Using a GSA MAS BPA to Procure Cloud Services
A Blanket Purchase Agreement (BPA) established under the GSA Multiple Award Schedule (MAS) can provide federal agencies with a streamlined approach for acquiring recurring cloud products, cloud services, and related professional services.
Under FAR 8.405-3, ordering activities may establish BPAs under Schedule contracts to fill repetitive needs for supplies or services. The BPA should be established with the Schedule contractor or contractors that provide the best value for the agency’s requirements.
Why Use a Schedule BPA?
A Schedule BPA can be useful when an agency expects recurring requirements and wants to establish consistent ordering procedures, technical requirements, service levels, pricing arrangements, security requirements, and administrative terms before individual orders are placed.
- Streamline recurring purchases under established Schedule contracts
- Define common technical and operational requirements
- Establish ordering, invoicing, and delivery procedures
- Address applicable service-level and performance requirements
- Provide opportunities to negotiate discounts or other favorable terms
- Support consistent security, governance, and reporting requirements
- Reduce repetitive administrative effort for recurring requirements
GSA Multiple Award Schedule Cloud Services
The GSA Multiple Award Schedule includes an Information Technology – Cloud Services category. SIN 518210C, Cloud Computing and Cloud Related IT Professional Services, covers commercially available cloud computing services and professional services supporting government cloud adoption, migration, modernization, governance, and management.
Services within the scope of the SIN include Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), emerging cloud services, and cloud-related professional services.
- Cloud assessments and planning
- Infrastructure as a Service (IaaS)
- Platform as a Service (PaaS)
- Software as a Service (SaaS)
- Cloud migration and workload modernization
- Cloud governance and management
- DevOps and automation
- Cloud-native application development
- Cloud security and related professional services
- Emerging cloud technologies, including cloud-based AI and machine learning services
Single-Award vs. Multiple-Award BPAs
FAR 8.405-3 provides for both single-award and multiple-award Schedule BPAs. To the maximum extent practicable, ordering activities are directed to give preference to establishing multiple-award BPAs rather than single-award BPAs.
A multiple-award BPA can preserve competition among qualified Schedule contractors for individual requirements, while a single-award BPA may be appropriate when supported by the circumstances and applicable acquisition requirements.
What Should a Cloud BPA Address?
The BPA should clearly define the agency’s anticipated requirements and the administrative and operational framework for placing orders. FAR 8.405-3 identifies areas such as ordering frequency, invoicing, discounts, requirements, delivery locations, and timing that should be addressed.
For cloud requirements, agencies should also consider technical, security, governance, financial, and service-management requirements.
Technical Requirements
- Cloud architecture and service models
- Workload and application requirements
- Networking and connectivity
- Identity and access integration
- Data storage and protection
- Migration and modernization services
- Interoperability and portability
Operational Requirements
- Service levels and performance measures
- Monitoring and reporting
- Incident and service-request management
- Backup, recovery, and resilience
- Configuration and change management
- Technical support
- Continual service improvement
Security & Compliance Considerations
Security requirements should be incorporated into the acquisition from the beginning. The agency should identify applicable security, privacy, data-protection, authorization, and contractual requirements and determine how responsibilities will be divided among the cloud service provider, Schedule contractor, managed-services provider, and government customer.
- Applicable FedRAMP requirements
- Data classification and handling requirements
- Identity and access management
- Encryption and key management
- Security logging and monitoring
- Vulnerability and configuration management
- Incident reporting and response
- Data location and personnel-access requirements where applicable
- Evidence and reporting required for authorization and ongoing monitoring
Cloud Financial Management
Cloud services often use consumption-based pricing, making financial management an important part of the BPA structure. Agencies should consider how cloud usage will be measured, allocated, monitored, forecast, and optimized.
- Usage and cost visibility
- Budgeting and forecasting
- Resource tagging and cost allocation
- Pricing and commitment options
- Licensing considerations
- Unused or underutilized-resource management
- Regular optimization and cost reviews
Managed & Professional Services
Cloud acquisition frequently involves more than purchasing cloud consumption. Agencies may also require architecture, migration, security, governance, operations, financial management, technical support, modernization, and managed services.
When these services are part of the requirement, the BPA and associated statements of work should clearly define the work to be performed, performance expectations, deliverables, responsibilities, and any specialized requirements.
Best-Value Considerations
Price is an important consideration, but cloud acquisition decisions should also evaluate technical capability, past performance, service features, security, operational support, migration capabilities, resilience, governance, and the ability to meet mission requirements.
A well-designed BPA can help an agency establish a repeatable acquisition framework while retaining sufficient flexibility to respond to changes in workloads, cloud technologies, security requirements, and mission needs.
A&T’s Cloud Acquisition Support
A&T Systems supports government customers with cloud architecture, acquisition planning, migration, cybersecurity, governance, managed operations, financial management, and ongoing technical services.
A&T works with customers to translate mission and technical requirements into cloud solutions that address architecture, security, service management, performance, resilience, cost, and operational accountability.
For related information, see Cloud Computing & Datacenter Services, Public Cloud Services Acquisition Strategies, and A&T’s Government Contract Vehicles.