ST-1330-15-RP-0071.pdf

RFQ IFB RFP

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODEFACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

DATE . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

17a CONTRACTOR/

OFFEROR.

CODE

8 (A)

SIZE STANDARD:

NAICS:

% FOR:SET ASIDE:UNRESTRICTED OR

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

10. THIS ACQUISITION IS

EDWOSB

SMALL BUSINESS PROGRAM

STANDARD FORM 1449 (REV. 2/2012) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

SCHEDULE Continued

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

PAGE 3 OF 86 ST-1330-15-RP-0071

0001 Service Area 01 - Virtual Machines (VM) Service Area 02 - Storage Services Service Area 03 - Networking Services Service Area 04 - Database Services Service Area 05 - Management Capabilities and Tools

PR NUMBER: NAAJ1000-15-00266

DELIVERY DATE: 07/24/2015

SHIP TO:

NOAA/OCIO/NOAALINK PGM OFC

ATTN: NOAALINK PGM OFC

1315 E-W HWY RM 9634, SOU1000

SILVER SPRING MD 20910

FOB : Destination

1.00 EA

0002 Service Area 06 - Professional Services

PR NUMBER: NAAJ1000-15-00266

DELIVERY DATE: 07/24/2015

SHIP TO:

NOAA/OCIO/NOAALINK PGM OFC

ATTN: NOAALINK PGM OFC

1315 E-W HWY RM 9634, SOU1000

SILVER SPRING MD 20910

0003 Service Area 07 - Business Support Services

DELIVERY DATE: 07/24/2015

SHIP TO:

NOAA/OCIO/NOAALINK PGM OFC

ATTN: NOAALINK PGM OFC

1315 E-W HWY RM 9634, SOU1000

SILVER SPRING MD 20910

0004 Service Area 08 - Travel

DELIVERY DATE: 07/24/2015

SHIP TO:

NOAA/OCIO/NOAALINK PGM OFC

ATTN: NOAALINK PGM OFC

1315 E-W HWY RM 9634, SOU1000

SILVER SPRING MD 20910

Table of Contents

PAGE 4 OF 86 ST-1330-15-RP-0071

SECTION

PAGE 5 OF 86 ST-1330-15-RP-0071

SECTION

. 1

PART I – The Schedule

Section A – Solicitation/Contract Form

This is a solicitation for commercial items prepared in accordance with the format in FAR Subpart 12 in conjunction with FAR Subpart 15. This Solicitation is a Request for Proposal (RFP) for Commercial Items and constitutes the only solicitation that will be issued. This is a Brand Name or Equal requirement for Amazon Web Services. This acquisition shall not be construed as limiting competition considering it permits prospective contractors to offer products other than those specifically reference by brand-name.

The associated North American Industrial Classification System (NAICS) Code is 518210 – Data Processing, Hosting and Related Services.

NOTE: Parts I and II will be included in the award.

Section B – Schedule of Prices

1. Brief Description of Services

The purpose is to create an agency-wide single award Indefinite Delivery/Indefinite Quantity (IDIQ) for Amazon Web Services or equal services, which will supply the National Oceanic and Atmospheric Administration (NOAA) with an open and reliable technical solution that can be provisioned and managed in an open and flexible manner to deliver Infrastrusture as a Service (IaaS) and Platform as a Service (PaaS) capabilities

2. Order Type

The Government may use a variety of contract types when issuing task orders under this contract, including: Fixed‐ Price (FP), Labor Hour (LH) or a combination thereof. Each Request for Task Order Proposal (RFTOP) issued under this contract will identify the Government’s determination of contract type.

3. Extent of Obligation

Task Order 1 shall obligate the minimum of $3,000; All funding will be obligated on task orders.

The minimum and ceiling amounts under this contract shall be $3,000 and $9,999,000.00, respectively.

4. Pricing Terms

The agreed upon negotiated fixed ceiling rates reflected in the pricing schedule below shall be fixed for the duration of the IDIQ unless reduced pricing is offered through technology refresh.

5. Pricing Schedule

PAGE 6 OF 86 ST-1330-15-RP-0071

Period of Performance: The award shall consist of a 36 month ordering period on the base award with the ability to include option periods on the Task Orders. The 36 month ordering period will begin on the day of contract award.

CLIN 0001: Service Area 01 – Virtual Machines (VM)

Service Area 01 - Virtual Machines (VM) AWS EC2 On-Demand Instances US Region East; or Equivalent

Amazon T2 and M3 - General Purpose Price (per) Model vCPU Mem (GiB) Storage OS Hour t2.micro 1 1 EBS Only RHEL t2.small 1 2 EBS Only RHEL t2.medium 2 4 EBS Only RHEL m3.medium 1 3.75 1x4 (GB) SSD RHEL m3.large 2 7.5 1x32 (GB) SSD RHEL m3.xlarge 4 15 2x40 (GB) SSD RHEL m3.2xlarge 8 30 2x80 (GB) SSD RHEL t2.micro 1 1 EBS Only Windows t2.small 1 2 EBS Only Windows t2.medium 2 4 EBS Only Windows m3.medium 1 3.75 1x4 (GB) SSD Windows m3.large 2 7.5 1x32 (GB) SSD Windows m3.xlarge 4 15 2x40 (GB) SSD Windows m3.2xlarge 8 30 2x80 (GB) SSD Windows m3.medium 1 3.75 1x4 (GB) SSD Win w/SQL Standard m3.large 2 7.5 1x32 (GB) SSD Win w/SQL Standard m3.xlarge 4 15 2x40 (GB) SSD Win w/SQL Standard m3.2xlarge 8 30 2x80 (GB) SSD Win w/SQL Standard t2.micro 1 1 EBS Only Win w/SQL Web t2.small 1 2 EBS Only Win w/SQL Web t2.medium 2 4 EBS Only Win w/SQL Web m3.medium 1 3.75 1x4 (GB) SSD Win w/SQL Web m3.large 2 7.5 1x32 (GB) SSD Win w/SQL Web m3.xlarge 4 15 2x40 (GB) SSD Win w/SQL Web m3.2xlarge 8 30 2x80 (GB) SSD Win w/SQL Web Price (per) GB/month Data Transfer in from internet Data Transfer in from another AWS Region (from any AWS Service)

Data Transfer in from Amazon S3, Glacier in the same AWS region

PAGE 7 OF 86 ST-1330-15-RP-0071

Data Transfer out from Amazon EC2, RDS, ElastiCache instances, Elastic Load Balancing in another Availability Zone or peered VPC in:

- same AWS Region

- a different AWS Region

Data Transfer out from Amazon S3 and Glacier in the same AWS Region

Data Transfer out to Amazon EC2, RDS, ElastiCache instances, Elastic Load Balancing in the same Availability Zone using:

- Private IP address

- Public or Elastic IP address

Amazon EC2, RDS, ElastiCache instances, Elastic Load Balancing in another Availability Zone or peered VPC in the:

- same AWS Region

- a different AWS Region

Data Transfer out to Internet up to 1 GB/Month Data Transfer out to Internet up to 10 TB/Month Data Transfer out to Internet up to 40 TB/Month Data Transfer out to Internet up to 100 TB/Month Data Transfer out to Internet up to 350 TB/Month

Service Area 01 - Virtual Machines (VM)

CLIN 0001: Service Area 02 – Storage Services

Service Area 02 - Storage Services AWS Storage US Region East; or Equivalent Amazon EBS Unit Price per

Service 1M I/Os GB/Month Magnetic Volumes Storage General Purpose (SSD) Volumes Storage Data Transfer into Storage Data Transfer out to EC3 in the same region Data Transfer out to EC3 outside to any other region Data Transfer out to Internet up to 1 GB/Month Data Transfer out to Internet up to 10 TB/Month Data Transfer out to Internet up to 40 TB/Month Data Transfer out to Internet up to 100 TB/Month Data Transfer out to Internet up to 350 TB/Month

Amazon S3

Service GB/Month Storage 1st TB/Month Storage next 49 TB/Month

PAGE 8 OF 86 ST-1330-15-RP-0071

Storage next 500 TB/Month Storage next 4000 TB/Month Storage next 5000 TB/Month Data Transfer in Data Transfer out to EC3 in Northern Virginia Data Transfer out to EC3 outside of Northern Virginia Data Transfer out to Internet up to 1 GB/Month Data Transfer out to Internet up to 10 TB/Month Data Transfer out to Internet up to 40 TB/Month Data Transfer out to Internet up to 100 TB/Month Data Transfer out to Internet up to 350 TB/Month

Amazon Glacier

Service GB/Month Storage Data Transfer in Data Transfer out up to 1 GB/Month Data Transfer out up to 10 TB/Month Data Transfer out up to 40 TB/Month Data Transfer out up to 100 TB/Month Data Transfer out up to 350 TB/Month

CLIN 0001: Service Area 03 – Networking Services

Service Area 03 - Networking Services AWS Networking US Region East; or Equivalent Amazon Unit Price per

Service Hour Device Data Import/Export by Hour Data Import/Export by device

Service Hour GB/Month Elastic Load Balancing by hour Elastic Load Balancing data transfer Virtual Private Cloud (VPC)

CLIN 0001: Service Area 04 – Database Services

Service Area 04 - Database Services AWS Database Services US Region East; or Equivalent

Amazon RDBS Unit Price per Instance Type vCPU Mem (GiB) DB Hour db.t1.micro 1 1 Oracle

PAGE 9 OF 86 ST-1330-15-RP-0071

db.m3.medium 1 3.75 Oracle db.m3.large 2 7.5 Oracle db.m3.xlarge 4 15 Oracle db.m3.2xlarge 8 30 Oracle db.t2.micro 1 1 SQL Express db.t2.small 1 2 SQL Express db.t2.medium 2 4 SQL Express db.t2.small 1 2 SQL Web db.t2.medium 2 4 SQL Web db.m3.medium 1 3.75 SQL Web db.m3.large 2 7.5 SQL Web db.m3.xlarge 4 15 SQL Web db.m3.2xlarge 8 30 SQL Web db.r3.large 2 15 SQL Web db.r3.xlarge 4 30.5 SQL Web db.r3.2xlarge 8 61 SQL Web db.m3.medium 1 3.75 SQL Standard db.m3.large 2 7.5 SQL Standard db.m3.xlarge 4 15 SQL Standard db.m3.2xlarge 8 30 SQL Standard db.r3.large 2 15 SQL Standard db.r3.xlarge 4 30.5 SQL Standard db.r3.2xlarge 8 61 SQL Standard Service Area 4 - Database Services

CLIN 0001: Service Area 05 – Management Capabilities and Tools

Service Area 05 - Management Capabilities and Tools

Unit Price per (Month)

Service Multi access Web-Interface Console Tool/Capability to migrate systems, make configuration decisions, control user access, manage security credentials and set up IAM users

Tool/Capability to permit scaling, allocate storage, upgrade/purchase expanded capabilities Tool/Capability to monitor resources/spending and perform security/compliance auditing, continuous monitoring and initiate/oversee disaster recovery

Tool/capability for resource tag management Other REQUIRED Management Capabilities and Tools - #1 Other REQUIRED Management Capabilities and Tools - #2- #n Service Area 5 - Management Capabilities and Tools

PAGE 10 OF 86 ST-1330-15-RP-0071

CLIN 0002: Service Area 06 – Professional Services

Service Area 06 - Professional Services Professional Services

Unit Price per Service Hour

Cloud Integration Services Project Manager Cloud Integration Services Subject Matter Expert I Cloud Integration Services Subject Matter Expert II Cloud Integration Services Subject Matter Expert III Cloud Integration Services Quality Assurance Analyst Cloud Integration Services System Architect Cloud Integration Services System Programmer Cloud Integration Services Hardware/Software Specialist Cloud Integration Services Security Specialist Cloud Integration Services Test Manager Cloud Integration Services Change Management Lead Service Area 6 - Professional Services

CLIN 0003: Service Area 07 – Business Support Services

Service Area 07 - Business Support Services

Unit Price per (Month)

Service Basic Developer

Business

$______ amount for the first $0–$10K in monthly usage

$______ amount for from $10K–$80K in monthly usage

$______ amount for from $80K–$250K in monthly usage

$______ amount for over $250K in monthly usage

Enterprise $_______ amount for the first $0–$10K in monthly usage

PAGE 11 OF 86 ST-1330-15-RP-0071

$______ amount for from $10K–$80K in monthly usage

$______ amount for from $80K–$250K in monthly usage

$______ amount for over $250K in monthly usage

CLIN 0004: Travel

This CLIN does not require pricing Unit Price SEE 8.3 Travel Travel will be an established Not to

Exceed amount

Section C – Performance Work Statement (PWS)

1.0 Introduction

The National Oceanic and Atmospheric Administration (NOAA), a bureau of the United States Department of Commerce (DOC), has reach that extends from the surface of the sun to the depth of the ocean floor, as it works to keep citizens informed of the changing environment around them. NOAA is composed of various Line, Staff, and Program Offices that serve as vital contributors to NOAA’s overall mission. From daily weather forecasts, severe storm warnings, and climate monitoring, to fisheries management, coastal restoration, and marine commerce support, NOAA products and services support economic vitality and impact more than one-third of America’s gross domestic product. NOAA’s dedicated scientists use cutting-edge research and high-tech instrumentation to provide citizens, planners, emergency managers, and other decision makers with reliable information they need - when they need it.

NOAA’s Information Technology (IT) organizations oversee activities in IT security, information systems operations, and information systems development and modernization.

Specialized technical products and services are required to support security assessment and authorization (A&A) and continuous monitoring of national, critical information systems, earned value and portfolio analysis of complex programs, and engineering support for data networks and telecommunications that span across the enterprise.

Given the rapidly changing IT infrastructure and operations supported by NOAA, with the addition of program management and potential consolidation activities, it is critical that senior management within this organization has access to the latest information on enterprise IT support and services. NOAA promotes and shapes an effective strategic and operational IT planning

PAGE 12 OF 86 ST-1330-15-RP-0071

process, coordinates the preparation of IT budget and associated materials, oversees selected operational IT systems and services, and is responsible for other assigned programs.

The NOAA Chief Information Officer (CIO) has extensive planning, reporting, and oversight responsibilities for IT investments, IT security, Information Quality, and Privacy. The NOAA CIO is also responsible for aligning the agency’s IT portfolio with Federal laws and mandates, including the “25-point Implementation Plan to Reform Federal IT”, the Federal Data Center Consolidation Initiative (FDCCI), and the Cloud-First Policy outlined by the Federal CIO and the Office of Management and Budget (OMB).

2.0 Background

In support of the Federal CIO’s “25-point Implementation Plan to Reform Federal IT,” Federal Data Center Consolidation Initiative (FDCCI), the Cloud-First Policy and Office Management and Budget’s (OMB) Federal Risk and Authorization Management Program (FedRAMP), NOAA is currently seeking to procure Infrastructure as a Service (IaaS) capabilities, limited aspects of Platform as a Service (PaaS) and optionally associated professional services. For the purpose of this PWS,

1. IaaS capabilities include networking, storage, servers, virtualization, and operating systems (O/S),

2. PaaS capabilities include only Database Management System (DBMS) services.

These capabilities will enable NOAA to adhere to federal mandates, advance Data Center Optimization objectives, achieve increased efficiencies through the provisioning of Virtual Machines (VM) from a Cloud Service Provider (CSP) and ensure a standard approach to security assessments, authorization and continuous monitoring of the cloud solution.

3.0 Objectives

This acquisition will create an Indefinite Delivery/Indefinite Quantity (IDIQ) award which will supply NOAA with an open and flexible, secure technical solution - to deliver IaaS and PaaS services (as stated in Section 5.0) and capabilities on a public cloud infrastructure and optionally a limited management solution, via cloud professional services – to assist NOAA in the successful migration to the cloud.

NOAA’s Public Cloud Acquisition objectives are as follows:

1. To enable scaling of infrastructure and application resources to meet evolving application and user demand while providing the required service levels and performance for customers;

PAGE 13 OF 86 ST-1330-15-RP-0071

2. To accommodate unanticipated spikes and surges in usage, including load balancing if needed;

3. To enable NOAA staff and line offices to migrate systems and applications (with FISMA Low to Moderate data and/or information in compliance with FedRAMP) from NOAA premises (or other contractor hosted facilities) to public cloud platform;

4. To enable users to extract data on demand at an agreed-upon fixed rate;

5. To leverage CSP Service Level Agreements (SLA) to ensure adequate service performance and availability;

6. To enable customers to select desired capabilities at competitive, pre-negotiated market prices, using a subscription-based or similar pricing/contracting model;

7. To provide storage, network and compute elasticity with pre-established ceilings or other financial management controls;

8. To provide NOAA customers with an alternative to technical refresh of physical servers;

9. To provide capability to perform quick proof of concepts; and

10. To provide rapid response multi-processor multi-machine simulation environment.

4.0 Scope

The purpose of this PWS is to create a single award Indefinite Delivery/Indefinite Quantity (IDIQ) for Amazon Web Services or equal services, which will supply NOAA with an open and reliable technical solution that can be provisioned and managed in an open and flexible manner to deliver IaaS and PaaS capabilities, as stated in Section 2.0, on a public cloud infrastructure.

NOAA intends to make this IDIQ award to a single CSP value added reseller of Amazon Web Services or equal services with a Joint Accreditation Board (JAB) FedRAMP Provisional Authorization To Operate (ATO) or a FedRAMP Agency ATO in order to support applications and systems with Federal Information Security Management Act (FISMA) Low to Moderate data and/or information.

This is a Brand Name or Equal procurement in accordance with FAR Part 52.211-6 Brand Name or Equal. Offerors proposing to furnish “equal” products shall provide the following description for the product: Manufacturers Name; Address: Product Name and Catalogue description.

Offerors shall be responsible for submitting, as a part of its offer, demonstrating how their product offering meets or exceeds the requirements of the solicitation in specific detail and all additional information on the offered products necessary for the Government to determine whether the products meet the salient specifications of the pricing schedule as listed in the RFP.

NOAALink Public Cloud Acquisition will focus on secure, scalable, commercially- available, public facing cloud-based services and will include the following seven (7) cloud service areas

PAGE 14 OF 86 ST-1330-15-RP-0071

1. Virtual Machine (or Compute) Services

2. Storage Services

3. Network Bandwidth (or Data Transfer) Services

4. Database Management Systems Services

5. Management Capabilities and Tools

6. Professional Services

7. Business Support Services

NOAALink is seeking services with fixed rate pricing options offering volume discounts.

NOAA's goal is to acquire a solution where NOAA can provision and manage dynamic and scalable environment to be supplied on a per demand basis for use by our staff and line offices.

As stated above, NOAA also seeks to acquire a limited set of Professional Services related to assessment, preparation, migration, and management of its cloud applications.

In the context of this PWS, the “services” shall refer to IaaS and PaaS services, associated product pricing and cloud professional services. Associated services shall be provided by authorized individuals contain the appropriate certifications, etc. The word “capability” shall refer to a public cloud feature or capacity that can be used by the Government.

4.1 Cloud Service Areas

NOAA is seeking cloud-based services in the following seven (7) service areas.

4.1.1 Virtual Machine (or Compute) Services

Service Area 01

The virtual machine services include server resources for running cloud-based systems that can be dynamically provisioned and configured as needed. These virtual machines will serve as an alternative to technical refresh of physical servers and provide rapid scalability or elasticity as needed.

4.1.2 Storage Services

Service Area 02

The storage service shall provide reliable, responsive, and price effective cloud based storage service that can be used to provide persistent storage, backup services, long term storage, continuity of operations (COOP), and disaster recovery services.

PAGE 15 OF 86 ST-1330-15-RP-0071

4.1.3 Network Bandwidth (or Data Transfer)

Service Area 03

Network Bandwidth or Data Transfer shall include services to allow NOAA to transfer its data (where authorized by NOAA) as follows:

1. From NOAA premises to the public cloud locations;

2. From public cloud locations to NOAA premises;

3. Across any two locations within public cloud;

4. From public cloud locations to general public end-points; and

5. From public cloud locations to other cloud (public, private, or hybrid clouds) locations.

4.1.4 Database Management Systems (DBMS)

Service Area 04

Database Management System shall include services to allow NOAA to procure licensing – for access to managed database services on the following databases in the cloud:

Required DBMS versions: Oracle and SQL Server Optional DBMS versions: MYSQL and PostgresSQL

“Managed database Services” shall mean that CSP handles database management tasks including DBMS provisioning (to include pre-packaged optimization for commonly used scenarios such as Decision Support, Online Transaction Processing, Data Warehousing etc.), providing alternatives for DBMS security provisioning, operations, scaling, backups, patch management and replication. NOAA will assume responsibility for database/application development, database production rollouts, application database accounts etc. NOAA shall retain system administration access to all DBMS deployments and shall own all data residing within these deployments.

4.1.5 Management Capabilities and Tools

Service Area 05

Cloud management capabilities and tools shall include software, technologies and associated capabilities that enable NOAA authorized users to configure, operate, manage, and monitor resources within the cloud service areas described within this PWS. These capabilities and tools will be used by NOAA to ensure that the resources are applied properly and perform optimally.

These capabilities and tools will enable NOAA staff and line offices to migrate systems and applications (with FISMA Low to Moderate data and/or information) from NOAA premises (or other contractor hosted facilities) to public cloud platforms, and allow NOAA control over the

PAGE 16 OF 86 ST-1330-15-RP-0071

authorized users list. They should also permit for the managing of security credentials and the ability to set up identity access management (IAM) users. Additionally, capabilities and tools will permit NOAA to make decisions about deployment, network, and policy management for the configuration and management of systems/applications on each VM.

Capabilities will permit scaling of infrastructure and application resources to meet evolving application and user demands. These shall include the ability to specify allocation of storage to VMs, to application systems, etc., as well as the ability to upgrade or purchase expanded capabilities via an administrative console. For example, the capabilities should include the ability to upgrade or purchase expanded memory caching and load balancing.

The ability to monitor resources from the perspective of both status and performance must also be provided. The Contractor shall enable the NOAA authorized staff to conduct performance monitoring (including but not limited to response times, latency, uptime, memory and disk utilization), to perform security and compliance auditing, continuous monitoring and to initiate and oversee disaster recovery and contingency plans. Additionally, the contractor shall provide NOAA the ability to monitor spending.

The tool shall also allow for multiple users to access a web-based interface and only view the information pertaining to their application(s) and for the ability to apply and manage resource tags individually and in bulk.

4.1.6 Cloud Professional Services

Service Area 06

NOAA is seeking limited Cloud professional services in the following areas:

1. Application suitability assessment services – partner with NOAA to provide expertise in developing (including the creation of templates/documentation and a roadmap) and conducting assessments to assist NOAA with identifying which applications are appropriate candidates for cloud migration.

2. Application preparatory services – partner with NOAA to effectively prepare the identified applications for cloud migration. This shall include, but not be limited to the development of checklist and process documentation that can facilitate NOAA in preparing for migration.

3. Application migration services – partner with NOAA to successfully migrate applications to and from the cloud. This shall include, but not be limited to the use of best practices to test and subsequently migrate applications to take advantage of the cloud.

PAGE 17 OF 86 ST-1330-15-RP-0071

4. Application management services – partner with NOAA to administer, maintain, and support applications in the cloud.

Labor Category Descriptions

Cloud Integration Services Project Manager or Equivalent Leads team on large projects or significant segment of large complex projects. Analyzes new and complex project related problems and creates innovative solutions involving finance, scheduling, technology, methodology, tools, and solution components. Provides applications systems analysis and programming activities for a Government site, facility or multiple locations.

Prepares long and short-range plans for application selection, systems development, systems maintenance, and production activities and for necessary support resources. Oversees all aspects of projects.

Cloud Integration Services Subject Matter Expert I or Equivalent Serves as subject matter expert, possessing knowledge of a particular area, such as business, computer science, engineering, mathematics, or the various sciences. Participates as needed in all phases of software development with emphasis on the planning, analysis, testing, integration, documentation, and presentation phases. Applies principles, methods and knowledge of the functional area of capability to specific task order requirements, advanced mathematical principles and methods to difficult and narrowly defined technical problems in engineering and other scientific applications to arrive at automated solutions. Familiar with the standard concepts, practices, and procedures within cloud computing and applies these to task order requirements.

Cloud Integration Services Subject Matter Expert II or Equivalent Serves as subject matter expert, possessing in-depth knowledge of a particular area, such as business, computer science, engineering, mathematics, or the various sciences. Provides technical knowledge and analysis of highly specialized applications and operational environments, high-level functional systems analysis, design, integration, documentation and implementation advice on exceptionally complex problems that need extensive knowledge of the subject matter for effective implementation. Participates as needed in all phases of software development with emphasis on the planning, analysis, testing, integration, documentation, and presentation phases. Applies principles, methods and knowledge of the functional area of capability to specific task order requirements, advanced mathematical principles and methods to exceptionally difficult and narrowly defined technical problems in engineering and other scientific applications to arrive at automated solutions.

Cloud Integration Services Subject Matter Expert III or Equivalent

PAGE 18 OF 86 ST-1330-15-RP-0071

Serves as the senior subject matter expert, possessing in-depth knowledge of a particular area, such as business, computer science, engineering, mathematics, or the various sciences. Provides technical knowledge and analysis of highly specialized applications and operational environments, high-level functional systems analysis, design, integration, documentation and implementation advice on exceptionally complex problems that need extensive knowledge of the subject matter for effective implementation. Participates in the planning and analysis phases and as needed in all other phases of software development to include, but not be limited to the testing, integration, documentation, and presentation phases.

Cloud Integration Services Quality Assurance Analyst or Equivalent Provides development of project Software Quality Assurance Plan and the implementation of procedures that conforms to the requirements of the contract. Provides an independent assessment of how the project's software development process is being implemented relative to the defined process and recommends methods to optimize the organization's process. May be responsible for all activities involving quality assurance and compliance with applicable regulatory requirements. Conducts audits and reviews/analyzes data and documentation.

Develops and implements procedures and test plans for assuring quality in a system development environment which supports large databases and applications.

Cloud Integration Services System Architect or Equivalent Provides high-level architectural expertise to managers and technical staff. Develops architectural products and deliverables for the enterprise and operational business lines.

Develops strategy of system and the design infrastructure necessary to support that strategy.

Advises on selection of technological purchases with regards to processing, data storage, data access, and applications development. Sets standards for the client/server relational database structure for the organization (SQL, ORACLE, SYBASE, etc.). Advises of feasibility of potential future projects to management. If license or certification is required it will be identified at the Task Order level.

Cloud Integration Services System Programmer or Equivalent Designs, develops, enhances, debugs, and implements software. Troubleshoots production problems related to software applications. Researches, tests, build, and coordinate the conversion and/or integration of new products based on client requirements. Designs and develops new software products or major enhancements to existing software. Addresses problems of systems integration, compatibility, and multiple platforms. Consults with project teams and end users to identify application requirements. Performs feasibility analysis on potential future projects to management. Assists in the evaluation and recommendation of application software packages, application integration and testing tools. Resolves problems with software and responds to suggestions for improvements and enhancements. Acts as team leader on projects. Instructs, PAGE 19 OF 86 ST-1330-15-RP-0071 assigns, directs, and checks the work of other software developers on development team.

Participates in development of software user manuals.

Cloud Integration Services Hardware/Software Specialist or Equivalent Provides analysis related to the design, development, and implementation of hardware/software for products. Develops test strategies, devices, and systems. Performs stress and performance tests on a variety of computer hardware/software for a specified cloud computing systems, software systems, hardware systems, operating systems, and/or application software. If certification is required or extensive expertise across hardware and software supplied by multiple vendors, this will be identified at the Task Order level.

Cloud Integration Services Security Specialist or Equivalent Determines enterprise information assurance and security standards. Develops and implements information assurance/security standards and procedures. Coordinates, develops, and evaluates security programs for an organization. Recommends information assurance/security solutions to support customers’ requirements. Identifies, reports, and resolves security violations. Establishes and satisfies information assurance and security requirements based upon the analysis of user, policy, regulatory, and resource demands. Supports customers at the highest levels in the development and implementation of doctrine and policies. Applies know-how to government and commercial common user systems, as well as to dedicated special purpose systems requiring specialized security features and procedures. Performs analysis, design, and development of security features for system architectures. Analyzes and defines security requirements for computer systems which may include mainframes, workstations, and personal computers.

Designs, develops, engineers, and implements solutions that meet security requirements.

Provides integration and implementation of the computer system security solution. Analyzes general information assurance-related technical problems and provides basic engineering and technical support in solving these problems. Performs vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle. Ensures that all information systems are functional and secure.

Cloud Integration Services Test Manager or Equivalent Evaluates, recommends, and implements automated test tools and strategies. Designs, implements, and conducts test and evaluation procedures to ensure system requirements are met.

Cloud Integration Services Change Management Lead or Equivalent Provides strategic planning of large projects or a significant segment of a strategic planning portion of a large complex project. Provides the overall approach to clarify mission statements so they can be used as springboards in envisioning their desired future. Assists in developing mission and vision statements, subsequent goal delineation, provides guidance for building

PAGE 20 OF 86 ST-1330-15-RP-0071

operational plans and specifying measurable outcomes to include capital outlay planning efforts in a consolidated strategic planning process and prioritizes those initiatives. Assist in preparation of key strategic planning documentation, including OMB Form 300.

4.1.7 Business Support Services

Service Area 07

NOAA is seeking one-on-one, fast-response access to both technical support and customer service professionals. The support shall be established in such a way that NOAA can select the level of service they chose to utilize for each task order. The services shall include, but not be limited to the following:

• Customer service 24x7x365

• Support forums

• Documentation, white papers, best practice guides

• Access to Trusted Advisor

• Access to Technical support

• Primary case handling

• Ability to create Technical Support cases

• Architecture support

• Best practice guidance

• API Support

• Third-party software support

• Infrastructure event management

• Concierge service

• Direct access to Technical Account Manager

• White-glove case routing

• Management business reviews

5.0 Specific Requirements

This section lists specific government requirements:

# Requirement Description

5.1 Virtual Machines (VM)

The Contractor shall provide public cloud based virtual machines with the following capabilities:

1. Virtual machine configurations in a variety of performance levels defined in

PAGE 21 OF 86 ST-1330-15-RP-0071

terms of computing power, random-access memory (RAM), and storage;

2. Capability to copy, clone, and customize VMs and any associated pre-built images;

3. Capability to consume Central Processing Unit (CPU) cycles that exceed the allocated baseline limit for a short period of time (CPU bursting);

4. Capability to export provider images to standard formats including but not limited to Open Virtualization Format (OVF);

5. Capability to assign and configure Geographic VM affinity;

6. At a minimum virtual machines running the following server operating systems are required:

a. Windows Server (Microsoft)

b. Red Hat Enterprise Linux (RHEL)

c. Open Source Linux

7. Capability to distribute VM workload by utilizing load or rule-based scaling (up or down); and

8. Allow role based access controls (RBAC) security assignment for each VM.

5.2 Storage Services

The Contractor shall provide public cloud based storage services, including persistent and archival storage, with the following capabilities:

1. Capability to create and restore storage drive snapshots;

2. Capability to perform bulk data imports and exports;

3. Capability to scale persistently stored data (at least 1000TB) on network attached drives, per task order;

4. Capability to scale stored data (at least 5000TB) on a long term basis with infrequent retrieval within an inexpensive media environment per task order;

5. Capability to assign and configure Geographic storage affinity; and

6. Allow role based access controls (RBAC) security assignment for each assigned/configured storage drives, storage drive snapshots and bulk imports/exports.

5.3 Network Bandwidth In/Out (Data Transfer)

The Contractor shall provide the following public cloud based network bandwidth capabilities:

1. Capability to utilize private network interface of VMs;

2. Capability to utilize multiple Network Interface Cards (NIC) and Routing

Networks simultaneously;

3. Capability to utilize static IP addresses;

4. Grouping of VMs into customer-defined network segments;

PAGE 22 OF 86 ST-1330-15-RP-0071

5. Creation, modification, and deletion of firewall rules related to the instances under management;

6. IPv6 capability for Public and Private Interfaces; and

7. Allow role based access controls (RBAC) security assignment for each public/private interface configured.

5.4 Database Management Systems (DBMS) Services

The Contractor shall provide public cloud managed database services for the following DBMS versions:

Required DBMS versions: Oracle and SQL Server Optional DBMS versions: MYSQL and PostgresSQL

“Managed Database Services” shall mean that CSP handles database management tasks including DBMS provisioning (to include pre-packaged optimization for commonly used scenarios such as Decision Support, Online Transaction Processing, Data Warehousing etc.), providing alternatives for DBMS security provisioning, operations, scaling, backups, patch management and replication. NOAA will assume all responsibility for database/application development, database production rollouts, application database accounts etc. NOAA shall retain system administration access to all DBMS deployments and shall own data residing within these deployments.

5.5 Management Capabilities and Tools

The Contractor shall provide the following public cloud based management capabilities and tools:

1. Configurable browser based access so that NOAA users can only view information applicable to their supported application(s)/system(s)

2. Capability to provide secure, private network tunnels between NOAA network segments and cloud zones, and between multiple cloud zones;

3. Capability to securely control access to Cloud Service Areas utilizing Role-based Access Controls (RBAC);

4. Capability to monitor VM, Network, and Storage Services and manage associated alerts/reporting tied to:

a. Service Requests

b. Performance

c. Resource Usage/Utilization

d. Spending Metering/Controls

e. Incidents

5. Capability to remotely and in real-time manage cloud services (e.g. memory

PAGE 23 OF 86 ST-1330-15-RP-0071

caching, server/cluster load balancing) through the web;

6. Browser-based access to self-provisioning (or self-service) capabilities that allow NOAA authorized staff to rapidly set up, launch, and scale up or down services (including de-provisioning, if necessary) without going through a Contractor intermediary

7. Capability for backups and archiving. NOAA will be responsible for backups, archiving and associated retention schedule

8. Capability to apply and manage resource tags individually and in bulk

5.6 Service Levels

The Contractor shall define service levels for the following, at minimum:

Cloud Service Areas:

Uptime and Availability Planned Downtime and Maintenance Recovery Time Objectives (RTO) Recovery Point Objectives (RPO)

5.7 Cloud Security

NOAA is seeking an integrated technical solution which meets the security requirements below. These requirements apply to each IaaS tier to be managed by the Contractor and to any Contractor-supplied or third-party supplied management interface that will be used to manage the service. The Contractor must meet the following security requirements:

1. Meet DOC and NOAA defined parameters for security control implementations.

2. Support Low and Moderate Impact IT Security Categorizations (per Federal

Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems" February 2004, and NIST Special Publication 800-60 Volume I & II, "Guide for Mapping Types of Information and Information Systems to Security Categories" August 2008)

3. Comply with DOC and NOAA Information Technology Security Policies;

4. Provide FIPS-201 compliant two factor authentication capability;

5. Provide Role-Based Access Control (RBAC) to services areas;

6. Possess a FedRAMP Agency Authorization to Operate (ATO) or Provisional

Authorization to Operate (PATO) at Moderate Impact Security Categorization for the integrated technical solution (covering all functionality layered on top and the IaaS solution including the prime, integrator, broker, and Infrastructure as a Service cloud service provider) throughout the length of this contract. The Contractor shall make the following reports available within five (5) business days of written request and annually:

PAGE 24 OF 86 ST-1330-15-RP-0071

• Authorization Letter from General Services Administration GSA (or other Federal agency) providing it's Authorization To Operate (ATO) through the FedRAMP program (FedRAMP Cloud Computing Security Requirements Baseline, (http://www.gsa.gov/graphics/staffoffices/FedRAMP_Security_Controls _072912.zip)

• Security Assessment Report (http://search.gsa.gov/search?utf8=%E2%9C%93&affiliate=gsa.gov&qu ery=Security+Assessment+Report&commit=Search)

• Comprehensive inventory, description, risk assessment, and status of all existing Plan of Action and Milestones (POA&M)

• System Security Plan (http://search.gsa.gov/search?utf8=%E2%9C%93&affiliate=gsa.gov&qu ery=System+Security+Plan&commit=Search)

• Customer Responsibility Matrix identifying controls that the solution requires the Government to address

• FedRAMP Control Implementation Summary (CIS) report (https://cloud.cio.gov/document/control-implementation-summary)

• FedRAMP Security Assessment Plan (SAP) document (https://search.cio.gov/search?utf8=%E2%9C%93&m=true&affiliate=cio main&query=FedRAMP+Security+Assessment+Plan+&commit=Search)

7. Provide Government with access to System Security Package (SSP) and results of security tests performed at least annually;

8. Provide real-time access to VM system audit logs and scan data of technical solution utilized by NOAA;

9. Capability for VMs to integrate with DOC and NOAA Cybersecurity operation solutions, through secure private tunnels:

• Include NOAA Security Operations Center (SOC) integration

• Integrate into NOAA's implementation of ArcSight system providing real-time input data, which is physically located on the Silver Spring Metro Campus. TCP connection over SSL with sufficient bandwidth to send logs in a format ArcSight will accept.

• Integrate with NOAA Computer Incident Response Team (N-CIRT), for addressing suspected and actual incident handling, reporting and forensic data exchange to meet DOC, NOAA, and federal reporting requirements

• Integrate with NOAA’s implementation of Homeland Security Presidential Directive 12 (HSPD-12) implementation for a Common Identification Standard for Federal Employees and Contractors

PAGE 25 OF 86 ST-1330-15-RP-0071

(http://www.dhs.gov/homeland-security-presidential-directive-12)

• Integrate with NOAA Enterprise Continuous Monitoring Operations

(ECMO) integration for meeting OMB memoranda M-10-15 and M-10- 19, which requires all Federal agencies to continuously monitor security-related information from across the enterprise

10. Ensure that NOAA has the ability to select locations of its data and applications (including VMs) from among the locations made available by the CSP;

11. Provide an "Alternate Processing Site" in accordance with the NIST Security Control CP-7 (1), CP-7 (2), and CP-7 (3) or equivalent;

12. Provide role-based access controls and auditing of administrative actions;

13. Secure interface capabilities including but not limited to Secure Sockets Layer

(SSL), Transport Layer Security (TLS), Internet Protocol (IP) Security (IPSec), and Secure Shell (SSH) for encrypted communications between NOAA locations and cloud-based services as well as between cloud-based services and the end users of NOAA applications on the Internet;

14. Provide Government with full administrative control to the master account or its equivalent. A master account is defined as a highest (or root) level access mechanism to Government's information technology resources resident within the contractor's cloud infrastructure. Full administrative control must support granular Role-based Access Controls (for example: Government granting access to cloud resellers/partners with limited access to the CSP financial and billing).

5.8 Professional Services

The Contractor shall develop, document and provide the following professional cloud services:

1. Application suitability assessment services - identify which applications are candidates for cloud migration

2. Application preparatory services - prepare identified applications for cloud migration

3. Application migration services - migrate the applications to and from the cloud

4. Application management services - administer, maintain and support applications in the cloud

5. The professional services labor categories that we are interested in utilizing are as follows:

• Cloud Integration Services Project Manager

• Cloud Integration Services Subject Matter Expert I

• Cloud Integration Services Subject Matter Expert II

• Cloud Integration Services Subject Matter Expert III

PAGE 26 OF 86 ST-1330-15-RP-0071

• Cloud Integration Services Quality Assurance Analyst

• Cloud Integration Services System Architect

• Cloud Integration Services System Programmer

• Cloud Integration Services Hardware/Software Specialist

• Cloud Integration Services Security Specialist

• Cloud Integration Services Test Manager

• Cloud Integration Services Change Management Lead

5.9 Business Support Services

The Contractor shall provide the following business support services:

• Customer service 24x7x365

• Support forums

• Documentation, white papers, best practice guides

• Access to Trusted Advisor

• Access to Technical support

• Primary case handling

• Ability to create Technical Support cases

• Architecture support

• Best practice guidance

• API Support

• Third-party software support

• Infrastructure event management

• Concierge service

• Direct access to Technical Account Manager

• White-glove case routing

• Management business reviews

These support services shall be established in such a way so that NOAA can select the level of service they chose to utilize.

Additionally, the Contractor shall define service levels for the following, at minimum:

1. Customer Support Services:

a. Service Center/Help Desk Availability

b. Mean-Time-To-Respond

c. Mean-Time-To-Resolve (from initial response until satisfactory resolution or escalation)

PAGE 27 OF 86 ST-1330-15-RP-0071

6.0 Deliverables

The Contractor shall provide the following deliverables:

Deliverable Frequency Medium/Format/ # of Copies

Submit To

Kick Off Meeting Within 20 days of award

In-Person/1 Consult with TM, COR, and CO to schedule

Quality Management Program

Original submitted within 1 month of award;

subsequently submitted only upon updates

E-Mail/MS Word

TM and COR

Monthly Activity Report By the 15th of every month

E-Mail/MS Word/1

Noaalink.invoice@noaa.

gov