Response to FedRAMP RFI submitted by Four Points Technology LLC

# Question/Comment on FedRamp RFI Directory

## Name and Affiliation
{Joel A. Lipkin Chief Operating Officer and Victoria L. Losman Director of Business Development Four Points Technology LLC}

## Cloud Services
{EXAMPLES OF POSITIVE ACQUISITION LANGUAGE
Four Points is providing verbatim extracts from actual RFPs/RFQs followed by comments explaining the relevance and importance.

General Cloud Services Positive Example #1
Prime Contractor Authorization/Certification
The , requires cloud services from an Authorized Public Sector Reseller

Four Points comment: Limits prime bidders to CSP authorized resellers. This is an important qualification because in cloud provisioning/delivery contracts the prime contractor has on-going responsibilities for reporting, billing, and managing funding to avoid anti-deficiency situations. The prime (and not a subcontractor/supplier) must be experienced in these core delivery services. Authorization to resell is different from technical and services related certifications and is focused on the specific skills necessary to support provisioning.

General Cloud Services Positive Example #2
Past Performance
The contractor shall provide past performance descriptions of three projects that demonstrate how well the contractor performed work relevant to the requirements of this solicitation. Projects must have been completed within the past 5 years, or be currently active for at least 1 year. Past performance descriptions shall include the following information:
 Name of contractor
 Company providing reference
 Contract number
 Contract period of performance
 Contract name/project title
 Contract dollar value
 Type of contract (firm-fixed price, IDIQ, etc.)

The Government seeks to determine how well contractors have satisfied their customers;
adhered to the applicable Federal, State, and local laws and regulations; and conducted business in an ethical manner. These factors are an indication of contractors’ probability of success on the current requirement.
For each of the three projects described in … “Past Performance,” the
contractor shall provide the reference in the form of a past performance questionnaire
submitted to by the POC associated with each project. The Government’s evaluation of past performance will consist of a qualitative assessment of verified performance on previous and/or ongoing contracts. The Government’s evaluation of past performance will be based upon consideration of all relevant facts and circumstances. The Government will evaluate the quality of contractors’ relevant past performance, and the probability of successfully performing the requirements in the solicitation based upon these references of past performance.

Four Points comment: Relevant past performance – demonstrated ability to perform on projects of similar scope and complexity -- is the best determinant of a prime contractor’s ability to perform on a new procurement. Cloud provisioning and the associated support requirements are anything BUT commoditized and should always be procured through a best value approach that emphasizes prime contractor capabilities and past performance.

General Cloud Services Positive Example #3
Scope of XaaS to be provided:
The , requires cloud services …in support of all service levels: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).

Four Points comment: Hyperscale CSPs provide a variety of “as a service” solutions beyond pure IaaS or PaaS. Agencies should have the flexibility to access all CSP capabilities in a single procurement. Ideally this includes CSP delivered support, services, and training. Additionally, each CSP has a marketplace to procure SaaS tools that sit within their environment. The procurement should include SaaS products via the marketplace and the option to procure enterprise-level SaaS for the infrastructure.

General Cloud Services Positive Example #4
Multiple CSP Provisioning
An Authorized Public Sector Reseller shall provide access to all Cloud Service Providers (CSPs) that are at the time of the solicitation date in compliance with the following U.S. Government and Agency requirements:
1. Currently Operate a Government Community Cloud with a Federal Risk and Authorization Management Program (FedRAMP) High Certification;
2. Authority To Operate (ATO) at the IaaS level in their Government Community Cloud offering at the FedRamp High Level.

Four Points comment: Providing access to multiple CSPs through a single contract achieves multiple positive results These include:
- Post-award competition among multiple CSPs
- Agency access to broader range of solutions
- Eliminates the need for a CSP-specific J&A
- Eliminates the need for multiple procurements

General Cloud Services Positive Example #5
The Contractor shall provide the following operational program management services for each CSP:
o Account Management:
Root Account Creation for each CSP based on standard CSP structures with Identity and Access Management (IAM) access;
Sub-Account Creation under CSP-Specific Root Accounts with capabilityto transfer accounts to/from any other Root Account;
If/As directed by , transferring existing and third-party (other reseller or integrator) owned accounts to the Contractor provided Dedicated Root Account;
Creating/setting up separate billing accounts as required;
Creating additional CSP specific Government Community Cloud accounts within 96 hours from the date of the request for such specific accounts;
Ensure any purchased Credits are available for usage within the respective CSP within 96 hours from the date exercises its option for additional Credits;
o Detailed Reporting Capabilities:
 plans to use CSP specific tagging and/or grouping mechanisms for granular cost and other reporting within all CSP Accounts. The Contractor shall provide direct access to each CSPs standard, secure web based reporting interface and/or APIs to enable to generate, view, and download in at least one standard format (i.e. comma separated values, MS Excel, Adobe PDF) detailed reports that identify service usage by each account, sub account, and/or by defined tags;
The Contractor shall provide Monthly Invoices and Usage Reports in Microsoft Excel 2016, or later, format that includes a detailed breakdown of monthly cloud service usage and cost by designated tags, subtotaled for each tag along with a monthly grand total. Excel documents shall be formatted and contain data so that data is easily manageable and extractable by using standard Excel features for use in other artifacts
and systems.;
The Contractor shall notify the Contracting Officer’s Representative (COR) in writing when spend for CSP usage/consumption reaches 85% of the total funded ceiling for each active CLIN. The Government will not be obligated to pay the Contractor any amount in excess of the funded ceiling amount.

Four Points comment: Cloud provisioning is fundamentally different than delivering hardware or software. A successful Cloud implementation requires ongoing support from the Prime contractor.
The capabilities required of the Prime Contractor should be identified as mandatory and the ability of the Prime to deliver should be a core element of the evaluation criteria and Best Value determination.

General Cloud Services Positive Example #6
Preferred pricing mechanism/multi-year procurement (Base + Option Years)
Consistent with Federal Acquisition Regulation (FAR) 8.404, wishes to maximize administrative and purchasing savings with qualified FSS contractors by obtaining discounted rates below FSS list prices. In order to achieve this goal, the pricing table shall consist of a percentage discount, per BPA year, off of contractors’ GSA FSS schedule 70 contracts.
Four Points comment: This language provides a manageable mechanism for easily taking advantage of future Cloud cost reductions as they occur in the commercial world.

General Cloud Services Positive Example #7
Best Value Evaluation Methodology
All quotations will be evaluated based on the following criteria:
- Technical Capability
- Past Performance
- Price
Technical capability is more important than Past Performance and Past Performance is slightly more important than Price. Technical and Past Performance combined are more important than Price.

Four Points comment: The above language is from a solicitation from a customer who previously awarded a multi-year contract based on LPTA and chose not to exercise option years based on poor performance by the prime. In their current award they adopted a best value approach as defined above.

General Cloud Services Negative Example #1
LPTA Evaluation
Award will be made to the lowest priced, responsive, responsible offeror whose quote conforms to the requirements of the solicitation set forth in the Price Schedule and Product Description of the solicitation.

Four Points comment: LPTA is such a significant issue that Four Points is providing a detailed position on LPTA. File attached.
}

## FedRAMP PMO
{
FedRAMP Positive Example #1
Any proposed cloud or cloud-hybrid solution by the offeror must be FEDRAMP-certified or FEDRAMP Certification ready. (The offeror must have an existing Authority to Operate from a GSA-approved FEDRAMP provider.) The contractor must maintain their Authority to Operate from a GSA-approved FEDRAMP provider throughout the duration of the contract and any extensions ordered by the

Four Points comment: In the above example, the Agency clearly specifies FedRAMP requirements at time of award and over the life of the contract.

FedRAMP Positive Example #2
Provide all Assessment and Authorization (A&A) support required to achieve and maintain full A&A certification in compliance with the most current versions of Handbook … The A&A process is the end to end process for ensuring new information systems adhere to and are in compliance with Federal Information Security Management Act (FISMA). The purpose of an Authority to Operate (ATO) is to ensure the risks to (operations, assets, or individuals) are acceptable. The result is the issuance of an ATO. If the risk to Agency operations, assets or individuals is low, an ATO authorizes the system to be moved into production or use production data. The vendor shall develop and submit all required security document artifacts as described in

Four Points comment: This project involves moving a COTS application to a CSP Government Cloud environment. The Agency is clear that the Agency is responsible for the ATO, and the contractor is responsible for providing the documentation, evidence and artifacts required for the Agency to make an informed ATO decision.

FedRAMP Positive Example #3
An Authorized Public Sector Reseller shall provide access to all Cloud Service Providers (CSPs) that are at the time of the solicitation date in compliance with the following U.S. Government and Agency requirements:
1. Currently Operate a Government Community Cloud with a Federal Risk and
Authorization Management Program (FedRAMP) High Certification;
2. Agency Authority To Operate (ATO) at the IaaS level in their Government CommunityCloud offering at the FedRamp High Level

Four Points comment: Minimum mandatory requirements are clearly defined both in terms of FedRAMP and Agency authorizations.

FedRAMP Negative Example #1
Secure, high availability cloud environment has been provisioned to support the operational … system, within XX days of contract award, with the ability to scale to meet emerging requirements.

Four Points comment: Operational, production systems require Agency ATOs. No definition of Agency support for approval is provided. Prime contractor needed to specify roles and responsibilities in their response. Inexperienced bidder could easily overlook costs, timeframes and level of effort associated with ATO documentation.
}

[LPTA Avoidance final.docx](https://github.com/GSA/fedramp/files/1564095/LPTA.Avoidance.final.docx)