Attachment 4: Security Objectives - Services Level Agreement

Foundation Cloud Hosting Services II

(FCHS2)

Section J
Attachment 1

C.5 Security Objectives – Service Level Agreements

This attachment covers security and privacy objectives by setting Service Level Agreement (SLA) metrics. In addition, see Attachment 2, “Information Technology Baseline Compliance Contract Guidelines” which is a mandatory policy for all DOI IT System compliance. Solicitation for Assessment requirement is a firm-fixed price (FFP) that requires vendors to agree to Services Level Agreement (SLA), no additional cost will be incurred for the hosting cloud service provider (CSP).

The government is requesting Contractors describe the right way to host their cloud environments and configure their cloud services, not the other way around. Individual DOI task orders shall not be less restrictive than Attachment 1 and/or Attachment 2 unless otherwise approved.
“The most important Security Law is The Federal Information Security Management Act (FISMA), which is the foundation of most cybersecurity policy in the U.S. today. This requires agencies to follow a series of processes to secure information systems created or used by the government. The Office of Management and Budget (OMB) has issued memoranda on many security topics, in addition to the security standards created by the The National Institute of Standards and Technology (NIST). The Inspector General (IG) of an agency is also required by FISMA to assess the overall cybersecurity program on an

annual basis.”

The following categories are based on ISO_IEC_19086 standards to include (1) accessibility, (2) availability, (3) performance, (4) service reliability, (5) data management, (6) information security, (7) service support, and (8) governance.
Assurances, Inspection, Penalties/Provisions
To baseline SLA commitments of cloud compute services, the government is requesting Contractor proposals include:
1. Assurance you can meet the standard (default) levels as required in a monthly billing cycle; or propose alternative SLA standards, as applicable, and as appropriate for the cloud computing service and to achieve an agreed baseline between the government and Contractor; and
2. Identify the commercially reasonable inspection technique to measure SLA metric compliance, including self-test, no response, error message, % threshold, etc. as appropriate for that service; and
3. A penalty or provision in the event of not meeting that service level, such as service credits.
Use Table 11 Service Level Baselines below for responding to this requirement. Adjust measures