After receiving feedback from industry representatives on creation of a new Special Item Number (SIN) for cloud services on IT Schedule 70, the General Services Administration is revising how it defines cloud and promised the private sector a "transition plan" for how existing offering would migrate to the new space.
Most cloud providers currently list their services under Information Technology Professional Services (SIN 132 51) or Electronic Commerce and Subscription Services (132 52), though these categories only related to cloud "as-a-Service" products in a general sense.
Having a separate SIN for cloud services — tentatively set to roll out in the first half of calendar 2015 — would set those offerings apart from other IT, allowing GSA to better track cloud purchases and establish an added layer of vetting for those services.
RELATED
Buying cloud services on GSA schedules to get easier
Price Reduction Clause could slow cloud on Schedule 70
Cloud's next step on Schedule 70
Determining which products belong under a cloud SIN will likely be based on criteria outlined by the National Institute for Standards and Technology (NIST), which defines cloud services as having five capabilities:
■ On Demand Self Service;
■ Broad Network Access;
■ Resource Pooling;
■ Rapid Elasticity; and
■ Measured Service
Initially, GSA intended to require all five criteria before labeling a service as "cloud." However, after speaking with private sector representatives at an industry day on Nov. 18, the second — Broad Network Access — might have to be revised or even removed to account for services deployed on internal, closed government networks.
Other issues, such as compliance with the Federal Risk and Authorization Management Program (FedRAMP) or other security measures, will be handled at the task order level, according to Marcelo Olascoaga, deputy director of the GWAC program.
"What we will look for in this SIN is to see if you have the capabilities for selling whatever you're telling us you're selling," he said. However, "We're not going to require FedRAMP, we're not going to require your company to have an ATO [authority to operate] and so forth" before the products are listed under the SIN.
GSA is considering options for allowing vendors to post information about whether they have these accreditations, though Olascoaga noted that could create the appearance that the administration was favoring certain companies.
Instead, GSA might allow vendors to add pertinent information to their profiles on the Schedule or find some other middle road.
Companies with products listed under existing SINs will have the option to migrate to the new cloud-specific SIN, though exactly how that process would function is still to be settled.
"What we owe you is a transition plan," IT Schedule 70 Director Katie Lewin said during the industry day. "This is going to be complicated, this is going to be complex."
The administration held the industry day to get feedback from the private sector on potential issues this transition might cause and to clarify their goals in implementing a new SIN.
"Nothing's really changed because a SIN is being created," Olascoaga said. "Procurements will take place the same way they do now… The only difference now is that we'll be able to provide structure and organization to IT Schedule 70 as it pertains to where cloud services are located and other agencies can quickly go under 70 and see this is where they are."
