Email as a Service (EaaS) Blanket Purchase Agreement (BPA) Requirements Document Purpose The purpose of this document is to provide a comprehensive list of the requirements that were outlined in the original solicitation and subsequent amendments for the EaaS BPA. This document can be used to assess if your organization’s Email as a Service requirements are met under the EaaS BPA requirements. It can also be as a reference for developing your Task Order documentation. This document was last updated on 2/11/15 for changes related to Section A.2:1 and D16. Points of Contact Customer should contact GSA Technology Solutions at (855) ITaid4U (482-4348) or by email at . Adrian Fish – Service Line Manager, EaaS Greg Norman – Contracting Officer, EaaS
services required for use in the Quoter’s Information System in accordance with NIST Special Publication 800-81 rev. 1. 40 8 21 Data Center Facilities LAN/WAN N The Quoter shall provide data center facilities including space, power, physical infrastructure (hardware). Upon request from the Government, the hosting Quoter shall provide access to the hosting facility for inspection 40 8 22 Data Center Facilities LAN/WAN N The Quoter shall specify the locations where data center facilities will be located and guarantee that all data center facilities will be located where specified in each price offering. Lot Specific Technical Requirements – Section C.4.3 Email-as-a-Service Requirements – Section C.4.3.1.1 42 10 1.1 Email as a Service General Provider Capabilities Y The Quoter shall provide a service that allows for high availability of 99.9% excluding pre-scheduled maintenance. The Quoter shall document and provide their pre-scheduled maintenance policies and windows of operation as part of this solicitation. The Quoter shall document and provide their maintenance and growth policies that demonstrate how they comply with the following system availability requirements: Service Availability (Measured as Total Uptime Hours / Total Hours within the Month) displayed as a percentage of availability up to one-tenth of a percent (e.g. 99.9%). Within a month of a major outage occurrence resulting in greater than 1-hour of unscheduled downtime. The Quoter shall describe the outage including description of and fix. Service provisioning and de-provisioning times (scale up and down) in near real-time. A Recovery Point Objective (RPO) of < 45 minutes per event. A Recovery Time Objective (RTO) of < two (2) hour per event. 42 10 1.2 Email as a Service 1. General Provider Capabilities N Reserved 42 10 1.3 Email as a Service 1. General Provider N The Quoter shall provide a soft copy and Uniform Resource Locator (URL) to a webpage for the Ordering Activity that cause
48 10 7.5 Email as a Service 7. eDiscovery Capabilities N The Quoter shall include the ability to permanently delete copies of data in accord with existing federal record retention schedules and policies, as well as to delete back-up versions of data maintained as part of the overall SaaS, in accordance with standard industry procedures for recycling backup media. 48 10 8.1 Email as a Service 8.User Administration, Authentication & Access N The Quoter shall allow Government Administrators to provide remote administration of end-user account provisioning, and access privileges through a web browser interface. 48 10 8.2 Email as a Service 8.User Administration, Authentication & Access N The Quoter shall provide configurable synchronization tools for integration with a Government LDAP source for provisioning, account disablement and enablement. Synchronization communication shall be conducted over Secure Sockets Layer (SSL)/Transport Layer Security (TLS) session supporting FIPS 140-2 encryption. 48 10 8.3 Email as a Service 8.User Administration, Authentication & Access N The Quoter shall comply with Media Protection standards as described in NIST Special Publication 800-88: Guidelines for Media Sanitization. 48 10 8.4 Email as a Service 8.User Administration, Authentication & Access N The Quoter shall support integration with agency directory services supporting an integrated authentication and authorization model (single sign on) utilizing the e-Government profile for Security Assertion Markup Language 2.0 (SAML 2.0). 48 10 8.5 Email as a Service 8.User Administration, Authentication & Access N The Quoter shall allow Government Administrators to allow access through the use of username and password if an administrator determines that the end user cannot utilize the agency’s multi-factor identification. 48 10 8.6 Email as a Service 8.User Administration, Authentication & Access N The Quoter shall provide end users the ability reset their own passwords. 48 10 8.7 Email as a Service 8.User Administration, Authentication & Access N The Quoter’s should provide end users with a local client application allowing offline access to cached email. If a separate local client application is provided by the Quoter, the local client shall only perform all or a subset of all of the solution’s functionality available through the web interface. The local client application shall not be necessary to perform any function offered by the
Maintenance of links between records and metadata, and Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with retention schedules. 55 16 2 Records Management Records Management Capabilities N The Quoter shall provide common Application Programming Interfaces (APIs) based upon open standards (ref: OMB Circular A-119) allowing integration with third party tools such as email archiving solutions, E-Discovery solutions, and Electronic Records Management Software Applications, including those that meet the requirements of 36 C.F.R. 1236.20 & 22, and that also allow for the transfer of permanent records to NARA per 36 CFR Part 1235. 55 16 3 Records Management Records Management Capabilities Y If certified, the Quoter shall provide DoD 5015.02-STD baseline requirements compliance test configuration ID number demonstrating they have passed DoD 5015.02-STD. Ref: 55 16 4 Records Management Capabilities Records Management Capabilities N The Quoter should provide a solution compliant with the following standards: • ISO 15489-1 () • Federal Enterprise Architecture Records Management Profile () • National Archives & Records Administration RM Profile checklists () Migration Service Requirements – Section C.4.3.4 56 17 N/A Migration Services Service Description N Service shall provide migration services for mailbox data from production source system including message store, calendar items and contacts. 56 17 N/A Migration Services Service Description N Service shall establish synchronization with agency LDAP provider via SAML interface. 56 17 N/A Migration Services Service Description Y Excluding sub-lot 1c, service shall provide integration between EaaS System and mobile devices if requested by Ordering Activity. 56 17 N/A Migration Services Service Description N Service shall establish dual-delivery of messages during transition period. 56 17 N/A Migration Services Service Description N Service shall establish proof of concept for message prior to commencing transition of production mailboxes. 56 17 N/A Migration Service Y After migration the service shall provide access to historical data
Capabilities Integration Service requirements – Section C.4.3.5 59 19 N/A Integration Services Service Description N Quoter shall offer development and technical maintenance services for integration of applications that extend the EaaS provider solution. 59 19 N/A Integration Services Service Description N At task order award, the Quoter shall be responsible for all work and deliverable products identified in individual task order(s). 59 19 N/A Integration Services Service Options N Personnel Clearance – Personnel provided for each of the tasks shall have achieved the appropriate clearances: Lot 5a – NACI Lot 5b – Secret Clearance Lot 5c – Top Secret Clearance Lot 5d - NACI 59 19 N/A Integration Services Service Options N Labor Categories - Service options shall be provided by labor categories as follows: Project Manager Subject Matter Expertise (SME) I Subject Matter Expertise (SME) II Subject Matter Expertise (SME) III Quality Assurance Analyst System Architect System Programmer Hardware/Software Specialist Security Specialist Test Manager Change Management Lead 60 20 1 Integration Services Technical Requirements – Integration Service Capabilities N The Quoter shall provide the Government dedicated project management support. 60 20 2 Integration Services Technical Requirements – Integration Service N The Quoter shall maintain an Integration Project Plan and maintain schedules providing key milestones, task dependencies, and resource requirements.
Capabilities 60 20 3 Integration Services Technical Requirements – Integration Service Capabilities N The Quoter shall provide internal controls, management oversight and office support for the Integration Project Plan. 60 20 4 Integration Services Technical Requirements – Integration Service Capabilities N The Quoter shall conduct weekly status meetings; drafting and delivering agendas and meeting minutes, documenting, tracking and following-up on action items from the meetings. 60 20 5 Integration Services Technical Requirements – Integration Service Capabilities N The Quoter shall provide a Monthly Status Report (MSR) that briefly summarizes the management and technical progress to date. The government shall instruct the Quoter on the level of MSR detail it wishes based on the Task Order Request (TOR). The Quoter shall provide such reports as the following when applicable, based on the TOR: Milestones vs. costs by tasks/activities Items purchased for the Government 60 20 6 Integration Services Technical Requirements – Integration Service Capabilities N The Quoter shall provide System Engineering which may include implementation of new application systems, and maintenance and/or enhancement of existing applications to support the core mission. 60 20 7 Integration Services Technical Requirements – Integration Service Capabilities N The Quoter shall develop an appropriate change management strategy that at a minimum will: Identify and fully articulate the major organizational changes that the initiative will bring; Develop specific transition and communication strategies for the various stakeholder groups; Develop strategies for mitigating and managing major barriers for implementation; Work with Federal counterpart(s) and communication support staff. 60 20 8 Integration Services Technical Requirements – Integration N The Quoter shall provide the Government configuration management support.
62 N/A C.5.2 Par. 2 Information Technology (IT) Systems Security Requirements N/A N Quoters shall obtain an adjudicated Authorization-To-Operate at the appropriate level through their BPA customer before fulfillment of any ordering activity. 62 N/A C.5.2 Par. 3 IT Systems Security Requirements N/A N The cost of meeting all security requirements and maintaining authorization shall be incorporated into the quoted prices. 62 N/A C.5.2 Par. 4 IT Systems Security Requirements N/A Y Quoters shall maintain a security management environment that meets or exceeds the requirements described in section D.8 based upon the latest edition of NIST Special Publication 800-53. 62 N/A C.5.2 Par. 5 IT Systems Security Requirements N/A Y Within 180 days of either the Federal Risk and Authorization Management Program (FedRAMP) achieving Initial Operating Capability or BPA award, whichever comes later, the Quoter shall submit appropriate documentation necessary to commence the FedRAMP security authorization process for offerings at the moderate impact level. The security authorization process for Secret Enclave high impact level service offerings will be conducted by the Ordering Activity. 62 N/A C.5.3 (a) Privacy Requirements N/A N (a)The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this award or otherwise provided by the Government. 63 N/A C.5.3 (b) Privacy Requirements N/A N (b) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases. 63 N/A C.5.3 (c) Privacy Requirements N/A N (c) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. 63 N/A C.5.3 (d) Privacy Requirements N/A Y (d) The Contractor shall safeguard any Personally Identifiable Information (PII) stored in the information system in accordance