Accessibility Information

Users of assistive technologies such as screen readers should use the following link to activate Accessibility Mode before continuing: Learn more and Activate accessibility mode.

Sources Sought for Potential Cloud Computing Services

Solicitation Number: NRC_Cloud_Computing_Sources_Sought_Feb2013
Agency: Nuclear Regulatory Commission
Office: Acquisition Management Division
Location: Acquisition Management Division
  • Print
Sources Sought
Added: Feb 01, 2013 2:22 pm


NRC is issuing this sources sought synopsis as a means of conducting market research to determine the availability and potential technical capability of sources to provide a broad range of cloud computing services.


The NRC headquarters (currently consisting of several buildings in the Rockville, Maryland area) are located in Bethesda, MD. The NRC also has other offices in the following locations:

• Regional Office in King of Prussia, PA
• Regional Office in Atlanta, GA
• Regional Office in Lisle, IL
• Regional Office in Arlington, TX
• Technical Training Center (TTC) in Chattanooga, TN.

Collectively among the NRC headquarters and other locations, there are approximately 6,400 NRC employees and contractor personnel.


Types of cloud computing services that NRC may acquire from a contractor in the future, and potentially on a phased basis, may include one or more of the following:

1) Infrastructure Hosting Services. NRC infrastructure (servers and storage) that supports Headquarters and Regional data center services may be hosted at one or more contractor facilities. The NRC may require at least 99.99% availability at all contractor hosting facilities that host NRC infrastructure.

a. The contractor may be required to provide all services necessary to ensure an optimal computing environment (rack space, power, HVAC, physical security, internal rack connectivity and carrier neutral telecommunications access).

b. The contractor may be required to manage and operate the data center facilities while the NRC owns and operates the IT equipment and resident applications. The NRC will continue to provide all labor to administer the hosted applications and data.

c. The contractor may be required to provide a minimum 99.99% availability using Tier IV rated facilities (using the Uptime Institute's Tier categorizations which are described at

2) Infrastructure Provisioning Services. The contractor may be required to provide a dynamic physical and virtual infrastructure to support the NRC's processing requirements. The contractor may be required to provide the physical servers and necessary support infrastructure (e.g., racks, internal network connections). The contractor may be required to dynamically create arbitrarily sized virtual machines (i.e., any combination of virtual central processing units, random access memory, and virtual machine storage subject to certain limitations) in order to meet NRC variable processing loads. The contractor may be required to dynamically reallocate virtual machines based on load, with no service interruption.

3) System Administration Services. The contractor may be required to provide basic and advanced system administration services as follows:

a. Basic system administration services include server installation and burn in, operating system loading, and system hardening in accordance with Federal Information Security Management Act (FISMA) and NRC's security requirements. Additionally, basic maintenance activities to include but are not limited to the installation of patches, upgrades to the operating system (Microsoft Windows Server 20XX, VMware and Oracle Solaris server), and system back-up and data restoration.

b. Advanced system administration services may include but are not limited to developing and maintaining configuration and other documentation, enforcing hardware, operating system standards and security, and performance tuning.

4) Application Delivery Services. The contractor may be required to provide cloud services to enable the NRC to develop and deploy scalable business applications in a secure, standardized environment. These services may include:

a. Application Platform to support application development, testing and deployment using an integrated end to end application tool set.

b. Application Services Management to provide application programming interface (API) management and services oriented architecture (SOA) governance services.

c. Messaging Services Oriented Middleware (MOM) - Cloud enabled inter-application communication software that generally relies on asynchronous message-passing.

d. Integration Services to include middleware to develop, execute, manage and govern integration flows and provide integration capabilities with NRC resident services.

5) Database Management & Data Store Services. The contractor may be required to provide cloud hosted Microsoft Structured Query Language (SQL) or Oracle Data Base Management System (DBMS)/data store services. Data store services may include the capability to store large data files which must be separated from other tenants' data.

6) Telephonic Communication Services. The contractor may be required to provide services to support NRC's telephonic communications (e.g., voice, fax, Short Message Service, and/or voice-messaging) at NRC Headquarters and Regions. These NRC offices may require at least 99.99% availability of the cloud telephone communication services. The types of cloud communication services include a cloud private branch exchange (PBX) platform that is scalable to meet NRC requirements and has selected calling features and Voice over IP (VOIP) service capabilities.

7) Network and Network Management Services. The contractor may be required to provide the network infrastructure and management services to support the implementation, in a phased manner, of a NRC unified communications environment. The initial phase may include network services to support commodity and NRC business application data, voice over internet protocol (VOIP, and video conferencing. The unified communications environment encompasses intra NRC communications at the NRC Headquarters and Regions and inters communications with NRC governmental and commercial partners. The contractor may be required to provide network architecture and design services to establish the network topology and bandwidth requirements and acquire the necessary circuits to meet the bandwidth requirements as these evolve. The contractor may be required to monitor the performance and availability of the network services and trouble shoot and resolve issues as they arise. The NRC may require 99.99 % availability of network services.

8) Commodity Application Services. The contractor may be required to provide "turn-key" solutions for specific commodity application services. They may include but are not limited to:

a. Microsoft Outlook (e.g. E-mail, calendaring, task management), Blackberry Server and Microsoft ActiveSync

b. Microsoft Office Suite (Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Access, etc.)

c. Virtual collaboration (e.g., Citrix GoToMeeting)

d. Microsoft SharePoint and Microsoft SharePoint Internet services

e. Geospatial services

f. Microsoft Project

9) Business Application Hosting Services. The contractor may also be required to provide services to support selected NRC business applications. These services may include:

a. Application hosting support that may include, but is not limited to maintenance and operation of the hardware, operating system software, data center support and telecommunications in support of the application. Software license maintenance costs are considered a part of hosting services.

b. Application management support that may include functional and technical tasks directly related to the application such as issue resolution, offline processing, report preparation, distribution and archiving , monthly, quarterly and annual processing, data and application software back-up and restore.

c. Application implementation and integration support that may include application installation, testing, cut-over, and post-deployment support at the hosting site(s). Services such as application configuration, interface development and testing, and system documentation may be required.

10) Continuity of Operations (COOP) Services. The contractor may be required to provide COOP services. These services would be required to comply with the guidance contained in the Federal Preparedness Circular 65 (FPC-65). This guidance describes the requirements of COOP and calls for essential functions to be operational within 12 hours of COOP activation. The contractor services would be required to meet this standard and must be tested at least annually.

11) Disaster Recovery (DR) Services. The contractor may be required to provide a DR plan and capabilities that comply with NRC requirements. DR capabilities may include high availability (i.e., 99.99%) systems, multiple communications access points and providers, mirroring for key services and business applications, replication to an off-site location, and redundant facility components (uninterruptible power supply, multiple power feeds, redundant generators, etc.).

12) Security Services. The contractor may be required to provide the security services to safeguard and secure facility, infrastructure, data, commodity application, business application, and network services. The contractor may be required to be certified under Federal Risk and Authorization Management Program (FedRAMP) (see and may be required to comply with the security directives, procedures and controls as stipulated in FISMA, the National Institute of Standards and Technology (NIST) 800.53 publications, and NRC IT security policies and controls. Please describe where you are in the FedRAMP process.

13) High Performance Computing (HPC) Services. The contractor may be required to provide infrastructure and support services to meet NRC's high performance computing requirements. NRC programs develop, maintain and operate computational models and analytic routines that require high bandwidth, low latency networking and very high computing capabilities. HPC requirements may be variable and may require close contractor collaboration with relevant NRC employees.

14) Cloud Computing Management Services: The contractor may be required to provide a range of services necessary to manage the NRC cloud service environment. These services may include but are not limited to:

a. Integration services which includes the ability to manage a diverse set of service providers as a single entity. Included in integration service is the management of trouble shooting performance and availability issues across service providers.

b. Control services that provide visibility into the service being provided and allow NRC to configure the services to meet changes in computing demand and NRC business requirements.

c. Transition services that allow the NRC to transition existing data center, application, communication, and other services to the contractor with no disruption to existing service levels and that ensure transparency from the end user perspective.


If your organization has the capability and capacity to perform, as a prime contractor, one or more of the services described in 1) through 14) above in the section entitled CLOUD COMPUTING SERVICES THAT NRC MAY REQUIRE IN THE FUTURE, then please respond to this notice and provide written responses to the following information. Please do not include any proprietary or otherwise sensitive information in the response, and do not submit a proposal. Proposals submitted in response to this notice will not be considered.

1. Organization name, address, emails address, Web site address and telephone number.

2. What size is your organization with respect to NAICS code 541519 (i.e. "small" or "other than small")? If your organization is a small business under the aforementioned NAICS code, what type of small business (i.e. small disadvantaged business, woman-owned small business, economically disadvantaged woman-owned small business, veteran-owned small business, service-disabled veteran-owned small business, 8(a), or HUBZone small business? Specify all that apply.

3. Separately and distinctly describe which of the fourteen (14) types of services listed above that your organization has experience providing as a prime contractor. Please also provide the contract number, contract type, customer name, address and point of contact phone number and email address, contract value, thorough description of supplies and services included in the scope of that contract, indication of how they differ from the descriptions in 1) through 14) above, period of performance, and any other relevant information.

4. For any federal customers that your agency has for items 1) through 14) above, indicate how your company complies with applicable Section 508 standards (see

5. Indicate whether your company is certified under FedRAMP and, if not, indicate whether your company has applied for FedRAMP certification, what stage in the FedRAMP certification process the company is in and whether the company can project an anticipated date for becoming certified. If the company has not applied for FedRAMP certification, indicate whether the company has a plan to apply for FedRAMP certification and, if so, when the company plans to apply for it.

6. Indicate whether your organization offers any of the fourteen listed services on your company's own Federal Government contracts (i.e., GSA Federal Supply Schedule contract or Government wide Acquisition Contracts) that the NRC could order from and, if so, which services are offered. Also, provide the contract number(s) and indicate what is currently available for ordering from each of those contract(s).

7. Provide a standard, non-proprietary commercial price list or similar standard non-proprietary commercial pricing information for how your company sells, as a prime contractor, services listed in 1) through 14) above that your organization has experience providing. Also, indicate what is included in that pricing.

8. Has your company worked for any of the licensees regulated by the NRC in the past year? If so, which licensees? See for more information on NRC licensing.

9. Has your company previously faced organizational conflict of interest issues with NRC? If so, what were they and how were they mitigated or resolved?

Responses to this sources sought notice shall be submitted by the response date to, with a courtesy copy to, in a format that is readable in Microsoft Word or Adobe .pdf formats.

11555 Rockville Pike
Rockville, Maryland 20852-2738
United States
Wanda M. Brown
Joseph Widdup