ST-1330-15-RP-0071_A0002.pdf

NSN 7540-01-152-8070 STANDARD FORM 30. (Rev. 10-83) Previous Edition unusable Prescribed by GSA FAR (48 CFR) 53.243

Page of Pages AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. Contract ID Code

2. AMENDMENT MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (if applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than item 6) CODE

(x) 9A. AMENDMENT OF SOLICITATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

8. NAME AND ADDRESS OF CONTRACTOR (NO., Street, Country, State and ZIP Code)

CODE FACILITY CODE

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning ______ copies of amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OR OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

Check One

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible)

Except as provided herein, all terms and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR 16B. UNITED STATES OF AMERICA

(Signature of person authorized to sign)

15C. DATE SIGNED

(Signature of Contracting Officer)

16C. DATE SIGNED

Table of Contents

PAGE 2 OF 81 ST-1330-15-RP-0071/A0002

SECTION

PAGE 3 OF 81 ST-1330-15-RP-0071/A0002

SECTION

. 1

PART I – The Schedule

Section A – Solicitation/Contract Form

This is a solicitation for commercial items prepared in accordance with the format in FAR Subpart 12 in conjunction with FAR Subpart 15. This Solicitation is a Request for Proposal (RFP) for Commercial Items and constitutes the only solicitation that will be issued. This is a Brand Name or Equal requirement for Amazon Web Services. This acquisition shall not be construed as limiting competition considering it permits prospective contractors to offer products other than those specifically reference by brand-name.

The associated North American Industrial Classification System (NAICS) Code is 518210 – Data Processing, Hosting and Related Services.

NOTE: Parts I and II will be included in the award.

Section B – Schedule of Prices

1. Brief Description of Services

The purpose is to create an agency-wide single award Indefinite Delivery/Indefinite Quantity (IDIQ) for Amazon Web Services or equal services, which will supply the National Oceanic and Atmospheric Administration (NOAA) with an open and reliable technical solution that can be provisioned and managed in an open and flexible manner to deliver Infrastrusture as a Service (IaaS) and Platform as a Service (PaaS) capabilities

2. Order Type

The Government may use a variety of contract types when issuing task orders under this contract, including: Fixed‐ Price (FP), Labor Hour (LH) or a combination thereof. Each Request for Task Order Proposal (RFTOP) issued under this contract will identify the Government’s determination of contract type.

3. Extent of Obligation

Task Order 1 shall obligate the minimum of $3,000; All funding will be obligated on task orders.

The minimum and ceiling amounts under this contract shall be $3,000 and $9,999,000.00, respectively.

4. Pricing Terms

PAGE 4 OF 81 ST-1330-15-RP-0071/A0002

The agreed upon negotiated fixed ceiling rates reflected in the pricing schedule below shall be fixed for the duration of the IDIQ unless reduced pricing is offered through technology refresh.

5. Pricing Schedule

Period of Performance: The award shall consist of a 36 month ordering period on the base award with the ability to include option periods on the Task Orders. The 36 month ordering period will begin on the day of contract award.

CLIN 0001: Service Area 01 – Virtual Machines (VM) CLIN 0001: Service Area 02 – Storage Services CLIN 0001: Service Area 03 – Networking Services CLIN 0001: Service Area 04 – Database Services CLIN 0001: Service Area 05 – Management Capabilities and Tools CLIN 0002: Service Area 06 – Professional Services CLIN 0003: Service Area 07 – Business Support Services CLIN 0004: Travel – See 8.3, Travel will be an established Not to Exceed amount, no pricing is required.

***All Pricing Schedules are separate attachements. Please see all attachments to ensure responsive and complete proposals are submitted.***

Section C – Performance Work Statement (PWS)

1.0 Introduction

The National Oceanic and Atmospheric Administration (NOAA), a bureau of the United States Department of Commerce (DOC), has reach that extends from the surface of the sun to the depth of the ocean floor, as it works to keep citizens informed of the changing environment around them. NOAA is composed of various Line, Staff, and Program Offices that serve as vital contributors to NOAA’s overall mission. From daily weather forecasts, severe storm warnings, and climate monitoring, to fisheries management, coastal restoration, and marine commerce support, NOAA products and services support economic vitality and impact more than one-third of America’s gross domestic product. NOAA’s dedicated scientists use cutting-edge research and high-tech instrumentation to provide citizens, planners, emergency managers, and other decision makers with reliable information they need - when they need it.

NOAA’s Information Technology (IT) organizations oversee activities in IT security, information systems operations, and information systems development and modernization.

Specialized technical products and services are required to support security assessment and authorization (A&A) and continuous monitoring of national, critical information systems, earned

PAGE 5 OF 81 ST-1330-15-RP-0071/A0002

value and portfolio analysis of complex programs, and engineering support for data networks and telecommunications that span across the enterprise.

Given the rapidly changing IT infrastructure and operations supported by NOAA, with the addition of program management and potential consolidation activities, it is critical that senior management within this organization has access to the latest information on enterprise IT support and services. NOAA promotes and shapes an effective strategic and operational IT planning process, coordinates the preparation of IT budget and associated materials, oversees selected operational IT systems and services, and is responsible for other assigned programs.

The NOAA Chief Information Officer (CIO) has extensive planning, reporting, and oversight responsibilities for IT investments, IT security, Information Quality, and Privacy. The NOAA CIO is also responsible for aligning the agency’s IT portfolio with Federal laws and mandates, including the “25-point Implementation Plan to Reform Federal IT”, the Federal Data Center Consolidation Initiative (FDCCI), and the Cloud-First Policy outlined by the Federal CIO and the Office of Management and Budget (OMB).

2.0 Background

In support of the Federal CIO’s “25-point Implementation Plan to Reform Federal IT,” Federal Data Center Consolidation Initiative (FDCCI), the Cloud-First Policy and Office Management and Budget’s (OMB) Federal Risk and Authorization Management Program (FedRAMP), NOAA is currently seeking to procure Infrastructure as a Service (IaaS) capabilities, limited aspects of Platform as a Service (PaaS) and optionally associated professional services. For the purpose of this PWS,

1. IaaS capabilities include networking, storage, servers, virtualization, and operating systems (O/S),

2. PaaS capabilities include only Database Management System (DBMS) services.

These capabilities will enable NOAA to adhere to federal mandates, advance Data Center Optimization objectives, achieve increased efficiencies through the provisioning of Virtual Machines (VM) from a Cloud Service Provider (CSP) and ensure a standard approach to security assessments, authorization and continuous monitoring of the cloud solution.

3.0 Objectives

This acquisition will create an Indefinite Delivery/Indefinite Quantity (IDIQ) award which will supply NOAA with an open and flexible, secure technical solution - to deliver IaaS and PaaS services (as stated in Section 5.0) and capabilities on a public cloud infrastructure and optionally

PAGE 6 OF 81 ST-1330-15-RP-0071/A0002

a limited management solution, via cloud professional services – to assist NOAA in the successful migration to the cloud.

NOAA’s Public Cloud Acquisition objectives are as follows:

1. To enable scaling of infrastructure and application resources to meet evolving application and user demand while providing the required service levels and performance for customers;

2. To accommodate unanticipated spikes and surges in usage, including load balancing if needed;

3. To enable NOAA staff and line offices to migrate systems and applications (with FISMA Low to Moderate data and/or information in compliance with FedRAMP) from NOAA premises (or other contractor hosted facilities) to public cloud platform;

4. To enable users to extract data on demand at an agreed-upon fixed rate;

5. To leverage CSP Service Level Agreements (SLA) to ensure adequate service performance and availability;

6. To enable customers to select desired capabilities at competitive, pre-negotiated market prices, using a subscription-based or similar pricing/contracting model;

7. To provide storage, network and compute elasticity with pre-established ceilings or other financial management controls;

8. To provide NOAA customers with an alternative to technical refresh of physical servers;

9. To provide capability to perform quick proof of concepts; and

10. To provide rapid response multi-processor multi-machine simulation environment.

4.0 Scope

The purpose of this PWS is to create a single award Indefinite Delivery/Indefinite Quantity (IDIQ) for Amazon Web Services or equal services, which will supply NOAA with an open and reliable technical solution that can be provisioned and managed in an open and flexible manner to deliver IaaS and PaaS capabilities, as stated in Section 2.0, on a public cloud infrastructure.

NOAA intends to make this IDIQ award to a single CSP value added reseller of Amazon Web Services or equal services with a Joint Accreditation Board (JAB) FedRAMP Provisional Authorization To Operate (ATO) or a FedRAMP Agency ATO in order to support applications and systems with Federal Information Security Management Act (FISMA) Low to Moderate data and/or information.

This is a Brand Name or Equal procurement in accordance with FAR Part 52.211-6 Brand Name or Equal. Offerors proposing to furnish “equal” products shall provide the following description for the product: Manufacturers Name; Address: Product Name and Catalogue description.

PAGE 7 OF 81 ST-1330-15-RP-0071/A0002

Offerors shall be responsible for submitting, as a part of its offer, demonstrating how their product offering meets or exceeds the requirements of the solicitation in specific detail and all additional information on the offered products necessary for the Government to determine whether the products meet the salient specifications of the pricing schedule as listed in the RFP.

NOAALink Public Cloud Acquisition will focus on secure, scalable, commercially- available, public facing cloud-based services and will include the following seven (7) cloud service areas

1. Virtual Machine (or Compute) Services

2. Storage Services

3. Network Bandwidth (or Data Transfer) Services

4. Database Management Systems Services

5. Management Capabilities and Tools

6. Professional Services

7. Business Support Services

NOAALink is seeking services with fixed rate pricing options offering volume discounts.

NOAA's goal is to acquire a solution where NOAA can provision and manage dynamic and scalable environment to be supplied on a per demand basis for use by our staff and line offices.

As stated above, NOAA also seeks to acquire a limited set of Professional Services related to assessment, preparation, migration, and management of its cloud applications.

In the context of this PWS, the “services” shall refer to IaaS and PaaS services, associated product pricing and cloud professional services. Associated services shall be provided by authorized individuals contain the appropriate certifications, etc. The word “capability” shall refer to a public cloud feature or capacity that can be used by the Government.

4.1 Cloud Service Areas

NOAA is seeking cloud-based services in the following seven (7) service areas.

4.1.1 Virtual Machine (or Compute) Services

UService Area 01

The virtual machine services include server resources for running cloud-based systems that can be dynamically provisioned and configured as needed. These virtual machines will serve as an alternative to technical refresh of physical servers and provide rapid scalability or elasticity as needed.

PAGE 8 OF 81 ST-1330-15-RP-0071/A0002

4.1.2 Storage Services

UService Area 02

The storage service shall provide reliable, responsive, and price effective cloud based storage service that can be used to provide persistent storage, backup services, long term storage, continuity of operations (COOP), and disaster recovery services.

4.1.3 Network Bandwidth (or Data Transfer)

UService Area 03

Network Bandwidth or Data Transfer shall include services to allow NOAA to transfer its data (where authorized by NOAA) as follows:

1. From NOAA premises to the public cloud locations;

2. From public cloud locations to NOAA premises;

3. Across any two locations within public cloud;

4. From public cloud locations to general public end-points; and

5. From public cloud locations to other cloud (public, private, or hybrid clouds) locations.

4.1.4 Database Management Systems (DBMS)

UService Area 04

Database Management System shall include services to allow NOAA to procure licensing – for access to managed database services on the following databases in the cloud:

Required DBMS versions: Oracle and SQL Server Optional DBMS versions: MYSQL and PostgresSQL

“Managed database Services” shall mean that CSP handles database management tasks including DBMS provisioning (to include pre-packaged optimization for commonly used scenarios such as Decision Support, Online Transaction Processing, Data Warehousing etc.), providing alternatives for DBMS security provisioning, operations, scaling, backups, patch management and replication. NOAA will assume responsibility for database/application development, database production rollouts, application database accounts etc. NOAA shall retain system administration access to all DBMS deployments and shall own all data residing within these deployments.

PAGE 9 OF 81 ST-1330-15-RP-0071/A0002

4.1.5 Management Capabilities and Tools

UService Area 05

Cloud management capabilities and tools shall include software, technologies and associated capabilities that enable NOAA authorized users to configure, operate, manage, and monitor resources within the cloud service areas described within this PWS. These capabilities and tools will be used by NOAA to ensure that the resources are applied properly and perform optimally.

These capabilities and tools will enable NOAA staff and line offices to migrate systems and applications (with FISMA Low to Moderate data and/or information) from NOAA premises (or other contractor hosted facilities) to public cloud platforms, and allow NOAA control over the authorized users list. They should also permit for the managing of security credentials and the ability to set up identity access management (IAM) users. Additionally, capabilities and tools will permit NOAA to make decisions about deployment, network, and policy management for the configuration and management of systems/applications on each VM.

Capabilities will permit scaling of infrastructure and application resources to meet evolving application and user demands. These shall include the ability to specify allocation of storage to VMs, to application systems, etc., as well as the ability to upgrade or purchase expanded capabilities via an administrative console. For example, the capabilities should include the ability to upgrade or purchase expanded memory caching and load balancing.

The ability to monitor resources from the perspective of both status and performance must also be provided. The Contractor shall enable the NOAA authorized staff to conduct performance monitoring (including but not limited to response times, latency, uptime, memory and disk utilization), to perform security and compliance auditing, continuous monitoring and to initiate and oversee disaster recovery and contingency plans. Additionally, the contractor shall provide NOAA the ability to monitor spending.

The tool shall also allow for multiple users to access a web-based interface and only view the information pertaining to their application(s) and for the ability to apply and manage resource tags individually and in bulk.

4.1.6 Cloud Professional Services

UService Area 06

NOAA is seeking limited Cloud professional services in the following areas:

PAGE 10 OF 81 ST-1330-15-RP-0071/A0002

1. Application suitability assessment services – partner with NOAA to provide expertise in developing (including the creation of templates/documentation and a roadmap) and conducting assessments to assist NOAA with identifying which applications are appropriate candidates for cloud migration.

2. Application preparatory services – partner with NOAA to effectively prepare the identified applications for cloud migration. This shall include, but not be limited to the development of checklist and process documentation that can facilitate NOAA in preparing for migration.

3. Application migration services – partner with NOAA to successfully migrate applications to and from the cloud. This shall include, but not be limited to the use of best practices to test and subsequently migrate applications to take advantage of the cloud.

4. Application management services – partner with NOAA to administer, maintain, and support applications in the cloud.

ULabor Category Descriptions

Cloud Integration Services Project Manager or Equivalent Leads team on large projects or significant segment of large complex projects. Analyzes new and complex project related problems and creates innovative solutions involving finance, scheduling, technology, methodology, tools, and solution components. Provides applications systems analysis and programming activities for a Government site, facility or multiple locations.

Prepares long and short-range plans for application selection, systems development, systems maintenance, and production activities and for necessary support resources. Oversees all aspects of projects.

Cloud Integration Services Subject Matter Expert I or Equivalent Serves as subject matter expert, possessing knowledge of a particular area, such as business, computer science, engineering, mathematics, or the various sciences. Participates as needed in all phases of software development with emphasis on the planning, analysis, testing, integration, documentation, and presentation phases. Applies principles, methods and knowledge of the functional area of capability to specific task order requirements, advanced mathematical principles and methods to difficult and narrowly defined technical problems in engineering and other scientific applications to arrive at automated solutions. Familiar with the standard concepts, practices, and procedures within cloud computing and applies these to task order requirements.

Cloud Integration Services Subject Matter Expert II or Equivalent Serves as subject matter expert, possessing in-depth knowledge of a particular area, such as business, computer science, engineering, mathematics, or the various sciences. Provides technical knowledge and analysis of highly specialized applications and operational

PAGE 11 OF 81 ST-1330-15-RP-0071/A0002

environments, high-level functional systems analysis, design, integration, documentation and implementation advice on exceptionally complex problems that need extensive knowledge of the subject matter for effective implementation. Participates as needed in all phases of software development with emphasis on the planning, analysis, testing, integration, documentation, and presentation phases. Applies principles, methods and knowledge of the functional area of capability to specific task order requirements, advanced mathematical principles and methods to exceptionally difficult and narrowly defined technical problems in engineering and other scientific applications to arrive at automated solutions.

Cloud Integration Services Subject Matter Expert III or Equivalent Serves as the senior subject matter expert, possessing in-depth knowledge of a particular area, such as business, computer science, engineering, mathematics, or the various sciences. Provides technical knowledge and analysis of highly specialized applications and operational environments, high-level functional systems analysis, design, integration, documentation and implementation advice on exceptionally complex problems that need extensive knowledge of the subject matter for effective implementation. Participates in the planning and analysis phases and as needed in all other phases of software development to include, but not be limited to the testing, integration, documentation, and presentation phases.

Cloud Integration Services Quality Assurance Analyst or Equivalent Provides development of project Software Quality Assurance Plan and the implementation of procedures that conforms to the requirements of the contract. Provides an independent assessment of how the project's software development process is being implemented relative to the defined process and recommends methods to optimize the organization's process. May be responsible for all activities involving quality assurance and compliance with applicable regulatory requirements. Conducts audits and reviews/analyzes data and documentation.

Develops and implements procedures and test plans for assuring quality in a system development environment which supports large databases and applications.

Cloud Integration Services System Architect or Equivalent Provides high-level architectural expertise to managers and technical staff. Develops architectural products and deliverables for the enterprise and operational business lines.

Develops strategy of system and the design infrastructure necessary to support that strategy.

Advises on selection of technological purchases with regards to processing, data storage, data access, and applications development. Sets standards for the client/server relational database structure for the organization (SQL, ORACLE, SYBASE, etc.). Advises of feasibility of potential future projects to management. If license or certification is required it will be identified at the Task Order level.

PAGE 12 OF 81 ST-1330-15-RP-0071/A0002

Cloud Integration Services System Programmer or Equivalent Designs, develops, enhances, debugs, and implements software. Troubleshoots production problems related to software applications. Researches, tests, build, and coordinate the conversion and/or integration of new products based on client requirements. Designs and develops new software products or major enhancements to existing software. Addresses problems of systems integration, compatibility, and multiple platforms. Consults with project teams and end users to identify application requirements. Performs feasibility analysis on potential future projects to management. Assists in the evaluation and recommendation of application software packages, application integration and testing tools. Resolves problems with software and responds to suggestions for improvements and enhancements. Acts as team leader on projects. Instructs, assigns, directs, and checks the work of other software developers on development team.

Participates in development of software user manuals.

Cloud Integration Services Hardware/Software Specialist or Equivalent Provides analysis related to the design, development, and implementation of hardware/software for products. Develops test strategies, devices, and systems. Performs stress and performance tests on a variety of computer hardware/software for a specified cloud computing systems, software systems, hardware systems, operating systems, and/or application software. If certification is required or extensive expertise across hardware and software supplied by multiple vendors, this will be identified at the Task Order level.

Cloud Integration Services Security Specialist or Equivalent Determines enterprise information assurance and security standards. Develops and implements information assurance/security standards and procedures. Coordinates, develops, and evaluates security programs for an organization. Recommends information assurance/security solutions to support customers’ requirements. Identifies, reports, and resolves security violations. Establishes and satisfies information assurance and security requirements based upon the analysis of user, policy, regulatory, and resource demands. Supports customers at the highest levels in the development and implementation of doctrine and policies. Applies know-how to government and commercial common user systems, as well as to dedicated special purpose systems requiring specialized security features and procedures. Performs analysis, design, and development of security features for system architectures. Analyzes and defines security requirements for computer systems which may include mainframes, workstations, and personal computers.

Designs, develops, engineers, and implements solutions that meet security requirements.

Provides integration and implementation of the computer system security solution. Analyzes general information assurance-related technical problems and provides basic engineering and technical support in solving these problems. Performs vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle. Ensures that all information systems are functional and secure.

PAGE 13 OF 81 ST-1330-15-RP-0071/A0002

Cloud Integration Services Test Manager or Equivalent Evaluates, recommends, and implements automated test tools and strategies. Designs, implements, and conducts test and evaluation procedures to ensure system requirements are met.

Cloud Integration Services Change Management Lead or Equivalent Provides strategic planning of large projects or a significant segment of a strategic planning portion of a large complex project. Provides the overall approach to clarify mission statements so they can be used as springboards in envisioning their desired future. Assists in developing mission and vision statements, subsequent goal delineation, provides guidance for building operational plans and specifying measurable outcomes to include capital outlay planning efforts in a consolidated strategic planning process and prioritizes those initiatives. Assist in preparation of key strategic planning documentation, including OMB Form 300.

4.1.7 Business Support Services

UService Area 07

NOAA is seeking one-on-one, fast-response access to both technical support and customer service professionals. The support shall be established in such a way that NOAA can select the level of service they chose to utilize for each task order. The services shall include, but not be limited to the following:

• Customer service 24x7x365

• Support forums

• Documentation, white papers, best practice guides

• Access to Trusted Advisor

• Access to Technical support

• Primary case handling

• Ability to create Technical Support cases

• Architecture support

• Best practice guidance

• API Support

• Third-party software support

• Infrastructure event management

• Concierge service

• Direct access to Technical Account Manager

• White-glove case routing

• Management business reviews

PAGE 14 OF 81 ST-1330-15-RP-0071/A0002

5.0 Specific Requirements

This section lists specific government requirements:

# Requirement Description

5.1 Virtual Machines (VM)

The Contractor shall provide public cloud based virtual machines with the following capabilities:

1. Virtual machine configurations in a variety of performance levels defined in terms of computing power, random-access memory (RAM), and storage;

2. Capability to copy, clone, and customize VMs and any associated pre-built images;

3. Capability to consume Central Processing Unit (CPU) cycles that exceed the allocated baseline limit for a short period of time (CPU bursting);

4. Capability to export provider images to standard formats including but not limited to Open Virtualization Format (OVF);

5. Capability to assign and configure Geographic VM affinity;

6. At a minimum virtual machines running the following server operating systems are required:

a. Windows Server (Microsoft)

b. Red Hat Enterprise Linux (RHEL)

c. Open Source Linux

7. Capability to distribute VM workload by utilizing load or rule-based scaling (up or down); and

8. Allow role based access controls (RBAC) security assignment for each VM.

5.2 Storage Services

The Contractor shall provide public cloud based storage services, including persistent and archival storage, with the following capabilities:

1. Capability to create and restore storage drive snapshots;

2. Capability to perform bulk data imports and exports;

3. Capability to scale persistently stored data (at least 1000TB) on network attached drives, per task order;

4. Capability to scale stored data (at least 5000TB) on a long term basis with infrequent retrieval within an inexpensive media environment per task order;

5. Capability to assign and configure Geographic storage affinity; and

6. Allow role based access controls (RBAC) security assignment for each

PAGE 15 OF 81 ST-1330-15-RP-0071/A0002

assigned/configured storage drives, storage drive snapshots and bulk imports/exports.

5.3 Network Bandwidth In/Out (Data Transfer)

The Contractor shall provide the following public cloud based network bandwidth capabilities:

1. Capability to utilize private network interface of VMs;

2. Capability to utilize multiple Network Interface Cards (NIC) and Routing

Networks simultaneously;

3. Capability to utilize static IP addresses;

4. Grouping of VMs into customer-defined network segments;

5. Creation, modification, and deletion of firewall rules related to the instances under management;

6. IPv6 capability for Public and Private Interfaces; and

7. Allow role based access controls (RBAC) security assignment for each public/private interface configured.

5.4 Database Management Systems (DBMS) Services

The Contractor shall provide public cloud managed database services for the following DBMS versions:

Required DBMS versions: Oracle and SQL Server Optional DBMS versions: MYSQL and PostgresSQL

“Managed Database Services” shall mean that CSP handles database management tasks including DBMS provisioning (to include pre-packaged optimization for commonly used scenarios such as Decision Support, Online Transaction Processing, Data Warehousing etc.), providing alternatives for DBMS security provisioning, operations, scaling, backups, patch management and replication. NOAA will assume all responsibility for database/application development, database production rollouts, application database accounts etc. NOAA shall retain system administration access to all DBMS deployments and shall own data residing within these deployments.

5.5 Management Capabilities and Tools

The Contractor shall provide the following public cloud based management capabilities and tools:

1. Configurable browser based access so that NOAA users can only view information applicable to their supported application(s)/system(s)

2. Capability to provide secure, private network tunnels between NOAA network segments and cloud zones, and between multiple cloud zones;

PAGE 16 OF 81 ST-1330-15-RP-0071/A0002

3. Capability to securely control access to Cloud Service Areas utilizing Role-based Access Controls (RBAC);

4. Capability to monitor VM, Network, and Storage Services and manage associated alerts/reporting tied to:

a. Service Requests

b. Performance

c. Resource Usage/Utilization

d. Spending Metering/Controls

e. Incidents

5. Capability to remotely and in real-time manage cloud services (e.g. memory caching, server/cluster load balancing) through the web;

6. Browser-based access to self-provisioning (or self-service) capabilities that allow NOAA authorized staff to rapidly set up, launch, and scale up or down services (including de-provisioning, if necessary) without going through a Contractor intermediary

7. Capability for backups and archiving. NOAA will be responsible for backups, archiving and associated retention schedule

8. Capability to apply and manage resource tags individually and in bulk

5.6 Service Levels

The Contractor shall define service levels for the following, at minimum:

Cloud Service Areas:

Uptime and Availability Planned Downtime and Maintenance Recovery Time Objectives (RTO) Recovery Point Objectives (RPO)

5.7 Cloud Security

NOAA is seeking an integrated technical solution which meets the security requirements below. These requirements apply to each IaaS tier to be managed by the Contractor and to any Contractor-supplied or third-party supplied management interface that will be used to manage the service. The Contractor must meet the following security requirements:

1. Meet DOC and NOAA defined parameters for security control implementations.

2. Support Low and Moderate Impact IT Security Categorizations (per Federal

Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems" February 2004, and NIST Special Publication 800-60 Volume I & II, "Guide for Mapping Types of Information and Information Systems to Security Categories" August 2008)

PAGE 17 OF 81 ST-1330-15-RP-0071/A0002

3. Comply with DOC and NOAA Information Technology Security Policies;

4. Provide FIPS-201 compliant two factor authentication capability;

5. Provide Role-Based Access Control (RBAC) to services areas;

6. Possess a FedRAMP Agency Authorization to Operate (ATO) or Provisional

Authorization to Operate (PATO) at Moderate Impact Security Categorization for the integrated technical solution (covering all functionality layered on top and the IaaS solution including the prime, integrator, broker, and Infrastructure as a Service cloud service provider) throughout the length of this contract. The Contractor shall make the following reports available within five (5) business days of written request and annually:

• Authorization Letter from General Services Administration GSA (or other Federal agency) providing it's Authorization To Operate (ATO) through the FedRAMP program (FedRAMP Cloud Computing Security Requirements Baseline, (U http://www.gsa.gov/graphics/staffoffices/FedRAMP_Security_Controls _072912.zip U )

• Security Assessment Report (U http://search.gsa.gov/search?utf8= %E2%9C %93&affiliate=gsa.gov&query=Security+Assessment+Report&commit= Search U )

• Comprehensive inventory, description, risk assessment, and status of all existing Plan of Action and Milestones (POA&M)

• System Security Plan (U http://search.gsa.gov/search?utf8=%E2%9C %93&affiliate=gsa.gov&query=System+Security+Plan&commit=Search U

• Customer Responsibility Matrix identifying controls that the solution requires the Government to address

• FedRAMP Control Implementation Summary (CIS) report (U https://cloud.cio.gov/document/control-implementation-summary U )

• FedRAMP Security Assessment Plan (SAP) document (U https://search.cio.gov/search?utf8=%E2%9C %93&m=true&affiliate=ciomain&query=FedRAMP+Security+Assessme nt+Plan+&commit=Search U )

7. Provide Government with access to System Security Package (SSP) and results of security tests performed at least annually;

8. Provide real-time access to VM system audit logs and scan data of technical solution utilized by NOAA;

9. Capability for VMs to integrate with DOC and NOAA Cybersecurity operation

PAGE 18 OF 81 ST-1330-15-RP-0071/A0002

solutions, through secure private tunnels:

• Include NOAA Security Operations Center (SOC) integration

• Integrate into NOAA's implementation of ArcSight system providing real-time input data, which is physically located on the Silver Spring Metro Campus. TCP connection over SSL with sufficient bandwidth to send logs in a format ArcSight will accept.

• Integrate with NOAA Computer Incident Response Team (N-CIRT), for addressing suspected and actual incident handling, reporting and forensic data exchange to meet DOC, NOAA, and federal reporting requirements

• Integrate with NOAA’s implementation of Homeland Security Presidential Directive 12 (HSPD-12) implementation for a Common Identification Standard for Federal Employees and Contractors (http://www.dhs.gov/homeland-security-presidential-directive-12)

• Integrate with NOAA Enterprise Continuous Monitoring Operations (ECMO) integration for meeting OMB memoranda M-10-15 and M-10- 19, which requires all Federal agencies to continuously monitor security-related information from across the enterprise

10. Ensure that NOAA has the ability to select locations of its data and applications (including VMs) from among the locations made available by the CSP;

11. Provide an "Alternate Processing Site" in accordance with the NIST Security Control CP-7 (1), CP-7 (2), and CP-7 (3) or equivalent;

12. Provide role-based access controls and auditing of administrative actions;

13. Secure interface capabilities including but not limited to Secure Sockets Layer

(SSL), Transport Layer Security (TLS), Internet Protocol (IP) Security (IPSec), and Secure Shell (SSH) for encrypted communications between NOAA locations and cloud-based services as well as between cloud-based services and the end users of NOAA applications on the Internet;

14. Provide Government with full administrative control to the master account or its equivalent. A master account is defined as a highest (or root) level access mechanism to Government's information technology resources resident within the contractor's cloud infrastructure. Full administrative control must support granular Role-based Access Controls (for example: Government granting access to cloud resellers/partners with limited access to the CSP financial and billing).

5.8 Professional Services

The Contractor shall develop, document and provide the following professional cloud services:

1. Application suitability assessment services - identify which applications are candidates for cloud migration

PAGE 19 OF 81 ST-1330-15-RP-0071/A0002

2. Application preparatory services - prepare identified applications for cloud migration

3. Application migration services - migrate the applications to and from the cloud

4. Application management services - administer, maintain and support applications in the cloud

5. The professional services labor categories that we are interested in utilizing are as follows:

• Cloud Integration Services Project Manager

• Cloud Integration Services Subject Matter Expert I

• Cloud Integration Services Subject Matter Expert II

• Cloud Integration Services Subject Matter Expert III

• Cloud Integration Services Quality Assurance Analyst

• Cloud Integration Services System Architect

• Cloud Integration Services System Programmer

• Cloud Integration Services Hardware/Software Specialist

• Cloud Integration Services Security Specialist

• Cloud Integration Services Test Manager

• Cloud Integration Services Change Management Lead

5.9 Business Support Services

The Contractor shall provide the following business support services:

• Customer service 24x7x365

• Support forums

• Documentation, white papers, best practice guides

• Access to Trusted Advisor

• Access to Technical support

• Primary case handling

• Ability to create Technical Support cases

• Architecture support

• Best practice guidance

• API Support

• Third-party software support

• Infrastructure event management

• Concierge service

• Direct access to Technical Account Manager

• White-glove case routing

PAGE 20 OF 81 ST-1330-15-RP-0071/A0002

• Management business reviews

These support services shall be established in such a way so that NOAA can select the level of service they chose to utilize.

Additionally, the Contractor shall define service levels for the following, at minimum:

1. Customer Support Services:

a. Service Center/Help Desk Availability

b. Mean-Time-To-Respond

c. Mean-Time-To-Resolve (from initial response until satisfactory resolution or escalation)

6.0 Deliverables

The Contractor shall provide the following deliverables:

UDeliverable UFrequency UMedium/Format/ # of Copies

USubmit To

Kick Off Meeting Within 20 days of award

In-Person/1 Consult with TM, COR, and CO to schedule

Quality Management Program/

Original submitted within 1 month of award;

subsequently submitted only upon updates

E-Mail/MS Word

TM and COR

Monthly Activity Report By the 15th of every month

E-Mail/MS Word/1

24TU Noaalink.invoice@noaa.

govU24T

Monthly Invoice (including IDIQ and Task Order discount rates, as appropriate)

By the 15th of every month

E-Mail/PDF/1 24TU Noaalink.invoice@noaa.

govU24T

Notification of ceiling consumption level (based on TBD level/threshold)

Whenever the level/threshold is met

E-Mail CO, TM and COR

PAGE 21 OF 81 ST-1330-15-RP-0071/A0002

7.0 Assumptions and Constraints

Assumptions and Constraints will be identified on an individual Task Order (TO) basis under this IDIQ.

8.0 General Information

8.1 Period of Performance

The base award shall have a 36 month ordering period beginning on the date of contract award.

The subsequent Task Orders may contain option periods/years. The Task Order option periods/years may extend beyond the 36 month ordering period. However, a Task Order shall not contain more than a 12 month period of performance and four (4), 12 month option periods/years.

8.2 Place of Performance

The primary place of performance will be the Contractor site unless otherwise specified in each individual task order. Contractors shall be available and capable of physically coming to the NOAA-wide task order site, which can be within the Contiguous United States CONUS, Alaska, Hawaii or in any of the US territories.

Some tasks will require Contractor staff to perform all work on site. This will be specified at the task order level. Government work sites include NOAA-wide facilities listed by state or territory at http://www.legislative.noaa.gov/NIYS/.

8.3 Travel

Additionally, travel may be required on some task orders, but this too will be defined at the task order level. If applicable, travel must be deemed necessary and authorized by the TM in order to be paid for by the Government. Except for exceptional circumstances, travel will not be reimbursed at more than applicable rates cited in the Federal Travel Regulations, prescribed by the General Services Administration, for travel in the conterminous 48 United States or the Standardized Regulations (Government Civilians, Foreign Areas), Section 925, "Maximum Travel Per Diem Allowances for Foreign Areas," prescribed by the Department of State, for travel in areas not covered above. Information regarding the Federal Travel Regulation can be found at 24TU http://www.gsa.gov/portal/content/104790 U24T.

PAGE 22 OF 81 ST-1330-15-RP-0071/A0002

8.4 Security Requirements

The systems supported under this IDIQ can be Moderate or Low risk. The suitability or risk level for work and the determination as to whether or not specific personnel can work on the task will be determined at the task order level. As such, the contractor shall pre-screen their employees to eliminate anyone who does not meet the following criteria:

• Low Risk Task Orders – Comply with the requirements as prescribed in 48 CFR 1337.110-70(c)

• Moderate Task Orders – Comply with the requirements as prescribed in 48 CFR 1337.110-70(b)

8.5 Government-Furnished property, data and services

For IaaS/PaaS requirements only, there will be no government-furnished property (GFP) provided to the contractor. However, for Cloud professional services, there may be government-furnished property, data and services defined at the task order level.

8.6 Government Quality Assurance Requirements

The Contractor shall develop and maintain an effective quality management program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality management program is the means by which the Contractor assures that their work complies with the requirement of this PWS and individual task orders. After acceptance of the quality plan, the Contractor shall receive the contracting officer’s acceptance in writing of any proposed change to the quality management plan before implementing such changes.

8.6.1 Quality Assurance and Management Tools

Key quality assurance and management tools, methodologies and performance management mandates at NOAA include, but are not limited to the following:

• Value Measurement Methodology

• (LEAN) Six-Sigma

• Acquisition Information Reporting (AIR) Business Intelligence

• Government Performance and Results Act (GPRA)

• Innovative Tools, Methods, and Systems to Measure Effectiveness (President Management Agenda)

PAGE 23 OF 81 ST-1330-15-RP-0071/A0002

• Earned Value Management

8.7 Avoidance of Contractor Lock-in

NOAA owns all rights to any Government-owned intellectual property (IP), including but not limited to code and/or data, placed in the cloud environment. The Contractor shall ensure NOAA is able to retrieve all data in a timely manner. The Contractor shall provide a summary of their exit/transition strategy in response to this PWS.

1. Implement an exit/transition strategy which can be executed quickly to ensure continuity of service

2. Ensure all NOAA intellectual property (IP) is protected

3. Capability to transfer all NOAA data to the government in a predefined format

4. Maintain, back up, and secure the data until it is returned

5. Capability to transfer all code and/or data without additional charge to the government

6. Sanitize all NOAA data residing on all types of media, upon request from the

Government, in accordance with NIST Special Publications 800-88 'Guidelines for Media Sanitization.’

8.8 Volume Discounts

The Contractor shall consider discounts based on volume. The Contractor’s proposed volume discount model shall be included and clearly described in the price proposal. The Contractor shall state whether the discounts are applicable at the IDIQ level, task order level, or both. The Contractor shall help the Government track the volume discounts at the IDIQ level and at the task order level as described in Section 6.0, Deliverables.

8.9 Extent of Obligation

Task Order 1 shall obligate at least the minimum of $3,000; additional funding will be obligated on subsequent task orders. The minimum amount under this contract shall be $3,000.00 and the ceiling amount under this contract shall be $9,999,000.00.

A Not-to-Exceed, Fixed Price based off of pre-established rates will be specified for each task order under this IDIQ. Anything ordered from the resulting IDIQ will have fixed rates established. The contractor and the Government will be jointly responsible for monitoring and tracking the burn rate and the consumption of the ceiling amount of the IDIQ as well as the Not-to-Exceed amount at task order level. The contractor's invoices shall include burn rate as well as

PAGE 24 OF 81 ST-1330-15-RP-0071/A0002

remaining ceiling amount. The contractor shall alert the COR and Task Manager via an email when the ceiling consumption reaches or crosses thresholds indicated by the Government. The IDIQ thresholds will be specified by the COR after the award. The task order thresholds will be specified when the task order is awarded.

9.0 Technology Refresh

If at any time during the period of performance of this IDIQ, the Contractor schedules products and/or services for discontinuation, improvement and/or replacement, other general price reduction, the Contractor shall provide a proposal to include the new or revised products and/or services in the IDIQ. Proposed prices for new or revised products shall be calculated on a Most Favored Customer basis. At no time will the proposed prices be higher than that of the offerors most favored customer(s). Any volume discounts shall be at the same or greater discount as the original IDIQ products prices.