SOW.pdf

RFQ 75F40124Q00407

Request for Quote

FDA Cloud Interconnect Services and Support

Statement of Work

December 2023

Version 1.0

Statement of Work (SOW) FDA Cloud Interconnect Services and Support

Version Date: December 15, 2023

1. Background The Office of Information Management and Technology (OIMT) mission is to provide the infrastructure, technologies, expertise, and services that enhance, transform, and sustain the ability of the FDA to protect and promote the public health. One of the primary methods by which it addresses these responsibilities is through promoting and enabling innovative technology‐based solutions, such as cloud and high‐performance computing.

In support of the Federal Chief Information Officer’s (CIO) “25‐point Implementation Plan to Reform Federal IT”, Federal Data Center Consolidation Initiative (FDCCI) and the Office Management and Budget’s (OMB) Cloud Smart Strategy and Federal Risk and Authorization Management Program (FedRAMP), the FDA is expanding and modernizing its cloud computing infrastructure to align and meet the requirements of customer use cases across the Centers. The use cases include:

• Achieving a compliant Federal Information Security Modernization Act (FISMA) authorization for AWS GovCloud supporting data categorized as low, moderate, and high.

• Increasing network bandwidth that enables the migration of large applications and the transfer of large data sets from the FDA network to the cloud service providers (CSP) in near real‐time.

To achieve these requirements, OIMT is establishing this contract to acquire secure, high‐ speed direct connections from the FDA to the Cloud Service Providers (CSPs) via of an Interconnect Service Provider (ICSP). The FDA Office of Digital Transformation (ODT) currently uses Equinix Fabric to connect the FDA White Oak Datacenter (WODC) and Ashburn Datacenter (ADC) to multiple CSPs, including AWS (US East & Gov West), Azure for Government.

ODT leases rack space from Equinix in their DC1 & DC3 datacenters in Ashburn, VA, and has an ODT owned and operated Cisco router in each location. Equinix provides 10G Ethernet Private Line (EPL) circuits from DC1 to ADC, and DC3 to WODC, which ODT secures using MACSEC encryption. Both Internet2 and Equinix have MACSEC encrypted cross connects between the ODT DC1/DC3 racks, and the nearest AWS Direct Connect interconnection points in Equinix DC2/DC11.

ODT uses an AWS Public VIF, and multiple IPSEC VPN tunnels for encrypted connections to the CSPs via the 10G Equinix Fabric service at both DC1 & DC3.

In this contract, the ICSP vendor shall provide connections to AWS GovCloud US‐ East (Ohio), AWS GovCloud US‐West (Oregon), and AWS US East (Northern Virginia), Azure for Government.

2. Objectives The objective of this contract is to acquire secure, high‐speed direct connections from the

FDA WODC and ADC to AWS (US Commercial and GovCloud East & GovCloud West), Azure for Government, utilizing MACSEC encryption and high data transfer bandwidth at or above 10 Gigabit circuits. The acquisition will include the network circuits that connect FDA data centers to the Interconnect Service Provider data centers, interconnect Service, technical support, and professional services to install, configure, test, and deploy the Interconnect Service to production. The FDA data centers include Ashburn Data Center (ADC) and White Oak Data Center (WODC). This contract will enable FDA to:

• Fulfill security controls for the AWS GovCloud to operate under FISMA high categorization; FISMA high categorization requires high availability (HA), and HA is one of the benefits of the Interconnect Service.

• Increase network performance and reduce latency issues between the FDA network and CSPs; the Interconnect Service enables real‐time access to cloud resources and services.

• Provide increase network bandwidth needed to migrate large applications and to transfer large data sets from FDA on‐premises data centers to the cloud in high speed.

• Provide secure connections to the CSPs which comply with all Federal cloud computing regulations and security standards that are specified in Section 3.1; improve security by bypassing the public internet with a direct connection to the CSPs.

• Support the monitoring and inspection of cloud traffic between the FDA network and the CSPs.

• Increase communication reliability since faster data transfers with high‐speed connections are less vulnerable to system timeouts.

• Facilitate Disaster Recovery (DR) with high speed direct and simultaneous connections to multiple CSPs that are geographically distributed across the Continental United States (CONUS).

• Minimize resources required to acquire, implement, and manage individual connections from the FDA to each CSP.

• Extend the FDA network infrastructure footprint with greater reach and flexibility to manage network resources in the ICSP infrastructure facilities/data centers.

• Increase security and performance through direct connections that are more secure and reliable and have lower latency than public internet connections.

3. Requirements The vendor’s services and support shall meet the following requirements:

3.1 Interconnect Service Requirements

i. Vendor shall provide redundant interconnection options of 1G, 10G, 25G, 40G, and 100G between both the FDA WODC and ADC Datacenters to AWS (US East Commercial and GovCloud & GovCloud West), Azure for Government, vendor shall provide provisioning options or technical solutions for interconnections to additional CSPs TBD.

ii. Vendor interconnection solution must support MACSEC encryption or other encryption technologies that can support the full bandwidth of the underlying circuit.

iii. Vendor interconnection solution must provide for redundancy along diverse fiber paths (if applicable).

iv. Vendor solution shall support the existing Equinix Datacenter & Fabric solution until it can be fully migrated to the new MACSEC or alternate interconnection solution.

v. Addresses:

FDA White Oak Datacenter 10903 New Hampshire Ave

WO2-0053

Silver Spring, MD 20903

DA Ashburn Datacenter 44480 Hastings Dr Ashburn, VA 20147

Equinix DC1 21711 Filigree Court Ashburn, VA 20147

Equinix DC3 44470 Chilum Place Ashburn, VA 20147

vi. The ICSP shall provide and install network circuits from FDA data centers to the ICSP data centers that shall be Ethernet Private Line (EPL) connections.

The first circuit shall originate from the FDA Ashburn Data Center (ADC) and terminate at one of the main ICSP data centers that is near ADC. An acceptable alternative to Ethernet Private Line EPL for this circuit at ADC is Inter Data Center leased fiber paths (dark fiber) in Ashburn and would be preferable if more cost effective. Quoters are encouraged to price and offer both options. The second circuit shall originate from the FDA White Oak Data Center (WODC) and terminate at a different ICSP data center. For this circuit, Quoters are also encouraged to price and offer both EPL and dark fiber options.

vii. The ICSP infrastructure facilities/data centers (if applicable) shall comply with the following security standards: FISMA high, NIST 800/53, SOC 1 Type II, SOC 2 Type II, ISO 27001, HIPAA, and PCI DSS.

viii. The ICSP infrastructure shall support fault tolerant operations across cloud environments and FDA’s Data Centers (WODC and ADC). In case of system failure in one CSP/Data Center, the system shall support failover to the second CSP/Data Center.

ix. The ICSP shall support HA by allowing two or more (2) redundant 10 or more Gbps uplink connections from FDA Data Centers (ADC and WODC) to the ICSP’s infrastructure.

x. The ICSP shall support HA by allowing FDA network equipment (i.e., routers, switches) to be installed across different Data Centers in the event one of the data centers has an outage.

xi. The ICSP shall provide a high‐speed Network Layer 2 Ethernet connection between the FDA and their data center that is scalable to a minimum of 10 or more Gbps.

xii. The network bandwidth connections between the ICSP and CSP shall be a scalable up to a minimum of 10Gbps.

xiii. The ICSP shall allow FDA furnished network equipment (i.e., routers, switches) to be installed/hosted in their facilities for connectivity to the CSPs.

xiv. The ICSP infrastructure shall be compatible and able to integrate with FDA network equipment that will be hosted/installed in their facilities. The network equipment includes Cisco ASR 1000 series routers, Cisco Catalyst switches and/or the most up to date Cisco router models.

xv. The ICSP shall secure FDA network routers and switches in a secure cabinet, rack, or cage to provide an additional physical security layer to prevent unauthorized access.

xvi. ICSP data centers, infrastructure, technologies, circuits, and services shall have an average minimum uptime of 99.999%

xvii. The ICSP shall have multiple Data Center access locations distributed across CONUS with the FDA connecting to a data center that is close to ADC and WODC in Washington DC metropolitan area.

xviii. All ICSP data centers, connections, and operations utilized by the FDA shall be within CONUS.

xix. The ICSP vendor shall not impose a limit (data cap) on the amount of data transferred at a specified level of throughput over a given time period or throttle the data transfer rate.

xx. The ICSP shall allow multiple layers of encryption to meet Federal guidelines for secure data communications.

xxi. Ethernet Private Line (EPL) Circuits shall support:

1. QinQ Trunking (802.1ad)

2. Jumbo Frame Support

3.2 Support Requirements

1. The ICSP shall provide technical and logistical support 24 hours a day, 7 days a week, 365 days a year via phone, email, and internet with a 1‐hour response time.

2. The ICSP shall allow an unlimited number of incidents tickets to be submitted to resolve/troubleshoot issues and to provide technical support and guidance.

3. The ICSP shall not restrict the number of FDA staff named as authorized contacts to initiate support calls.

4. The ICSP shall not restrict the number of FDA staff named to have physical access to the government furnished equipment installed in secured enclosure.

5. The ICSP shall perform all technology upgrades, maintenance releases, patches, and bug fixes on their infrastructure facilities/data centers to comply with Federal and FDA technology and security standards as specified in Section 3.1.

6. The ICSP shall provide access to on‐line technical documentation and self‐help resources such as knowledge bases and analysis tools.

4. Tasks This section defines the tasks that the vendor shall complete during contract performance. The vendor shall provide consulting services to the FDA to ensure the ICSP solution is optimally designed and implemented to meet the requirements specified in this SOW. The ISCP solution needs to be quickly setup, configured, and integrated with the FDA infrastructure in a timely and expert manner with no disruptions to existing systems or security compromises. The ICSP vendor shall ensure their expert knowledge is successfully transferred to FDA IT personnel that will be providing design, implementation, and operational support. Furthermore, the ICSP vendor shall provide on‐site access to FDA engineers and consultants with expertise on network equipment (i.e., routers) to be installed in the ICSP vendor facility/data center.

The vendor shall provide IT professional personnel to support OIMT on the following tasks:

• 4.1 Planning, Requirements, and Design Task

• 4.2 Installation, Configuration, and Maintenance Task

• 4.3 Testing, Troubleshooting, and Validation Task

• 4.4 Providing Interconnect Services and Support Task

The personnel working on the tasks shall be Subject Matter Expert(s) (SME) with hands‐on experience in designing and implementing ICSP solutions for Federal agencies and private businesses including security specific requirements (e.g. FIPS, FISMA etc.). They should also have certification to implement and maintain the infrastructure and technologies of their Interconnect Service. The SMEs shall be proficient and qualified with the latest versions of hardware and software that will be deployed in the ICSP facility/data center. At the completion of the consulting services, the acquired software and hardware shall seamlessly integrate with the existing FDA system.

a. Planning, Requirements, and Design Task The ICSP vendor shall perform the following activities in support of the Planning, Requirements, and Design Task:

i. Review, analyze, and provide input and recommendations on the FDA requirements and overall cloud strategy of the interconnect solution.

ii. Review architecture design to ensure architecture/solution optimally meets the requirements and integrates with FDA provided equipment and network infrastructure.

iii. Ensure the design is scalable and expandable to meet future requirements to add new FDA approved CSPs.

iv. Review desired deployment end state, identify risks and deployment requirements, best practices for target CSPs, and create a custom next step plan.

v. Provide a checklist of items that need to be completed by FDA, and review and assist FDA staff to complete.

vi. Work with FDA network engineers to document and deliver the architect design/diagram that includes:

1.Hardware/software components (servers, routers, switches) including model number/version

2. Connections from the FDA to the ICSP including network bandwidth and protocols

3. Connections from the ISCP to the CSPs including network bandwidth and protocols

4. Firewalls, IP addresses, ports, and Role Based Access Controls (RBAC)

5. Redundant components for HA

6. Connection and integration with external systems

a. Installation, Configuration, and Maintenance Task The ICSP vendor shall provide technical assistance at the ICSP sites in support of the Installation, Configuration, and Maintenance Task:

i. Confirm completion of all prerequisites that need to be performed by the FDA.

The prerequisites include ensuring FDA provided equipment and relevant CSP subscriptions have been procured and available, providing an edge network topology, providing remote access for the ICSP engineers to validate settings on the router equipment, and finishing the ICSP checklist to ensure readiness.

ii. Provide and implement two (2) network circuits from FDA data centers to the ICSP data centers that shall be 10Gbps or more ethernet private line connections. The first circuit shall originate from the FDA Ashburn Data Center (ADC) and terminate at one of the main ICSP data centers that is near ADC. The second circuit shall originate from the FDA White Oak Data Center (WODC) and terminate at a different ICSP data center. The following are the addresses of ADC and WODC where the circuits shall originate:

1. FDA White Oak Data Center (WODC) 10903 New Hampshire Avenue, Silver Spring, MD 20903

2. FDA Ashburn Data Center (ADC) 44480 Hastings Drive, Ashburn, VA 20147

iii. Provide and implement connectivity from the demarcation points of the circuits to the ICSP network.

iv. Unpack FDA equipment from boxes that includes new and replacement equipment. Equipment includes but not limited to routers, interface cards, storage, and memory.

v. Install FDA equipment in secure cages at the ICSP facilities/data centers. This includes racking equipment and performing cabling/wiring activities.

vi. Assemble, install, and maintain cabling/circuits to connect FDA equipment to ICSP network and panels.

vii. Track and report inventory of FDA equipment that includes recording the equipment model and serial numbers.

viii. Perform configurations between the FDA provided edge equipment and a single CSP.

ix. Transfer technical knowledge to FDA engineers to successfully manage and perform configurations between the FDA provided edge equipment and remaining CSPs.

x. Provide access and technical assistance to FDA staff and consultants performing work at ICSP facilities/data centers.

xi. Provide support to run power cycles (reboot) on FDA provided equipment as necessary.

b. Testing, Troubleshooting, and Validation Task The ICSP vendor shall perform the following activities in support of the Testing, Troubleshooting, and Validation Task:

i. Test circuits to ensure connection meets network bandwidth performance and reliability specifications.

ii. Work with FDA network engineers to perform end‐to‐end connectivity testing to verify operability from the FDA data centers to the CSP.

iii. Conduct testing of peering metrics (i.e., RDP, Ping and Traceroute, and file transfers) to an accessible service such as AWS S3

iv. Conduct route table examination on FDA provided edge equipment and the CSP to verify expected routes.

v. Perform troubleshooting that includes problem identification and resolution during the pilot and production rollout.

vi. Provide content and recommendations for troubleshooting guides for FDA operational support technicians.

vii. Track and resolve issues encountered during the pilot and provide rollout support.

viii. Validate that all components and connections in the ICSP solution are operating in accordance with the requirements.

ix. Coordinate and provide support, guidance, and instructions in the pilot of the Interconnect Service.

x. Coordinate and provide support, guidance, and instructions in the Production deployment (Go Live) of the Interconnect Service

xi. Schedule and host a post‐deployment quality assurance call and perform knowledge transfer

c. Providing Interconnect Services and Support Task The Providing Interconnect Services and Support Task shall occur in Base Year after the Production deployment (Go Live) and during Option Years 1 through 4. The ICSP vendor shall provide the following in support of this task:

i. Provide and support secure high‐speed direct connections in production from the FDA to the CSPs (AWS GovCloud and AWS Commercial Cloud) via the interconnect service.

ii. Perform technology upgrades, maintenance releases, patches, and bug fixes on their infrastructure facilities/data centers to comply with Federal and FDA technology and security standards.

iii. Ensure ICSP data centers, infrastructure, technologies, circuits, and services have an average minimum uptime of 99.999%.

iv. Replace and remove FDA equipment and equipment parts that are not functioning, have reached end of life support, need to be upgraded, or under the discretion and direction of FDA.

v. Provide technical and logistical support as specified in Section 3.2.

7. Project Milestones/Completion Dates/ Kick-Off Meeting and Report The Contractor shall conduct a kickoff meeting at the FDA facilities in Rockville, MD or Silver Spring, MD, or virtually as directed by the COR. The kickoff meeting shall introduce the Contractor team, discuss roles, responsibilities, review the new requirement details, and other relevant artifacts and issues. With COR approval, the Contractor PM shall setup and schedule the Kickoff Meeting to occur within ten (10) business days after the contract award. The Contractor shall coordinate with the COR to determine date, time, location, and attendees for the kickoff meeting. The attendees of this meeting shall include all key personnel working on this contract, and the FDA COR, PM, and technical monitors. Minutes for the Kickoff meeting shall be submitted within three (3) business days after the meeting and uploaded to the FDA’s project repository (e.g., SharePoint), along with the kickoff meeting PowerPoint presentation.

The Contractor shall submit contract data in a format provided by the COR.

Weekly Status Reports

The Contractor shall submit weekly status reports in the Enterprise Status Tracking and Reporting System (eSTARS). The project names used for the project intake process shall be used as project names in eSTARS. The COR will provide the project intake details, such as project names and project intake numbers, if applicable. eSTARS is a web application that makes it easier for Contractors to submit their weekly status reports and for supervisors, leads, PMs, and CORs to review the report submissions in a centralized system. Each Contractor staff member must first be granted access before they can use eSTARS. eSTARS is only accessible from within the FDA internal network. The eSTARS URL will be provided by the COR upon contract award.

Weekly Status Reports are due each Tuesday by the close of business (COB) for the work performed the previous week. If Tuesday is a non-working day the report shall be due by COB, the following business day. The Contractor shall provide the information for each task that was performed during the weekly reporting period.

This information includes the following, but not limited to:

• Project Area/Name

• Planned Start and End Date

• Accomplishments

• Description/Comments

• Issues/Risks/Mitigation Plans

• Deliverables

• Role

• Action Items

Monthly Status Report The Contractor shall submit a Monthly Status Report (MSR) to the COR on the 10th of each month for the prior month’s work. If the 10th falls on a non-working day the MSR shall be due the next business day after the 10th. The Contractor shall obtain approval from the COR before using the MSR format. The MSR shall cover all work completed during the preceding month and shall describe the work to be accomplished during the subsequent month. This report shall also identify any issues/problems identified and a statement explaining how the issue/problem was resolved. The

Contractor shall not wait until the Weekly Status Meeting, MFR, or MSR to notify the COR of any identified or anticipated issues/problems. The MSR shall include the following information on tasks within this SOW:

• Work completed during each billing period.

• Changes or updates to the Project Management Plan to include changes to project schedules for each activity (if applicable).

• Problems or issues that may impact successful contract performance and risk mitigation strategies taken.

• List of change requests submitted during the billing period and issue resolution process.

• List of Data Calls for the month and actions taken.

• Action Items - which includes personnel to whom the Actions Items are assigned, date assigned, due date, and status (i.e., open, closed) by task.

• Planned Activities for the next (month) reporting period by task.

• Running total of sprints completed, along with the sprint #, month of the sprint, and the velocity for each sprint. For example, and for the purposes of this new requirement, the velocity should be constant as it represents the workload capacity of the Contractor.

• Organization chart that lists the new requirement team members, their roles, and their management, noting Key Personnel with an asterisk.

Monthly Financial Report The Contractor shall submit Monthly Financial Report (MFR) in eSTARS and inform the COR before the 5th of each month for the prior month’s work. If the 5th falls on a non-working day, the MFR shall be due to next business day after the 5th. The Contractor shall obtain approval from the COR before using the MFR format and enter data in eSTARS. The MFR shall include the following information on tasks within this SOW:

• For T&M and Labor Hour Service tasks - Resources (contractors’ names and their labor categories) assigned to each project/task, level of effort expended per resource on activities for the billing period, and amount billed per resource against the obligated amount.

• For Firm Fixed Price (FFP) tasks – Amount billed for the billing period.

Staffing The contractor shall provide experienced and qualified personnel to meet the needs of the FDA.

The Government reserves the right to review the technical qualifications and experience of any individual proposed by the Contractor prior to assignment to the contract. The Contractor shall notify the COR prior to changing allocation hours between tasks and labor categories compared to their proposal in a time and materials or labor hour service contract.

The Government requires the Contractor to identify key personnel for the total period of the project. The execution of project tasks will be subject to the precise assignment of specific individuals identified as key personnel. The Contractor shall ensure the continued assignment of personnel from project start to project finish. In the event an individual become incapacitated or leaves the company, it is the responsibility of the Contractor to have qualified and/or cleared (if required) individuals on staff to accomplish the task with a minimal learning curve. For temporary and/or permanent replacement personnel, the Contractor shall provide a resume for each individual prior to that individual’s reporting for work on this effort.

The Contractor shall not start charging a new staff member against the order unless the new contractor has been badged and has FDA network access and the necessary equipment to perform the work. The Contractor shall always use government-furnished equipment and/or the Virtual Private Network (VPN) account to access HHS/FDA systems and to conduct HHS/FDA business. The Contractor shall use only FDA email accounts to perform the work under this SOW and shall not send any documents or official communications to their personal email or their company email address.

The Contractor shall ensure that their personnel complete all required annual agency training (i.e. security awareness training, records management training, and other required trainings) by the due dates specified by the COR.

The vendor shall plan to meet the project milestones/completion dates specified in the following table. If the vendor cannot meet the milestone completion dates, the vendor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within one (1) business day.

Base Year

Sections Milestones Projected Completion Date

4.1, 4.2, 4.3 Kickoff Meeting Within 7 days of contract award

4.1 Requirements review meeting 1 day after Kickoff Meeting

4.1 Complete updated requirements 3 days after Kickoff Meeting

4.1 Architecture design and review working

session 4 days after Kickoff Meeting

4.1 Complete architecture design 7 days after Kickoff Meeting

4.2 Begin review of installation procedures 8 days after Kickoff Meeting

4.2 Complete review of installation procedures 9 days after Kickoff Meeting

4.2 Perform installation 10 days after Kickoff Meeting

4.2 Complete installation 70 days after Kickoff Meeting

4.3 Begin review of testing and validation

procedures 71 days after Kickoff Meeting

4.3 Perform testing and validation 73 days after Kickoff Meeting

4.3 Complete testing and validation 77 days after Kickoff Meeting

4.3 Perform pilot of the Interconnect Service 78 days after Kickoff Meeting

4.3 Interconnect Service Production Go Live 81 days after Kickoff Meeting

4.4 Provide Interconnect Services and Support End of Base Year

Option Years 1‐4

4.4 Provide Interconnect Services and Support End of Each Option Year

Table 1: Project Milestones/Completion Dates

8. Deliverables The ICSP vendor shall provide the deliverables in the format, delivery mechanism, and by the completion date specified in the following table:

Deliverable Task Description Format and Delivery Mechanism

Completion Date/Frequency

1 4.1 System Design and Architecture

Microsoft Visio (Architecture Diagram) and Microsoft Word (Description), Email to COR

7 days after Kickoff Meeting

2 4.2 Two (2) network circuits from FDA data centers to the ICSP data centers

60 days after Kickoff Meeting

3 4 Submit weekly status report into eSTARS

Weekly - Delivery to COR 52

4 4 Develop monthly status report

10th of each month – Delivery to

COR

5 4 O&M Optimization Cost Reduction Plan

Within 30 days of the award. Reviewed and updated quarterly.

4 Quarterly

6 4 Submit monthly financial report in eStars

5th of each month – Delivery to

COR

7 4 Transition-In Plan Within 10 days of the award 1

8 4 Transition-Out Plan Within 30 days before the POP ends

Table 2: Deliverables

• Reduce the overall Operations and Maintenance (O&M) expenditures by an average of 5% via improved efficiency and innovation each year during the life of the contract.

To meet the FDA’s goal of annual contract cost savings, the Contractor shall optimize, consolidate, and automate processes through adoption of improved cost control processes, adoption of a modular approach that consolidates duplication of functionalities across the contract tasks, adoption of emerging and innovative technologies to reduce costs and achieve efficiencies, and look for continual improvement opportunities whenever feasible to reduce O&M costs by 5% each year of performance.

O&M Optimization Cost Reduction Plan: The Contractor shall develop an annual O&M Optimization Cost Reduction Plan within 30 days of award. This plan shall be reviewed and approved by the COR annually and reviewed as part of contract performance management quarterly unless otherwise directed by the COR/COR Designee.

The plan at a minimum shall include:

• Task monitoring and cost savings measures

• Specific initiatives, activities, and milestones leading to the O&M cost savings of 5% per year

• Provide comparative data to verify annual actual cost reductions

• Quarterly tracking and reports of achievement of actual reduction in work that would lead to the reduction in labor hours

• Anticipated cost savings by task area and by suggested optimization

• Implementation timeline

Transition Out (Add as applicable to the SOW) (Optional)

The Contractor shall provide a Transition-Out Plan for COR review and approval no later than prior to the end of the period of performance as determined by the project schedule. The contractor shall provide support services to the orderly transition of functions from this contract to the FDA and/or successor contractor. The contractor shall be the lead on the transition activities during the transition period, leading Technical Exchange Meetings (TEMs) with the successor to impart complete and full knowledge transfer of OIMT projects, systems, applications, and databases, as well as sustainment activities that are in progress to include the technology used for all projects initiated under this contract. During this period, the contractor shall ensure no degradation in support to the Government. At the COR designated turnover date, the successor contractor shall assume full responsibility of the contract, while the outgoing contractor focuses on contract closeout activities and providing sustainment support to complete the transition.

While individual orders will detail specific requirements, representative tasks may include but are not limited to the following:

• Providing the FDA with current versions of all system and user documentation, to include the native format for diagrams (e.g., Visio), even those embedded in documents

• Providing FDA all licensing and renewal information, asset management records, software documentation, and training materials

• Providing FDA with a current inventory of all Government-owned assets used by the

Contractor along with full support in the reconciliation of this inventory

• Providing FDA with current versions of all CONOPS, operational procedures, standard operating procedures, guidelines, performance reports, specifications for hardware and software, and other pertinent information needed to continue the services being performed by the Contractor, i.e., any documentation developed under this contract Within 30 days of contract award, the COR will identify the repository will all documentation is to be stored;

however, it will be the contractor’s responsibility to update/maintain the repository for all orders

• Providing “shadowing” and other knowledge transfer plans, meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor

• Providing full source code sets (not COTS source code) with configuration management information; and,

• Providing up to date EPLC and program/project management documents

• Providing COR with a current inventory of all Government-owned assets used by the

Contractor along with full support in the reconciliation of this inventory

9. Inspection and Acceptance The Contracting Officer Representative (COR) shall perform inspection and acceptance of the Interconnect Services, support, and deliverables specified in Sections 3, 1, and 6.

Inspection and Acceptance will primarily be based on the performance, timely delivery, and meeting the requirements within the POP or established completion dates.

The acceptance criteria for the Interconnect Services and support are the requirements specified in Section 3 must be fulfilled. The acceptance criteria for the deliverables is they must be reviewed, approved, completed, and delivered to the COR in the format by the completion date specified in Table 2: Deliverables in Section 6. The Government will provide written notification of rejection within four (4) hours of receipt. The Government will reject non‐conforming services and deliverables. The Contractor shall correct any deficiencies within three (3) calendar days when the Government issues the rejection notices. If the Contractor cannot correct the deficiencies within this time frame, the Contractor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within one (1) business days.

10. Government-Furnished Property, Material, Equipment, or Information (GFP, GFM, GFE, or GFI)

This section identifies any Government‐furnished property provided to implement the Interconnect Service. This includes all Government‐furnished property, such as Government‐furnished material, equipment, or information.

The FDA will acquire outside of this contract any network equipment required to connect from the FDA network to the ICSP. This may include the following equipment:

• Routers/switches to be hosted the ICSP data centers

11. Security and Privacy Requirements A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

2) Access (Physical or Logical) to Government Information: A

Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

a. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

3) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non‐ repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

4) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800‐60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ X ] Moderate [ ] High Integrity: [ ] Low [ X ] Moderate [ ] High Availability: [ ] Low [ X ] Moderate [ ] High Overall Risk Level: [ ] Low [ X ] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[ X ] No PII [ ] Yes PII

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government‐wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re‐ using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need‐To‐Know basis;

c. protected in accordance with NIST SP 800‐53, Security and Privacy

Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800‐171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800‐88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer‐Related Storage Media.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M‐06‐16, Protection of Sensitive Agency Information by securing it with a FIPS 140‐2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

802.1 x Requirements Any system requiring wired or wireless connectivity to the FDA Enterprise network shall support the Institute of Electrical and Electronics Engineers (IEEE) 802.1X protocol and shall provide 802.1x authentication “supplicant” software. All systems shall support X.509 Public Key Infrastructure (PKI) and accept FDA issued device certificates as a method of authentication. If the system does not support the 802.1X protocol, a waiver will be required to document and justify the exemption with the Information System Security Officer (ISSO), and the FDA system owner shall provide a device MAC (Media Access Control) address identifying the end point network device and its associated role the device will perform when connected to the FDA network. (e.g. Printer, Scientific Instrument, Telephone)

The following Extensible Authentication Protocols (EAP) Methods are supported under 802.1x for wired access, EAP-TLS, EAP-PEAP, and EAP-TTLS. All Government Systems connected via wireless shall use EAP-TLS as defined by National Institute of Standards and Technology (NIST) Special Publication 800-53

- AC-18(1) - Wireless Access – (Authentication and Encryption).

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M‐05‐22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public‐facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal‐facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use FDA‐provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140‐2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non‐public FDA information should utilize FDA‐ provided or FDA information security authorized devices that meet HHS and FDA‐specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140‐2.

The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification

Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract.

Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

11) Contractor Non‐Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non‐public government information under this contract shall complete the FDA non‐disclosure agreement (3398 Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) –

The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M‐03‐22, Guidance for Implementing the Privacy Provisions of the E‐ Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role‐based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role‐based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role‐Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures

(SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable…