Using GSA MAS to Procure Cloud Services

Using GSA MAS to Procure Cloud Services

The GSA Multiple Award Schedule (MAS) provides eligible government agencies with access to pre-qualified commercial technology providers offering cloud products, cloud services, and related professional services.

Cloud services are available under the MAS Information Technology category, including SIN 518210C, Cloud Computing and Cloud Related IT Professional Services. This SIN supports commercially available cloud services as well as professional services associated with cloud assessment, migration, modernization, governance, management, and operations.

Cloud Services Available Through GSA MAS

SIN 518210C includes a broad range of cloud capabilities and related professional services.

• Infrastructure as a Service (IaaS)
• Platform as a Service (PaaS)
• Software as a Service (SaaS)
• Cloud assessments and planning
• Cloud migration and modernization
• Cloud governance and management
• DevOps and automation
• Cloud-native application development
• Cloud security and related professional services
• Emerging cloud technologies, including cloud-based artificial intelligence and machine learning

Federal Agency Ordering

Federal agencies purchasing through MAS should follow the applicable Federal Supply Schedule ordering procedures and their agency acquisition policies.

The appropriate ordering procedure depends on the nature of the requirement. FAR 8.405-1 applies to supplies and services that do not require a Statement of Work, while FAR 8.405-2 addresses services requiring a Statement of Work.

What Should a Cloud Requirement Include?

Cloud acquisitions should address more than the underlying computing resources. Agencies should define technical, security, operational, financial, and service-management requirements appropriate to the mission and workloads being supported.

• Cloud service and deployment models
• Architecture and workload requirements
• Migration and modernization needs
• Identity and access management
• Cybersecurity and compliance requirements
• Data protection and retention
• Networking and connectivity
• Availability, backup, recovery, and resilience
• Monitoring and operational support
• Service levels and performance measures
• Cloud cost management and reporting
• Exit, transition, and data-portability requirements

Security & Authorization Requirements

Government cloud acquisitions should identify applicable cybersecurity, privacy, data-handling, and authorization requirements before an order is placed.

Depending on the agency and workload, requirements may include FedRAMP, agency authorization procedures, NIST security controls, data-location requirements, identity and access controls, encryption, logging, vulnerability management, incident response, and continuous-monitoring obligations.

The specific requirements should be tied to the agency’s mission, information classification, risk profile, and contractual obligations rather than assumed to be the same for every cloud acquisition.

State & Local Cooperative Purchasing

Eligible state, local, tribal, and certain other governmental organizations may purchase qualifying Information Technology products and services through GSA’s Cooperative Purchasing Program.

SIN 518210C, Cloud Computing and Cloud Related IT Professional Services, is currently eligible for Cooperative Purchasing.

• Confirm that the organization is eligible to use the Cooperative Purchasing Program
• Confirm that the applicable SIN is eligible for Cooperative Purchasing
• Follow applicable state, local, tribal, or organizational procurement requirements
• Identify the applicable GSA MAS contract and SIN on the solicitation or order
• Confirm that the Schedule contractor accepts the Cooperative Purchasing order

State & Local Ordering Considerations

State and local governments retain responsibility for following their applicable procurement laws, competition requirements, funding restrictions, and internal acquisition procedures when using GSA Cooperative Purchasing.

GSA recommends that eligible buyers identify the applicable MAS contract number and Special Item Number when issuing an order or Request for Quote. Applicable MAS terms and conditions generally flow to the order, subject to the rules of the Cooperative Purchasing Program.

Cloud Professional & Managed Services

Agencies should consider whether the requirement includes professional or managed services in addition to cloud consumption.

• Cloud architecture and engineering
• Migration and workload modernization
• Cybersecurity and compliance support
• Landing-zone implementation
• Governance and operational controls
• Monitoring and service management
• Backup, recovery, and resilience
• Cloud financial management and optimization
• Ongoing managed cloud operations

These requirements should be clearly incorporated into the Statement of Work, performance requirements, evaluation criteria, and ordering documentation where applicable.

Best-Value Cloud Acquisition

Cloud acquisition decisions should consider more than unit price. Agencies should evaluate technical capability, security, past performance, migration experience, service levels, operational support, resilience, governance, portability, and total lifecycle cost.

The appropriate solution may include cloud infrastructure, professional services, managed services, or a combination of these capabilities depending on the customer’s operational model.

A&T’s Cloud Acquisition Support

A&T Systems supports federal, state, and local customers with cloud architecture, acquisition planning, migration, cybersecurity, governance, managed operations, financial management, and modernization services.

Our approach connects cloud procurement decisions with the technical, security, operational, and service-management requirements needed to operate the resulting environment throughout its lifecycle.

For recurring cloud requirements, see Using a GSA MAS BPA to Procure Cloud Services. You may also review Public Cloud Services Acquisition Strategies and A&T’s Government Contract Vehicles.