USDA Secure Data Enclave SOW (DRAFT).pdf

Procurement Statement of Work for

United States Department of Agriculture Secure Enclave Services

1.0 GENERAL INFORMATION

1.1 Summary

The United States Department of Agriculture (USDA) statistical agencies and units, Economic Research Service (ERS), National Agricultural Statistical Service (NASS), and Agricultural Plant Health Inspection Service (APHIS) seek to procure data enclave services to serve as a secure computing and collaboration workspace. This workspace will be a highly controlled, secure space for both USDA employees and approved external users across the United States that allows them to conduct approved research and work with restricted-access datasets. This requirement will allow USDA the continuity to provide data users access to restricted-access data in a secure enclave environment.

1.2 Description of Services

Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform all tasks as defined in this Statement of Work except for those items specified as government-furnished services. The Contractor shall perform to the standards in this contract.

1.3 Period of Performance

The period of performance for this procurement is a base year with four one –year option periods.

1.4 Place of Performance

The place of performance for this procurement is the contractor’s location.

1.5 Type of Contract

This will be a firm-fixed-price contract with separate line items for identified USDA users, Artificial Intelligence and Machine-Learning training, and additional project-specific technical expertise.

1.6 Background

ERS and NASS are Principal Federal Statistical Agencies adhering to the principles and practices of U.S.

Federal Statistical Agencies.1 APHIS has a recognized Federal Statistical Unit that also falls under the auspices of the guidance for Federal Statistical Agencies. All data accessed by these agencies are kept confidential and used only for statistical purposes as required by law under United States Code, Title 7, Section 2204(g) and the Confidential Information Protection and Statistical Efficiency Act of 2018, Title III of Pub. L. No. 115-435, codified in 44 U.S.C. Ch. 35. USDA statistical Agencies and Units have policies, standards, and practices addressing data access to ensure adherence to confidentiality laws, and data providers trust their data is protected.

1 See, Principles and Practice for a Federal Statistical Agency, 7th edition, National Academy of Sciences, 2021, https://www.nationalacademies.org/our-work/7th-edition-of-principles-and-practices-for-a-federal-statistical-agency.

DRAFT

The Confidential Information Protection and Statistical Efficiency Act (CIPSEA) gives discretionary authority to Federal Statistical Agencies to swear in Special Sworn Agents. No individual has a right to the appointment nor are Agencies obligated to appoint any individual. Data access can be provided to academic researchers from public or private universities, other USDA agencies, other Federal statistical agencies, and State government agencies; and with cooperative agreements, for purposes that serve the general public and contribute significantly to understanding the agricultural sector or the statistical procedures used by Agencies to collect and summarize data. These data are not to be used for regulatory, enforcement, or investigative purposes.

The use of a data enclave enhances the accessibility of data for researchers who can access from their work locations. The data enclave provided under this agreement will enhance the data stewardship of USDA data while protecting the privacy and confidentiality of the data, with improved ability to manage data access requests, agreements, and reporting metrics. The Foundations in Evidence-Based Policymaking Act of 2018, Public Law No. 115-435 states that Federal Statistical Agencies and Units should seek opportunities to improve efficiency, including ways to share data for statistical purposes.

This requirement is for an enclave that provides an online computing and data storage platform for researchers to access and use securely stored data and enables government data stewards to monitor and manage the use of such data. The enclave must provide management tools for comprehensive administrative analytics on researchers’ use of computational resources and data assets.

The enclave must be implemented and operated in accordance with Federal Risk and Authorization Management Program (FedRAMP) authorization requirements, achieve appropriate balance between ease of access and functionality for data users, and provide confidentiality and privacy protection for data providers. The enclave service must have an active FedRAMP Authority to Operate (ATO) at the time of quote, and the FedRAMP package ID must be included with the quote. In addition, the service must maintain its FedRAMP ATO throughout the contract period of performance.

2.0 REQUIREMENTS AND DELIVERABLES

2.1 Enclave Technical Requirements

2.1.1 Security Overview

Security requirements are defined by the FedRAMP Moderate Impact overlay to the NIST SP 800-53 Moderate Impact minimum security controls. The FedRAMP and National Institute of Standards and Technology (“NIST”) Special Publication (SP) 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, PL-8 (Information Security Architecture) require that the developer of an information system develop a security architecture that describes the approach taken with regard to protecting the confidentiality, integrity, and availability of Government information and ensures appropriate security levels of staff are maintained

2.1.2 Scalability

The platform will need to be a state-of-the-art, cloud-based, scalable environment for USDA to be able to meet developing needs of researchers and the participating agencies. This involves the capacity to implement continuing improvements to the development strategy, enclave design, and appropriate technology to ensure the sustainability of the data enclave and meet increased or expanding workloads and operational demands. The ability to onboard all relevant USDA staff members is necessary. Cost efficiency in scalability is ideal. Scalability will enable USDA to respond appropriately and cost-effectively to evolving needs for increased storage and performance.

The Enclave should follow 'scalability in depth' design to enable end to end scalability in its core infrastructure. Agencies/Projects can acquire additional end user computing, database, and storage resources to meet their growth needs and similarly, they can release these resources when they no longer need them. To support the growing number of project workspaces, researcher accounts, and data volume, the scalability is embedded in the following three layers:

• An End User Compute (App stream Images) - An end user compute that offers both vertical and horizontal scalability. For example, when the need arises, a user's machine can be quickly upgraded from a lower compute power (e.g. 2 vCPU (Virtual Central Processing Unit), 8GB (Gigabyte) memory) machine to a higher compute power machine (e.g. 4 vCPU, 16GB memory). Similarly, when the need arises, and a project workspace needs to add additional researchers to the project (e.g., 50 additional researchers), then the ability exists to provision those additional end user compute machines on a short notice and, upon completion of the project, those additional machines can be quickly released.

• Database – The amount of data that individual projects need to analyze is growing exponentially as is the number of researchers who need to analyze this growing set of data. USDA requires an enclave that can deploy a massively parallel processing database solution to successfully meet this demand of continually growing volume of data and higher analytical needs. The database solution will need to offer:

o both vertical and horizontal scalability o a database cluster that can scale up to 128 computing nodes with each node being able to grow in its compute capacity from 4 CPUs (Central Processing Unit) to 48 CPUs.

o the ability for researchers to simultaneously work in an environment to analyze terabytes worth of data without disrupting the computing power and speed of other users.

• Storage –

• Structured Data – The single instance of a database solution can scale up to storing 16PB (Petabyte) of structured data and can stand up additional database instances as the need arises.

• Unstructured Data – The ability to host at least 5PB of unstructured data, with the ability to stand up additional unstructured data storage as the need arises.

• Data Archival and Restoration – Inactive data and/or user workspace can be archived and later restored as necessary.

2.1.3 User Workspace Technical specifications

Each user will have access to one or more dedicated workspaces within the enclave with 2-8 vCPU, 8-150GB memory, 50-500GB storage, and 20 – 80 hours of usage, configurable to Agency or project requirements. An advisor user will be available with minimum configuration necessary to review and browse files. The user workspace is secure and not accessible or visible to other enclave users. However, the enclave must also be flexible enough to allow collaborative workspaces when the users and project specifications allow for such an arrangement. Levels of workspace visibility are: None, Only for Specified Team Members, and Open To All. Pricing structure for workspace performance configuration and the related data storage requirements can be stratified by different levels from Advisory Roles to Power Users.

2.1.4 Workspace Software

At a minimum, users will have access to all Windows native tools, Microsoft Office Suite, the Export Request & Review Tool,Dbeaver, Jupyter Lab, Python, R, R Studio and PyCharm. Subject to provision of licensure by USDA, SAS >= v9.4, most recent version of STATA, SUDAAN >= v11.0.4, ArcGIS, GAMS, GTAP, GEMPACK General Equilibrium Modelling Software, and other software products will also be available and installed on the Windows Desktop, according to Agency/project needs. The enclave must allow an option for users to provide additional software and associated license compatible with the enclave environment.

2.2 Performance and Maintenance

2.2.1 Performance

Performance is regularly monitored by the contractor, and any changes required to maintain a consistent experience are applied by the contractor team. This may include adjusting compute profiles and/or standard data access tuning activities.

2.2.2 Security Scanning/Remediation

The contractor’s team performs regular scanning for security vulnerabilities, remediates any issues within FedRAMP mandated timeframes, and maintains an active USDA Authority to Operate.

2.2.3 Code versioning

The contractor will secure and maintain software needed to provide a secure sandbox for sharing of code and code version control in the data enclave.

2.2.4 Maintenance and Downtime

The Contractor will provide 96-hour advance notice to the COR and Task Monitors of any maintenance that could result in disruption of services and/or diminished performance. The contractor will provide two-week notice to the COR and USDA Task Monitors for any scheduled downtime and will work with USDA to identify optimal timing for the downtime. To the greatest extent possible the contractor will perform maintenance between the hours of 20:00 – 06:00.

2.3 Data Stewardship and Management Portal

USDA is requesting a management portal or module that enables USDA staff charged with providing data stewardship for restricted-access data (Data Stewards) to manage and monitor the usage of their data at scale. USDA requests an environment and tools that facilitate interactions between Data Stewards and users. USDA is looking for the following key features:

2.3.1 Management Portal

Dashboards, Reporting, Workflow Monitoring, Usage Stats, Admin Functions.

2.3.2 Portal User Registration & Approval

Users of this portal register themselves and are “approved” by the Agency and contractor for the required role.

Registration and continued enclave use will include Contractor oversight of:

1. CIPSEA training documentation and maintenance of non-disclosure agreement

(NDA) paperwork

2. Open Researcher and Contributor ID (ORCID)

3. Record of Agency and Division for each user

4. Disclosure review process, software, and oversight as well as access to disclosure review staff. Disclosure review needs to address review of any code to be removed and well as re-identification risk.

5. Onboarding

6. Training and support for data enclave users

2.3.3 Data Ingestion

Data ingestion operations, particularly file transfer, are conducted over a secure transmission protocol directly to a FedRAMP Authorized 140-2 compliant storage platform. The target storage platform is configured, the logical definition of the dataset in the management system is set up, and initial access control configured in the Data Stewardship console. Some data will be loaded to contractor provided relational database and other data will be simple flat files made available to a specific project workspace. Some data ingestions will send data to a data library open to multiple enclave users while other data will go directly and only to a specific workspace folder. Data ingests will occur within two business days of receipt.

2.3.4 User accounts

User accounts are created by the Contractor and defined in the Data Stewardship console.

Default compute profiles are defined for each user to access the enclave using secure credentials. Accounts are created within two business days of request.

USDA will allow access to the Enclave by non-USDA personnel who are responsible for self-pay services. Non-USDA users will require pre-approval from the individual USDA agencies pripr to Enclave access. USDA agencies will designate a POC for orders who will provide instructions for the contractor and the users to gain access.

2.3.5 Dataset Definition

Data Stewards may “request” a new dataset definition. This initiates the Data Ingest Team to engage with data “owners” to complete the definition and ingest the data. A defined dataset can have agreements attached to it. The dataset definitions depend on the agency and guidelines for use of the dataset that is to be ingested.

2.3.6 Agreement Management-Agreement owners

The USDA will define this “vehicle” that manages the relationship between entities. Contract and agreement bookkeeping (which includes oversight of the types of agreements needed between different entities) is maintained by the virtual data enclave services provider. The data enclave will maintain a database of these data use agreements. The enclave will provide

Document management (including Adobe and DocuSign) and including enabling agreements to be “linked” to other agreements.

Relationships and types of agreements to be managed:

• agency <> agency (MOU, Third-Party Agreement (TPA), etc)

• agency <> user (CIPSEA)

• agency <> dataset (Data use agreement (DUA))

• agency <> project (NDA, Terms of Use (TOU))

2.3.7 Event Management

Rules engine managing notifications are required for ANY dates on ANY component in the system (users, projects, datasets, agreements, trainings, etc.). Any user role may define rules specific to their function.

2.3.8 Project Request

Data Stewards may request new projects by selecting datasets and predefined agreements. This initiates “workflow” for approvals from Data Stewards, agencies, and/or persons defined in the agreement before being sent for creation.

2.3.9 Contractor User Management

Data Stewards may add/remove project users, specifying if costs are covered by agency contract or need to be invoiced separately. This initiates enclave user agreement workflows before user is created/granted access to the project.

The contractor will configure project groups for access control of data sources and file system for read-only (datasets) and read/write (project space); provisioning project and anticipated user storage requirements; provide cursory reviews of export requests and securely transfer requested export files for disclosure risk review; develop user accounts for individual researchers, ingest data and provide Tier 1 technical support (password resets).

2.3.10 Portability

The vendor will ensure the capability to remove and rebuild the enclave. The portability of the data enclave will be necessary for data and structure of the enclave to be available in a portable format, assuring the technology is in place for USDA to maintain the enclave if met with resource or technology constraints.

2.3.11 Scalable Pricing and Use Options

Researchers need options for computing hours, CPU, memory, and storage to scale the costs of projects.

2.3.12 Project Tracking

The contractor will provide project tracking tools and dashboards to determine Agency agreements and work plans which are associated with the projects as well as whether and what progress is being made on the projects to meet established work plan deliverable dates.

Dashboards should enable monitoring of onboarding status, hours used, storage used, disclosure requests and project end dates.

2.3.13 Additional Dataset Uploads

The contractor shall provide space to have approved datasets uploaded to the enclave to allow researchers to combine them with the restricted USDA data. For researchers interested in adding licensed datasets, the contractor shall obtain approval from the appropriate USDA Data Steward prior to uploading any licensed data into the enclave. The system shall ensure all uploaded information is scanned to prevent viruses from entering the data enclave. The minimum space for this is 100GB.

2.3.14 Data Output Exports

The enclave shall include a space for researchers to save outputs that they wish to have approved for public dissemination. This space shall allow USDA staff to review and approve those outputs for disclosure concerns. The enclave shall include the option to securely transfer export requests to USDA for disclosure review outside the enclave. Each dataset will have a pool of approvers that can each independently approve an export for dissemination. The export review process should include notification to the data owner and information about the project (name, PI name, date of request, all datasets being used). For each dataset being used, the export must be approved by one of the designated pool of approvers. Upon approval, a partition must exist where the researchers can download the USDA-approved outputs. The minimum size for this space is 100GB. The contractor will provide cursory disclosure review, if requested by the Agency. Cursory reviews will include a check to ensure no microdata is requested for export, all required supporting documentation is present, codes do not embed notes that disclose confidential data, and Agency data management standards for disclosure control are met.

Cursory disclosure review will occur within three business days of receipt.

The contractor should maintain an archive of all exports, both approved and rejected, that is accessible by USDA export approvers.

2.3.15 Archive of Projects

At the end of the project the contractor will transfer all workspace files to USDA and delete them from the enclave.

2.3.16 Migration of Existing Projects and Users and Prorated Pricing USDA has existing data users and projects (set up in another research environment) that will need to be migrated over to the data enclave. These research projects are midstream and will need to finish their work in the data enclave. These users will require a special data ingest to bring in their project files, programs, and materials. Line-item pricing is needed for the data ingest, project set-up, and prorated annual user fees. These costs should be included as a cost to the government.

2.4 Other Deliverables

2.4.1 Training

The contractor will provide training on the security and basic use of the data enclave to users, will store receipt of completion of that training for each user, and will supply receipts to USDA upon request.

As needed, the contractor will provide training for data enclave users in Artificial Intelligence and Machine Learning. These will be organized events put together jointly by the contractor and USDA. Please provide individual pricing for this item as the frequency of this task is undecided.

2.4.2 Technical Expertise

As needed, the contractor will provide data science expertise to clean data, process data, and provide Structured Query Language (SQL) administration. Please provide individual pricing for this item as the frequency of this task in undecided.

2.4.3 Meetings and Periodic Status Reports

The contractor team will meet with USDA staff on a scheduled basis and as needed when issues arise. At regularly scheduled meetings the contractor will provide reports on the status of data ingests, user account set-ups and on-boarding, data storage, and other items of interest as defined by the USDA.

2.4.4 Technical Support

The contractor shall provide technical support to users using the enclave by email or telephone.

Supported topics shall be procedures for accessing the data and any access issues to the enclave. Emails requests shall be responded to within two business days.

3.0 RESTRICTIONS AND PROTOCOLS

3.1 Subcontractors

The provider shall ensure all employees of the prime and sub-contractors (including third party cloud service providers) have access to the cloud data storage complete CIPSEA training and sign USDA Non-Disclosure Agreements.

3.2 Geographic Location Restrictions

The enclave should not be accessible to anyone outside of the United States and Territories. This includes users that are otherwise allowed to work with the data. The contractor shall have security measures in place to monitor for, detect, and prevent access logins that originate from outside of the United States and Territories.

3.3 Third Party Software Certification

Any third-party software used in the enclave or for data access to the enclave must support third-party software certification as defined by the U.S. Government.

3.4 Communication Protocol

The communication protocol will be detailed during kick-off and must include the following considerations.

3.4.1 Change Management/Establishment of a Change Management Board

3.4.2 Scheduled Maintenance and Downtimes

3.4.3 Export Request Notifications and Approval

3.4.4 Project Initiations and Account Creations

3.4.5 Changes to Designated Task monitors

3.4.6 Data Ingests

3.4.7 Data Deletions

3.4.8 User Account and Workspace Deletions

4.0 USDA PERSONNEL AND TERMINOLOGY DEFINITIONS

4.1 Contracting Officer Representative (COR)

The COR monitors all technical aspects of the contract and assists in contract administration.

The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements; monitor the Contractor's performance and notify both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates changes in delivery dates, or any changes that could result in additional costs or periods of performance.

4.2 USDA Task Monitors

The USDA will create an Enclave Administrative Team of Subject Matter Experts to serve as the USDA Task Monitors. In support of the COR, the USDA Task Monitors will assist in the administration, oversight, monitoring of the enclave, and management of the contract as allowed by the Contracting Officer and the COR.

4.3 USDA Researchers

USDA Researchers refers to USDA staff.

4.4 USDA-Affiliated Researchers

USDA-Affiliated Researchers refers to external researchers and cooperators authorized by USDA to request a seat in the data enclave.

4.5 USDA Data Stewards

USDA Data Stewards are staff with administrative oversight privileges. USDA Data Stewards authorize data access, data use agreements, and administrative access. The USDA Data Steward will have special permissions, e.g., to authorize access to specific data sets. Data Stewards are authorized to request creation of new projects and new project workspaces. Data Stewards have authority to authorize export of outputs from the data enclave after disclosure risk review protocol is complete.

4.6 Agent

All USDA-approved enclave data users and participants are considered USDA agents, sometimes referred to as data users in this agreement. The individuals meet the definition of agent as set forth by CIPSEA and who has been designated by the USDA to perform exclusively statistical activities under an agent agreement.

4.7 Agent Agreement

A formal legal agreement used to designate non-USDA employees as USDA agents under the authority of CIPSEA. Agent status authorizes non-USDA employees to access CIPSEA-protected data for exclusively statistical purposes.

4.8 Memorandum of Understanding (MOU)

An MOU authorizes the specified parties of the MOU, individuals external to USDA, to receive access to confidential data and specifies the security requirements and protocols for using the data for research as well as the safe handling of the confidential data.

4.9 Project

A specific and defined research quote submitted and accepted by the USDA. Each project may have multiple researchers/users who will be required to complete an agent agreement prior to gaining access to the enclave.

5.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, SERVICES

5.1. Services

The Government will answer questions about USDA data or procedures, review and provide feedback on deliverables.

5.2 Facilities and Equipment

No facilities or equipment shall be provided under this contract.

5.3 Materials

The Government will provide all restricted-access datasets to be accessed within the enclave.

The government will also provide a list of approved research agreements, including researcher contact information, approved datasets, and confirmation that the researchers have an approved MOU/User Agreement and have completed required CIPSEA and security training.

Datasets may be updated yearly with new information.

6.0 CONTRACTOR FURNISHED PROPERTY, EQUIPMENT, SERVICES

6.1 General

The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed as Government furnished items and services.

6.2. Materials

The Contractor shall furnish all materials required to perform work under this contract including office supplies.

6.3. Equipment

The Contractor shall furnish and maintain all necessary equipment required to perform work under this contract including but not limited to computers, hardware and software required to conduct analysis.

7.0 DELIVERABLES SCHEDULE

Deliverable/ Milestones Timing or Frequency Format Submit To

1. Kick off and clarification meeting

Within 10 business days of award. Teleconference COR and Task Monitors

2. Task Management Plan and Quality Control Plan

2 weeks after kick-off meeting MSWord COR and Task Monitors via email

3. Meeting notes Within 2 business days after meetings MSWord COR and Task Monitors via email

4. Monthly Progress Reports

Every Friday during enclave constructions, and by the 5th day of the month for the duration of the contract.

MSWord COR and Task Monitors via email

5. Enclave Migration Complete 90 days after kick-off meeting. COR and Task Monitors

6. Database of data user agreements 90 days after kick-off meeting. COR and Task Monitors

7. Documentation that the enclave complies to all applicable security requirements including FedRamp and NIST 800- 171 Moderate specifications

Proof of compliance at the time of quote. Confirmation of continued compliance shall be included in monthly reports.

MSWord COR and Task Monitors

8. Presentation of the Data Stewardship and management Module

Within 5 days of completion. COR and Task Monitors

9. Complete updates to the enclave and Data Steward Admin Module

Within 10 days of receiving USDA feedback, or within agreed-upon timeline.

COR and Task Monitors

10. Closeout Plan 90 days prior to contract expiration. COR, Contracting Officer, and Task Monitors

11. Confirmation of data transfer or destruction

Upon expiration of contract COR, Contracting Officer, and Task Monitors

8.0 CONTRACT CLOSEOUT

The contractor shall perform two (2) tasks during final contract closeout.

8.1 Closeout Plan

As stipulated by the contracting Agency, but no less than 90 days prior to contract expiration or termination, the Contractor shall provide a closeout plan to stipulate how they will preserve, transfer, or destroy the data stored in the enclave based on the Agency’s direction. USDA Task monitors will provide input as needed and approval of the plan prior to execution.

8.2 Data Integrity and Preservation

The contractor’s data enclave environment and systems shall ensure the protection, integrity, and preservation of the data. Throughout the contract period and upon expiration or termination of this contract, the Contractor shall ensure no Data Breaches occur and shall follow the approved plan to preserve, transfer, or destroy the Agency and user data stored in the enclave. The contractor shall preserve and deliver to USDA any project data that has been created in the enclave. For all other data, the contractor shall destroy it by purging or physical destruction, in accordance with National Institute of Standards and Technology (NIST) Special Publication 800-171 section 3.8.3 media protection. The Contractor shall certify in writing that the destruction of data has been completed.

9.0 INSTRUCTIONS AND REQUIRED DOCUMENTS

9.1 Instructions

The contractor shall provide written instructions and manuals to Enclave users to facilitate access and to explain basic system processes. It is assumed that individual users will be knowledgeable of how to use specific programs and any other enhanced features of the Enclave.

9.2 Quality Control Plan

The contactor shall provide a Quality Control Plan to be included with any quotes and which shall be reviewed as part of the award process.

9.3 Security Monitoring Plan

The contractor shall provide a Security Monitoring Plan to be included with any quotes and which shall be reviewed as part of the award process.

9.4 Key Personnel

9.4.1 Project manager – The contractor shall designate a project manager who will be the primary point of contact for the implementation and monitoring of the contract.

9.4.2 Information Security Officer – The contractor shall designate an Information Security Officer who will have primary responsibility for the implementation and monitoring of all aspects of security measures required by USDA and to ensure conformity with all Federal policies, standards, and practices addressing data access to ensure adherence to confidentiality and usage laws.

9.5 Pricing

Data migration will be at the expense of the contractor. Data access must be available within one week of data migration. Data migration should begin within the first week of the beginning period of performance of the contract and should take no more than two weeks. The data enclave must be operational at the time of quote. The data migration and availability is at the discretion of the individual agencies and must be coordinated with them through their contract.

Contractor will provide a pricing tier that includes price of onboarding and providing services for users for both ongoing and, also, for duration of project only users, as well as the creation of project workspaces. Users should have options for number of hours needed per month on average for a year, processing levels needed, and storage needed. Pricing should be flexible to meet agency needs for the number of ingests and disclosure reviews for each user/project.

Pricing structure shall include basic pricing for a minimum number of users with a standard suite of services and clearly stipulate any other charges based on incremental addition of users or amount of use required. Pricing strategy should be granular enough to allow USDA to calculate the cost of adding users and/or supporting specific projects.

Pricing should be provided for users who will be invoiced and paid directly to the enclave provider (self paid) and other users (covered under contract) who will be paid under the contract with USDA. Overall management of both type of users will be covered under the USDA contract.

10.0 SE10.0 SECTION 508 – ACCESSIBILITY OF INFORMATION AND COMMUNICATIONS TECHNOLOGY This contract vehicle is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 749d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). The Revised Section 508 Standards, which consist of 508 Chapters 1 and 2 (Appendix A), along with Chapters 3 through 7 (Appendix C), contain scoping and technical requirements for information and communication technology (ICT) to ensure accessibility and usability by individuals with disabilities. Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

Each ICT product or service furnished under this contract shall comply with the Revised Section 508 ICT Accessibility Standards at a minimum, as specified in the contract. If any furnished product or service is determined to be noncompliant, the Contracting Officer will notify the Contractor in writing. The Contractor shall, without charge to the Government, remediate or replace the noncompliant products or services within a specified timeframe as determined by the Government in writing. If such remediation or replacement is not completed within the time specified, the Government shall have the following recourses:

1. Cancellation of the contract, delivery, task order, purchase, or line item without termination liabilities; or

2. In the case of custom ICT being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant ICT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

The contractor must ensure all noncompliant ICT products and services are provided pursuant to extensive market research and exhibit the highest level of compliance while satisfying the contract requirements.

For every ICT product or service accepted under this contract by the Government that does not comply with the Revised Section 508 Accessibility Standards, the contractor shall, at the discretion of the Government, remediate or upgrade the item with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date, whichever shall occur first.

Section 508 Compliance Vendors, contractors, and their respective ICT products and services shall comply with the following standards, policies, and procedures. In the event of conflicts between the referenced documents and this contract vehicle, the contract vehicle shall take precedence.

1. Revised Section 508 ICT Accessibility Standards

2. Section 508 of the Rehabilitation Act as amended (29 U.S.C. 794d)

3. Federal Acquisition Regulation (FAR) Subpart 39.2

4. USDA Section 508 Departmental Regulation

Additionally, all contract deliverables are subject to these standards. All ICT products and services, regardless of format, must conform to the applicable Section 508 standards to allow Federal employees and members of the public with disabilities equivalent access to and use of information and data provided to those without disabilities.

All contractors, sub-contractors, and consultants are responsible for preparing or posting content must comply with the applicable Section 508 accessibility standards and, where applicable, those set forth in the referenced policy or standards document. Remediation of any noncompliant ICT or materials as set forth in this contract vehicle shall be the responsibility of the contractor, sub-contractor, or consultant.

According to the Access Board’s Section 508 Scoping Requirements The following Section 508 provisions apply to the products and/or services identified in this contract vehicle:

• C202 Functional Performance Criteria: Where the requirements in Chapters 4 and 5 do not address one or more functions of telecommunications or customer premises equipment, the functions not addressed shall conform to the Functional Performance Criteria specified in Chapter 3.

• C203 Electronic Content: Electronic content that is integral to the use of telecommunications or customer premises equipment shall conform to the most current Web Content Accessibility Guidelines (WCAG) Level A and Level AA Success Criteria and Conformance Requirements.

• C204 Hardware: Where components of telecommunications equipment and customer premises equipment are hardware, and transmit information or have a user interface, those components shall conform to applicable requirements in Chapter 4.

DRAFT

https://www.access-board.gov/ict/%22%20/l%20%22about-the-ict-accessibility-standards https://www.access-board.gov/law/ra.html%22%20/l%20%22text-of-section-508-of-the-rehabilitation-act-of-1973-as-amended-29-usc-794d https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2039_2.html http://www.ocio.usda.gov/document/departmental-regulation-4030-001 https://www.access-board.gov/ict/%22%20/l%20%22C203-electronic-content https://www.access-board.gov/ict/%22%20/l%20%22C204-hardware

• C205 Software: Where software is integral to the use of telecommunications functions of telecommunications equipment or customer premises equipment and has a user interface, such software shall conform to C205 and the applicable requirements in Chapter

5. WCAG Conformance: User interface components, as well as the content of platforms and applications shall conform to the most current WCAG Level A and Level AA Success Criteria and Conformance Requirements.

• C206 Support Documentation and Services: Where support documentation and services and provided for telecommunications equipment and customer premises equipment, manufacturers shall ensure that such documentation and services conform to Chapter 6 and are made available upon request at no additional charge.

In addition, vendors and contractors shall comply with the standards, policies, and procedures below for all ICT pursuant to this contract:

• For Custom ICT Development Services, the vendor or contractor shall ensure the ICT fully conforms to the applicable Revised Section 508 standards prior to delivery and before final acceptance.

• For Installation, Configuration, and Integration Services, the vendor or contractor shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised Section 508 standards.

• For Maintenance, Upgrades, and Replacements, the vendor or contractor shall ensure maintenance upgrades, substitutions, and replacements do not reduce the original level of conformance with the applicable Revised Section 508 standards at the time of the contract award.

• Service Personnel are ensured by the vendor or contractor to possess the knowledge, skills, and ability necessary to address the applicable Revised Section 508 standards and shall provide supporting documentation upon request.

• When providing Hosting Services, the vendor or contractor shall not reduce the existing level of conformance of the electronic content with the applicable Revised Section 508 standards.

• When purchasing ICT where 1) Section 508 validation is not possible prior to award, 2) the ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, the vendor or contractor shall test and validate the ICT solution for conformance to the Revised Section 508 standards, in accordance with the required testing methods as defined by the agency.

• The vendor or contractor shall document and maintain information regarding the measures taken to ensure compliance with the applicable requirements. This documentation includes but is not limited to testing records, product demonstrations, and reported defects by end users and testers.

• Prior to acceptance, the vendor or contractor shall provide an Accessibility Conformance Report (ACR) for each ICT item that is developed, updated, and/or configured for the agency, and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary Product Accessibility Template (VPAT) provided by the Information Technology Industry Council (ITI). To be considered for award, an ACR must be submitted for each ICT item, and must be completed according to the instructions provided by the ITI.

Note: A supplemental ACR may be required if the agency has additional or stricter accessibility requirements than what is outlined in the VPAT.

DRAFT

https://www.access-board.gov/ict/%22%20/l%20%22C205-software https://www.access-board.gov/ict/%22%20/l%20%22C206-documentation-services https://www.section508.gov/sell/vpat http://www.itic.org/policy/accessibility http://www.itic.org/policy/accessibility

• Prior to acceptance, the agency reserves the right to require a full working demonstration of the completed ICT item to demonstrate conformance to the agency’s accessibility requirements in addition to independent testing to validate.

• In the case of non-compliance where the vendor or contractor claims its products and/or services satisfy the applicable Revised Section 508 standards specified in the contract vehicle, the contracting officer will promptly inform the vendor or contractor in writing of the non-compliance. The vendor or contractor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.

All Information and Communications Technology (ICT) subject to the Revised Section 508 standards will be evaluated for Section 508 conformance and usability. The test must be administered by a Federal Section 508 Testing Center. All maintenance for ICT that requires upgrades, modifications, installations, repairs, and purchases shall adhere to the Revised Section 508 standards.

11.0 COMPLIANCE WITH INTERNET PROTOCOL VERSION 6 (IPV6) IN ACQUIRING INFORMATION

TECHNOLOGY

Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500- 267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products:

Specifically, any new IP product or system developed, acquired, or produced must:

(1) Interoperate with both IPv6 and IPv4 systems and products, and

(2) Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

(3) As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government.

(4) The Contractor shall provide technical support for both IPv4 and IPv6.

(5) Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

(6) Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified or replaced to bring it into compliance at no additional cost to the Government.

• item, and must be completed according to the instructions provided by the ITI.