Cloud_Questions and Answers -USCA22R0092.pdf

No. Question Document Ref Answer

Can the government please clarify if the $100M purchasing volume is a total for all 3 BPAs to be awarded or $100M purchasing limit for each of the awarded BPAs?

N/A The estimated value of all BPAs in the Cloud program collectively is $100M across all BPAs awarded. Please see Amendment 0003.

Can the Judiciary clarify the nature of the relationship between the Contractor and the CSP? Section L.1 of the SF-33 states that all offerors must be CSPs. However, the solicitation makes multiple references to Contractor and CSP that suggests the Contractor and CSP are separate entities. For example, Section 6 of the PWS states that the Contractor shall provide their CSP’s standard level technical support. Section 6.4.2 states that the Contractor shall provide direct access to each CSPs standard, secure web-based reporting interface and/or APIs.

RFP Section L.1, Attachment J.1 Judiciary Cloud PWS

Please reference Amendment 0003 - The word "CSP" and "Contractor" have been corrected throughout the solicitation are no longer used interchangeably.

If the Judiciary is requiring that the Contractor and CSP be the same entity, please note that this requirement would disqualify the vast majority of contractors that perform the types of services envisioned in this solicitation. The solicitation requires a solution that provides (1) a CSP infrastructure platform, and (2) additional systems integration and cloud services account management support for Judiciary applications hosted in the platform. Two of the market-leading CSPs, [CSP 1] and [CSP 2], are very unlikely to bid as prime contractors on this solicitation and perform the role of systems integrator and account manager. Consistent with industry standards, will the Judiciary remove its requirement that the Contractor and CSP be the same entity and instead allow for resellers to bid as prime contractors and perform the role of systems integrator and account manager on the CSP platform?

RFP Section L.1, Attachment J.1 Judiciary Cloud PWS

No, the Judiciary does not plan to remove its requirement that the Contractor and CSP be the same entity, nor does the solicitation allow for resellers to propose as prime contractors and perform the role of systems integrator and account manager on the CSP platform.

The Government states that the Reading Room will be open from June 16- 27, 2022. Would the Government consider keeping it open until the proposal due date?

RFP Section L.1.3 - Reading Room Scheduling

No, the Judiciary does not plan to extend the reading room period, nor will consideration be given to keep it open until the proposal due date.

Cloud (RFP) - Questions & Answers

Fully understanding the importance of short supply chains as an element in reducing supply chain risk, it is important to point out that most CSP’s do not generally hold direct contracts and are not well-structured for supporting direct business with Federal entities.

Looking at GSA Schedules for instance, only [CSP] holds a direct Schedule. [CSP], [CSP], and [CSP] choose to work exclusively through first tier resellers. All of these CSP’s have issued direct “Letters of Supply” to selected resellers who have demonstrated competency in the supply chain management and operational management capabilities that the Courts have identified. All these Letters of Supply (with the exception of [CSP]) support direct purchasing from the CSP for the selected resellers.

Understanding that the Courts have greater contracting flexibility than Executive branch agencies, nevertheless, will the Courts please modify the solicitation to allow for first tier resellers purchasing directly from the CSP to submit offers for evaluation?

N/A No, as detailed in the RFP posting, the Judiciary's requirements are as stated therein.

This section states that “ The data categorized with these applications align to the Judiciary Information Security Framework (JISF) Low, Moderate, and High, yet PWS Section 5.3.4 states that FedRAMP Impact Level High is the CSP Minimum Requirement. Please clarify the FedRAMP requirement.

Attachment J.1 - Judiciary Cloud PWS, Sections 2.0 Overview and Section 5.3.4

CSP Minimum Requirements

Both statements are accurate. Section 5.3 are the minimum CSP requirements. Further, CSPs must meet JISF requirements as detailed in the solicitation.

Re: Response Due date of 8/1/2022 Question: Will the AOUSC please consider extending the due date to 4 weeks following the release of answers to questions?

RFP Box 9, Page 1 Please reference Amendment 0002.

Re: Presentation. The presentations shall be organized into 3 segments each correlating to the 3 technical factors in Section M sufficient to permit the government to assess its level of confidence that the offeror will successfully perform the requirements Question: L.4.5 lists only Factors 1 and 2, limited to 3 hours with a breakdown of 2.5 hours. M.1 lists three factors: 1) BPA Technical & Management Approach, 2) TSO BPA Call Technical Approach, 3) Price.

Can the AOUSC please confirm if there will be 3 segments, or only 2?

RFP Section L.4.4 - Presentation, page 25;

Section L.4.5 - Time, page 26, and Section

M.1 - Evaluation Criteria, Page 27 Please reference Amendment 0003.

Question: Commercial cloud services achieve scale that provides benefits like performance, security, and cost by being standard across all customers.

Common standards for features like deployment via APIs or security (FedRAMP, JISF) ensure the Judiciary and others get the best services available at the lowest cost. This extends to Service Level Agreements, which must be common across all users, but can be a point of differentiation between CSPs based on the individual BPA Call.

For these reasons, will the AOUSC evaluate and score the existing CSP SLAs as part of the award process instead of requiring unique SLAs that may increase costs and reduce service availability for the US Courts users?

Attachment J.2 - Performance Measurement Management Plan, Section 3, Page 2

No, Offerors are to meet the SLAs as listed in attachment J.2 - Performance Measurement Management Plan.

Re: The AO shall have access to all new features and services offered by each CSP upon availability as listed in their publicly online catalogs, that are within scope of this BPA.

Question: Will the AOUSC consider revising this sentence to read as follows: "The AO shall have access to all new features and services offered by each CSP upon availability by data center region as listed in their publicly online catalogs—that are within the scope of this BPA."

Please also clarify that CSPs are not obligated to make every commercially available cloud service available in every data center region. Not all services are available in all regions. For example, services that are not FedRAMP authorized will not be available in a FedRAMP-authorized region.

Attachment J.1 - Judiciary Cloud PWS, Section 5, pages 2, 3

No, solicitation language will not be revised, but specific requirements will be defined and competed at the BPA Call level.

RE: The contractor shall ensure that all personnel administering, maintaining, and managing or that are in contact with US Courts hosting, including but not limited to facilities, systems, or environments are cleared for background checks at a Public Trust level.

Question: Will the AOUSC please clarify that a CSP's FedRAMP implementation satisfies the requirement? NIST 800-53/FedRAMP require CSPs satisfy personnel screening criteria.

Attachment J.4, TSO BPA Call PWS, Section 5.2; Bullet No. 6, page 4

No, FedRAMP implmentation does not satisfy personnel screening criteria listed in section 5.2. The offeror shall comply with the requirements as stated in section 5.2 of the TSO BPA Call PWS.

RE: Security Question: Will the AOUSC consider reviewing a CSP’s facility audit procedure, in order to accept, in satisfaction of this requirement? CSPs provide uniform rules and processes around access to, and audit of, CSP facilities hosting customer data. Customers can access their data at any time pursuant to the relevant hosting and delivery policies.

Attachment J.4, TSO BPA Call PWS, Section 5.2, page 4, 5

No. The requirements in attachment J.4 - TSO BPA Call PWS remain unchanged.

RE: Asset Availability Question: CSPs offering commercial items at-scale can only warrant to compatibility in the context of meeting the CSP's own service specifications. Will the AOUSC please consider changing the first sentence of 5.5.5.2 to read as follows: "Once the Government has determined that compatibility and interoperability has been established, the CSP will be responsible for maintaining services without material reduction in functionality, availability and security?"

Attachment J.4, TSO BPA Call PWS, Section 5.5.5, page 7

No, the offeror shall comply with the requirements as stated in section

5.5.5 of the TSO BPA call PWS.

Can CSPs price the sample task order as FFP to align with its commercial approach to pricing?

Attachment J.4 - TSO BPA Call PWS, Section 4.0, page 3

No, the pricing shall be submitted in accordance with Section L.

Commercial CSPs may have hundreds of services and thousands of SKUs within each service. Given the sheer volume of items in a CSP's commercially available catalog, it is administratively burdensome to deliver a notification each time a service may have a price change. Price changes posted online are up-to-date. Will the Government remove this requirement and accept the commercially available information to support this requirement?

RFP Section I - Contract Clauses, Clause 4- 100, page 16

No, Clause 4-100 will remain unchanged.

The significant change in acquisition strategy as originally articulated in the draft solicitation documents has created a challenge for both the CSPs as well as our Partner ecosystem. The offeror respectfully requests a 45 day extension to the current due date of 1 Aug 2022.

RFP Block 9, Response Due Date, page 1 Please reference Amendment 0002.

Re: CLIN 0002 Use Beyond 6.1 – 6.6 SF-33 Section B has a definition for CLIN 0002 that includes the phrase, “Professional Services in accordance with the PWS section 6.1 through 6.6.”

However, the RFP requires Professional Services that are a mix of those in document J.1, section 4.2: “BPA Administration and Management” and sections 6.1 through 6.6. Should OFFERERS use CLIN 0002 for all of these Professional Services?

RFP Section B, page 4

No. The services detailed in attachment J.1, section 4.2: “BPA Administration and Management” are general and administrative services to be performed by the CSP; and, they are not professional services in accordance with PWS Section 6.1 through 6.6.

My team and I would like to verify that it is, in fact, still open and that you are accepting applications, correct?

Please reference Amendment 0002.

Are offerors expected to propose labor associated with the BPA Call? If so, will the Government please add a tab to the pricing table?

Attachment J.5 - TSO BPA Call Price Workbook

Offerors are not expected to propose labor associated with the BPA Call.

Is there an incumbent on this contract? If so, please provide the incumbent name, current contract number, duration, historical level of effort and value of the contract?

N/A No, this is a new requirement

21 If new then please provide the estimated level of efforts ? N/A No, there is no estimated level of efforts.

Will the Government allow a CSP Reseller to submit a prime proposal and be eligible for an award for this solicitaiton?

RFP Section L.1 - General Inforiamtion No, as detailed in the RFP posting, the Judiciary's requirements are as stated therein.

The Evaluation Criteria states: "The proposed solution offerings against the requirement as stated in the TSO BPA Call’s PWS. This evaluation will include a review of a price-redacted order sheet along with the technical proposal to determine if the product/service offerings provided are in alignment with the requirement as stated in the TSO BPA Call PWS." However, Section L provides no instructions for a technical proposal and does not list a technical volume in the volume list in Section L.3.3. Can the Government clarify if offerors are required to provide a written technical proposals to describe our solution for Factor 1 and 2 or if this content is only covered in the oral presentation?

RFP Section M.1 - Evaluation Criteria, RFP Section L.3 - Submission of Written Proposals, Section L.3.3 - Volumes

There is no requriement for a written technical proposal. Please reference Amendment 0003.

Can the government confirm when the slide deck for the oral presentation needs to be submitted?

RFP Section L.4 - Oral Presentation No, there is no requirement in section L.4 to submit a slide deck.

The first sentence of L.4 Oral Presentation states “All Offerors that submit a oral proposal in accordance with L.3 shall be invited to make an oral presentation.” Can the government confirm that there is a typo, and the intended statement is “All Offerors that submit a written proposal in accordance with L.3 shall be invited to make an oral presentation.”

RFP Section L.4 - Oral Presentation Please see reference Amendment 0003

Can the government clarify the following statement from L.4.1 Oral Presentation Scheduling “Oral presentations will be scheduled no later than five days after receipt of proposals.”? Does this indicate oral presentations will occur within five days of submission or that offerors will be notified within five days that a date has been scheduled.

RFP Section L.4 - Oral Presentation Please reference Amendment 0003.

Can the government confirm that Volume 1 consists exclusively of J.5 TSO BPA Call Price Workbook?

RFP Section L.3.3 - Volumes, RFP Section L.3.3.1 - Volume I - TSO BPA Call Price

Yes, please reference Amendment 0003.

Can the government confirm that Volume 2 consists exclusively of J.3 BPA Discount Workbook?

RFP Section L.3.3 - Volumes, RFP Section L.3.3.2 - Volume II - BPA Discount

Workbook Yes, please reference Amendment 0003.

Can the government confirm if the included workbooks J.3 and J.5 be included as attachments or as printed pages?

RFP Section L.3.3 - Volumes, RFP Section L.3.3.1 - Volume I - TSO BPA Call Price, RFP Section L.3.3.2 - Volume II - BPA

Discount Workbook

Quotes shall be submitted as an electronic attachment in accordance with Section L.3.2. As detailed in Section L.3.3.1, Volume I shall be submitted using attachment J.5; and, as detailed in Section L.3.3.2, Volume II shall be submitted using attachment J.3.

Can the government clarify the statement in L3.1 - Quotation Format/Information: “The submitted proposal is limited to 30 pages in total including all attachments, and tables.”? Given that Volume 1 and Volume 2 are references to workbooks J.3 and J.5, how will page count be measured (by tab, equivalent printed page)?

RFP Section L.3.1 - Quotation/Format Information

Please reference Amendment 0003. The page limit has been removed, but submissions are limited to what is required in Section L.3.3.

Can the government confirm if the BPA Technical and Management Approach and the TSO BPA Call Technical Approach are only in the slide deck for the oral presentation and not in one of the identified volumes?

RFP Section L.3 - Submission of Written Proposals, RFP Section L.4 - Oral

Presentation Please see Section L.4.4 in Amendment 0003.

The future state includes a variety of technology-based approach questions that may be dependent on the current state architecture. Could you share a high-level current state view of process, technology skills and schema?

N/A No, the information currently provided in the RFP is sufficient for offerors to submit bids for the BPA. Please note that specific requirements will be included on subsequent BPA Call solicitations.

Section 6.3.8. states: “Provide monthly, continuous monitoring reports for all systems that support AO. The report will be in NIST Security Content Automation Protocol (SCAP) format.” – Will the offeror be responsible for deploying new security tools to perform continuous monitoring or will existing government tools be used to meet the requirement?

Attachment J.1 - Judiciary Cloud PWS Per Section 6.3 of Attachment J.1. The Judiciary's requirements are as stated therein.

[Potential Offeror] has a trusted relationship with a cloud provider and may be offering the judiciary an arrangement by which the judiciary will have privity with the cloud provider while achieving the benefits of a seasoned professional services firm with decades of government service delivery. Using a contract teaming arrangement akin to a GSA style CTA, [Potential Offeror] and our cloud partner will meet each of the judiciary’s requirements including contract privity. If this arrangement is of interest to the judiciary, we would like to visit the reading room.

Please reference answer to Question #3; and, this not a FAR based procurement. This is not a GSA MSA procurement. GSA MAS CTA's only exist in GSA MAS procurements.

Are offerors permitted to add additional labor categories that may be necessary to fulfill the BPA requirements?

Attachment J.3 - BPA Discount Workbook Yes, per the Instructions Tab on J.3 "Additional Labor Categories can be added if they align to the work described in BPA PWS section 6.1"

The brief description of Use Case 2 requires the contractor to provide rapid deployment and maintenance of court website content. Is the government expecting the CSPs to deliver web content services—in addition to provisioning services—that will be implemented into production?

Attachment J.4, TSO BPA Call PWS, Page 1, Use Case 1.2.2, Use Case 2

In Use Case 2, the AO is looking for an environment that will allow the AO to do rapid deployment and maintenance of website content, we are not looking for the CSP to perform these functions.

This section states that the contractor shall offer support services, including a maximum of 2 hours response time for all incidents. Having all issues responded to within 2 hours may not be cost efficient, depending on this issue identified. Would the government consider a tiered approach that aligns with ITIL for incident management with SLAs that correspond to the severity of the issue?

Attachment J.1 - Judiciary Cloud PWS, Page 11, Section 6.8.1

Please reference Amendment 0003 - Attachment J.1 - Judiciary Cloud PWS for revised language tying support to the SLAs in the Performance Management Plan.

Where are incidents logged? Will the AO provide access to their system for incident logging and tracking, or will the contractor be expected to offer a solution?

Attachment J.1 - Judiciary Cloud PWS, Page 11, Section 6.8.1

Per Attachment J.1 - Judiciary Cloud PWS "Contractor shall provide an incident management system for identifying, submitting, and tracking cloud service incidents."

There are only 3 LCATs listed on the professional services tab. Are these the only allowable LCATs for professional services? Can contractors propose other LCATs?

Attachment J.3, BPA Discount Workbook - Professional Services Tab

Per the Instructions Tab on Attachement J.3 - BPA Workbook, "Additional Labor Categories can be added if they align to the work described in BPA PWS section 6.1"

Section 6.1 states that, “The Judiciary requires professional services in the following areas to assure a successful migration to a hybrid/commercial cloud environment and for the operation of cloud services by the Judiciary.

Specific requirements will be detailed on BPA requests for proposals. No professional services will be ordered independent from an order for cloud services.” What percentage of BPA Calls will comprise professional services? What percentage of BPA Calls will be requests for just IaaS/PaaS provisioning services?

Attachment J.1 - Judiciary Cloud PWS, Section 6.1 - Professional Services, 5

This is a new requirement, and therefore this information is not available.

Can the government elaborate on how many AO Cloud environments exist that CSP services are required?

Attachment J.1 - Judiciary Cloud PWS, Section 5.1 - CSP Services, 3

This is a new requirement, and therefore this information is not available.

The PWS states that “The Common Computing Environment (CCE) will be an interconnected, virtualized, hybrid, information technology infrastructure hosting mission systems, applications, services, and data.”

Please clarify if a resource management/monitoring tool that can report on operations both on premises (private cloud) and public cloud services is within scope of this procurement or whether US Courts will seek this type of management tool on its own, separate from the CSP BPAs.

Attachment J.1 - Judiciary Cloud PWS, Section 2.0 Overview and Section 4.2 BPA

Administration and Management

The offeror shall comply with the requirements of the PWS with regards to their CSP environment only.

“The Contractor shall ensure that the Judiciary will have daily visibility into resource usage and performance of all systems” and Section 4.2.4, “Provide the Judiciary team Cloud Service Management capabilities to centrally manage, track and report cost and performance data for applications hosted, or the performance requirements as listed under section 5.” Please clarify (1) if US Courts desires three separate CSP toolsets for this capability or whether the Judiciary wants one tool that can provide this visibility into multiple CSPs systems and resources. (2) If the latter, please clarify who will own and operate that tool if it provides visibility across all three (3) CSPs.

Attachment J.1 - Judiciary Cloud PWS, Sections 2.0 Overview and Section 4.2.4 BPA Administration and Management

The offeror shall comply with the requirements of the PWS with regards to their CSP environment only.

The Performance Requirements outline that Contractors “shall include third party products and services directly supporting CSP utilization and optimization available through each CSP marketplace and directly from the supplier.” Please clarify that CSP offerors shall identify these third party optimization services and products in their technical volume and price them in both the J.3 BPA Discount Workbook as well as in the “Other Capabilities” tab of the J.5 TSO BPA Call Price Workbook as applicable.

Attachment J.1 - Judiciary Cloud PWS, Section 5 Performance Requirements

Reference Amendment 0003, identifies the 3rd party optimization within the J.3 attachment.

45 When will the decision be made? N/A We anticipate making award first quarter of FY 2023

46 What employees by title will be evaluating the responses? N/A This is not public information.

47 Please define how the government will assess level of confidence.

RFP Page 27, Section M.1, Evaluation

Criteria Proposals will be evaluated in accordance with Section M.

The RFP appears to use the terms Contractor and CSP interchangeably.

Please clarify the definition of contractor vs CSP?

Attachment J.1 - Judiciary Cloud PWS, Attachment J.4, TSO BPA Call PWS -

Global See Amendment 0003.

“The Contractor shall be the owner and operator of a public, hybrid and/or Government Community Cloud (GCC) cloud service provider (CSP)”. Can the government confirm that no authorized resellers will be able to submit a bid?

Attachment J.1 - Judiciary Cloud PWS, Section 3.0 Scope of Services

Please reference Section L.1. No authorized resellers will be able to propose.

“The Contractor shall provide the professional implementation support, and program administrative activities as specified in this Performance Work Statement.” Is the implementation support inclusive of services and labor for non-CSP-specific deliverables?

Attachment J.1 - Judiciary Cloud PWS, Section 3.0 Scope of Services

All deliverables are CSP deliverables as the offerors must be CSPs.

“The Contractor shall provide direct access to each CSPs standard…” Since AOUSC is acting as the CSP broker, should the language be changed to: “The CSP shall provide direct access to their respective standard, secure web-based reporting interface…”?

Attachment J.1 - Judiciary Cloud PWS, Section 6.4.2-1 Detailed Reporting

Capability Please reference Amendment 0003, Attachment J.1 has been updated.

The language in this section implies a central reporting solution for all cloud services. Is this government’s intent that this language apply on a per-CSP (Contractor) basis and that each CSP will provide a financial management system that meets the criteria specified in 6.5.1 and 6.5.2?

Attachment J.1 - Judiciary Cloud PWS, Section 6.5 Financial Management

Please reference Amendment 0003, Attachment J.1 has been updated.

The Use Cases presented are broadly written to include activities that are not clearly associated with activities performed or offered by CSPs. Please clarify which activities are expected to be performed by the CSP.

Attachment J.4, TSO BPA Call, Section 1.2 Use Cases

The Call is for the CSP to provide a pilot environment that can be used to support the listed Use Cases. This also aligns to the environment as described in the J.5 TSO BPA Call Price Workbook

As defined by the FedRAMP PMO security and cryptographic library guidelines, will the agency leverage supported operating systems?

[https://www.fedramp.gov/2021-03-30-CentOS-Linux-End-of-Life/]

Attachment J.4, TSO BPA Call, Section

5.4.1 Use Case Environment Technical

Requirements

The Call is for the CSP to provide a pilot environment that can be used to support the listed Use Cases. This also aligns to the environment as described in the J.5 TSO BPA Call Price Workbook

Re: The submitted proposal is limited to 30 pages in total… Question: As part of a complete and full submission, it’s important to include standard cloud documents (e.g., service descriptions, terms of use, SLAs, etc.). Therefore, is it accurate to say that this 30-page limit is specifically for technical descriptions for the requested BPA services? Are administrative pages like the table of contents, glossaries, price workbook tabs, and title pages included in this 30-page limit?

RFP Section L.3.1 - Quotation/Format Information, Page 24

Please reference response to Question #30

Re: Provide a Continuous Monitoring Plan that complies with current NIST and AO guidance.

Question: Can the AOUSC please list the specific NIST and AO guidance required?

Attachment J.1 - Judiciary Cloud PWS, Section 6.3.4 - CCE Environment

Cybersecurity and Compliance, Page 7 Please reference Amendment 0003, Attachment J.1 has been updated.

Re: Incident Response Plan. The Contractor must have and [sic] Incident Response Plan that meets the Judiciary requirements in place within 30 days after BPA Award.

Question: Can the AOUSC please clarify what constitutes “Judiciary requirements” for an Incident Response Plan?

Attachment J.1 - Judiciary Cloud PWS, Section 6.3.9 - CCE Environment

Cybersecurity and Compliance, Page 7 Please reference Amendment 0003, Attachment J.1 has been updated.

Re: Evaluation Approach Criteria…. (a) The Judiciary will evaluate how effectively and efficiently the Offeror’s proposed solution can fulfill the Judiciary’s vision for all services as described in the PWS within the constraints and assumptions stated.

Question: Since the PWS includes brand names (e.g., Cortana Intelligence) can the AOUSC please clarify whether these exact services are required, or will services with equivalent functionality also be acceptable?

RFP Section M.1 - Evaluation Criteria, Page

These exact services are needed per the PWS, if these need to be acquired through 3rd party services they need to be identified on the J5 under Other Capabilities.

Re: Data Transfer TAB Question: What is the unit of measure for data transfer?

Attachment J.5 - TSO BPA Call Price Workbook

Refence Amendment 0003 - Attachment J.5. The unit of measure is added: Gigabytes (GB).

Re: Pay-As-You-Go Instances TAB Question: What is the significance of “SQL” in this context (see Column C)?

Attachment J.5 - TSO BPA Call Price Workbook

SQL refers to Virtual Machines that are used for SQL.

Re: Instructions TAB: Each tab provides projected usage….

Question: The workbook tabs do not contain projected usage. Will the AOUSC please clarify this statement made on the “Instructions” tab?

Attachment J.3 - BPA Discount Workbook See Amendment 0003 - Reference Attachment J.3.

RE: The Contractor shall ensure that all data and all data elements stored or created by the Judiciary or its contractors within the CSP environment is the exclusive property of Judiciary organization issuing the BPA call.

Question: This is generally true; however, some CSPs may define "data" and "data elements" differently. Certain metadata about environments or services is used to measure and improve service levels. Will the AOUSC please provide a definition of Judiciary "data and data elements?” Also, will the AOUSC confirm that this metadata about the services (that does not contain any identifiable customer information) is the property of the CSP—only to be used to provide the services?

Attachment J.1 - Judiciary Cloud PWS, Section 5, page 3

Judiciary data and data elements are defined as data and data elements that is stored or created by the Judiciary as well as any data or data element that is created by the CSP that contains any data or data elements orginially created or stored by the Judiciary. This includes metedata that fits this description.

Please reference the links below for the current definition of data and data element per NIST.

https://csrc.nist.gov/glossary/term/data https://csrc.nist.gov/glossary/term/data_element

Re: Hardware and software components of all points of presence.

Question: What does the AOUSC mean by "hardware and software components of all points of presence?”

Attachment J.1 - Judiciary Cloud PWS, Section 5.1.4, page 3

A point of presence is an artificial demarcation point or network interface point between communicating entities. A common example is an ISP point of presence, the local access point that allows users to connect to the Internet with their Internet service provider.

Re: Comply with all FedRAMP requirements, Federal Statutes, Standards, and Guidelines.

Question: Can the AOUSC please specify all FedRAMP requirements, Federal statutes, Standards, and Guidelines? Or consider revising 6.3.1 to require CSPs to "maintain FedRAMP High authorization for the cloud services?"

Attachment J.1 - Judiciary Cloud PWS, Section 6.3.1, page 7

The FedRAMP requirements, Federal Statutes, Standards, and Guidllines can be found at https://www.fedramp.gov/.

RE: Contractor Personnel Security Requirements Question: Will the AOUSC stipulate that the requirements listed in Section 6.9 apply to employees providing operations or support for commercial cloud services within the customer tenancy? Additionally, is the AOUSC willing to work with the CSP to define the specific training and security requirements listed in Section 6.9?

Attachment J.1 - Judiciary Cloud PWS, Section 6.9, page 11, 12

Per section 6.9 of the PWS "The Contractor shall comply with all of the following requirements related to individual Contractor Personnel operating under this BPA and all subsequent BPA Calls"

Question: Please confirm that the AOUSC does not object to CSPs collecting Judiciary data to: (i) compile statistical and other information related to the performance, operation and use of the Services, and (ii) use data from the Services in aggregated form for security and operations management, to create statistical analyses, and for research and development purposes.

CSPs will not incorporate Judiciary's data in any form that could identify Judiciary or any individual. These types of data use rights help CSPs operate and improve the cloud services, and do not directly disclose Judiciary data or identify Judiciary or any individual.

Attachment J.4, TSO BPA Call PWS, Section 5.5.3, Section 5.5.4, Section 5.5.6, pages 6, 7

The CSP shall comply with the requirements as stated and collecting of Judiciary data complies with Contract Clause 6-65 Rights in Data- Special Works.

RE: Misuse of Government Data and Metadata Question: Please confirm that these security requirements do not apply to employees providing operations or support for commercial cloud services not related to this BPA.

Attachment J.4, TSO BPA Call PWS, Section 5.5.6, page 7

The offeror shall comply with the requirements as stated in section

5.5.6 of the TSO BPA call PWS.

RE: …Incident Reporting Question: Will the AOUSC please clarify that CSPs shall provide Incident Reporting in accordance with their FedRAMP-audited Incident Response Controls? CSPs operate the cloud services uniformly across all of its customer base, using methods that have been reviewed and authorized by FedRAMP and other accrediting authorities.

Attachment J.4, TSO BPA Call PWS, Section 5.5.7, page 7

The offeror shall comply with the requirements as stated in section

5.5.7 of the TSO BPA call PWS.

RE: Records Question: Will the AOUSC identify its specific format requirements (as indicated in 5.5.11) at the time of the BPA call?

Attachment J.4, TSO BPA Call PWS, Section 5.5.11, page 8

See Amenemdnt 0003- Attachement J.4 BPA Call PWS

RE: BPA Call Ordering Method Question: To minimize disputes over whether parties have an agreement as to a BPA Call, will the AOUSC consider removing the following phrase: "or when the contractor commences performance"?

RFP Section G.1, Section 2.1 BPA Call Ordering Method, page 5, 6

No, BPA Call Ordering Method language remains as written.

Re: Clause 3-105—Audit and Records Question: Will the AOUSC please clarify via an amendment that this is not a BPA for cost-reimbursement contracting?

RFP Section I - Contract Clauses, page 11 See Amendment 0003 - Clause 3-105 is reflected in its entirety. Call for this BPA could have labor hour or time and material CLINs.

Re: Clause 2-50—Continuity of Services Question: Will the AOUSC please clarify this clause since the PWS already provides for transition services? A CSP will work in good faith with the AOUSC to negotiate a BPA Call addressing any transition needs not covered in the existing PWS.

RFP Section I - Contract Clauses, page 12 Clause 2-50 will remain unchanged.

Re: Clause 6-65—Rights in Data-Special Works Question: Will the AOUSC please confirm that this clause does not apply given that data rights, ownership and use rights, in the cloud services, are comprehensively addressed in the CSP’s Terms and Conditions?

Consistent with Federal contracting practices for commercial items, ownership and use rights in cloud services are governed by the CSP's terms and conditions that are customary commercial practices.

RFP Section I - Contract Clauses, page 16, Clause 6-65 - Rights in Data-Special Works does and will apply to any BPAs awarded off the solicitation and subsequent BPA Calls. This procurement is not a FAR based procurement.

Re: Clause 2-140—Judiciary IT Security Standards Question: Will the AOUSC please clarify with respect to this clause, that the contractor is not "developing information systems on behalf of the judiciary." Contractors are providing a fixed scope of work under a PWS, not delivering an information system to AOUSC. Alternatively, at a minimum, please clarify that in the event of a conflict between requirements in the RFP and CSP’s security policies (as accepted by AOUSC) and clause 2-140, the RFP and agreed-upon security policies will take precedence.

RFP Section I - Contract Clauses, page 13 While the CSP is not "developing" an IT system, the clause is applicable to the CSP meeting the requirement outlined in Attachment J.1 - Judiciary Cloud PWS.

Re: Evaluation Factors for Award Question: To reduce cost and improve service delivery, CSPs use standard Terms & Conditions; therefore, will the AOUSC enter into negotiations with awarded CSPs to ensure that the CSP’s Terms & Conditions are appropriately incorporated into the contract and any conflicts resolved?

RFP Section M - Evaluation Factors for Award, page 26, 27, 28

AOUSC will not enter into negoiations with the CSP regarding CSP terms and conditions. Please see Amendment 0003, and please see clause 3-120.

Re: Submission of Written Proposals Question: In which volume does the AOUSC want offerors to place their narrative responses to the PWS requirements?

RFP Section L.3 thru L.3.3.3 - Submission of Written Proposals, page 24, 25

Please reference Amendment 0003 - Narrative responses are not to be submitted in the Volumes. Oral presentations shall cover any narrative responses to BPA PWS and TO PWS.

Re: Instructions Tab Question: In which of the three volumes should bidders place the “pricing narrative” mentioned in the “Instructions” Tab of the J.5 BPA Call Price workbook, Row 2?

Attachment J.5 - TSO BPA Call Price Workbook

Please reference Amenemdnt 0003 attachement J.5 Workbook

Section M states: "The proposed solution offerings against the requirement as stated in the TSO BPA Call’s PWS. This evaluation will include a review of a price-redacted order sheet along with the technical proposal to determine if the product/service offerings provided are in alignment with the requirement as stated in the TSO BPA Call PWS." However, Section L provides no instructions for a technical proposal and does not list a technical volume in the volume list in Section L.3.3. Can the Government clarify if offerors are required to provide a written technical proposal or if this is only covered in the oral presentation?

RFP Section M.2.b, page 27 Please reference answer to Question #76

Can the goverment please clarify if the $100M purchasing volume is a total for all 3 BPAs to be awarded or $100M purchasing limit for each of the awarded BPAs

RFP 3.1.1 and Multiple Award, Pages 6 and 26

Please reference answer to Question #1

L.4.4 says that the presentation will be organized into 3 segements each correlating to the 3 technical factors in Section M. Furthermore, L.4.5 says that the Oral Presentation will be limited to 3 hours, broken down as follows in a table. The table itself only lists Factor 1 and Factor 2, and the time adds up to 2 hours and 30 minutes. Would the government please clarify the time limitation and format for the Factor 3 presentation?

RFP Section L.4.4 and Section L.4.5, page

Please reference answer to Question #8

The BPA Discount Workbook provided may not align to the CSP's commercial approach to providing discounts. Can bidders provide their own version of Attachment J.3 to align with their commercial approach to providing discounts?

Attachment J.3 - BPA Discount Workbook Offerors shall align any discounts to the format in the discount book provided and in accordance with the instructions.

CSPs may have different approaches to how they sell professional services that don't align to the labor categories requested in the RFP. Can CSPs propose professional services pricing that aligns with their commercial approach to offering professional services to US Federal government customers?

RFP Section L.3.3.2.c, page 25 and Attachment J.3, BPA Discount Workbook

Please reference answer to Question #39.

J1 states that CSPs must provide "Provide monthly, continuous monitoring reports for all systems that support AO. The report will be in NIST Security Content Automation Protocol (SCAP) format." Will the Government accept the same format the CSP provides to FedRAMP (which maybe be in SCAP or OSCAL format)?

Attachment J.1 - Judiciary Cloud PWS, Section 6.3.8, page 7

Please reference Amendment 0003 - Attachment J.1 - Judiciary Cloud PWS section 6.3.8 now reads "The report shall adhere to FedRAMP requirements and be in a machine-readable format."

Section G.4 indicates that CSPs cannot increase their commercial pricing.

This requirement is arbitrary, unreasonable, and non-commercial -- that the government shall benefit from commercial price reductions only, but not pay commercial price increases along with all other commercial customers. This is a multi-award, IDIQ contract. Task order competitions will establish pricing economics, and the government should not dictate CSPs' commercial pricing practices -- effecting both increases and decreases. Please delete the requirements that "Unless otherwise specified in the contract, the unit prices are subject to downward adjustment only, with such adjustments based on changes to the contractor's commercial catalog Pricing."

RFP Section G.4, page 8 Section G.4 will remain a requirment of the RFP USCA22R0092

Would the government clarify the following the following is in reference to the CSP’s SSP and FedRamp compliance document. “The contractor will provide access to FedRAMP Security System Plan (SSP) as well as authorization to operate (ATO) documentation to the government within 10 days of award, with updates provided on a quarterly basis. The contractor shall create a JISF SSP within 20 days of award”.

Attachment J.4 - TSO BPA Call PWS 5.2 (bullet #3)

Clarification: Both a FedRAMP SSP and a JISF SSP are required.

Would the government clarify, “logical access” as it relates to: “This may include the entrant’s name, role, purpose, account identification, entry and exit time(s).” It was unclear if the intent was logical or physical access.

Attachment J.4 - TSO BPA Call PWS 5.2 (bullet #6)

Clarification: The referenced quotation refers to logical access.

Would the government clarify what they intended with respect to “the contractor shall provide immediate access to all government data and government-related data” specifically as it relates to the following:

“without the contractors involvement”

Attachment J.4 - TSO BPA Call PWS 5.2 (bullet #7)

The two quotations are not mutually exclusive as they are from two different sentences.

Would government confirm that they intended to ask for support of end-of-life operating systems?

Attachment J.4 - TSO BPA Call PWS, Section 5.4.1

The offeror shall comply with the requirements as stated in section

5.4.1 of the TSO BPA call PWS.

Is the information expected in this section different from what will be provided in the Price Workbook?

RFP Section B - Supplies or Services and Prices/Costs (p.4)

No. Please refer to the Price Workbook for instructions

90 Are the ordering periods listed in this section option years?

RFP Section B.1.2 BPA Ordering Periods

(p.4) Yes, the ordering periods listed in Section B.1.2 are option periods.

The RFP states "The judiciary requires privity of contract directly with the CSPs due to our need to maintain the closest possible custody of judiciary data, solutions, and systems and limiting infrastructure vulnerability.

Therefore, all offerors must be CSPs." Many CSPs have a sales model that utilizes a distributor, this distributor would thus the be most direct way to contract with CSPs. Will the government accept offers from the distributor knowing that they represent the CSP?

RFP Section L.1 General Instructions: Who Can Offer (p.22)

Please reference the answer to Question #3.

Will the questions and answers to them be published? If so, what's the expected date?

RFP Section L.2. -Submission of Questions (p.24)

Yes, the Q&A will be posted on SAM.

93 Does the 30 page limit include the pricing in Section B?

RFP Section L3.1 - Quotation

Format/Information: (p.24) Please reference answer to Question 30.

(b) The Judiciary will evaluate if the Offeror’s proposed solution provides proof of a VMWare Hypervisor availability within the CSP or a detail architecture plan to provide availability within 3 months of BPA award.

Should this be delivered as a separate document ot part of the 30 page proposal?

RFP Section M - Evaluation Approach Criteria (p.27)

Please reference Amendment 0003

Is this requirement specific to the 9th Circuit Court or all courts? Is there an existing team or contractor that will work with the CSP on the design of the new website?

Attachment J.4 TSO BPA Call PWS, Section 1.2.2 Use Case 2 - Core Mission:

Rapid deployment and maintenance of court website content (p.1)

The offeror shall structure their proposal to comply with the requirements as stated in the TSO BPA Call PWS.

Please provide the complete list of the technologies and their versions that AOUSC environment needs to have uptime/downtime setup for.

Attachment J.4 TSO BPA Call PWS, Section 5.4 Use Case Environment

Technical Requirements - 5.4.3 (p.5)

The offeror shall structure their proposal to comply with the requirements as stated in the TSO BPA Call PWS.

97 What CODECs for video streaming are required to be supported?

Attachment J.4 TSO BPA Call PWS, Section 1.2.2 #4 - Streaming Services (p.1) Please reference answer to Question #96

What types of development tools does AOUSC require for building and compiling code off-premises? Cloud hosted IDE? Code repository? Code-to-Container automation?

Attachment J.4 TSO BPA Call PWS, Section 1.2.3 #2 Cloud Based Development

Tools (p. 3) Please reference answer to Question #96

99 What CODECs for video streaming need support?

Attachment J.4 TSO BPA Call PWS, Section 1.2.2 #4, (p.1) Please reference answer to Question #96

How are the web sites currently hosted? Are they using WordPress or some other Content Management System (CMS)?

Attachment J.4 TSO BPA Call PWS, Section 1.2.2 #3 Re-Hosting Web Sites (p.

1) Please reference answer to Question #96

What languages and frameworks are the web sites currently using? And do you intend to continue to use these languages and fraemworks?

Attachment J.4 TSO BPA Call PWS, Section 1.2.2 #3 Re-Hosting Web Sites (p.

1) Please reference answer to Question #96

What types of development tools does AOUSC require for building and compiling code off-premises? Cloud hosted IDE? Code repository? Code-to-Container automation?

Attachment J.4 TSO BPA Call PWS, Section 1.2.3 #2 Cloud Based Development

Tools (p. 3) Please reference answer to Question #96

Does US Courts have a hot/warm/cold preference for off-site HA/DR hosting?

Attachment J.4 TSO BPA Call PWS, Section 1.2.4 (p. 2)

Please reference answer to Question #96

Is FedRAMP High required at time of award? We are presently FedRAMP High Ready status and this would require an agency sponsorship as we are sponsor authorized having not gone through the JAB

Attachment J.1 - Judiciary Cloud PWS, Section 5.3 CSP Minimum Requirements;

5.3.1 FedRAMP Status: Authorized; 5.3.2

FedRAMP Service Models: IaaS, PaaS and/or IaaS, PaaS, SaaS; 5.3.3 FedRAMP Deployment Model: Public, Hybrid and/or

GCC Cloud; 5.3.4 FedRAMP Impact Level:

High

The offeror shall meet the FedRAMP requirements at time of award.

The Data Transfer tab identifies the Units per Month as 300000. Is the unit of measure in MB, GB, or TB?

Attachment J.5 TSO BPA Call Price Worksheet

See Amendment 0003 - The unit of measure is Gigabytes (GB).

RFP Section L.1 states that, "The judiciary requires privity of contract directly with the CSPs due to our need to maintain the closest possible custody of judiciary data, solutions, and systems and limiting infrastructure vulnerability." Attachment J.1, Section 3 states that, "The Contractor shall be the owner and operator of a public, hybrid and/or Government Community Cloud (GCC) cloud service provider (CSP)..." Please confirm that only cloud owners/operators may bid as prime.

RFP Section Section L.1 General Instructions; J.1, Section 3 Scope of

Services Please reference the answer to Question #3.

The CLIN structure in Section B does not align to the PWS breakdown of services. Can the Government please provide additional details of how Section B should be completed?

RFP Section Section B. Supplies or Services and Prices/Costs, page 4

Please refer to answer in Question #89

Section L.4.4 states that "[t]he presentations shall be organized into 3 segments each correlating to the technical factors in Section M…". There appear to be only 2 technical factors as follows: Factor 1 (Technical & Management Approach) and Factor 2 (Technical Approach TSO BPA Call). Factor 3 is Price. Please confirm that Offerors should organize the oral presentation into 2 segments each correlating to the technical factors in Section M.

RFP Section L.4.4. Presentation, page 25 Please reference Amendment 0003

Section L.3.3.1 states that "[t]he offeror shall present their best pricing for the scenario as though it were an actual BPA call." Please confirm that the sample call is not awardable under the BPA.

RFP Section L.3.3.1. Volume 1-TSO BPA Call Price, page 24

Please refer to amendment 0003, The intent is to award this call with the BPA awards.

"The submitted proposal is limited to 30 pages in total including all attachments, and tables." We respectfully request that commercial licensing documentation be excluded from the 30 pg limit.

RFP Section L.3.1, page 24 Please refer to answer in Question #30

The RFP does not appear to address how an Offeror should submit any exceptions to requirements, terms and conditions, etc. Would AOUSC please advise how exceptions should be submitted?

N/A Any techinical assumptions should be noted during Oral presentations.

Any pricing assumptions should be noted within the J.3 and J.5 workbooks (tabs have been added to each workbook)

“Per Section L.4 of the RFP, AOUSC intends to schedule oral presentation times “no later than five days after receipt of proposals”. Can bidders schedule a presentation time prior to proposal submission? This will enable bidders to validate that all presenters (to be listed in Vol. III of the proposal per L.3.3) are available for the date of the presentation.”

RFP Section L.4 - Presentation Timing No, there be no advance scheduling of the virtual oral presentations prior to the proposal submission.

Re: Costs for Ongoing PMO Services The RFP requires certain services be provided by an OFFERER’s program management office (PMO), most notably in document J.1, section 4.2 (“BPA Administration and Management”). These services are not associated with any single BPA Call, they persist over the contract’s period-of-performance. How and when does AOUSC want OFFERERS to present the costs associated with these ongoing services?

Attachment J.1 - Judiciary Cloud PWS - Section 4.2, page 2

Reference Answer to Question 17.

In the Call PWS Use case 3, 1.2.3, 1-4 The Judiciary uses the term "Demonstrate." Does the Judiciary intend for us to have demonstrations and if so does that count against our 30 minute time? Or can they be presented in the 45 minute Q&A session?

J.4 TSO…