Sources Sought: Cloud Hosting, Provisioning, and Management for Indian Health Service (IHS)

Statement of Work (SOW)

To modernize, secure, and automate Indian Health Service (IHS) cloud operations across the enterprise, establishing a Cloud Center of Excellence (CCoE) utilizing Cloud (GovCloud - FedRAMP) to centralize, secure, and automate cloud operations while supporting mission-critical health IT objectives.

The contractor will provide a comprehensive solution for designing, implementing, and sustaining the CCoE, including:

• Cloud Landing Zone Design & Deployment (multi-account architecture, Zero Trust principles)

• Secure Enclave Provisioning (FedRAMP-compliant, hardened environments)

• Automation and Orchestration (ATO lifecycle, compliance reporting, SIEM/SOAR integration)

• Data Engineering and ETL (ingesting and transforming log/event data, HIPAA/FISMA compliance)

• Large Language Model (LLM) Enablement (on-premise LLMs for secure inference, AI-assisted document generation)

• Compliance Dashboards and Risk Analytics (real-time status, audit readiness)

• Zero Trust Architecture Implementation (aligned with CISA ZTMM)

• Security Operations and Monitoring (centralized logging, threat detection, vulnerability management)

• Secure Data Vault and Metadata Governance (encrypted storage, role-based tagging)

• Stakeholder Support and Role-Based Toolkits (tailored interfaces, embedded support)

• Period of Performance: One Year (Base Year for core implementation phases)

• Place of Performance: Remote, unless otherwise directed.

The project is divided into three phases:

• Phase 1: Foundation (Secure Enclave and Cloud Infrastructure Deployment)
• Phase 2: Automation (Compliance, Risk Visibility, and ATO Enablement)
• Phase 3: Transition (Training, Knowledge Transfer, and Operational Readiness)

Contractor must provide Key Personnel with demonstrated experience in public sector cloud security, automation, and compliance modernization, cleared to Public Trust level or higher.

All work must comply with:

• Data Sovereignty: All data remains in Cloud GovCloud (US).
• Standards: FedRAMP High, NIST 800-53 Rev 5, CISA Zero Trust Maturity Model (ZTMM), EO 14028, OMB M-22-09, M-24-04.
• Personnel: Public Trust background clearance required.
• Non-Disclosure: NDAs required for sensitive IHS data access.

Performance evaluated on timeliness, accuracy, usability, compliance, training scores, and risk dashboard lag. Reporting includes weekly status updates, monthly executive dashboards, and quarterly reviews.

Form / Attachment / Pricing Sheet

This document is the "Indian Economic Enterprise Representation Form" required under the Buy Indian Act. It serves as a self-certification for offerors to confirm they meet the definition of an "Indian Economic Enterprise" (IEE) as defined by HHSAR 326.601. This form is to be submitted in response to a Sources Sought Notice, Request for Information (RFI), or Solicitation.

• Self-Certification: Offerors must certify whether they meet the definition of an IEE with "Indian Ownership."
• Eligibility Period: The enterprise must meet the IEE definition at the time of offer, contract award, and throughout the contract performance period. Any change in eligibility requires immediate notification to the Contracting Officer.
• Required Information: Bidders must provide:
  • Name of Federally Recognized Tribal Entity (if applicable)
  • Name of the 51% owner of the IEE Firm
  • Business Name
  • Unique Entity Identifier (UEI) Number
  • Certifying Signature and Printed Name
• Consequences of False Information: Submitting false or misleading information is a violation of law and punishable under 18 U.S.C. 1001, with false claims subject to penalties under 31 U.S.C. 3729-3731 and 18 U.S.C. 287.

This form is critical for any bidder seeking to be considered for contracts or awards under the Buy Indian Act. Bidders must accurately complete this self-certification to demonstrate their eligibility. Contracting Officers may require additional documentation and awards may be subject to protest if eligibility is questioned. Successful offerors must also be registered with the System of Award Management (SAM).