF (searchable format) documents attached to emails received no later than 10:00 a.m. EST, October 30, 2024. Responses shall be submitted to:

● Contracting Officer, Eric Olmstead, at Eric.Olmstead@noaa.gov

● Contract Specialist, Meredith Eaton, at Meredith.Eaton@noaa.gov

The statement of capability shall also include the information listed below:

1. Company Name/Division, mailing address, e-mail address, telephone, FAX numbers, and website address (if available).

2. Single point-of-contact name, title, telephone, and email address.

3. Unique Entity Identifier (UEI). Please note that offerors must be registered in the System for Award

Management (SAM) at SAM.gov at the time an offer or quotation is submitted in order to comply with the annual representations and certifications requirements.

4. Indicate if your firm qualifies as a small business under NAICS Code 541512 Computer Systems Design Services, if qualified as one or more of the following:

a. 8(a) firm (must be certified by SBA)

b. Small Disadvantaged Business

c. Woman-Owned Small Business (must be certified by SBA)

d. HUBZone firm (must be certified by SBA)

e. Service-Disabled Veteran-Owned Small Business

5. Vendors may provide any other information determined to be important and relevant to the purposes of this Sources Sought.

INDUSTRY DISCUSSIONS

Some respondents may be asked to provide additional information regarding the matters addressed in this notice. Those respondents will be contacted directly if there is a need for further information.

QUESTIONS

Respondents may submit questions regarding this notice to the contact(s) listed below. Responses to questions may be posted on SAM.gov. Please send any questions you may have to Contracting Officer, Eric Olmstead, at Eric.Olmstead@noaa.gov. and Contract Specialist, Meredith Eaton, at Meredith.Eaton@noaa.gov http://www.sam.gov http://www.sam.gov mailto:Meredith.Eaton@noaa.gov