Rancho Cucamonga City Council
August 19, 2026

VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MBM‐DLD‐D‐2G‐F 68.00 $ $ 65.09 VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription V‐MBM‐DLD‐D‐2P‐F 70.00 $ $ 67.00 VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription V‐MBM‐DLD‐D‐3G‐F 96.00 $ $ 91.89 VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MBM‐DLD‐D‐3P‐F 98.00 $ $ 93.80 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MBM‐DLD‐D‐G‐F 36.00 $ $ 34.46 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription V‐MBM‐DLD‐D‐P‐F 37.00 $ $ 35.42 VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MBM‐OPL‐D‐2G‐F 23.00 $ $ 22.02 VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/SubscriptV‐MBM‐OPL‐D‐2P‐F 25.00 $ $ 23.93 VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/SubscriptV‐MBM‐OPL‐D‐3G‐F 32.00 $ $ 30.63 VMware U.S. Federal VMware AirWatch Blue Management Suite Perpetual: 1 Device V‐MBM‐OPL‐D‐3P‐F 35.00 $ $ 33.50 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MBM‐OPL‐D‐G‐F 12.00 $ $ 11.49 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/SubscriptV‐MBM‐OPL‐D‐P‐F 13.00 $ $ 12.44 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐MBM‐PLL‐D‐F 20.00 $ $ 19.14 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐MBM‐SSS‐D‐3G‐F 10.56 $ $ 10.11 VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐MBM‐SSS‐D‐3P‐F 13.20 $ $ 12.63 VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐MBM‐SSS‐D‐G‐F 4.00 $ $ 3.83 VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐MBM‐SSS‐D‐P‐F 5.00 $ $ 4.79 VMware U.S. Federal Basic Support/Subscription for VMware Collaboration Bundle: 1 User for 1 year V‐MDM‐CLD‐D‐2G‐F 98.00 $ $ 93.80 VMware U.S. Federal Production Support/Subscription for VMware Collaboration Bundle: 1 User for 3 years V‐MDM‐CLD‐D‐2P‐F 102.00 $ $ 97.63 VMware U.S. Federal Production Support/Subscription for VMware Collaboration Bundle: 1 User for 1 year V‐MDM‐CLD‐D‐3G‐F 138.00 $ $ 132.09 VMware U.S. Federal VMware Collaboration Bundle 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MDM‐CLD‐D‐3P‐F 143.00 $ $ 136.88 VMware U.S. Federal VMware Collaboration Bundle Perpetual: 1 User V‐MDM‐CLD‐D‐G‐F 52.00 $ $ 49.77 VMware U.S. Federal Basic Support/Subscription for VMware Collaboration Bundle: 1 User for 3 years V‐MDM‐CLD‐D‐P‐F 54.00 $ $ 51.69 VMware U.S. Federal VMware Collaboration Bundle 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MDM‐DLD‐D‐2G‐F 121.00 $ $ 115.82 VMware U.S. Federal VMware Collaboration Bundle 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐MDM‐DLD‐D‐2P‐F 125.00 $ $ 119.65 VMware U.S. Federal VMware Collaboration Bundle 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐MDM‐DLD‐D‐3G‐F 169.00 $ $ 161.76 VMware U.S. Federal VMware Collaboration Bundle 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MDM‐DLD‐D‐3P‐F 175.00 $ $ 167.51 VMware U.S. Federal VMware Collaboration Bundle 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MDM‐DLD‐D‐G‐F 64.00 $ $ 61.26 VMware U.S. Federal VMware Collaboration Bundle 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐MDM‐DLD‐D‐P‐F 66.00 $ $ 63.17 VMware U.S. Federal VMware Collaboration Bundle 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MDM‐OPL‐D‐2G‐F 76.00 $ $ 72.75 VMware U.S. Federal VMware Collaboration Bundle 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐MDM‐OPL‐D‐2P‐F 79.00 $ $ 75.62 VMware U.S. Federal VMware Collaboration Bundle 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐MDM‐OPL‐D‐3G‐F 106.00 $ $ 101.46 VMware U.S. Federal VMware AirWatch Inbox Perpetual: 1 Device V‐MDM‐OPL‐D‐3P‐F 111.00 $ $ 106.25 VMware U.S. Federal VMware Collaboration Bundle 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐MDM‐OPL‐D‐G‐F 40.00 $ $ 38.29 VMware U.S. Federal VMware Collaboration Bundle 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐MDM‐OPL‐D‐P‐F 42.00 $ $ 40.20 VMware U.S. Federal VMware AirWatch Mobile Browser 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐MDM‐PLL‐D‐F 50.00 $ $ 47.86 VMware U.S. Federal VMware AirWatch Mobile Browser 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐MDM‐SSS‐D‐3G‐F 29.04 $ $ 27.80 VMware U.S. Federal VMware AirWatch Mobile Browser 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐MDM‐SSS‐D‐3P‐F 34.32 $ $ 32.85 VMware U.S. Federal VMware AirWatch Mobile Browser 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐MDM‐SSS‐D‐G‐F 11.00 $ $ 10.53 VMware U.S. Federal VMware AirWatch Mobile Browser 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐MDM‐SSS‐D‐P‐F 13.00 $ $ 12.44 VMware TPP L3 U.S. Federal VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) V‐OMS‐CLD‐D‐2G‐F 115.00 $ $ 106.60 VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) for 1 year V‐OMS‐CLD‐D‐2P‐F 121.00 $ $ 112.16 VMware TPP L4 U.S. Federal VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) V‐OMS‐CLD‐D‐3G‐F 162.00 $ $ 150.17 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) for 1 year V‐OMS‐CLD‐D‐3P‐F 169.00 $ $ 156.65 VMware TPP L2 U.S. Federal VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) V‐OMS‐CLD‐D‐G‐F 61.00 $ $ 56.54 VMware TPP L5 U.S. Federal VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) V‐OMS‐CLD‐D‐P‐F 64.00 $ $ 59.32 VMware TPP L4 U.S. Federal VMware vRealize Automation 7 for Desktop per CCU (25 Pack) V‐OMS‐CLD‐U‐2G‐F 230.00 $ $ 220.15 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 for Desktop per CCU (25 Pack) for 1 year V‐OMS‐CLD‐U‐2P‐F 239.00 $ $ 228.77 VMware TPP L5 U.S. Federal VMware vRealize Automation 7 for Desktop per CCU (25 Pack) V‐OMS‐CLD‐U‐3G‐F 323.00 $ $ 309.17

VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 (10 Pack) for 1 year V‐OMS‐CLD‐U‐3P‐F $ 336.00 $ 321.61 VMware TPP L3 U.S. Federal VMware vRealize Automation 7 for Desktop per CCU (25 Pack) V‐OMS‐CLD‐U‐G‐F $ 122.00 $ 116.78 VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 for Desktop per CCU (25 Pack) for 1 year V‐OMS‐CLD‐U‐P‐F $ 127.00 $ 121.56 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) for 3 years V‐OMS‐DLD‐D‐2G‐F $ 138.00 $ 127.92 VMware TPP L2 U.S. Federal VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) V‐OMS‐DLD‐D‐2P‐F $ 143.00 $ 132.55 VMware U.S. Federal VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) V‐OMS‐DLD‐D‐3G‐F $ 193.00 $ 178.90 VMware TPP L3 U.S. Federal VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) V‐OMS‐DLD‐D‐3P‐F $ 201.00 $ 186.32 VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) for 3 years V‐OMS‐DLD‐D‐G‐F $ 73.00 $ 67.67VMware TPP L1 U.S. Federal VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) V‐OMS‐DLD‐D‐P‐F $ 76.00 $ 70.45 VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 for Desktop per CCU (25 Pack) for 3 years V‐OMS‐DLD‐U‐2G‐F $ 275.00 $ 263.22 VMware TPP L1 Upgrade: U S. Federal VMware vRealize Automation 7 Advanced to U.S. Federal VMware vRealize Automation 7 Enterprise (25 OSI Pack) V‐OMS‐DLD‐U‐2P‐F $ 284.00 $ 271.84 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 for Desktop per CCU (25 Pack) for 3 years V‐OMS‐DLD‐U‐3G‐F $ 386.00 $ 369.47 VMware TPP L2 Upgrade: U S. Federal VMware vRealize Automation 7 Advanced to U.S. Federal VMware vRealize Automation 7 Enterprise (25 OSI Pack) V‐OMS‐DLD‐U‐3P‐F $ 399.00 $ 381.91 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 (10 Pack) for 1 year V‐OMS‐DLD‐U‐G‐F $ 146.00 $ 139.75VMware U.S. Federal Upgrade: VMware vRealize Automation 7 Advanced to VMware vRealize Automation 7 Enterprise (25 OSI Pack) V‐OMS‐DLD‐U‐P‐F $ 151.00 $ 144.53 VMware TPP L5 U.S. Federal VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) V‐OMS‐OPL‐D‐2G‐F $ 93.00 $ 89.02 VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) for 2 Months V‐OMS‐OPL‐D‐2P‐F $ 98.00 $ 93.80 VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) for 1 year V‐OMS‐OPL‐D‐3G‐F $ 130.00 $ 124.43 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) for 2 Months V‐OMS‐OPL‐D‐3P‐F $ 138.00 $ 132.09 VMware TPP L4 U.S. Federal VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) V‐OMS‐OPL‐D‐G‐F $ 49.00 $ 46.90 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) for 1 year V‐OMS‐OPL‐D‐P‐F $ 52.00 $ 49.77 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 Enterprise (25 OSI Pack) for 2 Months V‐OMS‐PLL‐D‐F $ 70.00 $ 68.41 VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) for 3 years V‐OMS‐PLL‐U‐F $ 140.00 $ 134.01 VMware U.S. Federal VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) V‐OMS‐SSS‐D‐3G‐F $ 39.60 $ 38.70 VMware TPP L1 U.S. Federal VMware vRealize Automation 7 Advanced Public Cloud Extension (25 OSI Pack) V‐OMS‐SSS‐D‐3P‐F $ 47.52 $ 46.44VMware U.S. Federal Basic Support/Subscription VMware vRealize Automation 7 Enterprise (25 OSI Pack) for 3 years V‐OMS‐SSS‐D‐G‐F $ 15.00 $ 14.66VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 Enterprise (25 OSI Pack) for 3 years V‐OMS‐SSS‐D‐P‐F $ 18.00 $ 17.59 VMware TPP L1 U.S. Federal VMware vRealize Automation 7 for Desktop per CCU (25 Pack) V‐OMS‐SSS‐U‐3G‐F $ 76.56 $ 73.28VMware TPP L2 U.S. Federal VMware vRealize Automation 7 for Desktop per CCU (25 Pack) V‐OMS‐SSS‐U‐3P‐F $ 92.40 $ 88.44 VMware U.S. Federal Production Support/Subscription VMware vRealize Automation 7 Enterprise Public Cloud Extension (25 OSI Pack) for 3 years V‐OMS‐SSS‐U‐G‐F $ 29.00 $ 27.76 VMware U.S. Federal VMware vRealize Automation 7 for Desktop per CCU (25 Pack) V‐OMS‐SSS‐U‐P‐F $ 35.00 $ 33.50 VMware U.S. Federal AirWatch by VMware Accelerated Deployment Add‐On One Time Fee V‐PS‐ACCELERATE‐F $ 5,500.00 $ 5,375.31 VMware U.S. Federal VMware AirWatch Per App Tunneling Configuration One Time Fee V‐PS‐APP‐VPN‐SP‐F $ 750.00 $ 733.00 VMware U.S. Federal VMware AirWatch Application Server Migration V‐PS‐APSV‐MG‐SP‐F $ 1,000.00 $ 977.33 VMware U.S. Federal VMware AirWatch Reports Server Configuration and Deployment One Time Fee V‐PS‐AW‐RPT‐SP‐F $ 500.00 $ 488.66 VMware U.S. Federal VMware AirWatch Telecom Module Deployment One Time Fee V‐PS‐AWT‐SP‐F $ 500.00 $ 488.66VMware U.S. Federal VMware AirWatch Video Deployment One Time Fee V‐PS‐AWV‐SP‐F $ 500.00 $ 488.66 VMware U.S. Federal VMware AirWatch Blue Management Suite Cloud Deployment Fee One Time Fee V‐PS‐BMS‐CLD‐SP‐F $ 4,500.00 $ 4,397.98 VMware U.S. Federal VMware AirWatch Blue Management Suite On Premise Deployment Fee One Time Fee V‐PS‐BMS‐OP‐SP‐F $ 5,500.00 $ 5,375.31VMware U.S. Federal AirWatch by VMware Blue Management Suite On‐Premise ‐ Includes 3 days On‐Site V‐PS‐BMS‐OPL‐3OS‐F $ 9,800.00 $ 9,577.83 VMware U.S. Federal AirWatch by VMware Blue Management Suite On‐Premise with ability to Remote Screen Share No On‐Site Included V‐PS‐BMS‐OPL‐RSS‐F $ 7,250.00 $ 7,085.64 VMware U.S. Federal VMware AirWatch Database Server Migration V‐PS‐DBSV‐MG‐SP‐F $ 500.00 $ 488.66 VMware U.S. Federal VMware AirWatch Device Enrollment Program (DEP) Configuration and Deployment One Time Fee V‐PS‐DEP‐SP‐F $ 500.00 $ 488.66 VMware U.S. Federal VMware AirWatch Cloud ‐ Dedicated Environment Setup One Time Fee / Environment V‐PS‐DHE‐SET‐F $ 10,000.00 $ 9,773.30 VMware U.S. Federal VMware AirWatch Cloud ‐ Dedicated UAT Environment 1 Year Fee / Device V‐PS‐DHE‐UAT‐F $ 10,000.00 $ 9,773.30 VMware U.S. Federal VMware AirWatch Disaster Recovery Set‐up Fee V‐PS‐DR‐SP‐F $ 1,200.00 $ 1,172.80 VMware U.S. Federal VMware AirWatch Cloud Connector (ACC) Configuration and Deployment ‐ Enterprise Integration One Time Fee V‐PS‐ENT‐ACC‐SP‐F $ 500.00 $ 488.66 VMware U.S. Federal VMware AirWatch Telecom 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐PS‐ENT‐SUP‐GEO‐F $ 25,000.00 $ 23,929.47 VMware U.S. Federal AirWatch by VMware End User On‐Boarding Video V‐PS‐EU‐OBV‐F $ 1,200.00 $ 1,172.80

VMware U.S. Federal VMware AirWatch Enterprise Gold SaaS Cloud Deployment up to 100000 devices One Time Fee V‐PS‐GLD‐CLD‐SP‐F 37,500.00 $ $ 36,649.87 VMware U.S. Federal VMware AirWatch Enterprise Gold On Premise Deployment up to 100000 devices One Time Fee V‐PS‐GLD‐OP‐SP‐F 50,000.00 $ $ 48,866.50 VMware U.S. Federal VMware AirWatch Green Management Suite Lite Cloud Deployment Fee One Time Fee V‐PS‐GMCL‐LITE‐F 750.00 $ $ 733.00 VMware U.S. Federal VMware AirWatch Green Management Suite Lite On Premise Deployment Fee One Time Fee V‐PS‐GMOP‐LITE‐F 1,750.00 $ $ 1,710.33 VMware U.S. Federal VMware AirWatch Green Management Suite Cloud Deployment Fee One Time Fee V‐PS‐GMS‐CLD‐SP‐F 1,500.00 $ $ 1,465.99 VMware U.S. Federal VMware AirWatch Green Management Suite On Premise Deployment Fee One Time Fee V‐PS‐GMS‐OP‐SP‐F 2,500.00 $ $ 2,443.32 VMware U.S. Federal AirWatch by VMware Green Management Suite On‐Premise ‐ Includes 2 days On‐Site V‐PS‐GMS‐OPL‐2OS‐F 5,450.00 $ $ 5,326.45 VMware U.S. Federal AirWatch by VMware Green Management Suite On‐Premise with ability to Remote Screen Share No On‐Site Included V‐PS‐GMS‐OPL‐RSS‐F 3,250.00 $ $ 3,176.32 VMware U.S. Federal VMware AirWatch High Availability Set‐up One Time Fee V‐PS‐HA‐SP‐F 1,200.00 $ $ 1,172.80 VMware U.S. Federal VMware AirWatch Health Check One Time Fee V‐PS‐HC‐F 2,500.00 $ $ 2,443.32 VMware U.S. Federal VMware AirWatch Professional Services ‐ 1 hour of support services One Time Fee V‐PS‐HR‐PS‐F 150.00 $ $ 146.60 VMware U.S. Federal AirWatch by VMware Browser Deployment Fee One Time Fee V‐PS‐MBM‐SP‐F 750.00 $ $ 733.00 VMware U.S. Federal AirWatch by VMware AirWatch Content Locker Collaborate Add‐On for K12+MAG Management Suite Deployment One Time Fee V‐PS‐MCC‐BMS‐SP‐F 1,000.00 $ $ 977.33 VMware U.S. Federal AirWatch by VMware AirWatch Content Collaborate Add‐On for Green/Orange Deployment Fee One Time Fee V‐PS‐MCC‐SP‐F 1,500.00 $ $ 1,465.99 VMware U.S. Federal VMware AirWatch Mobile Content Management Only Cloud Deployment One Time Fee V‐PS‐MCM‐CLD‐SP‐F 2,000.00 $ $ 1,954.66 VMware U.S. Federal VMware AirWatch Mobile Content Management Only On Premise Deployment One Time Fee V‐PS‐MCM‐OP‐SP‐F 3,000.00 $ $ 2,931.99 VMware U.S. Federal VMware AirWatch Content View Cloud Deployment Fee One Time Fee V‐PS‐MCV‐SP‐F 750.00 $ $ 733.00 VMware U.S. Federal VMware AirWatch Advanced Migration Configuration and Deployment On Premise Deployment Fee One Time Fee V‐PS‐MIG‐ADV‐OP‐F 4,000.00 $ $ 3,909.32 VMware U.S. Federal AirWatch by VMware Advanced Migration Configuration and Deployment Cloud One Time Fee V‐PS‐MIG‐ADV‐SP‐F 3,000.00 $ $ 2,931.99 VMware U.S. Federal VMware AirWatch Basic Migration Configuration and Deployment On Premise Deployment Fee One Time Fee V‐PS‐MIG‐BASIC‐OP‐F 2,500.00 $ $ 2,443.32 VMware U.S. Federal AirWatch by VMware Basic Migration Configuration and Deployment Cloud Deployment One Time Fee V‐PS‐MIG‐BASIC‐SP‐F 1,500.00 $ $ 1,465.99 VMware U.S. Federal VMware AirWatch Rugged Device Configuration and Deployment Add‐On One Time Fee V‐PS‐MS‐ADDONRG‐SP‐F 1,200.00 $ $ 1,172.80 VMware U.S. Federal VMware AirWatch Rugged Device Cloud Configuration and Deployment One Time Fee V‐PS‐MS‐CLDSPRG‐SP‐F 2,500.00 $ $ 2,443.32 VMware U.S. Federal VMware AirWatch Rugged Device On Premise Configuration and Deployment One Time Fee V‐PS‐MS‐OP‐SPRG‐SP‐F 3,500.00 $ $ 3,420.65 VMware U.S. Federal VMware AirWatch Orange Management Suite Cloud Deployment Fee One Time Fee V‐PS‐OMS‐CLD‐SP‐F 2,000.00 $ $ 1,954.66 VMware U.S. Federal VMware AirWatch Orange Management Suite On Premise Deployment Fee One Time Fee V‐PS‐OMS‐OP‐SP‐F 3,000.00 $ $ 2,931.99 VMware U.S. Federal AirWatch by VMware Orange Management Suite On‐Premise ‐ Includes 2 days On‐Site V‐PS‐OMS‐OPL‐2OS‐F 6,200.00 $ $ 6,059.45 VMware U.S. Federal AirWatch by VMware Orange Management Suite On‐Premise with ability to Remote Screen Share No On‐Site Included V‐PS‐OMS‐OPL‐RSS‐F 4,000.00 $ $ 3,909.32 VMware U.S. Federal VMware AirWatch On Premise to Dedicated Deployment One Time Fee V‐PS‐OP2‐DHS‐F 10,000.00 $ $ 9,773.30 VMware U.S. Federal AirWatch by VMware On‐Premise Weekend Upgrades and Off‐Hours Requiring Same Region One Time Fee V‐PS‐OPL‐WUOH‐F 3,700.00 $ $ 3,616.12 VMware U.S. Federal VMware AirWatch PKI Certificate Advanced Configuration and Deployment One Time Fee V‐PS‐PKI‐ADV‐SP‐F 2,500.00 $ $ 2,443.32 VMware U.S. Federal VMware AirWatch PKI Certificate Basic Configuration and Deployment One Time Fee V‐PS‐PKI‐BASIC‐SP‐F 1,200.00 $ $ 1,172.80 VMware U.S. Federal VMware AirWatch PowerShell Configuration and Deployment One Time Fee V‐PS‐PWR‐SHELL‐SP‐F 500.00 $ $ 488.66 VMware U.S. Federal AirWatch Socialcast Cloud Deployment One Time Fee V‐PS‐SC‐CLD‐SP‐F 1,800.00 $ $ 1,759.19 VMware U.S. Federal AirWatch by VMware SocialCast Dedicated SaaS Setup Fee One Time Fee V‐PS‐SC‐DSAAS‐F 1,200.00 $ $ 1,172.80 VMware U.S. Federal AirWatch Socialcast On Premise Deployment One Time Fee V‐PS‐SC‐OP‐SP‐F 4,200.00 $ $ 4,104.79 VMware U.S. Federal AirWatch by VMware SaaS SEG and MAG Upgrade V‐PS‐SEG‐MAG‐UG‐F 800.00 $ $ 781.86 VMware U.S. Federal AirWatch by VMware SaaS SEG and MAG Weekend and Same Region Off‐Hours Upgrade V‐PS‐SEG‐MAG‐WR‐F 3,300.00 $ $ 3,225.19 VMware U.S. Federal VMware AirWatch Secure Email Gateway (SEG) Configuration and Deployment One Time Fee V‐PS‐SEG‐SP‐F 500.00 $ $ 488.66 VMware U.S. Federal VMware AirWatch Enterprise Silver SaaS Cloud Deployment up to 50000 devices One Time Fee V‐PS‐SLV‐CLD‐SP‐F 20,000.00 $ $ 19,546.60 VMware U.S. Federal VMware AirWatch Enterprise Silver On Premise Deployment up to 50000 devices One Time Fee V‐PS‐SLV‐OP‐SP‐F 25,000.00 $ $ 24,433.25 VMware U.S. Federal VMware AirWatch Professional Services ‐ 8 hours of support services One Time Fee V‐PS‐SP‐DAY‐F 1,200.00 $ $ 1,172.80 VMware U.S. Federal VMware AirWatch Standby Support (Monday ‐ Friday) One Time Fee V‐PS‐STBS‐WD‐PS‐F 5,000.00 $ $ 4,886.65 VMware U.S. Federal VMware AirWatch Standby Support (Weekend) One Time Fee V‐PS‐STBS‐WE‐PS‐F 10,000.00 $ $ 9,773.30 VMware U.S. Federal VMware AirWatch Incident Support Package 5 pack V‐PS‐SUPP‐INC‐F 1,000.00 $ $ 977.33 VMware U.S. Federal VMware AirWatch Telecom 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐PS‐TAM‐F 69,995.00 $ $ 66,997.73 VMware U.S. Federal VMware AirWatch Professional Services Travel and Expense ‐ daily One Time Fee V‐PS‐TE‐AW‐F 610.00 $ $ 596.17 VMware U.S. Federal VMware AirWatch Teacher Tools Deployment One Time Fee V‐PS‐TT‐SP‐F 500.00 $ $ 488.66 VMware U.S. Federal VMware AirWatch Upgrade from Green Management Suite to Orange Management Suite Deployment (Cloud or On Premise) One Time Fee V‐PS‐UPG‐GM‐OM‐SP‐F 500.00 $ $ 488.66

VMware U.S. Federal VMware AirWatch Dedicated Cloud Upgrade off‐hours One Time Fee V‐PS‐UPGR‐OFFHOURS‐F 2,500.00 $ $ 2,443.32 VMware U.S. Federal VMware AirWatch Upgrade Services for On Premise Deployments Fee One Time Fee V‐PS‐UPGR‐STD‐F 1,200.00 $ $ 1,172.80 VMware U.S. Federal VMware Collaborate Bundle Cloud Deployment One Time Fee V‐PS‐VCB‐CLD‐SP‐F 4,000.00 $ $ 3,909.32 VMware U.S. Federal VMware Collaborate Bundle On Premise Deployment One time Fee V‐PS‐VCB‐OP‐SP‐F 7,500.00 $ $ 7,329.97 VMware U.S. Federal VMware Identity Manager Shared Cloud Deployment One Time Fee V‐PS‐VIDM‐CLD‐SP‐F 1,200.00 $ $ 1,172.80 VMware U.S. Federal VMware Identity Manager On Premise Deployment One Time Fee V‐PS‐VIDM‐OP‐SP‐F 1,800.00 $ $ 1,759.19 VMware U.S. Federal VMware AirWatch Yellow Management Suite Cloud Deployment Fee One Time Fee V‐PS‐YMS‐CLD‐SP‐F 5,500.00 $ $ 5,375.31 VMware U.S. Federal VMware AirWatch Yellow Management Suite On Premise Deployment Fee One Time Fee V‐PS‐YMS‐OP‐SP‐F 6,500.00 $ $ 6,352.64 VMware U.S. Federal AirWatch by VMware Yellow Management Suite On‐Premise ‐ Includes 3 days On‐Site V‐PS‐YMS‐OPL‐3OS‐F 11,050.00 $ $ 10,799.50 VMware U.S. Federal AirWatch by VMware Yellow Management Suite On‐Premise with ability to Remote Screen Share No On‐Site Included V‐PS‐YMS‐OPL‐RSS‐F 8,500.00 $ $ 8,307.30 VMware U.S. Federal VMware Identity Manager Advanced Edition SaaS Deployment One Time Fee V‐PSVIDM‐ADVCLD‐SP‐F 3,000.00 $ $ 2,931.99 VMware U.S. Federal VMware Identity Manager Advanced Edition On‐Premises Deployment One Time Fee V‐PSVIDM‐ADVOP‐SP‐F 4,000.00 $ $ 3,909.32 VMware U.S. Federal VMware AirWatch Mobile Browser 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐PTR‐CLD‐D‐2G‐F 36.00 $ $ 34.46 VMware U.S. Federal VMware AirWatch Mobile Browser 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐PTR‐CLD‐D‐2P‐F 38.00 $ $ 36.37 VMware U.S. Federal VMware AirWatch Mobile Browser 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐PTR‐CLD‐D‐3G‐F 51.00 $ $ 48.82 VMware U.S. Federal VMware AirWatch Mobile Browser 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐PTR‐CLD‐D‐3P‐F 53.00 $ $ 50.73 VMware U.S. Federal VMware AirWatch Mobile Browser 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐PTR‐CLD‐D‐G‐F 19.00 $ $ 18.19 VMware U.S. Federal VMware AirWatch Mobile Browser 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐PTR‐CLD‐D‐P‐F 20.00 $ $ 19.14 VMware U.S. Federal VMware AirWatch Mobile Browser 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐PTR‐DLD‐D‐2G‐F 36.00 $ $ 34.46 VMware U.S. Federal VMware AirWatch Mobile Browser 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐PTR‐DLD‐D‐2P‐F 38.00 $ $ 36.37 VMware U.S. Federal VMware AirWatch Mobile Browser 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐PTR‐DLD‐D‐3G‐F 51.00 $ $ 48.82 VMware U.S. Federal VMware AirWatch Mobile Browser 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐PTR‐DLD‐D‐3P‐F 53.00 $ $ 50.73 VMware U.S. Federal VMware AirWatch Mobile Browser 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐PTR‐DLD‐D‐G‐F 19.00 $ $ 18.19 VMware U.S. Federal VMware AirWatch Mobile Browser 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐PTR‐DLD‐D‐P‐F 20.00 $ $ 19.14 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Mobile Browser: 1 Device for 1 year V‐PTR‐PLL‐D‐F 25.00 $ $ 23.93 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Mobile Browser: 1 Device for 3 years V‐PTR‐SSS‐D‐3G‐F 13.20 $ $ 12.63 VMware U.S. Federal VMware AirWatch Mobile Browser 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐PTR‐SSS‐D‐3P‐F 15.84 $ $ 15.16 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Mobile Browser: 1 Device for 1 year V‐PTR‐SSS‐D‐G‐F 5.00 $ $ 4.79 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Mobile Browser: 1 Device for 3 years V‐PTR‐SSS‐D‐P‐F 6.00 $ $ 5.74 VMware U.S. Federal VMware AirWatch Video 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐RUG‐CLD‐D‐2G‐F 98.00 $ $ 93.80 VMware U.S. Federal VMware AirWatch Video 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐RUG‐CLD‐D‐2P‐F 102.00 $ $ 97.63 VMware U.S. Federal VMware AirWatch Video 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐RUG‐CLD‐D‐3G‐F 138.00 $ $ 132.09 VMware U.S. Federal VMware AirWatch Video 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐RUG‐CLD‐D‐3P‐F 143.00 $ $ 136.88 VMware U.S. Federal VMware AirWatch Video 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐RUG‐CLD‐D‐G‐F 52.00 $ $ 49.77 VMware U.S. Federal VMware AirWatch Video 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐RUG‐CLD‐D‐P‐F 54.00 $ $ 51.69 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Video: 1 User for 1 year V‐RUG‐DLD‐D‐2G‐F 121.00 $ $ 115.82 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Video: 1 User for 3 years V‐RUG‐DLD‐D‐2P‐F 125.00 $ $ 119.65 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Video: 1 User for 1 year V‐RUG‐DLD‐D‐3G‐F 169.00 $ $ 161.76 VMware U.S. Federal VMware AirWatch Video 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐RUG‐DLD‐D‐3P‐F 175.00 $ $ 167.51 VMware U.S. Federal VMware AirWatch Video Perpetual: 1 User V‐RUG‐DLD‐D‐G‐F 64.00 $ $ 61.26 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Video: 1 User for 3 years V‐RUG‐DLD‐D‐P‐F 66.00 $ $ 63.17 VMware U.S. Federal VMware AirWatch Video 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐RUG‐OPL‐D‐2G‐F 76.00 $ $ 72.75 VMware U.S. Federal VMware AirWatch Video 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐RUG‐OPL‐D‐2P‐F 79.00 $ $ 75.62 VMware U.S. Federal VMware AirWatch Video 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐RUG‐OPL‐D‐3G‐F 106.00 $ $ 101.46 VMware U.S. Federal VMware AirWatch Video 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐RUG‐OPL‐D‐3P‐F 111.00 $ $ 106.25 VMware U.S. Federal VMware AirWatch Video 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐RUG‐OPL‐D‐G‐F 40.00 $ $ 38.29 VMware U.S. Federal VMware AirWatch Video 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐RUG‐OPL‐D‐P‐F 42.00 $ $ 40.20 VMware U.S. Federal VMware AirWatch Video 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐RUG‐PLL‐D‐F 50.00 $ $ 47.86 VMware U.S. Federal VMware AirWatch Video 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐RUG‐SSS‐D‐3G‐F 29.04 $ $ 27.80

VMware U.S. Federal VMware AirWatch Video 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐RUG‐SSS‐D‐3P‐F $ 34.32 $ 32.85 VMware U.S. Federal VMware AirWatch Video 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐RUG‐SSS‐D‐G‐F $ 11.00 $ 10.53 VMware U.S. Federal VMware AirWatch Video 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐RUG‐SSS‐D‐P‐F $ 13.00 $ 12.44 VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐SCT‐CLD‐U‐2G‐F $ 59.00 $ 56.47VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription V‐SCT‐CLD‐U‐2P‐F $ 66.00 $ 63.17 VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription V‐SCT‐CLD‐U‐3G‐F $ 82.00 $ 78.49VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐SCT‐CLD‐U‐3P‐F $ 93.00 $ 89.02VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐SCT‐CLD‐U‐G‐F $ 31.00 $ 29.67 VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription V‐SCT‐CLD‐U‐P‐F $ 35.00 $ 33.50 VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐SCT‐DLD‐U‐2G‐F $ 81.00 $ 77.53VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscript V‐SCT‐DLD‐U‐2P‐F $ 89.00 $ 85.19 VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscript V‐SCT‐DLD‐U‐3G‐F $ 114.00 $ 109.12 VMware U.S. Federal VMware AirWatch Mobile Browser Perpetual: 1 Device V‐SCT‐DLD‐U‐3P‐F $ 125.00 $ 119.65 VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐SCT‐DLD‐U‐G‐F $ 43.00 $ 41.16 VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscript V‐SCT‐DLD‐U‐P‐F $ 47.00 $ 44.99 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Yellow Management Suite: 1 User for 1 year V‐SCT‐PLL‐U‐F $ 90.00 $ 86.15 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Yellow Management Suite: 1 User for 3 years V‐SCT‐SSS‐U‐3G‐F $ 50.16 $ 48.01VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐SCT‐SSS‐U‐3P‐F $ 60.72 $ 58.12 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Yellow Management Suite: 1 User for 1 year V‐SCT‐SSS‐U‐G‐F $ 19.00 $ 18.19VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Yellow Management Suite: 1 User for 3 years V‐SCT‐SSS‐U‐P‐F $ 23.00 $ 22.02 VMware U.S. Federal VMware AirWatch Mobile Device 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TEL‐CLD‐D‐2G‐F $ 23.00 $ 22.02 VMware U.S. Federal VMware AirWatch Mobile Device 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐TEL‐CLD‐D‐2P‐F $ 25.00 $ 23.93 VMware U.S. Federal VMware AirWatch Mobile Device 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐TEL‐CLD‐D‐3G‐F $ 32.00 $ 30.63 VMware U.S. Federal VMware AirWatch Mobile Device 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TEL‐CLD‐D‐3P‐F $ 35.00 $ 33.50 VMware U.S. Federal VMware AirWatch Mobile Device 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TEL‐CLD‐D‐G‐F $ 12.00 $ 11.49 VMware U.S. Federal VMware AirWatch Mobile Device 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐TEL‐CLD‐D‐P‐F $ 13.00 $ 12.44 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐TEL‐CLD‐U‐2G‐F $ 47.00 $ 44.99 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐TEL‐CLD‐U‐2P‐F $ 49.00 $ 46.90 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐TEL‐CLD‐U‐3G‐F $ 66.00 $ 63.17VMware U.S. Federal VMware AirWatch for Laptop Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscript V‐TEL‐CLD‐U‐3P‐F $ 69.00 $ 66.05 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐TEL‐CLD‐U‐G‐F $ 25.00 $ 23.93 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐TEL‐CLD‐U‐P‐F $ 26.00 $ 24.89 VMware U.S. Federal VMware AirWatch Mobile Device 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TEL‐DLD‐D‐2G‐F $ 46.00 $ 44.03 VMware U.S. Federal VMware AirWatch Mobile Device 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐TEL‐DLD‐D‐2P‐F $ 47.00 $ 44.99 VMware U.S. Federal VMware AirWatch Mobile Device 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐TEL‐DLD‐D‐3G‐F $ 64.00 $ 61.26 VMware U.S. Federal VMware AirWatch Mobile Device 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐TEL‐DLD‐D‐3P‐F $ 66.00 $ 63.17 VMware U.S. Federal VMware AirWatch Mobile Device 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TEL‐DLD‐D‐G‐F $ 24.00 $ 22.97 VMware U.S. Federal VMware AirWatch Mobile Device 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐TEL‐DLD‐D‐P‐F $ 25.00 $ 23.93 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscript V‐TEL‐DLD‐U‐2G‐F $ 93.00 $ 89.02 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Sub V‐TEL‐DLD‐U‐2P‐F $ 94.00 $ 89.97 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Sub V‐TEL‐DLD‐U‐3G‐F $ 130.00 $ 124.43VMware U.S. Federal VMware AirWatch for Laptop Management Suite 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐TEL‐DLD‐U‐3P‐F $ 132.00 $ 126.35 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscript V‐TEL‐DLD‐U‐G‐F $ 49.00 $ 46.90 VMware U.S. Federal VMware AirWatch for Laptop Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Sub V‐TEL‐DLD‐U‐P‐F $ 50.00 $ 47.86 VMware U.S. Federal VMware AirWatch Mobile Device 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐TEL‐OPL‐D‐2G‐F $ 23.00 $ 22.02 VMware U.S. Federal VMware AirWatch Mobile Device 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐TEL‐OPL‐D‐2P‐F $ 25.00 $ 23.93 VMware U.S. Federal VMware AirWatch Mobile Device 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐TEL‐OPL‐D‐3G‐F $ 32.00 $ 30.63VMware U.S. Federal VMware AirWatch Laptop Management Suite Perpetual: 1 Device V‐TEL‐OPL‐D‐3P‐F $ 35.00 $ 33.50 VMware U.S. Federal VMware AirWatch Mobile Device 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐TEL‐OPL‐D‐G‐F $ 12.00 $ 11.49

VMware U.S. Federal VMware AirWatch Mobile Device 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐TEL‐OPL‐D‐P‐F $ 13.00 $ 12.44 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Mobile Device: 1 Device for 1 year V‐TEL‐PLL‐D‐F $ 20.00 $ 19.14 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch for Laptop Management Suite: 1 Device for 1 year V‐TEL‐PLL‐U‐F $ 40.00 $ 38.29VMware U.S. Federal Production Support/Subscription for VMware AirWatch Mobile Device: 1 Device for 3 years V‐TEL‐SSS‐D‐3G‐F $ 10.56 $ 10.11 VMware U.S. Federal VMware AirWatch Mobile Device 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TEL‐SSS‐D‐3P‐F $ 13.20 $ 12.63 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Mobile Device: 1 Device for 1 year V‐TEL‐SSS‐D‐G‐F $ 4.00 $ 3.83 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Mobile Device: 1 Device for 3 years V‐TEL‐SSS‐D‐P‐F $ 5.00 $ 4.79VMware U.S. Federal Production Support/Subscription for VMware AirWatch for Laptop Management Suite: 1 Device for 3 years V‐TEL‐SSS‐U‐3G‐F $ 21.12 $ 20.22VMware U.S. Federal VMware AirWatch for Laptop Management Suite 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐TEL‐SSS‐U‐3P‐F $ 26.40 $ 25.27 VMware U.S. Federal Production Support/Subscription for VMware AirWatch for Laptop Management Suite: 1 Device for 1 year V‐TEL‐SSS‐U‐G‐F $ 8.00 $ 7.66 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch for Laptop Management Suite: 1 Device for 3 years V‐TEL‐SSS‐U‐P‐F $ 10.00 $ 9.57 VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TTS‐CLD‐D‐2G‐F $ 12.00 $ 11.49VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/SubscriptioV‐TTS‐CLD‐D‐2P‐F $ 14.00 $ 13.40 VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/SubscriptioV‐TTS‐CLD‐D‐3G‐F $ 16.00 $ 15.31VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TTS‐CLD‐D‐3P‐F $ 19.00 $ 18.19VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TTS‐CLD‐D‐G‐F $ 6.00 $ 5.74 VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/SubscriptioV‐TTS‐CLD‐D‐P‐F $ 7.00 $ 6.70 VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TTS‐DLD‐D‐2G‐F $ 12.00 $ 11.49VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscri V‐TTS‐DLD‐D‐2P‐F $ 14.00 $ 13.40 VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscri V‐TTS‐DLD‐D‐3G‐F $ 16.00 $ 15.31VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐TTS‐DLD‐D‐3P‐F $ 19.00 $ 18.19VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TTS‐DLD‐D‐G‐F $ 6.00 $ 5.74 VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscri V‐TTS‐DLD‐D‐P‐F $ 7.00 $ 6.70 VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐TTS‐OPL‐D‐2G‐F $ 12.00 $ 11.49VMware U.S. Federal VMware AirWatch Yellow Management Suite 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐TTS‐OPL‐D‐2P‐F $ 14.00 $ 13.40 VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐TTS‐OPL‐D‐3G‐F $ 16.00 $ 15.31 VMware U.S. Federal VMware AirWatch Yellow Management Suite Perpetual: 1 User V‐TTS‐OPL‐D‐3P‐F $ 19.00 $ 18.19 VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐TTS‐OPL‐D‐G‐F $ 6.00 $ 5.74 VMware U.S. Federal VMware AirWatch Yellow Management Suite 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐TTS‐OPL‐D‐P‐F $ 7.00 $ 6.70 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Yellow Management Suite: 1 Device for 1 year V‐TTS‐PLL‐D‐F $ 20.00 $ 19.14 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Yellow Management Suite: 1 Device for 3 years V‐TTS‐SSS‐D‐3G‐F $ 10.56 $ 10.11 VMware U.S. Federal VMware AirWatch Yellow Management Suite 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐TTS‐SSS‐D‐3P‐F $ 13.20 $ 12.63 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Yellow Management Suite: 1 Device for 1 year V‐TTS‐SSS‐D‐G‐F $ 4.00 $ 3.83 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Yellow Management Suite: 1 Device for 3 years V‐TTS‐SSS‐D‐P‐F $ 5.00 $ 4.79 VMware U.S. Federal VMware AirWatch Content Locker View 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐UG‐BU‐CLD‐U‐G‐F $ 83.50 $ 77.40 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Mobile Application Wrapping: 1 Device for 3 years V‐UG‐BU‐CLD‐U‐P‐F $ 87.00 $ 80.64 VMware U.S. Federal VMware AirWatch Content Locker View 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐UG‐BU‐DLD‐U‐G‐F $ 97.00 $ 89.91 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Mobile Application Wrapping: 1 Device for 3 years V‐UG‐BU‐DLD‐U‐P‐F $ 100.00 $ 92.70 VMware U.S. Federal VMware AirWatch Enterprise Support 1 Year Fee per Geography or Business Unit V‐UG‐BU‐PLL‐U‐F $ 99.00 $ 96.76 VMware U.S. Federal VMware AirWatch Technical Account Manager can be purchased by AirWatch Production or Enterprise Customers V‐UG‐BU‐SSS‐U‐G‐F $ 21.00 $ 20.52 VMware U.S. Federal Upgrade: VMware AirWatch from Blue Management Suite to Yellow Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic Su V‐UG‐BU‐SSS‐U‐P‐F $ 25.00 $ 24.43 VMware U.S. Federal VMware Identity Manager Advanced Edition Perpetual: 1 User V‐UG‐BY‐CLD‐D‐G‐F $ 39.50 $ 37.81 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐UG‐BY‐CLD‐D‐P‐F $ 40.50 $ 38.77 VMware U.S. Federal VMware AirWatch Telecom 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐UG‐BY‐CLD‐U‐G‐F $ 78.00 $ 74.66VMware U.S. Federal VMware AirWatch Content Locker Collaborate 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐UG‐BY‐CLD‐U‐P‐F $ 81.50 $ 78.01 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscript V‐UG‐BY‐DLD‐D‐G‐F $ 39.50 $ 37.81 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscriptio V‐UG‐BY‐DLD‐D‐P‐F $ 40.50 $ 37.54 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscript V‐UG‐BY‐DLD‐U‐G‐F $ 78.00 $ 74.66 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscriptio V‐UG‐BY‐DLD‐U‐P‐F $ 81.50 $ 75.55

VMware U.S. Federal Basic Support/Subscription for VMware Identity Manager Advanced Edition: 1 User for 1 year V‐UG‐BY‐OPL‐D‐G‐F $ 39.50 $ 37.81 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices Perpetual: 1 Device V‐UG‐BY‐OPL‐D‐P‐F $ 40.50 $ 38.77VMware U.S. Federal Upgrade: VMware AirWatch from Orange Management Suite to Yellow Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic V‐UG‐BY‐PLL‐D‐F $ 44.00 $ 43.00 VMware U.S. Federal Upgrade: VMware AirWatch from Orange Management Suite to Blue Management Suite Subscription ‐ On Premise (Includes Basic Support/ V‐UG‐BY‐SSS‐D‐G‐F $ 9.00 $ 8.80 VMware U.S. Federal Upgrade: VMware AirWatch from Orange Management Suite to Yellow Management Suite Subscription ‐ On Premise (Includes Basic Suppo V‐UG‐BY‐SSS‐D‐P‐F $ 11.00 $ 10.75 VMware U.S. Federal Production Support/Subscription for VMware Identity Manager Advanced Edition: 1 User for 1 year V‐UG‐GB‐CLD‐D‐G‐F $ 26.50 $ 25.37 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Management Suite for Rugged Devices: 1 Device for 1 year V‐UG‐GB‐CLD‐D‐P‐F $ 28.50 $ 27.28 VMware U.S. Federal VMware Identity Manager Advanced Edition 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐UG‐GB‐CLD‐U‐G‐F $ 54.00 $ 51.69 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/SubsV‐UG‐GB‐CLD‐U‐P‐F $ 57.00 $ 54.56 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐UG‐GB‐DLD‐D‐G‐F $ 26.50 $ 25.37 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/SubscV‐UG‐GB‐DLD‐D‐P‐F $ 28.50 $ 26.42 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐UG‐GB‐DLD‐U‐G‐F $ 54.00 $ 51.69 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/SubscV‐UG‐GB‐DLD‐U‐P‐F $ 57.00 $ 52.84 VMware U.S. Federal VMware Identity Manager Advanced Edition 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐UG‐GB‐OPL‐D‐G‐F $ 26.50 $ 25.37 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Management Suite for Rugged Devices: 1 Device for 3 years V‐UG‐GB‐OPL‐D‐P‐F $ 28.50 $ 27.28 VMware U.S. Federal Upgrade: VMware AirWatch from Orange Management Suite to Blue Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic SuV‐UG‐GB‐PLL‐D‐F $ 44.00 $ 43.00 VMware U.S. Federal Upgrade: VMware AirWatch from Orange Management Suite to Yellow Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic V‐UG‐GB‐SSS‐D‐G‐F $ 9.00 $ 8.80 VMware U.S. Federal Upgrade: VMware AirWatch from Blue Management Suite to Yellow Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS Basic V‐UG‐GB‐SSS‐D‐P‐F $ 11.00 $ 10.75 VMware U.S. Federal Basic Support/Subscription for VMware Identity Manager Advanced Edition: 1 User for 3 years V‐UG‐GO‐CLD‐D‐G‐F $ 10.00 $ 9.57VMware U.S. Federal Production Support/Subscription for VMware AirWatch Management Suite for Rugged Devices: 1 Device for 1 year V‐UG‐GO‐CLD‐D‐P‐F $ 11.00 $ 10.53 VMware U.S. Federal VMware Identity Manager Advanced Edition 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐UG‐GO‐CLD‐U‐G‐F $ 21.00 $ 20.10 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Suppor V‐UG‐GO‐CLD‐U‐P‐F $ 22.00 $ 21.06 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐UG‐GO‐DLD‐D‐G‐F $ 10.00 $ 9.57 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/SubscV‐UG‐GO‐DLD‐D‐P‐F $ 11.00 $ 10.20 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐UG‐GO‐DLD‐U‐G‐F $ 21.00 $ 20.10 VMware U.S. Federal VMware AirWatch Content Locker View Perpetual: 1 Device V‐UG‐GO‐DLD‐U‐P‐F $ 22.00 $ 20.39 VMware U.S. Federal VMware Identity Manager Advanced Edition 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐UG‐GO‐OPL‐D‐G‐F $ 10.00 $ 9.57 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/SubsV‐UG‐GO‐OPL‐D‐P‐F $ 11.00 $ 10.53 VMware U.S. Federal Upgrade: VMware AirWatch from Blue Management Suite to Yellow Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS Basic V‐UG‐GO‐PLL‐D‐F $ 22.00 $ 21.50 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Blue Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS Basic V‐UG‐GO‐SSS‐D‐G‐F $ 5.00 $ 4.89 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Blue Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS Basic V‐UG‐GO‐SSS‐D‐P‐F $ 6.00 $ 5.86 VMware U.S. Federal Production Support/Subscription for VMware Identity Manager Advanced Edition: 1 User for 3 years V‐UG‐GY‐CLD‐D‐G‐F $ 66.00 $ 63.17 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Management Suite for Rugged Devices: 1 Device for 3 years V‐UG‐GY‐CLD‐D‐P‐F $ 69.50 $ 66.52 VMware U.S. Federal VMware Identity Manager Advanced Edition 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐UG‐GY‐CLD‐U‐G‐F $ 132.00 $ 126.35 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Suppor V‐UG‐GY‐CLD‐U‐P‐F $ 138.50 $ 132.57 VMware U.S. Federal VMware AirWatch Content Locker View 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐UG‐GY‐DLD‐D‐G‐F $ 64.00 $ 59.32 VMware U.S. Federal VMware AirWatch Content Locker View 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐UG‐GY‐DLD‐D‐P‐F $ 69.50 $ 64.42 VMware U.S. Federal VMware AirWatch Content Locker View 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐UG‐GY‐DLD‐U‐G‐F $ 132.00 $ 122.36 VMware U.S. Federal VMware AirWatch Content Locker View 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐GY‐DLD‐U‐P‐F $ 138.50 $ 128.38 VMware U.S. Federal VMware Identity Manager Advanced Edition 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐UG‐GY‐OPL‐D‐G‐F $ 66.00 $ 63.17 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/SubsV‐UG‐GY‐OPL‐D‐P‐F $ 69.50 $ 66.52 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Orange Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS Ba V‐UG‐GY‐PLL‐D‐F $ 88.00 $ 86.01VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Orange Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS Ba V‐UG‐GY‐SSS‐D‐G‐F $ 18.00 $ 17.59VMware U.S. Federal Upgrade: VMware AirWatch from Mobile Device & Airwatch Content Locker View to Yellow Management Suite Subscription ‐ Dedicated Clo V‐UG‐GY‐SSS‐D‐P‐F $ 22.00 $ 21.50VMware U.S. Federal VMware AirWatch Content Locker View 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐UG‐MU‐CLD‐U‐G‐F $ 56.00 $ 51.91 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐MU‐CLD‐U‐P‐F $ 58.50 $ 54.23 VMware U.S. Federal VMware AirWatch Content Locker View 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐UG‐MU‐DLD‐U‐G‐F $ 69.50 $ 64.42 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐MU‐DLD‐U‐P‐F $ 71.50 $ 66.28 VMware U.S. Federal Upgrade: VMware AirWatch from Blue Management Suite to Yellow Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic Su V‐UG‐MU‐PLL‐U‐F $ 55.00 $ 53.75

VMware U.S. Federal Upgrade: VMware AirWatch from Blue Management Suite to Yellow Management Suite Subscription ‐ On Premise (Includes Basic Support/SV‐UG‐MU‐SSS‐U‐G‐F $ 12.00 $ 11.73 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Blue Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic SupV‐UG‐MU‐SSS‐U‐P‐F $ 14.00 $ 13.68VMware U.S. Federal Production Support/Subscription for VMware AirWatch Content Locker Collaborate: 1 Device for 1 year V‐UG‐MY‐CLD‐D‐G‐F $ 33.00 $ 31.59 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/S V‐UG‐MY‐CLD‐D‐P‐F $ 35.00 $ 33.50 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐UG‐MY‐DLD‐D‐G‐F $ 20.00 $ 19.14 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Content Locker View: 1 Device for 1 year V‐UG‐MY‐DLD‐D‐P‐F $ 22.00 $ 20.39 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Content Locker Collaborate: 1 Device for 1 year V‐UG‐MY‐OPL‐D‐G‐F $ 46.00 $ 44.03VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/S V‐UG‐MY‐OPL‐D‐P‐F $ 48.50 $ 46.42 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Orange Management Suite Subscription ‐ On Premise (Includes Basic Suppor V‐UG‐MY‐PLL‐D‐F $ 66.00 $ 64.50 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Yellow Management Suite Subscription ‐ On Premise (Includes Basic Support V‐UG‐MY‐SSS‐D‐G‐F $ 14.00 $ 13.68 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Blue Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic SupV‐UG‐MY‐SSS‐D‐P‐F $ 17.00 $ 16.61 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Content Locker Collaborate: 1 Device for 3 years V‐UG‐OB‐CLD‐D‐G‐F $ 16.50 $ 15.79VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/S V‐UG‐OB‐CLD‐D‐P‐F $ 17.50 $ 16.75 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐OB‐CLD‐U‐G‐F $ 33.00 $ 31.59 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Sup V‐UG‐OB‐CLD‐U‐P‐F $ 35.00 $ 32.44 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐UG‐OB‐DLD‐D‐G‐F $ 16.50 $ 15.79 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Content Locker View: 1 Device for 1 year V‐UG‐OB‐DLD‐D‐P‐F $ 17.50 $ 16.22 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐UG‐OB‐DLD‐U‐G‐F $ 33.00 $ 31.59 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Content Locker View: 1 Device for 3 years V‐UG‐OB‐DLD‐U‐P‐F $ 35.00 $ 32.44 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐OB‐OPL‐D‐G‐F $ 16.50 $ 15.79 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Sup V‐UG‐OB‐OPL‐D‐P‐F $ 17.50 $ 16.75 VMware U.S. Federal Upgrade: VMware AirWatch from Orange Management Suite to Blue Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS BasicV‐UG‐OB‐PLL‐D‐F $ 22.00 $ 21.50VMware U.S. Federal Upgrade: VMware AirWatch from Orange Management Suite to Blue Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS BasicV‐UG‐OB‐SSS‐D‐G‐F $ 5.00 $ 4.89 VMware U.S. Federal Upgrade: VMware AirWatch Orange Management Suite to Yellow Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS Basic SuV‐UG‐OB‐SSS‐D‐P‐F $ 6.00 $ 5.86VMware U.S. Federal VMware AirWatch Content Locker View 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐UG‐OU‐CLD‐U‐G‐F $ 67.00 $ 62.11 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscri V‐UG‐OU‐CLD‐U‐P‐F $ 69.50 $ 64.42 VMware U.S. Federal VMware AirWatch Content Locker View 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐UG‐OU‐DLD‐U‐G‐F $ 80.50 $ 74.62 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐OU‐DLD‐U‐P‐F $ 82.50 $ 76.47 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Orange Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic V‐UG‐OU‐PLL‐U‐F $ 77.00 $ 75.25VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Yellow Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic S V‐UG‐OU‐SSS‐U‐G‐F $ 16.00 $ 15.64 VMware U.S. Federal Upgrade: VMware AirWatch from Airwatch Content Locker View to Airwatch Content Locker Collaborate ‐ Shared Cloud (Includes SaaS BasicV‐UG‐OU‐SSS‐U‐P‐F $ 19.00 $ 18.57VMware U.S. Federal Production Support/Subscription for VMware AirWatch Content Locker Collaborate: 1 Device for 3 years V‐UG‐OY‐CLD‐D‐G‐F $ 56.00 $ 53.60 VMware U.S. Federal VMware AirWatch Content Locker View 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐OY‐CLD‐D‐P‐F $ 56.00 $ 51.91 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscript V‐UG‐OY‐CLD‐U‐G‐F $ 111.00 $ 106.25 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscriptio V‐UG‐OY‐CLD‐U‐P‐F $ 116.50 $ 107.99 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐UG‐OY‐DLD‐D‐G‐F $ 56.00 $ 53.60 VMware U.S. Federal VMware AirWatch Content Locker View 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐OY‐DLD‐D‐P‐F $ 58.50 $ 54.23 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐UG‐OY‐DLD‐U‐G‐F $ 111.00 $ 106.25 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Content Locker View: 1 Device for 3 years V‐UG‐OY‐DLD‐U‐P‐F $ 116.50 $ 107.99 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐OY‐OPL‐D‐G‐F $ 56.00 $ 53.60 VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Sup V‐UG‐OY‐OPL‐D‐P‐F $ 58.50 $ 55.99 VMware U.S. Federal Upgrade: VMware AirWatch from Airwatch Content Locker View to Airwatch Content Locker Collaborate ‐ Dedicated Cloud (Includes SaaS B V‐UG‐OY‐PLL‐D‐F $ 66.00 $ 64.50 VMware U.S. Federal Upgrade: VMware AirWatch Orange Management Suite to Yellow Management Suite Subscription ‐ Dedicated Cloud (Includes SaaS Basic SuV‐UG‐OY‐SSS‐D‐G‐F $ 14.00 $ 13.68 VMware U.S. Federal Upgrade: VMware AirWatch from Blue Management Suite to Yellow Management Suite Subscription ‐ Shared Cloud (Includes SaaS Product V‐UG‐OY‐SSS‐D‐P‐F $ 17.00 $ 16.61 VMware U.S. Federal VMware AirWatch Content Locker View 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐TU‐CLD‐U‐G‐F $ 14.50 $ 13.44 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping Perpetual: 1 Device V‐UG‐TU‐CLD‐U‐P‐F $ 14.50 $ 13.44 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/SubscriptioV‐UG‐TU‐DLD‐U‐G‐F $ 27.50 $ 25.49 VMware U.S. Federal VMware AirWatch Content Locker View 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐UG‐TU‐DLD‐U‐P‐F $ 27.50 $ 25.49 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/SubscriptioV‐UG‐TU‐PLL‐U‐F $ 22.00 $ 21.50

VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subs V‐UG‐TU‐SSS‐U‐G‐F $ 5.00 $ 4.89 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subs V‐UG‐TU‐SSS‐U‐P‐F $ 6.00 $ 5.86 VMware U.S. Federal VMware AirWatch Content Locker Collaborate Perpetual: 1 Device V‐UG‐VC‐CLD‐D‐G‐F $ 21.00 $ 20.10VMware U.S. Federal VMware AirWatch Management Suite for Rugged Devices 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Suppor V‐UG‐VC‐CLD‐D‐P‐F $ 22.00 $ 21.06 VMware U.S. Federal VMware AirWatch Content Locker Collaborate 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐UG‐VC‐DLD‐D‐G‐F $ 21.00 $ 20.10 VMware U.S. Federal VMware AirWatch Content Locker View 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐VC‐DLD‐D‐P‐F $ 22.00 $ 20.39 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Orange Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic V‐UG‐VC‐PLL‐D‐F $ 33.00 $ 32.25 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Yellow Management Suite Subscription ‐ Shared Cloud (Includes SaaS Basic S V‐UG‐VC‐SSS‐D‐G‐F $ 7.00 $ 6.84 VMware U.S. Federal Upgrade: VMware AirWatch from Green Management Suite to Blue Management Suite Subscription ‐ On Premise (Includes Basic Support/S V‐UG‐VC‐SSS‐D‐P‐F $ 8.00 $ 7.82 VMware U.S. Federal VMware AirWatch Content Locker View 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscription) V‐UG‐VU‐CLD‐U‐G‐F $ 33.00 $ 30.59 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Mobile Application Wrapping: 1 Device for 1 year V‐UG‐VU‐CLD‐U‐P‐F $ 34.00 $ 31.52VMware U.S. Federal VMware AirWatch Content Locker View 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐UG‐VU‐DLD‐U‐G‐F $ 46.00 $ 42.64 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Mobile Application Wrapping: 1 Device for 1 year V‐UG‐VU‐DLD‐U‐P‐F $ 47.50 $ 44.03 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subs V‐UG‐VU‐PLL‐U‐F $ 33.00 $ 32.25 VMware U.S. Federal VMware AirWatch Cloud ‐ Dedicated Environment for Perpetual Licenses: 1 Device for 1 year V‐UG‐VU‐SSS‐U‐G‐F $ 7.00 $ 6.84 VMware U.S. Federal VMware AirWatch Cloud ‐ Shared Environment for Perpetual Licenses: 1 Device for 1 year V‐UG‐VU‐SSS‐U‐P‐F $ 8.00 $ 7.82 VMware U.S. Federal VMware AirWatch Content Locker View 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐UG‐YU‐CLD‐U‐G‐F $ 122.00 $ 113.09 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscri V‐UG‐YU‐CLD‐U‐P‐F $ 127.50 $ 118.19 VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/SubscriptioV‐UG‐YU‐DLD‐U‐G‐F $ 135.50 $ 125.60VMware U.S. Federal VMware AirWatch Mobile Application Wrapping 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscri V‐UG‐YU‐DLD‐U‐P‐F $ 141.00 $ 130.70VMware U.S. Federal Upgrade: VMware AirWatch from Mobile Device & Airwatch Content Locker View to Yellow Management Suite Subscription ‐ On Premise (I V‐UG‐YU‐PLL‐U‐F $ 143.00 $ 139.76VMware U.S. Federal Upgrade: VMware AirWatch from Mobile Device & Airwatch Content Locker View to Yellow Management Suite Subscription ‐ Shared Cloud V‐UG‐YU‐SSS‐U‐G‐F $ 30.00 $ 29.32 VMware U.S. Federal Upgrade: VMware AirWatch from Orange Management Suite to Blue Management Suite. Subscription ‐ Shared Cloud (Includes SaaS Basic S V‐UG‐YU‐SSS‐U‐P‐F $ 36.00 $ 35.18 VMware U.S. Federal Basic Support/Subscription for VMware Socialcast: 1 User for 1 year V‐VID‐CLD‐D‐2G‐F $ 59.00 $ 56.47 VMware U.S. Federal Production Support/Subscription for VMware Socialcast: 1 User for 3 years V‐VID‐CLD‐D‐2P‐F $ 61.00 $ 58.39 VMware U.S. Federal Production Support/Subscription for VMware Socialcast: 1 User for 1 year V‐VID‐CLD‐D‐3G‐F $ 82.00 $ 78.49 VMware U.S. Federal VMware Socialcast 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐VID‐CLD‐D‐3P‐F $ 85.00 $ 81.36 VMware U.S. Federal VMware Socialcast Perpetual: 1 User V‐VID‐CLD‐D‐G‐F $ 31.00 $ 29.67VMware U.S. Federal Basic Support/Subscription for VMware Socialcast: 1 User for 3 years V‐VID‐CLD‐D‐P‐F $ 32.00 $ 30.63 VMware U.S. Federal VMware AirWatch Printer 3‐year Subscription ‐ Shared Cloud for 1 device (Includes SaaS Basic Support/Subscription) V‐VID‐CLD‐U‐2G‐F $ 115.00 $ 110.08 VMware U.S. Federal VMware AirWatch Printer 3‐year Subscription ‐ Shared Cloud for 1 device (Includes SaaS Production Support/Subscription) V‐VID‐CLD‐U‐2P‐F $ 119.00 $ 113.90 VMware U.S. Federal VMware AirWatch Printer 1‐year Subscription ‐ Shared Cloud for 1 device (Includes SaaS Production Support/Subscription) V‐VID‐CLD‐U‐3G‐F $ 162.00 $ 155.06 VMware U.S. Federal VMware AirWatch Printer 1‐year Subscription ‐ Dedicated Cloud for 1 device (Includes SaaS Basic Support/Subscription) V‐VID‐CLD‐U‐3P‐F $ 167.00 $ 159.85 VMware U.S. Federal VMware AirWatch Printer 2‐year Subscription ‐ Shared Cloud for 1 device (Includes SaaS Basic Support/Subscription) V‐VID‐CLD‐U‐G‐F $ 61.00 $ 58.39 VMware U.S. Federal VMware AirWatch Printer 2‐year Subscription ‐ Shared Cloud for 1 device (Includes SaaS Production Support/Subscription) V‐VID‐CLD‐U‐P‐F $ 63.00 $ 60.30 VMware U.S. Federal VMware Socialcast 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐VID‐DLD‐D‐2G‐F $ 81.00 $ 77.53 VMware U.S. Federal VMware Socialcast 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐VID‐DLD‐D‐2P‐F $ 83.00 $ 79.45VMware U.S. Federal VMware Socialcast 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐VID‐DLD‐D‐3G‐F $ 114.00 $ 109.12 VMware U.S. Federal VMware Socialcast 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐VID‐DLD‐D‐3P‐F $ 117.00 $ 111.99 VMware U.S. Federal VMware Socialcast 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐VID‐DLD‐D‐G‐F $ 43.00 $ 41.16 VMware U.S. Federal VMware Socialcast 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐VID‐DLD‐D‐P‐F $ 44.00 $ 42.12VMware U.S. Federal VMware AirWatch Printer 3‐year Subscription ‐ Dedicated Cloud for 1 device (Includes SaaS Basic Support/Subscription) V‐VID‐DLD‐U‐2G‐F $ 160.00 $ 153.15 VMware U.S. Federal VMware AirWatch Printer 3‐year Subscription ‐ Dedicated Cloud for 1 device (Includes SaaS Production Support/Subscription) V‐VID‐DLD‐U‐2P‐F $ 164.00 $ 156.98VMware U.S. Federal VMware AirWatch Printer 1‐year Subscription ‐ Dedicated Cloud for 1 device (Includes SaaS Production Support/Subscription) V‐VID‐DLD‐U‐3G‐F $ 225.00 $ 215.37 VMware U.S. Federal VMware AirWatch Mobile Device Perpetual: 1 Device V‐VID‐DLD‐U‐3P‐F $ 230.00 $ 220.15 VMware U.S. Federal VMware AirWatch Printer 2‐year Subscription ‐ Dedicated Cloud for 1 device (Includes SaaS Basic Support/Subscription) V‐VID‐DLD‐U‐G‐F $ 85.00 $ 81.36 VMware U.S. Federal VMware AirWatch Printer 2‐year Subscription ‐ Dedicated Cloud for 1 device (Includes SaaS Production Support/Subscription) V‐VID‐DLD‐U‐P‐F $ 87.00 $ 83.27 VMware U.S. Federal VMware Socialcast 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐VID‐OPL‐D‐2G‐F $ 36.00 $ 34.46VMware U.S. Federal VMware Socialcast 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐VID‐OPL‐D‐2P‐F $ 38.00 $ 36.37

VMware U.S. Federal VMware Socialcast 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐VID‐OPL‐D‐3G‐F $ 51.00 $ 48.82 VMware U.S. Federal VMware AirWatch Printer Perpetual: 1 Device V‐VID‐OPL‐D‐3P‐F $ 53.00 $ 50.73 VMware U.S. Federal VMware Socialcast 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐VID‐OPL‐D‐G‐F $ 19.00 $ 18.19 VMware U.S. Federal VMware Socialcast 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐VID‐OPL‐D‐P‐F $ 20.00 $ 19.14 VMware U.S. Federal VMware AirWatch Teacher Tools 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐VID‐PLL‐D‐F $ 30.00 $ 28.72 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Printer: 1 Device for 1 year V‐VID‐PLL‐U‐F $ 60.00 $ 57.43VMware U.S. Federal VMware AirWatch Teacher Tools 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐VID‐SSS‐D‐3G‐F $ 15.84 $ 15.16 VMware U.S. Federal VMware AirWatch Teacher Tools 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐VID‐SSS‐D‐3P‐F $ 21.12 $ 20.22 VMware U.S. Federal VMware AirWatch Teacher Tools 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐VID‐SSS‐D‐G‐F $ 6.00 $ 5.74 VMware U.S. Federal VMware AirWatch Teacher Tools 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐VID‐SSS‐D‐P‐F $ 8.00 $ 7.66 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Printer: 1 Device for 3 years V‐VID‐SSS‐U‐3G‐F $ 34.32 $ 32.85 VMware U.S. Federal VMware AirWatch Printer 1‐year Subscription ‐ Shared Cloud for 1 device (Includes SaaS Basic Support/Subscription) V‐VID‐SSS‐U‐3P‐F $ 39.60 $ 37.90 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Printer: 1 Device for 1 year V‐VID‐SSS‐U‐G‐F $ 13.00 $ 12.44 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Printer: 1 Device for 3 years V‐VID‐SSS‐U‐P‐F $ 15.00 $ 14.36 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Green Management Suite: 1 User for 1 year V‐YMS‐CLD‐D‐2G‐F $ 211.00 $ 201.96VMware U.S. Federal Production Support/Subscription for VMware AirWatch Green Management Suite: 1 User for 3 years V‐YMS‐CLD‐D‐2P‐F $ 220.00 $ 210.58VMware U.S. Federal Production Support/Subscription for VMware AirWatch Green Management Suite: 1 User for 1 year V‐YMS‐CLD‐D‐3G‐F $ 296.00 $ 283.32 VMware U.S. Federal VMware AirWatch Green Management Suite 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐YMS‐CLD‐D‐3P‐F $ 309.00 $ 295.77 VMware U.S. Federal VMware AirWatch Green Management Suite Perpetual: 1 User V‐YMS‐CLD‐D‐G‐F $ 112.00 $ 107.20 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Green Management Suite: 1 User for 3 years V‐YMS‐CLD‐D‐P‐F $ 117.00 $ 111.99VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐YMS‐CLD‐U‐2G‐F $ 420.00 $ 402.02 VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscripti V‐YMS‐CLD‐U‐2P‐F $ 439.00 $ 420.20 VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscripti V‐YMS‐CLD‐U‐3G‐F $ 589.00 $ 563.78 VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐YMS‐CLD‐U‐3P‐F $ 616.00 $ 589.62 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐YMS‐CLD‐U‐G‐F $ 223.00 $ 213.45 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Production Support/Subscripti V‐YMS‐CLD‐U‐P‐F $ 233.00 $ 223.02VMware U.S. Federal VMware AirWatch Green Management Suite 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐YMS‐DLD‐D‐2G‐F $ 234.00 $ 223.98 VMware U.S. Federal VMware AirWatch Green Management Suite 3‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐YMS‐DLD‐D‐2P‐F $ 243.00 $ 232.59 VMware U.S. Federal VMware AirWatch Green Management Suite 1‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐YMS‐DLD‐D‐3G‐F $ 328.00 $ 313.95VMware U.S. Federal VMware AirWatch Green Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐YMS‐DLD‐D‐3P‐F $ 341.00 $ 326.40 VMware U.S. Federal VMware AirWatch Green Management Suite 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐YMS‐DLD‐D‐G‐F $ 124.00 $ 118.69 VMware U.S. Federal VMware AirWatch Green Management Suite 2‐year Subscription ‐ Shared Cloud for 1 User (Includes SaaS Production Support/Subscription) V‐YMS‐DLD‐D‐P‐F $ 129.00 $ 123.48 VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐YMS‐DLD‐U‐2G‐F $ 465.00 $ 445.09 VMware U.S. Federal VMware AirWatch Orange Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐YMS‐DLD‐U‐2P‐F $ 484.00 $ 463.27VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐YMS‐DLD‐U‐3G‐F $ 653.00 $ 625.04 VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐YMS‐DLD‐U‐3P‐F $ 679.00 $ 649.92 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Basic Support/Subscription V‐YMS‐DLD‐U‐G‐F $ 247.00 $ 236.42 VMware U.S. Federal VMware AirWatch Orange Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 Device (Includes SaaS Production Support/Subscr V‐YMS‐DLD‐U‐P‐F $ 257.00 $ 245.99 VMware U.S. Federal VMware AirWatch Green Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐YMS‐OPL‐D‐2G‐F $ 188.00 $ 179.95 VMware U.S. Federal VMware AirWatch Green Management Suite 3‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscripti V‐YMS‐OPL‐D‐2P‐F $ 198.00 $ 189.52 VMware U.S. Federal VMware View: Install Configure Manage [V5.0] ‐ Extra Person EDU‐VICM5‐XP‐F $ 2,750.00 $ 2,687.66 VMware Application Virtualization with VMware ThinApp [V5.0] ‐ Open Enrollment EDU‐THINAPP5‐OE‐F $ 825.00 $ 806.30 VMware Application Virtualization with VMware ThinApp [V5.0] ‐ On Site EDU‐THINAPP5‐OS‐F $ 6,875.00 $ 6,719.14 VMware Application Virtualization with VMware ThinApp [V5.0] ‐ Extra Person EDU‐THINAPP5‐XP‐F $ 688.00 $ 672.40 VMware VMware vCloud Automation Center: Extensibility and Advanced Administration [V5 2] ‐ Open Enrollment EDU‐VCACEXT52‐OE‐F $ 1,645.00 $ 1,607.71 VMware VMware vCloud Automation Center: Extensibility and Advanced Administration [V5 2] ‐ Onsite EDU‐VCACEXT52‐OS‐F $ 13,750.00 $ 13,438.29 VMware VMware vCloud Automation Center: Extensibility and Advanced Administration [V5 2] ‐ Extra Person EDU‐VCACEXT52‐XP‐F $ 1,375.00 $ 1,343.83 VMware U.S. Federal Using VMware vCenter Lab Manager ‐ Open Enrollment EDU‐LM4‐OE‐F $ 825.00 $ 806.30VMware U.S. Federal Using VMware vCenter Lab Manager ‐ On Site EDU‐LM4‐OS‐F $ 6,875.00 $ 6,719.14

VMware U.S. Federal Using VMware vCenter Lab Manager ‐ Extra Person EDU‐LM4‐XP‐F $ 688.00 $ 672.40 VMware U.S. Federal Consulting & Training Credits ‐ Prepaid Services PSO Credit 1‐150 SVC‐CR‐0‐F $ 100.00 $ 97.73 VMware U.S. Federal Restricted SKU: Consulting & Training Credits. Prepaid Services. PSO Credit 1‐150. SVC‐CR‐0‐SSS‐F $ 100.00 $ 97.73 VMware U.S. Federal Consulting & Training Credits ‐ Prepaid Services PSO Credit 151‐600 SVC‐CR‐10‐F $ 90.00 $ 87.96 VMware U.S. Federal Restricted SKU: Consulting & Training Credits. Prepaid Services. PSO Credit 151‐600. SVC‐CR‐10‐SSS‐F $ 90.00 $ 87.96VMware U.S. Federal Consulting & Training Credits ‐ Prepaid Services PSO Credit 601‐1200 SVC‐CR‐15‐F $ 85.00 $ 83.07 VMware U.S. Federal Restricted SKU: Consulting & Training Credits. Prepaid Services. PSO Credit 601‐1200. SVC‐CR‐15‐SSS‐F $ 85.00 $ 83.07 VMware U.S. Federal Consulting & Training Credits ‐ Prepaid Services PSO Credit 1201+ SVC‐CR‐20‐F $ 80.00 $ 78.19VMware U.S. Federal Restricted SKU: Consulting & Training Credits. Prepaid Services. PSO Credit 1201+ SVC‐CR‐20‐SSS‐F $ 80.00 $ 78.19 VMware U.S. Federal Socialcast Configuration and Integration Design ‐ On Premises CON‐SC‐CIDOP‐FF‐F $ 7,500.00 $ 7,329.97 VMware U.S. Federal Socialcast Assigned Client Account Representative CON‐SC‐ACAR‐FF‐F $ 30,000.00 $ 29,319.90 VMware U.S. Federal Socialcast Reach System Integration CON‐SC‐RSI‐FF‐F $ 3,500.00 $ 3,420.65 VMware U.S. Federal Socialcast Single Sign On Configuration CON‐SC‐SSOC‐FF‐F $ 5,000.00 $ 4,886.65VMware U.S. Federal Socialcast Custom Theme Integration CON‐SC‐CTI‐FF‐F $ 3,500.00 $ 3,420.65 VMware U.S. Federal VMware AirWatch Green Management Suite 1‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscripti V‐YMS‐OPL‐D‐3G‐F $ 264.00 $ 252.70 VMware U.S. Federal VMware AirWatch Orange Management Suite Perpetual: 1 Device V‐YMS‐OPL‐D‐3P‐F $ 278.00 $ 266.10 VMware U.S. Federal VMware AirWatch Green Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Basic Support/Subscription) V‐YMS‐OPL‐D‐G‐F $ 100.00 $ 95.72 VMware U.S. Federal VMware AirWatch Green Management Suite 2‐year Subscription ‐ Dedicated Cloud for 1 User (Includes SaaS Production Support/Subscripti V‐YMS‐OPL‐D‐P‐F $ 105.00 $ 100.50 VMware U.S. Federal VMware AirWatch Green Management Suite 2‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐YMS‐PLL‐D‐F $ 130.00 $ 124.43 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Orange Management Suite: 1 Device for 1 year V‐YMS‐PLL‐U‐F $ 260.00 $ 248.87 VMware U.S. Federal VMware AirWatch Green Management Suite 2‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐YMS‐SSS‐D‐3G‐F $ 71.28 $ 68.23 VMware U.S. Federal VMware AirWatch Green Management Suite 3‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐YMS‐SSS‐D‐3P‐F $ 87.12 $ 83.39 VMware U.S. Federal VMware AirWatch Green Management Suite 3‐year Subscription ‐ On Premise for 1 Device (Includes Basic Support/Subscription) V‐YMS‐SSS‐D‐G‐F $ 27.00 $ 25.84 VMware U.S. Federal VMware AirWatch Green Management Suite 1‐year Subscription ‐ On Premise for 1 Device (Includes Production Support/Subscription) V‐YMS‐SSS‐D‐P‐F $ 33.00 $ 31.59 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Orange Management Suite: 1 Device for 3 years V‐YMS‐SSS‐U‐3G‐F $ 145.20 $ 138.98VMware U.S. Federal VMware AirWatch Orange Management Suite 1‐year Subscription ‐ Shared Cloud for 1 Device (Includes SaaS Basic Support/Subscription) V‐YMS‐SSS‐U‐3P‐F $ 171.60 $ 164.25 VMware U.S. Federal Production Support/Subscription for VMware AirWatch Orange Management Suite: 1 Device for 1 year V‐YMS‐SSS‐U‐G‐F $ 55.00 $ 52.64 VMware U.S. Federal Basic Support/Subscription for VMware AirWatch Orange Management Suite: 1 Device for 3 years V‐YMS‐SSS‐U‐P‐F $ 65.00 $ 62.22VMware U.S. Federal Upgrade: VMware AirWatch from Mobile Device & Airwatch Content Locker View to Yellow Management Suite Subscription ‐ On Premise (I V‐YMS‐WKS‐MF‐2M‐SSS‐F $ 10.84 $ 10.59 VMware U.S. Federal Upgrade: VMware AirWatch from Mobile Device & Airwatch Content Locker View to Yellow Management Suite Subscription ‐ Shared Cloud V‐YMS‐WKS‐MF‐3Y‐SSS‐F $ 171.60 $ 167.71 VMware U.S. Federal Upgrade: VMware AirWatch from Airwatch Content Locker View to Airwatch Content Locker Collaborate Subscription ‐ Shared Cloud (IncludV‐YMS‐WKS‐MF‐SSS‐F $ 65.00 $ 63.53 VMware U.S. Federal VMware vCloud Air Accelerator CON‐VCA‐ACL‐F $ 19,035.00 $ 18,603.48 VMware U.S. Federal VMware Desktop Viritualization Health Check CON‐VDI‐HC‐S‐F $ 24,406.60 $ 23,853.30

SOLICITATION # CH16012
i

TABLE OF CONTENTS
RFP Signature Page ........................................................................................................... 1 Acknowledgement of Amendments .................................................................................. 4 Executive Summary............................................................................................................ 6 Prime Contractor: Carahsoft Technology Corp....................................................................................6 Mandatory Minimums......................................................................................................... 8 Business Profile................................................................................................................ 12 Organizations Profile........................................................................................................ 21 Technical Response......................................................................................................... 23 Confidential, Protected, or Proprietary Information..................................................... 183 Exceptions and/or Additions to the Standard Terms and Conditions........................ 185 In Summary..................................................................................................................... 186 Supplemental Information.............................................................................................. 187

SOLICITATION # CH16012
1 RFP SIGNATURE PAGE
The Lead State’s Request for Proposal Signature Page completed and signed. See Section 5.1 of the RFP.

Please find below Carahsoft’s RFP Signature Page below.

SOLICITATION # CH16012
4 ACKNOWLEDGEMENT OF AMENDMENTS
Please find below Carahsoft’s Acknowledgement of Amendments.

SOLICITATION # CH16012
6 EXECUTIVE SUMMARY
The one or two page executive summary is to briefly describe the Offeror's Proposal. This summary should highlight the major features of the Proposal. It must indicate any requirements that cannot be met by the Offeror. The Lead State should be able to determine the essence of the Proposal by reading the executive summary. See Section 5.4 of the RFP.

Prime Contractor: Carahsoft Technology Corp.

Carahsoft Technology Corporation understands that the State of Utah & NASPO ValuePoint is seeking a Master Agreement for Cloud Solutions.

Carahsoft has assembled a team from our vast portfolio of over 200 hundred vendors that includes our premiere network of cloud solutions, resellers, and subcontractors as the best solution to meet the State of Utah’s requirements. The intent of our proposal is to deliver the highest value proposition at the lowest possible cost to the State of Utah, NASPO ValuePoint, & all participating entities for the acquisition of cloud solutions. Carahsoft understands the need for high quality cloud based service providers that have the ability to provide a menu of cloud solution offerings. Carahsoft’s superior contract management and network of Cloud Solution Providers will ultimately increase the State & Participating Entities overall efficiency, reduce costs, improve operational scalability, provide business continuity, increase collaboration efficiencies, and all for expanded flexibility.

Carahsoft Technology Corp. is an IT solutions provider delivering best-of-breed hardware, software, and support solutions to federal, state and local government agencies since 2004. Carahsoft has built a reputation as a customer-centric real-time organization with unparalleled experience and depth in government sales, marketing, and contract program management. This experience has enabled Carahsoft to achieve the top spot in leading software license GSA resellers.

VENDOR RELATIONSHIPS – Just as each state, territory, and participating entity is unique in how they employ cloud solutions, Carahsoft’s cloud offering follows a unique business model focusing on providing superior sales and marketing execution, a track record of success, high integrity, and a focus on strategic vendor relationships.

PROVEN EXECUTION (Growth and Experience of Sales) – Carahsoft has been supporting the IT needs of Government and Education Customers for more than 12 years. Our Public Sector Sales Team supports the Government, Education, and Healthcare vertical markets and is an enormous component of Carahsoft’s ongoing and continued growth. In 2014, Carahsoft had revenues of over $2B in the public sector market.

Our State & Local Government Sales Force is solely dedicated to supporting the unique needs of Higher Education, K‐ 12 Schools, State Government, and Local Government customers.

CONTRACT VEHICLES – Over the past ten years Carahsoft has acquired and maintained a wide variety of purchasing contract vehicles for agencies at the state, local, and federal levels. Carahsoft holds statewide contracts in many states across the country, and we have a great deal of experience with contract transitions. Associated with all contracts are dedicated and experienced contract management resources.

SOLICITATION # CH16012
7 Carahsoft has leveraged its vast contracting experience and extended it to quoting and order management.

Carahsoft seamlessly generates quotes within 30 minutes or less and processed over 56,000 orders in 2014 that were each completed the same day received.

GROWTH & STABILITY – Carahsoft has continued to show impressive growth year after year, turning annual revenue from $3.4 million in our first year in 2004 to $1.065 billion in 2011, $1.465 billion in 2012, $1.8 billion in 2013, and $2.45 billion in 2014. In September of 2014, 7,501 orders were processed worth over $626 million. We are a stable, conservative, and profitable company and have received numerous accolades including the 2013 GovCon Government Contractor of the Year Award in the greater than $300M revenue category. Carahsoft was also recognized in the following areas:
 Largest GSA Schedule 70 Contract holder for software
 7
th of the Washington Business Journal’s 100 Largest Private Companies List for 2014
 2012 Federal 100 Winner, Craig P. Abod, President and CEO  2013 Federal 100 Winner, John Lee, Vice President of Cloud Services As a part of this response Carahsoft has utilized multiple Cloud Solution Vendors, covering all of the Cloud Solution Categories; SaaS, IaaS, PaaS. Carahsoft’s strong vendor relationships and partner ecosystem have created an efficient and cost effective response which encompasses all vendor solutions into a single, easy to utilize vehicle. While the technical requirements of each solution vary, Carahsoft strives to consolidate these specifications and responses into a cohesive unit.

SOLICITATION # CH16012
8 MANDATORY MINIMUMS
This section should constitute the Offeror’s point-by-point response to each item described in Section 5 of the RFP, except 5.1 (Signature Page) and 5.4 (Executive Summary). An Offeror’s response must be a specific point-by-point response, in the order listed, to each requirement in the Section 5 of the RFP.

5.1 – Signature Page
Proposals must be submitted with a vendor information form, located on Bidsync as an attachment to the RFP, which must contain an ORIGINAL HANDWRITTEN signature executed in INK OR AN ELECTRONIC SIGNATURE, and be returned with the Offeror’s proposal.

Please find Carahsoft’s Signature Page completed above.

5.2 – Cover Letter
Proposals must include a cover letter on official letterhead of the Offeror. The cover letter must identify the RFP Title and number, and must be signed by an individual authorized to commit the Offeror to the work proposed. In addition, the cover letter must include:

5.2.1 A statement indicating the Offeror’s understanding that they may be required to negotiate additional terms and conditions, including additional administrative fees, with Participating Entities when executing a Participating Addendum.

5.2.2 A statement naming the firms and/or staff responsible for writing the proposal.

5.2.3 A statement that Offeror is not currently suspended, debarred or otherwise excluded from federal or state procurement and non-procurement programs.

5.2.4 A statement acknowledging that a 0.25% NASPO ValuePoint Administrative Fee and any Participating Entity Administrative fee will apply to total sales for the Master Agreement(s) awarded from the RFP.

5.2.5 A statement identifying the service model(s) (SaaS, IaaS, and/or PaaS) and deployment model(s) that it is capable of providing under the terms of the RFP. See Attachment C for a determination of each service model subcategory. The services models, deployment models and risk categories can be found in the Scope of Services, Attachment D. Note: Multiple service and/or deployment model selection is permitted, and at least one service model must be identified. See Attachment H.

5.2.6 A statement identifying the data risk categories that the Offeror is capable of storing and securing.

See Attachment D and Attachment H.

Please find above Carahsoft’s Cover Letter addressing these requirements.

SOLICITATION # CH16012
9 5.3 – Acknowledgement of Amendments
If the RFP is amended, the Offeror must acknowledge each amendment with a signature on the acknowledgement form provided with each amendment. Failure to return a signed copy of each amendment acknowledgement form with the proposal may result in the proposal being found nonresponsive.

Carahsoft acknowledges all amendments. Also please find below Carahsoft’s Acknowledgement of Amendments form completed.

5.4 – Executive Summary
Offerors must provide an Executive Summary of its proposal. An Executive Summary should highlight the major features of an Offeror’s proposal. Briefly describe the proposal in no more than three (3) pages. The evaluation committee should be able to determine the essence of the proposal by reading the Executive Summary. Any requirements that cannot be met by the Offeror must be included.

Please find above Carahsoft’s Executive Summary addressing these requirements.

5.5 – General Requirements

5.5.1 Offeror must agree that if awarded a contract it will provide a Usage Report Administrator responsible for the quarterly sales reporting described the Master Agreement Terms and Conditions, and if applicable Participating Addendums.

Carahsoft agrees that if awarded a contract they will provide a Usage Report Administrator responsible for quarterly sales reporting described in the Master Agreement Terms and Conditions, and if applicable Participating Addendums.

5.5.2 Offeror must provide a statement that it agrees to cooperate with NASPO ValuePoint and SciQuest (and any authorized agent or successor entity to SciQuest) with uploading an Offeror’s ordering instructions, if awarded a contract.

Carahsoft agrees to cooperate with NASPO ValuePoint and SciQuest (and any authorized agent or successor entity to SciQuest) with uploading Carahsoft’s ordering instructions, if awarded a contract.

5.5.3 Offeror must at a minimum complete, provide, and maintain a completed CSA STAR Registry SelfAssessment. Offeror must either submit a completed The Consensus Assessments Initiative Questionnaire (CAIQ), Exhibit 1 to Attachment B, or submit a report documenting compliance with Cloud Controls Matrix (CCM), Exhibit 2 to Attachment B. Offeror must also represent and warrant the accuracy and currency of the information on the completed. Offerors are encouraged to complete and submit both exhibits to Attachment B.

For ease of access and evaluation, Carahsoft has provided these Assessment documents under separate cover. All copies have been submitted electronically per the instructions of the RFP. Please note that specific assessments have been labeled as confidential- additional information is provided in the Confidential, Protected, or Proprietary Information section.

SOLICITATION # CH16012
10 5.5.4 Offeror, as part of its proposal, must provide a sample of its Service Level Agreement, which should define the performance and other operating parameters within which the infrastructure must operate to meet IT System and Purchasing Entity’s requirements.

SERVICE LEVEL FRAMEWORK
The service levels (“Service Levels”) applicable to the Services specified in Sections 1 and 2 are set forth in Schedule B to this SD (“Service Levels for Cloud Platform Services”). The framework that governs all Service Levels is set forth in this Section.

Commencement of Service Levels
Commencing thirty (30) days from the Service Start Date (as set forth in the applicable Order Form), Virtustream’s performance of the Services will meet each applicable Service Level. If Virtustream’s performance of the Services does not meet the applicable Service Level, then Virtustream will use commercially reasonable efforts to restore its performance to meet such Service Level.

Service Level Reports
Service Levels will be calculated and measured monthly by Virtustream on a calendar month basis and reported each month for the previous month. The reports will be provided to Customer by the tenth (10th) working day of the month following that to which such report relates, commencing on the second (2nd) month following the Service Start Date and each month thereafter. The monthly service level report will contain at least the following items: (i) Uptime statistics for the month concerned; (ii) an analysis of reported incidents over the previous month, broken down by type for discussion; (iii) action plans for items giving rise to concern; (iv) comments and observations on any issues arising from Virtustream’s performance monitoring activities; (v) recommendations on service delivery strategies to maintain or enhance the service level; and (vi) review of general business requirements (“Service Level Report”).

Cloud Platform Services (CPS) has its own specific service levels as described in this document. Cloud Cover Services (CCS) has service levels that pertain to the CCS offerings and are reported separately. Not all Virtustream customers have CCS but all Virtustream customers use CPS.

Service Level Review Meetings
Monthly Service Level review meetings will be conducted by Virtustream with Customer where the monthly Service Level report specified above will be discussed. If any of the Service Levels measured over the previous calendar month period is not achieved in that month, then Virtustream will include the steps taken to rectify the problem in the next monthly Service Level Report. In addition, the issue shall be an agenda topic for discussion at the next monthly service review meeting. Additionally, after restoring service or otherwise resolving any immediate problem as specified in this SD, if Virtustream fails to provide Services in accordance with the Service Levels, Virtustream shall:
a. Promptly investigate and report on the causes of such problem; b. Provide a Root Cause Analysis of such failure as soon as practical after such failure or at Customer’s request; c. Correct such problem that is Virtustream’s fault or responsibility, as soon as reasonably practicable and coordinate the correction of such problem if Virtustream does not have responsibility for the cause of such problem. d. Advise Customer of the status of remedial efforts being undertaken with respect to such problem; e. Demonstrate to Customer’s reasonable satisfaction that the causes of such problem (that is Virtustream’s fault or responsibility) have been or shall be corrected on a permanent basis; and f. Take corrective actions to prevent any recurrence of such problem (that is Virtustream’s fault or responsibility).

Root Cause Analysis
Promptly following Virtustream’s failure to meet a Service Level, Virtustream will perform a root cause analysis to determine the reason for that failure. Upon Virtustream’s determination of the cause of such failure, it will provide to Customer a preliminary report citing the cause of such failure. If Virtustream determines that the failure was due to Virtustream, an additional report will be provided that details the root causes of the failure, and which details any measures that should be taken to minimize the possibility that such failures will re-occur. Virtustream will correct the problem and use reasonable commercial efforts to minimize the re-occurrence of such failures.

Service Level Exceptions
Virtustream shall not be liable for any failure to meet the Service Levels, to the extent such failure was caused by one or more of the following:
a. A failure of Customer or any of its employees, agents or contractors (including any of Customer’s third party service providers) to perform any of its responsibilities under this SD;

SOLICITATION # CH16012
11 b. Any act or omission of Customer or any of its employees, agents or contractors (including Customer’s third party service providers or other third parties acting on behalf of Customer); c. Any hardware, software or other product of a third-party or Customer equipment; d. Any failure of Customer to secure the proper access rights or maintenance and support services with respect to any component of the Services (e.g., hardware, software, network, maintenance) for which Virtustream does not bear operational responsibility;
e. Downtimes resulting from a Virtustream’s scheduled maintenance windows; f. Customer’s reprioritization of the tasks to be performed by Virtustream where such reprioritization causes Virtustream to miss a Service Level;
g. Viruses; provided that the infected Virtustream-provided system had virus protection for which the virus protection software updates were up to date;
h. An election by Customer to purchase a base commitment that is not sufficient to run Customer’s system (e.g., If a customer elects to size a µVM pool that is insufficient to run the designated workload); i. Issues occurring outside of standard working hours (as defined for business level customers) — for which the Service Level Objectives (SLOs) do not apply;
j. Cloud Cover Services (CCS) offerings — for which the Service Level Objectives (SLOs) do not apply; k. Resolution delays due to lack of client response and/or Customer provided credential based information; l. Priority levels not agreed upon by both customer and supplier; m. Claims of performance degradation not substantiated through Customer provided diagnostic testing results.

5.7 Recertification of Mandatory Minimums and Technical Specifications Offeror must acknowledge that if it is awarded a contract under the RFP that it will annually certify to the Lead State that it still meets or exceeds the technical capabilities discussed in its proposal.

Carahsoft acknowledges that if awarded a contract under the RFP that it will annually certify to the Lead State that it still meets or exceeds the technical capabilities discussed in this proposal.

SOLICITATION # CH16012
12 BUSINESS PROFILE
This section should constitute the Offeror’s response to the items described in Section 6 of the RFP. An Offeror’s response must be a specific point-by-point response, in the order listed, to each requirement in the Section 6 of the RFP.

6.1 – Business Profile Provide a profile of your business including: year started, organizational structure, client base (including any focus by region, market sector, etc.), growth over the last three (3) years, number of employees, employee retention rates (specific for employees that may be associated with the services related to the RFP) over the last two (2) years, etc. Businesses must demonstrate a minimum of three (3) years of experience providing cloud solutions for large scale projects, including government experience, to be eligible for award.

Carahsoft Technology Corp. was started in Reston, Virginia in 2004. Carahsoft remains headquartered in Reston Virginia employing over 500 people that specifically support the Public Sector (Federal, State, Local, and Public Funded Educational Entities Nationwide within the United States.) Carahsoft has built a reputation as a customer focused organization with depth of experience in government sales, marketing, and contract program management.

Carahsoft is one of the largest sellers of Cloud (including SaaS, PaaS, and IaaS) to U.S. the Public Sector.

Carahsoft’s organizational structure allows for very focused and individualized support of any customer. The Executive Management team at Carahsoft is responsible for all aspects of day to day running of the organization.

Reporting to the Executive Management Team are Directors. It is the Director’s primary responsibility to oversee a particular technology area(s) and to monitor and manage all aspects of the staff, customers, and business within that area. An example of a Technology Area at Carahsoft is the VMware Virtualization practice. A host of technology offerings that use VMware at their core are supported by a single business unit overseen by a single Director that has reach back and access to the Executive Management staff. The Director’s are then supported by a group of Team Leads. Each Team Lead Oversees a business area (typically defined by customer type (i.e. State Customers) or technology type (i.e. Virtual Desktop). Each team lead oversees a staff that is responsible for executing and managing the activities within that business unit.

At its’ core, this organizational structure is lean and efficient, lacking layers of middle management, and empowering individuals with decision making capability in order to support all customers quickly an efficiently.

Carahsoft boasts an excellent employee retention rate. Specific benchmarks that we track include employee retention at 2 years of employment and 4 years of employment with rates of 65% and 90% respectively.

Carahsoft has been providing cloud solutions since opening its doors in 2004. US Public Sector entities have relied on Carahsoft to provide a wide variety of cloud technologies. Carahsoft serves as the cloud distributor and provides access to the core cloud technology with the core technology being supported by companies such as SalesForce, Google, ServiceNow, etc. Carahsoft currently support a state-wide implementation of Service Now’s cloud technology within the Commonwealth of Pennsylvania. This implementation is known as the Enterprise Information Help Desk and manages all incident requests. Additionally, in 2013, Carahsoft has contracted with the State of Ohio to provide a cloud solution built around the technology from Salesforce. Ohios’ Department of Administrative Services has contracted for Carahsoft to provide a variety of services including Service Cloud, Radian6 and Marketing Cloud as well as others. Both the Ohio and Pennsylvania cloud solutions are still being provided to these organizations.

Contracts similar in scope and size of this NASPO Cloud RFP:

SOLICITATION # CH16012
13 California Multiple Award Schedule California CMAS 3-12-70-2247E Delaware Salesforce Contract Delaware SE-CLD-001
Florida Commercial-off-the-shelf Software Contract Florida COTS 43230000-14-01 Iowa Salesforce Contract Iowa 2015-BUS-004
Ohio Master Cloud Services Agreement Ohio MCSA-0016
Ohio State Term Schedule Ohio STS 534354
Texas DIR Salesforce Contract DIR-SDD-1793
Texas DIR Emergency Preparedness Contract DIR-SDD-2035
Texas DIR Software/SaaS Contract DIR-TSO-3149
VITA Desktop Productivity Software Contract VITA VA-140401-CARA

6.2 – Scope of Experience Describe in detail the business’ experience with government or large consortium contracts similar to the Master Agreements sought through this RFP. Provide the approximate dollar value of the business’ five (5) largest contracts in the last two (2) years, under which the Offeror provided Solutions identical or very similar to those required by this RFP. Government experience is preferred.

CONTRACT VEHICLES – Over the past ten years Carahsoft has acquired and maintained a wide variety of purchasing contract vehicles for agencies at the state, local, and federal levels. Carahsoft holds statewide contracts in many states across the country, and we have a great deal of experience with IT Master contracts accessible to numerous public agencies. Carahsoft has extensive experience in successfully launching, maintaining, and managing these contracts and projects over a wide range of government customers. The range of government projects include agency/ county/ city wide project, state-wide efforts, and multi-state contracts, as well as supporting projects that cross a wide range of Federal government customers. Examples of some of these projects include:

TEXServe Multi-jurisdictional Purchasing Program: Carahsoft promoted and managed the Texserve Contract-allowing the full VMware Products & Services portfolio to be procured by Texas K-12 Users at a discounted price.

TEXserve services including: VMware Technical Support, Pre-sales licensing configuration & design, contract promotion, ad hoc revenue reporting, and customer nurturing/ upsell campaigns. Carahsoft worked with Texserve, K-12 customers, to partner with a select number of VMware Premier and Enterprise Authorized Resellers utilizing their expertise under the Texserve contract.

ONENET Purchasing Consolidation: Carahsoft serves as the prime contractor and program manager for the ONENET contract serving the entire ONENET community providing the ability to procure VMware software (licensing/support) through a trusted network of strategic partners at a discounted rate. Carahsoft has a proven track record of providing the highest level of technical support while ensuring that members receive the proper software products and services conveniently under the ONENET Contract.

TX DIR Contract Sales: Carahsoft maintains a number of purchasing vehicles with the State of Texas Department of Information Resources (DIR.) 2014 DIR sales accounted for greater than $50M in revenues.

Carahsoft actively markets these contracts and has grown revenues at greater than 10% annually for the past 5 years.

Total GSA State & Local Sales: Carahsoft holds a US General Services Administration (GSA) Schedule 70 Technology Contract. This contract is open to State and Local agencies to purchase as a form of Cooperative

SOLICITATION # CH16012
14 Purchasing. Carahsoft markets the availability of this contract to eligible users and maintains sales revenues to eligible State and Local entities at greater than $50M annually.

As a whole, Carahsoft’s five largest public sector contracts have totaled approximately $211,571,007 in sales in the past 2 years.

Carahsoft GSA Schedule GS-35F-0119Y $127,242,948.95
Texas DIR Emergency Preparedness Contract TX-DIR-SDD-2035 $ 39,007,058.19 Texas DIR BMC Contract TXDIR-SDD-1727 $ 15,734,306.68
Texas DIR Salesforce Contract TXDIR-SDD-1793 $ 14,876,679.26 Texas DIR Adobe Contract TX-DIR-SDD-2504 $ 14,710,013.43 Total Sales: $211,571,006.51
These contracts make up close to 2/3 of the total sales on contract that Carahsoft completed in that span. All of these contracts are currently in place with government entities.

6.3 – Financials Offeror must provide audited financial statements, of the last two years, to the State that demonstrate that an Offeror meets at a minimum Dun and Bradstreet (D&B) credit rating of 3A2 or better, or a recognized equivalent rating. Please provide the Respondent’s D&B Number and the composite credit rating. The State reserves the right to verify this information. If a branch or wholly owned subsidiary is bidding on this RFP, please provide the D&B Number and score for the parent company that will be financially responsible for performance of the agreement.

Carahsoft has deemed its audited financials to be considered confidential. Additional information is provided in the Confidential, Protected, or Proprietary Information section. For D&B report along with additional clarification, please see page 360 in the Supplemental Information Section.

6.4 – General Information

6.4.1 Provide any pertinent general information about the depth and breadth of your Solutions and their overall use and acceptance in the cloud marketplace.

Carahsoft has assembled a team from our vast portfolio of vendors that includes our leading premiere network of cloud solutions, resellers, and subcontractors as the best solution to meet the State of Utah’s requirements. They include:

AODocs, CA, DocuSign, FireEye, Google, QTS, Salesforce, SAP, ServiceNow, Virtru, Virtustream, VMware Carahsoft is submitting as the exclusive offeror for all Google, Salesforce, and ServiceNow solutions and services for the NASPO Cloud solicitation. These manufacturers have deemed Carahsoft as the prime contractor who can effectively and efficiently manage the NASPO cloud contract on their behalf.

As a part of this response Carahsoft has utilized multiple Cloud Solution Vendors, covering all of the Cloud delivery models; SaaS, IaaS, PaaS. Carahsoft’s strong vendor relationships and partner ecosystem have created an efficient and cost effective response which encompasses all vendor solutions into a single, easy

SOLICITATION # CH16012
15 to utilize vehicle. While the technical requirements of each solution vary, Carahsoft strives to consolidate these specifications and responses into a cohesive unit. For example:

CA Technologies is a leader in IT Management Solutions in the industry. CA has be steadily moving its premier on premise management solutions to the cloud. CA Clarity Project and Portfolio Management (PPM) is one of the leading solutions used by state governments today.

Google’s SaaS offering, Google Apps, has been commercially available since 2006 and presently has ~5.3 million paying customers covering 26m+ end user licenses. Google Apps represents a combination of the most popular consumer products that have been prepared for Enterprise use through the means of adding Administrative and Compliance Controls to the suite.

Gmail is the anchor product in the SaaS offering. Google has over 1B consumer users of Gmail and from that success designed a means by which customers could bring their own email-enabled domain name(s) into this managed service to replace legacy on-premises systems at a significantly reduced price. The straightforward means of migrating data as well as configuring the service and the knowledge that a majority of these business users may already be familiar with Gmail via personal use has made the adoption of Google Apps a logical choice.

Examples of the evolution of this SaaS offering include:
● Acquisition in 2007 of one of the leading email security and compliance vendors and the integration of those services to the Gmail Advanced Settings options. These features include the ability for customer System Administrators to set Spam, Content, Attachment and TLS policies to meet their specific requirements.
● In 2011 Google launches the Google Apps Status Dashboard, a publicly accessible website with RSS feeds to keep the world apprise of current system status. ● In 2012 Google increases the Gmail storage allocation from 10gb to 25gb, no change in price ● In 2013 Google modifies the storage space to unify email and Drive storage and increase the allocation to 30Gb, no change in price
● In 2014 Google offers a new premium SKU that offers unlimited unified Storage ● In 2015 Google enhances the Gmail Advanced Settings features to include pre-defined lexicons to support Data Loss Prevention scanning in email.

The above list is a short list of the variety of services, support offerings, features and best practices that Google has adopted into the service delivery of the SaaS offering. In addition to the wide use of GMail, Google has six other products with over a Billion active users. Those are Google Search, Chrome, Android, Google Maps, YouTube and Google Play.

Chrome as a browser and an operating system are further evidence of strong usage and market acceptance. In a report released by Net Applications in April of 2015, Chrome browser held 25.68% market share while IE11 had 25.04, followed by IE8 at 16.0. The increase in adoption by Enterprise customers is attributed to the real time updates against emerging threats and the Chrome for Enterprise browser controls.

Chromebooks, the laptops that run Google Chrome as the OS, are seeing a rapid increase in sales in the K-12 market worldwide. This is attributed to the low-cost and the easy-to-manage machines.

SOLICITATION # CH16012
16 Google’s PaaS/IaaS offerings entitled Google Cloud Platform was first announces in 2008 with Google App Engine, a platform to develop and host web applications. Early success on this platform included The Royal Wedding Website and BestBuy moving their online Gift Card/Registry service to the platform. Over the years, and based on market demand, Google began to externalize off PaaS/IaaS service offerings that Google developed originally for their own infrastructure and platform utilization.

Google continues to expose the benefits of Google’s infrastructure to outside entities.

Or, put differently, Google lets customers use the same infrastructure that allows Google to return billions of search results in milliseconds, serve 6 billion hours of YouTube video per month and provide storage for 1Billion Gmail users.

Salesforce is the enterprise cloud computing leader dedicated to helping companies and government agencies transform into connected organizations through social and mobile technologies. Since launching its first service in 2000, Salesforce’s list of over 150,000 customers span nearly every industry worldwide.

The company’s trusted cloud platform is creating a connected government experience for over 1000 government agencies including all federal cabinet government agencies and the majority of US States.

With the world’s leading cloud platform, Salesforce is freeing government data from legacy systems, empowering citizens and connecting agencies to administer government in powerful new ways.

Government agencies are using Salesforce solutions for a multitude of government functions including grants management, constituent communications and correspondence management, incident and case management, call/contact center management, outreach programs, learning management, volunteer management, project management, and even donor management, among numerous others.

SAP is the fastest growing company at scale in the cloud with a user base of over 95 million subscribers.

We also have the largest cloud portfolio of over 30 solutions for all lines of business as well as business suites. We also have 41 data centers in 21 locations in 11 countries.

6.4.2 Offeror must describe whether or not its auditing capabilities and reports are consistent with SAS 70 or later versions including, SSAE 16 6/2011, or greater.

Security is a multidimensional business imperative that demands consideration at multiple levels, from security for applications to physical facilities and network security. In addition to the latest technologies, world-class security requires ongoing adherence to best-practice policies. To ensure this adherence, our various cloud providers continually seek relevant third-party certification, including ISO 27001, the SysTrust audit (the recognized standard for system security), and SSAE 16 SOC 1 audit (an examination and assessment of internal corporate controls, previously known as SAS 70 Type II). SOC1, SOC2 and SOC3 audits are performed by third party auditor annually at a minimum. Additional audits and certifications include: CSA ‘Consensus Assessments Initiative’, JIPDC (Japan Privacy Seal), Tuv (Germany Privacy Mark), and TRUSTe.

Some examples include:

ServiceNow’s security framework is based on ISO/IEC 27002 and has been ISO 27001 certified since 2012. Annually, ServiceNow undergoes ISO 27001 Surveillance audits and well as SSAE 16 attestations for both SOC 1 Type 2 and SOC 2 Type 2. Customers under an NDA can request these reports annually in assisting with both their vendor management and regulatory or compliance programs. ServiceNow provides Security Event Logs using Application Level Audit Logs and Infrastructure Monitoring,

SOLICITATION # CH16012
17 Application Level Audit Logs. The ServiceNow application writes detailed audit log information that is stored in tables within a customer’s instance. Since this is considered customer data and is stored within a customer’s instance, ServiceNow does not attempt to monitor or view this data unless specifically requested by a customer. As a result the customer is responsible for monitoring the contents of these logs files and, at the customer’s choosing, exporting the logs through the capabilities provided within the platform.

Infrastructure Monitoring. All components of the infrastructure supporting the private cloud feed alerts and logs into the SIEM. In addition, ServiceNow has deployed an Intrusion Detection System (IDS), positioned to listen to all inbound network traffic, with all events going to the SIEM as well. The SIEM is configured to automatically send alerts for common attacks. ServiceNow is responsible for managing the SIEM environment and securing the logs. ServiceNow retains all infrastructure logs for at least 90 days. The Security Operations Center (SOC) is also responsible for completing a daily checklist across a range of security domains, including privilege account usage, IDS alerts, file integrity monitoring (FIM), and database access. The daily checklists and captured events are managed through an instance of ServiceNow. Any variances that are discovered are raised as incidents for tracking, notifications, and investigation.

CA SaaS environment is compliant with SSAE16 for services where infrastructure and application are managed and maintained by CA. CA Agile Management currently does not hold SSAE16 certification. For SaaS offerings where infrastructure is managed by a third party, provider’s SSAE16 reports are available upon request.

6.5 – Billing and Pricing Practices

6.5.1 Describe your billing and pricing practices, including how your billing practices are transparent and easy to understand for Purchasing Entity’s.

Carahsoft’s Order Management team works to ensure that billing and payment are completed in an efficient and simple manner. Purchase Orders and Invoices are provided to the customer early to ensure that payment can be completed whenever the customer is ready and within the confines of the agreed upon deal. Our OM team is available to answer any questions a Purchasing Entity has in order to assist with the process and confirm that they have everything needed for payment.

Carahsoft’s pricing is dictated by the manufacturers- Carahsoft ensures that the Purchasing Entity’s receive the best possible price by working directly with the manufacturer and ensuring that pricing meets or exceeds the contract being used. In addition, Carahsoft works with the manufacturer to ensure that all pricing changes are accounted for within the contract, as applicable.

6.5.2 Identify any typical cost impacts that a Purchasing Entity might need to consider, if any, to implement your cloud solutions.

When a purchasing entity determines they need implementation services to their cloud solutions, the Carahsoft offering provides these additional services. For Example:

ServiceNow Response: Customers typically engage ServiceNow for the initial implementation and training services and then for any major new future application implementations to get the best-of-breed expertise

SOLICITATION # CH16012
18 for good standard solution support. ServiceNow developed the platform and applications so anyone could support changes to the configuration without having to hire outside consultants. The customer is empowered as they gain experience either by shadowing ServiceNow consultants during initial implementations, as they talking to other customers through the Community website, or by asking for technical support through the portal. So initial costs typically occur for ServiceNow when it is first implemented and there might be requested services as customers add new application support but there are no ongoing costs typically.

CA Cloud SaaS solutions are fully operational multi-tenant solution that are fully ready to use at outset.

These Solutions are typically complex management solutions that do require setup and training. For example many customer will purchase a limited time block of consulting to help with loading data, and configuring reports. Training is also available for all applications to either augment start-up packs or walk customers through basic tasks.

In addition to the licensing fees there are optional Google services that a Purchasing Entity may find meet additional mandatory requirements. Examples would include adding on other SaaS solutions like Virtru for end to end encryption or AODocs for Document Management. The key benefit to moving to Cloud based vendors is a new set of transformative tools that are more productive and most cost effective than traditional client server solutions. Other additional costs may come into play of the Purchasing Entity wants to outsource all of the configuration and migration work to the selected reseller leading to additional time and materials expenses.

The Salesforce solution is available immediately for use via the internet after a Purchasing Entity makes a purchase of the solution. Other additional costs would include any implementation fees to be performed by a certified Salesforce implementation partner. These fees vary based on the type of project and length and complexity of implementation.

6.5.3 Offeror must describe how its Solutions are NIST compliant, as defined in NIST Special Publication 800-145, with the service models it offers.

Carahsoft’s cloud solution offerings all fit within the guidelines listed in NIST publication 800-145 and repeated in Attachment D of this response. Please see response 8.1.5 for a more detailed explanation.

6.6 – Scope and Variety of Cloud Solutions

6.6 Specify the scope and variety of the service models you offer under this solicitation. You may provide a list of the different SaaS, IaaS, and/or PaaS services that you offer.

Carahsoft proudly offers a number of SaaS, PaaS, and IaaS supported by the cloud technologies as listed below. Many of our top tier cloud vendors also provide subscription and utility based pricing models which would be available to the State. Below is a list of each manufacturer being proposed in this response, along with the specific type of solution (SaaS, IaaS, and PaaS) they fit into:

SaaS – AODocs, CA Technologies, DocuSign, FireEye, Google, QTS, Salesforce, SAP, ServiceNow, Virtru, VMware
PaaS – Google, QTS, Salesforce, SAP, ServiceNow, Virtustream IaaS – FireEye, Google, QTS, Virtustream, VMware

SOLICITATION # CH16012
19 6.7 – Best Practices

6.7 Specify your policies and procedures in ensuring visibility, compliance, data security and threat protection for cloud-delivered services; include any implementations of encryption or tokenization to control access to sensitive data.

Carahsoft utilizes varying procedures for ensuring visibility, compliance, data security and threat protection for cloud-delivered services. Please see the below examples of potential options for meeting the State’s expectations:

ServiceNow Response: ServiceNow applications have the advantage of being built on a single cloud platform that consists of one user interface, one code base and one data model; delivering holistic visibility into processes, creating a single source of truth, irrespective of whether the processes and systems are within the customer’s environment or hosted in the cloud. ServiceNow invests significant resources in providing its services in a secure manner. This includes global teams delivering 24x7 operations and technical support from ServiceNow staff. ServiceNow currently has offices with staff focused on the management of the private cloud in Australia, the Netherlands, the U.K, North America, and Asia. The ServiceNow environment is a private cloud, fully owned and operated by ServiceNow, which supports a logically single tenant architecture. Customer data is isolated from other customer data by leveraging an enterprise-grade cloud architecture and a dedicated database and application set per instance. This gives ServiceNow customers cost reduction through shared infrastructure, while having the security benefits of customer-specific isolation at the application and data layers. In addition to the security features that come standard within the platform and each customer instance, customers can leverage the additional security features within ServiceNow to augment the security configuration of their instances based on their own needs and risk profile.

CA Response: This is addressed throughout all of our policies and procedures. CA SaaS Operations and Delivery runs an Information Security Management Framework (ISMS), which includes security organization, documentation, monitoring, and continuous improvement cycle. The security documentation comprises of CA SaaS Operations information security policies, procedures, guidelines and checklists.

ISMS documentation is reviewed along with applicable controls annually. CA offers a variety of SaaS solutions, details for each offering has been provided in Exhibit 1 and 2 of this proposal.

Salesforce Response: Salesforce has many customers that are subject to laws pertaining to the processing of personally identifiable information (PII) or personal data. Salesforce offers its customers a broad spectrum of functionalities and customer-controlled security features that its customers may implement in their respective uses of the Salesforce services. Salesforce believes that these provide its customers the flexibility to comply with laws with stringent privacy and security requirements. Encryption options vary based on Salesforce Commercial Cloud or Salesforce Government Cloud offering.

Government Cloud Encryption:

As part of the Salesforce Government Cloud, Salesforce is capable of responding to FIPS 140-2 cryptographic implementations for data being transferred between the State’s web browser and Salesforce.

Data that resides within Salesforce’s protected boundary does not use FIPS 140-2 validated encryption as compensating/mitigating controls are in place to protect data. Additional information is provided below.

Data In Motion:

SOLICITATION # CH16012
20 Salesforce employs cryptographic mechanisms to protect information during transmission. All transmissions between the user and Salesforce are encrypted by default with a 2048- bit Public Key. Our service uses International/Global Step Up certificates. We support one- way TLS, in which customers create secure connections before sharing private data.

Secure routing and traffic flow policies ensure that customer traffic is encrypted entering Salesforce until the load balancer decrypts the traffic. The load balancers decrypting the traffic are FIPS 140-2 compliant and are located inside of the Salesforce Government Cloud isolation boundary.

Data At Rest:

NIST SP 800-53 Rev. 4 states in SC-28, “Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system.” SC-28 also states, “Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate.” All secondary storage media (hard drives, disk drives, and tapes) containing customer data are maintained within Salesforce’s secure production data centers until the media has been sanitized and destroyed. Salesforce relies on physical access controls as a compensating control to protect the data.

SOLICITATION # CH16012
21 ORGANIZATIONS PROFILE
This section should constitute the Offeror’s response to the items described in Section 7 of the RFP. An Offeror’s response must be a specific point-by-point response, in the order listed, to each requirement in the Section 7 of the RFP.

7.1 – Contract Manager
The Offeror must provide a Contract Manager as the single point of contact for management of the NASPO ValuePoint Master Agreement, administered by the State of Utah. The Contract Manager must have a minimum of three (3) years’ experience managing contracts for cloud solutions.

7.1.1 Provide the name, phone number, email address, and work hours of the person who will act as Contract Manager if you are awarded a Master Agreement.

Bethany Blackwell
Senior Manager
703-230-7435 (office)
703-501-1134 (cell)
[email protected]
Working hours: 7am-7pm EST M-F

7.1.2 Describe in detail the Contract Manager’s experience managing contracts of similar size and scope to the one that will be awarded from this RFP. Provide a detailed resume for the Contract Manager.

The proposed contract manager, Bethany Blackwell, has over 5 years of experience in managing SaaS contracts in both the State and Local and Federal markets.

Bethany developed and manages contracts and associated terms for cloud contracts in more than 10 states. The combination of the State and Federal contract vehicles and BPAs being managed is valued at over $300M. Annually, she oversees 1000+ SaaS transactions off of these contract vehicles which include licensing and implementation that provide end to end cloud solutions to public sector customers.

Name Position
Bethany Blackwell
Carahsoft Senior Account Manager –
Will serve as the NASPO ValuePoint
Contract Manager
Background
 Senior Manager for cloud solutions products, including Salesforce.com, DocuSign, BMC Software  Vendor/Partner manager for 20+ complimentary solution vendors and 25+ implementation partners and system integrators
 Graduated Virginia Tech in 2010 - dual degree with concentrations in Psychology and Political Science
 5+ years of experience at Carahsoft
Skills

SOLICITATION # CH16012
22  Expertise in negotiating SaaS contract vehicles and terms at State level  Knowledge of contract vehicles, BPAs, multi-year deals, multi-vendor deals  Management of enterprise size product contracts
 Establish and maintain positive customer relationships through proactive communication  Maintained interactions with customers to ensure quick, accurate quotes; facilitated easy ordering process for customers
Relevant Experience
 Oversees the management and execution of 900+ individual SaaS contracts, valued at 85M+ annually
 Maintain the annual recurring subscription renewal bases to ensure no customer’s lapse in service  Oversees the ordering and distribution of licenses on statewide enterprise licenses agreements and various BPAs
 Established vendor specific terms and conditions for 10 different statewide contracts  Assist customers in shifting buying strategy from perpetual to subscription licensing model

7.1.3 Describe in detail the roles and responsibilities of the Contract Manager as they apply to the NASPO ValuePoint Master Agreement that will be awarded from this RFP.

The Contract Manager assigned to this contract will be in charge of all coordination and organization efforts between Carahsoft and NASPO ValuePoint. This includes, but is not limited to:
 contract negotiation
 roll-out plan
 amendments completion
 renewal execution
 reseller/subcontractor additions
 contract pricelist updates and upkeep
 contract compliance
 marketing coordination

SOLICITATION # CH16012
23 TECHNICAL RESPONSE
This section should constitute the Technical response of the proposal and must contain at least the following information:

A. A complete narrative of the Offeror's assessment of the Cloud Solutions to be provided, the Offerors ability and approach, and the resources necessary to fulfill the requirements. This should demonstrate the Offeror's understanding of the desired overall performance expectations and clearly indicate any options or alternatives proposed.

In response to the State of Utah request for Cloud Solution Proposals, Carahsoft has assembled a response that includes a number of Cloud Solution Offerings from within the Carahsoft Cloud framework.

These offerings are all supported in part or wholly by twelve leading cloud technology providers. Each provider’s technology is an integral part of Carahsoft’s proposal. Within this framework, Carahsoft will orchestrate, assemble, and execute on all activities necessary to support this contract, engaging each cloud technology provider as needed in the delivery of a particular service or solution offering.

The Carahsoft Cloud framework will provide for all requirements of the State of Utah Request for Proposal to be fulfilled. Carahsoft will be able to provide Cloud Solution Offerings to the State of Utah as well as to those entities that may participate via the cooperative purchasing program. The Carahsoft Cloud proposal provides for the provision of PaaS, IaaS, and SaaS offerings that are compliant with all requirements as outlined by the State. Carahsoft will provide dedicated resources to supporting this agreement. Carahsoft will insure that adequate resources are supplied to fully support this agreement during all phases from contract launch through termination. Usage requirements and demand resources fluctuate over time and Carahsoft’s Cloud offering has been constructed in a manner that provides for the ability to scale without interruption, disruption, or any other similar interruption of customer service and solution availability.

B. A specific point-by-point response, in the order listed, to each requirement in the Section 8 of the RFP. Offerors should not provide links to a website as part of its response.

Offeror’s should focus their proposals on the technical qualifications and capabilities described in the RFP.

Offerors should not include sales brochures as part of their response.

For the purposes of Carahsoft’s response to the technical requirements (section 8) of this RFP, please note that any response provided related to a specific manufacturer should be treated as a response to the following categories:

SaaS – AODocs, CA Technologies, DocuSign, FireEye, Google, QTS, Salesforce, SAP, ServiceNow, Virtru, VMware
PaaS – Google, QTS, Salesforce, SAP, ServiceNow, Virtustream IaaS – FireEye, Google, QTS, Virtustream, VMware

8.1 – Technical Requirements

8.1.1 Offeror must identify the cloud service model(s) and deployment model(s) it intends to provide to Eligible Users. See Attachment D.

SOLICITATION # CH16012
24 CA APM CA APIM SaaS offering helps accelerate, secure and manage APIs. CA is responsible for development and management of application. AWS provides IaaS services to CA for management of the underlying cloud infrastructure.

MAA CA Mobile App Analytics stimulates collaboration between business analysts, developers, operations and support in order to accelerate mobile app delivery and improve end-user experience. This service is hosted at CenturyLink Data center and the infrastructure is managed and maintained by CA SaaS Ops and Delivery team.

CA Agile CA Agile Central is a SaaS offering that is generally used to document and manage work within the SDLC.

ASM CA App Synthetic Monitor (ASM) provides end-to-end transaction response-time visibility into cloud, mobile and Web applications. Application utilizes Rack Space IaaS services.

Google The Cloud Service Models that we intend to provide include SaaS, PaaS, and IaaS. In our response we will describe the various options for using Google Apps under the SaaS model and the functions of Google Cloud Platform under Paas and Iaas.

AODocs The Cloud Service Models that we intend to provide is SaaS.

Virtru All Virtru services are cloud-based and accessed via browser or downloadable browser extensions and plugins.

Salesforce Salesforce’s deployment model is a “public” cloud infrastructure, as defined by NIST 800-145 ServiceNow Cloud service model: Software as a Service (SaaS) Deployment model: Private Cloud
QTS "QTS is a leading national provider of Infrastructure as a Service (IaaS) data center solutions and fully managed cloud services and a leader in security and compliance. The company offers a complete, unique portfolio of core data center products, including custom data center (C1), colocation (C2) and cloud and managed services (C3), providing the flexibility, scale and security needed to support the rapidly evolving hybrid infrastructure demands of web and IT applications.

With 12 data centers in eight states, QTS owns, operates and manages approximately 4.7 million square feet of secure, state-of-the-art data center infrastructure and supports more than 850 customers. QTS’ Critical Facility Management (CFM) can provide increased efficiency and greater performance for third-party data center owners and operators.

QTS offers a number of IaaS solutions.

SAP Ariba Our solutions are offered and delivered in a true subscription-based model and shared service (multi-tenant) offering. There is no software to install, no hardware to buy, no maintenance or support costs and no need to hire consultants or tech specialists to run the system. We deploy and manage the infrastructure. Customers only need a web browser for access. Subscriptions include system maintenance, automatic upgrades, enhancements and application of service packs, Level 1– 3 help desk support, professional services and best practices built directly into the application.

Fieldglass The SAP Fieldglass application is exclusively offered in a software as a service (SaaS) model.

Hanna SAP HANA Enterprise Cloud (HEC) is a private managed isolated & dedicated ladnscape (single tenant) offering end-to-end cloud-based infrastructure and managed services for SAP applications powered by SAP HANA. It is a fully scalable, enterprise-ready, mission-critical, secure and high-availability cloud service.

Hybris The SAP Hybris Commerce, Cloud Edition offering are all single tenent hosted VM environments. Customers have their own VM's with SAP Hybris instances deployed to those VM's. The SAP Hybris Commerce, Cloud Edition currently

SOLICITATION # CH16012
25 has Development, Staging, Testing, and Production environment. More environments can be added as required.

SuccessFactors Our solutions are delivered through a private cloud using a multi-tenant architecture. We refer to this as a Controlled Cloud. It includes a contractual framework reflecting applicable data privacy regulations, implementation and maintenance in accordance with Technical and Organizational Measures (TOMS) and regular audits by an independent third party for industry compliance and transparency.

VMware vCloud Air IaaS – Public, Hybrid, Community
Horizon Air
Desktop & Apps
IaaS – Public
vCloud Suite IaaS – Private, Hybrid, Community
Airwatch IaaS – Private
SaaS – Public
Horizon 6 IaaS – Private
Realize Air
Complaince
SaaS – Public
SocialCast SaaS – Public
FireEye All FireEye cloud offerings included in this response fit the SaaS cloud service model and private cloud deployment model.

VirtueStream Virtustream solution is fully NIST compliant for Essential Characteristics, as the Infrastructure as a Service (IaaS) Service Model, with all deployment options – Private Cloud, Community Cloud, Public and Hybrid Cloud.

8.1.2 For the purposes of the RFP, meeting the NIST essential characteristics is a primary concern. As such, describe how your proposed solution(s) meet the following characteristics, as defined in NIST Special Publication 800-145:

8.1.2.1 NIST Characteristic – On Demand Self-Service: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met.

CA APM N/A. This is a SaaS service and clients do not have direct access to the underlying infrastructure in order to provision computing capabilities. CA is responsible for the management and maintenance of the infrastructure and will make any necessary adjustments as part of providing this service to its clients.

MAA This is a SaaS offering and On-Demand service is not available, however, MAA customers are enabled to manage their accounts and carry out configuration changes required to manage mobile applications.

CA Agile We are a fully multi-tenant environment and do not provide the On-Demand SelfService capability.

ASM This does not apply as this is a SaaS service. ASM customers are able to manage all aspects of their accounts, create sub-accounts, and make any configuration changes necessary for their monitors.

Google SaaS, Google Apps administrators have access to an Admin Panel that allows them to perform user administration, service configurations, reporting on demand.

Paas/IaaS, Google Cloud Platform is an integrated set of Compute tools, Storage Tools, Networking Tools, Big Data analytic tools, Management tools and Services APIs. A customer can use any of these services on demand via the Developer's Console.

AODocs SaaS, AODocs administrators have access to an Admin Panel that allows them to perform user administration, product configurations,reporting on demand.

SOLICITATION # CH16012
26 Virtru All required services can be provisioned immediately when required. Users only need to install application to get single-user capability, or login to administrative dashboard for administrative features.

Salesforce Salesforce PaaS and SaaS solutions are delivered on-demand via the web and can be accessed with a browser and internet connection or mobile device. No additional software or infrastructure is required. Salesforce hosts the entire solution, thus freeing up customers to manage their mission, not manage an infrastructure solution. Additionally, Salesforce is browser agnostic and supports all major browsers (Firefox, Chrome, Safari, IE). No installations on users’ laptops or desktops are required and thus the solution is accessible from anywhere an internet connection and supported browser are available, including mobile devices.

ServiceNow Customer instances are provisioned automatically after an agreement between a customer and ServiceNow is executed. ServiceNow actively monitors customer instance performance and can automatically scale its application servers out horizontally by adding them to the load balancer pools for a particular instance.

Docusign DocuSign’s DTM® solution is ISO 27001:2013 certified and many of the ISO 27001:2013 controls are mapped to the NIST 800-53 requirements; we can provide additional information upon request.

QTS On-demand self-service. A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

SAP Ariba The solution provides self-service user profile management. Users profit from the intuitive, minimal-step nature of the user interface with little or no training.

Changes to user profile includes workflow capability for profile changes.

Fieldglass All system resources are available to all customers without limitation. The system is highly configurable with most configurations being available to the customer’s administrators.

Hanna HANA Enterprise Cloud is a private managed cloud therefore infra & services could be requested (added or decommisioned) on demand by placing change requests with SAP HEC teams. HEC roles & responsibilties document clearly articulates what is included in the monthly HEC pricing and what is available on-demand in addition to scaling up or down on the infra/compute.

Hybris N/A
SuccessFactors All self-service is in one place, including benefits and payroll if those products are in scope. Self-service is an intuitive experience. We provide the ability for employees to have configured permissions to take action in the tool such as field or data updates for personal information, benefits changes, payroll actions, completing workflow for assigned activities in the tool, etc. Selfservice for both employees and managers is configurable to fit your business rules and organizational requirements.

VMware VMware's IaaS and SaaS offerings complies with the On-Demand Self-Service characteristic, because once purchased, a user can unilaterally provision compute resources with no human interaction with VMware. The subscription includes access to two self service consoles: My VMware for account management, and the VMware vCloud Air Console which is the primary interface for access consumption and management of cloud resources purchased from VMware. (See doc for a complete list of products/ features that comply) FireEye FireEye is offering 4 distinct SaaS cloud solutions each featuring self-service features specific to the unique capabilities of the offerings:

1.Email Threat Prevention (ETP)
Email Provisioning

SOLICITATION # CH16012
27 Once the ETP infrastructure is provisioned, customers can self-service the acceptance of upstream mail and delivery to user mailboxes by configuring their own domain settings. No user mailbox provisioning is required as ETP will automatically check the validity of the email recipient with the downstream service.

2.Mobile Threat Prevention (MTP)
User Provisioning
Once the MTP infrastructure is provisioned, customers can self-service the creation of service users by integrating with an LDAP service or manually adding the users via the user interface.

Device Provisioning
Once the MTP infrastructure is provisioned, customers can self-service the creation of managed devices by instructing users to install the FireEye MTP Application on their mobile device and having a valid user account provisioned.

3.Threat Analytics Platform (TAP)
User Provisioning
Once the TAP infrastructure is provisioned, customers can create and assign role-based access control to user accounts. The enrollment process includes the ability to create two-factor authentication for newly provisioned users.

Data Sources
Once the TAP infrastructure is provisioned, customers can configure new data sources to feed the TAP instance without the assistance of FireEye. The TAP communications broker accepts data feeds in the following formats: syslog, flat files, TCP/UDP streams, and JDBC connections.

4.FireEye as a Service with Continuous Vigilance (FaaS CV) User Provisioning
Once the FaaS infrastructure is provisioned, customers can create and assign role-based access control to user accounts via the on premise FireEye sensors.

VirtueStream Virtustream IaaS provides a self-service portal called xStream, where users can access, view, edit, provision, and modify compute, storage, network and application services based on granular Role Based Access Control, which can be integrated with Active Directory or LDAP. Virtustream portal that enables the user to provision VMs, order services through a catalog, add storage, upload service templates, and run various reports all through the same portal.

8.1.2.2 NIST Characteristic – Broad Network Access: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how network access is provided.

CA APM The APIM service is accessed via HTTPS on a supported browser with no requirements for a workstation client install ; mobile friendly and optimized for use with iOS and Android tablets
MAA Upon native authentication, MAA dashboard is accessible by any host over public internet. Also, mobile devices connect to the service using REST API.

CA Agile All access to the application is through a browser.

ASM The ASM dashboard and API are accessible from any host connected to the public Internet. The API and dashboard require authentication, and each account is only accessible by the account owner (customer).

Google SaaS, Google Apps is device, platform and network agnostic. As a pure play cloud-based solution the services can be accessed via any modern browser from any network access point. Customers that have requirements to limit access to trusted devices or trusted access points have access to Device Management tools via the Admin Panel at no additional cost.

PaaS/IaaS, Google Cloud Platform management services can be accessed via any modern browser from any network access point. End-users can accesses services through one or more

SOLICITATION # CH16012
28 appropriate tools (browser, CLI, APIs, etc.). Administrators can also monitor and manage services through a mobile app.

AODocs SaaS, AODocs is service, platform and network agnostic. As a pure play cloud-based solution the services can be accessed via any modern browser from any network access point.

Virtru All Virtru services are available on the publically available internet.

Salesforce Salesforce PaaS and SaaS solutions are delivered on-demand via the web and can be accessed with a browser and internet connection or mobile device. No additional software or infrastructure is required. Salesforce hosts the entire solution, thus freeing up customers to manage their mission, not manage an infrastructure solution. Additionally, Salesforce is browser agnostic and supports all major browsers (Firefox, Chrome, Safari, IE). No installations on users’ laptops or desktops are required and thus the solution is accessible from anywhere an internet connection and supported browser are available, including mobile devices.

ServiceNow ServiceNow’s physical architecture is deployed into ServiceNow’s managed dedicated colocation cage space. Multiple diverse Internet connections terminate within the dedicated cage space providing redundant access from the Internet to the ServiceNow environment.

All users, administrators and developers connect to the ServiceNow private cloud over HTTPS, leveraging TLS, for communication to and from a ServiceNow instance with all normal interactions via a web browser. There is no requirement to install any client software on any desktop, laptop, tablet, or smart phone used to access a ServiceNow instance.

Docusign Please see above.

QTS Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).

QTS recognizes that the connectivity challenges of today are largely driven by consolidation, virtualization and adaptive architectures. Our agile connectivity solutions provide you with both unification across your communication infrastructure and with built-in network scale, reliability, and high-performance.

QTS metroConnect is a fast, reliable, high bandwidth connection to hundreds of network and service providers inside the local Carrier Hotel. With access to the numerous networks at the carrier hotel, QTS delivers the interconnection necessary to support your connectivity, business continuity and application collaboration needs. metroConnect offers redundancy and diversity options that ensure your content is always available.
•High availability
•Backed by a 99.999% SLA
•24x7x365 monitoring and management
•Carrier-neutral model
•Convenient access to an array of Carriers and Internet providers •Dedicated, secure, and highly resilient connectivity with speeds of 100Mbps, 1Gbps or 10Gbps* •Supports all connectivity redundancy, business continuity, and collaborative application needs QTS data centerConnect Service
Data centerConnect is a secure, scalable, cost-effective way to connect your primary and secondary sites between two or more client environments located in different QTS data centers providing a reliable interconnection option for any size business. QTS data centerConnect enables data replication and recovery through its resilient and redundant network. This ensures your business operates successfully with seamless, day-to-day transactions over a high-performance, low latency connection that supports business continuity, data replication and other IT business application needs.

With QTS data centerConnect you get:
•High Availability – Resilient network architecture provides high availability and reliability

SOLICITATION # CH16012
29 •Dedicated and Secure – Dedicated bandwidth with secure MPLS encapsulation •Scalable Bandwidth – Easily scale your bandwidth (from 10Mb up to 1Gb) •Flexible Network Configurations – Supports multiple network topologies •Cost-effective, Bundled Solution – All inclusive, bundled offer •Fully Managed, End-to-End – End-to-end, proactive monitoring and management, 24x7x365 QTS internetConnect Service
internetConnect provides a multi-homed, high performance, dual access, multi-carrier network that meets all your Internet service needs. We ensure maximum uptime, guaranteed availability, and various bandwidth speeds through our flexible, high performance, carrier-neutral offer. For enterprises and government agencies conducting business over the Internet, QTS internetConnect Service provides a highly reliable, secure connectivity solution for production environments. •Direct access to multiple ISP backbones gives unmatched reliability and guarantees maximum uptime
◦Dual connections with direct access to multiple ISP backbones ◦Diverse, redundant paths to multiple backbone providers ◦Dual paths, with diverse entry points into the QTS Data Center •Anti-DDoS Mitigation Services provide an additional level of protection and security •Dedicated with burstable bandwidth options provides resiliency and flexibility •Backed by an industry leading 100% SLA
•Optional service plans to meet your needs
QTS ethernetConnect Service
You need to be able to connect your employees and customers to your applications and to the outside world. Whether hybrid cloud, disaster recovery/disaster recovery as a service, data replication, data migration or other applications, you need the ability to seamlessly and conveniently connect your business together and to the outside world as if there is no distance between you.

QTS ethernetConnect offers a variety of connectivity options. You can centralize your services with a single provider. And since QTS can handle everything from ordering to billing you have a single provider for a complete solution – “One Stop Shopping”. QTS understands your needs and will tailor your end-to-end solution for your business. •High Bandwidth – Speeds are available in select increments of 100Mb to 10Gb •Data Privacy – Data is separated from IP traffic as it traverses the carrier backbone •High Performance Options – Solutions can be developed to fit your specific performance or reliability requirements
•Consistency – Ethernet circuits travel over a single carrier’s infrastructure and data follows a consistent path.

SAP Ariba Ariba uses Cisco Routers and Catalysts (high-speed switches) for ensuring maximum network connection performance. They deliver enterprise-class versatility, integration, and power to Ariba. Together, these routers provide the required support for Internet/intranet access with firewall security.

Fieldglass Customers are only required to use a standard web browser with default settings to access and use the Fieldglass solution.

Hanna Cloud Capabilities are available over the network (via secure MPLS or VPN network connectivity) and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms such as mobile phones, laptops. HEC is an extension of customers existing netwerk and uses customes IP range and /24 range.

Hybris All capabilities of SAP Hybris are available over the network. Furthermore, they are accessible by standard mechanism including heterogenous thin or

SOLICITATION # CH16012
30 thick client platforms through either standard web technologies or through the hybris OCC REST web service API's.

SuccessFactors Our solution was designed from the outset for high availability. We provide a system availability SLA of 99.5%. Every component (hardware and software) is completely redundant. There is a redundant piece of equipment or software for every hardware or software component for every layer of the infrastructure stack (server, software and network).

We load balance at every tier in the infrastructure, from the network to the database servers. F5 load balancers are used to route traffic to an available web server to process the request. Application server clusters are enabled so that servers can fail without interrupting the user experience. We maintain an N+1 approach for all equipment in the hosted cloud environment, so that there is never a single point of failure. All customer database backups are encrypted and streamed in a secure manner from the customer’s “primary” data center to their “alternate” data center, allowing for a timely restoration of service in the event of disaster.

Based on the terms of the agreement, we will designate one of the data centers as the customer’s “primary” data center, with an additional data center designated as the “alternate” for data redundancy and disaster recovery purposes.

Load balancers will automatically detect a software or hardware error and take the servers out of service if needed without interrupting the user experience or application. They also allow capacity addition or reduction without interrupting service.

All of the JBOSS application servers are clustered. Each is designated as a primary and a secondary, so any application server can fail without any loss of service or interruption of the application or user experience.

The database servers are also clustered using a Veritas high availability cluster. The Veritas suite will detect any hardware or software errors in the database machines and automatically fail them over to a standby server VMware VMware's IaaS offerings complies with the Broad Network Access characteristic. All fo these products' capabilities are available over the public internet and can be used by heterogeneous thin or thick client platforms. Consumers only need internet access to access these resources.

Additional capabilities exist including the ability to secure communications over the public internet including IPSEC VPN, SSL Client VPN, and the ability to consume via WAN connectivity.

VMware's SaaS offering AirWatch can be accessed over the internet or private network through standard mechanisms.

FireEye All FireEye cloud offerings included in this response meet the definition of broad network access.

Each of the solutions performs its designed functionality over standard internet-facing services and is accessible via a web browser from any internet connected device when valid credentials are provided.

VirtueStream Virtustream IaaS provides Broad Network Access, where it can provide landing zone for any private network (Point-to-Point, Virtual Private Label Switching, Multi-Protocol Label Switching, or Direct Connect), public network (Internet, Trusted Internet Connectivity as landing zone, IPSEC VPN and SSL VPN) and also extranet connectivity (shared network, i.e, Cloud Connect, Cloud Exchange, etc.) which is growing rapidly as option for connecting cloud resources.

8.1.2.3 NIST Characteristic - Resource Pooling: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how resource pooling technical capability is met.

SOLICITATION # CH16012
31 Carahsoft’s multiple Cloud Service Provider’s solution provides for Resource Pooling, as defined by NIST, in a variety of methods. Each method optimizes the cloud subscriber’s experience while optimizing the availability of compute, network, and data resources. Each service provider provides Resource Pooling, see below for details.

CA APM CA API Management SaaS (SaaS APIM) has been built from the ground up to be a multi-tenanted, SaaS-based offering that leverages Amazon’s infrastructure to scale appropriately; utilize a continuous integration model to provide for frequent updates; and fail over across multiple availability zones.

MAA MAA core service utilizes dedicated infrastructure layered with virtualization capabilities. It doesn’t share computing resources with other services. Tenants are segregated using application containerization capabilities.

CA Agile We monitor all system resources and have alerting mechanisms when resource constraints have reached a defined threshold. We can easily scale our systems to accommodate any additional capacity. If we determine a single user is using a significant amount of resources we will proactively reach out to them to understand what they are trying to accomplish and help them to formulate more performant queries.

ASM All ASM core servers are dedicated physical servers. ASM Public Status Pages are served from dedicated web servers (used only by CA ASM) in the Amazon Cloud, on shared tenancy virtualization. Amazon Cloud virtual machines used by ASM are managed by and provisioned by CA ASM systems administrators.

Google SaaS, Google's global infrastructure is a shared pool of resources that dynamically serve each end user with a primary data center access point that may rotate throughout the session without the end user being aware while at the same time replicating any data across at least two additional geographically dispersed data centers which also may rotate through the session.

PaaS/IaaS, Google Cloud Platform also operates across the global Google infrastruture. The elements of this service can be defined within the Developer's console to run within a higher level of abstraction which covers four regions; Central US, Eastern US, Western Europe, East Asia where each region has three or four zones.

AODocs AODocs infrastructure is hosted in Google App Engine and data of our customers on Google Drive. This protection is insured by Google.

Virtru Virtru Services are offered in a fully multi-tenant mode if the customer requests.

Salesforce Salesforce is a multitenant cloud-based subscription service. Multi-tenant cloud solutions provide a single, shared infrastructure, one code base, one platform that is all centrally managed, with platform-based API to support all integration traffic, and multiple release upgrades included as part of the subscription service. Multi-tenancy and the Cloud Computing model remove unneeded tasks from the process of delivering, managing, and integrating software. Salesforce customers will not need to maintain any hardware or software. Without multiple versions to support, integrations don’t break during updates; they are simply updated automatically. As a result, both the initial integration and its continued maintenance are simplified. More resources can be focused on creating a better product, with a faster cycle of innovation, instead of having to manage the complexity of many different versions to support a vast installed base.

Salesforce's position as an online service enables us to roll out all levels of improvement, from patch releases to major upgrades that are largely transparent to the end users. When a bug is fixed and tested, it is rolled out to the application as part of regular maintenance; the nature of the service prevents special patches and code branches for individual customers, so all fixes can potentially benefit all customers.

ServiceNow The ServiceNow environment is a private cloud, fully owned and operated by ServiceNow, which supports a logically single tenant architecture. Customer data is isolated from other customer data

SOLICITATION # CH16012
32 by leveraging an enterprise-grade cloud architecture and a dedicated database and application set per instance. This gives ServiceNow customers cost reduction through shared infrastructure, while having the security benefits of customer-specific isolation at the application and data layers. In addition to the security features that come standard within the platform and each customer instance, customers can leverage the additional security features within ServiceNow to augment the security configuration of their instances based on their own needs and risk profile.

Customers share a hardware platform (no virtualization), but access entirely separate individual instances of the ServiceNow platform.

Docusign
QTS Resource pooling. The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth.

SAP Ariba Ariba recognizes that customers need the highest-possible availability and reliability. To that end, Ariba infrastructure is scalable and redundant at all tiers. To provide high availability and reliability, Ariba has extensive error handling and fail-over capabilities. In order to ensure the highest availability, Ariba uses such best practices as frequent systems backup and maintenance, redundant systems, proactive customer notification of unplanned down-time and international support coverage.

Fieldglass Fieldglass is offered in a SaaS model. All customers access the same Fieldglass application version in a multi-tenancy database. The system is hosted in a secure hosting facility. All system resources are available to all customers without limitation.

Hanna SAP HEC does not pool resources for critical business systems as it’s a managed private cloud, which is dedicated to one particular customer.

However, network routers, availability reporting & monitoring could be shared.

Details can be provided during HEC technical assessment workshop.

Hybris All computing resources of the data centers are pooled to serve multiple customers. Each customer gets their own separate VM's and their own instances of hybris deployed to those VM's.

SuccessFactors Load Balancing & Server Clustering – We load balance at every tier in the infrastructure, from the network to the database servers. Application server clusters are enabled so that servers can fail without interrupting the user experience. Database servers are clustered for failover. We maintain an N+1 approach for all equipment in its hosted environment, so that there is never a single point of failure.

Complete Redundancy - Every infrastructure component is redundant. There are at least two of each hardware component that processes the flow and storage of data.

Backup & Restore - the Data center runs full data backups weekly and incremental data backups nightly.

VMware All VMware's IaaS products comply with the Resource Pooling characteristic (except for the Hybrid Cloud Manager which is Not Applicable). vCloud Air provides a pool of vCPU, vRAM, Network and storage on the shared physical infrastructure. vCloud Air provides the required location independence and requires that the customer directly specify location of the datacenter that will host their cloud at time of instantiation. Note VMware's SaaS is also Not Applicable.

FireEye The FireEye cloud infrastructures consists of web and application servers, operating systems, and databases in a hosted environment and are comprised of both physical and virtual devices.

SOLICITATION # CH16012
33 Computing power and resources are load-balanced across infrastructure and replicated to redundant datacenters in the event of a disaster. Client-specific data stored in databases are logically separated from other clients’ data providing segmentation and isolation.

VirtueStream Key to Virtustream solution is its proprietary and patented solution of uVM technology, which is effectively a granular solution for resource pooling, providing application performance, pay for consumption only and segregate resources for security and compliance, but aggregate for cost efficiency. In addition, Virtustream is currently one of very few Cloud Service Provider with capabilities for Geo-Fencing and Geo-Tagging of the virtual machines to a specific data center, and getting down to cluster and host machine level. The resources are pooled based on two specific criteria:
•ONLY Accessible Using Private Network – We call this pool “Enterprise” which most of Virtustream’s IaaS workload is residing. There is no direct access from Internet into this pool. This is protected via a pair of routing and firewall from any other zones.

8.1.2.4 NIST Characteristic - Rapid Elasticity: Provide a brief written description of how the cloud solutions proposed satisfies this NIST Characteristic. Attest capability and briefly describe how rapid elasticity technical capability is met.

CA APM CA API Management SaaS (SaaS APIM) has been built from the ground up to be a multi-tenanted, SaaS-based offering that leverages Amazon’s infrastructure to scale appropriately; utilize a continuous integration model to provide for frequent updates; and fail over across multiple availability zones.

MAA The pool of web and application servers can be grown or shrunk when necessary.

Any changes to the size of the pool remains transparent to end-users and customers, and would only be done by CA MAA systems administrators.

CA Agile This is a SaaS service, therefore, CA monitors all system resources and have alerting mechanisms when resource constraints have reached a defined threshold. Data storage and network capacity are monitored and scaled to meet current client demands. Compute resources are scaled to meet client processing requirements ASM All ASM core servers are dedicated physical servers; there is no elasticity. The ASM Public Status Pages are served from web servers in the Amazon Cloud, and the pool of web servers can be grown or shrunk if necessary. Any changes to the size of the pool would be transparent to end-users and customers, and would only be done by CA ASM systems administrators. Since this is a SaaS environment the CA SaaS Operations and delivery along with RackSpace are responsible for management of the capacity and monitoring.

Google Saas, Google Apps can scale from 1 user to tens of thousand users. The usage of the services included are designed to horizontal scale within the confines of the per user storage allocation.

Google Apps can be purchased with a 30gb per user allocation or with unlimited storage.

Paas/IaaS, Google Cloud Platform was designed to scale on demand both in terms of available resources for applications designed and running on Google App Engine but also Compute Engine resources and more.

AODocs AODocs can scale from one user to tens of thousand users. The storage is based on the Google Apps storage which could be from 30Gb to unlimited storage depending on the Google Apps subscription.

Virtru Presently we over-provision services by 2.5x peak traffic in order to handle spikes. We are in the process of implementing horizontal scaling of all services and expect to have that work completed in the second half of 2016.

Salesforce User AuthenticationLogon is form-based. When users log into the Salesforce application, they submit a username and password, which are sent to Salesforce via an TLS-encrypted session.

SOLICITATION # CH16012
34 Security features are developed by Salesforce and built into the application. Third-party packages are not used for development or implementation of security internal to the application.

In addition, single sign-on and two-factor authentication may be used to authenticate users. Some organizations prefer to use an existing single sign-on capability to simplify and standardize their user authentication. You have two options to implement single sign-on—federated authentication using Security Assertion Markup Language (SAML) or delegated authentication.

Federated authentication using Security Assertion Markup Language (SAML) allows you to send authentication and authorization data between affiliated but unrelated Web services. This enables you to sign-on to Salesforce from a client application. Federated authentication using SAML is enabled by default for your organization.

Delegated authentication single sign-on enables you to integrate Salesforce with an authentication method that you choose. This enables you to integrate authentication with your LDAP (Lightweight Directory Access Protocol) server, or perform single sign-on by authenticating using a token instead of a password. You manage delegated authentication at the profile level, allowing some users to use delegated authentication, while other users continue to use their Salesforce-managed password. Delegated authentication is set by profile, not organization wide. You must request that this feature be enabled by Salesforce.

Salesforce can be configured to utilize Active Directory directly via Delegated Authentication, or indirectly via Federated Identity using either SAML 1.1, or SAML 2.0. Additionally your users can be loaded from information drawn from your Active Directory servers and modifications made in Active Directory can be propagated into Salesforce.

Customers can use their own SAML Identity Provider, or license one directly from Salesforce with our Identity Connect product.User ProvisioningUser provisioning and management is performed through the Salesforce Administrative Setup environment and is performed by Salesforce customers. Users, their profiles, permissions and passwords may be managed, edited, activated and deactivated as needed by those with appropriate permissions. An administrator (appointed by the customer and not by Salesforce) with appropriate privileges can manage session timeout, password policies, IP range login restrictions, delegated authentication/SSO, and requirements as part of this process. On first time login or password reset request, users are required to change their passwords to gain access. Salesforce also offers delegated authentication, enabling customers to provision and deactivate users from an external directory service.User Access ProfilesSalesforce enables administrators to manage roles and relationships between roles from within the application, in a single easy to read page depicting the role hierarchy.

All users and application-level security are defined and maintained by the organization administrator and not by Salesforce. The organization administrator is appointed by CSBS. An organization's sharing model sets the default access that users have to each other's data.

There are four sharing models: Private, Public Read Only, Public Read/Write, and Public Read/Write/Transfer. There are also several sharing model elements: Profiles, Roles, Hierarchy, Record Types, Page Layouts, and Field Level security.

Details about sharing models and sharing model elements are provided below:

Private
Only the record owner, and users above that role in the hierarchy, can view, edit, and report on those records.

SOLICITATION # CH16012
35 Public Read Only
All users can view and report on records but not edit them. Only the owner, and users above that role in the hierarchy, can edit those records.

Public Read/Write
All users can view, edit, and report on all records.

Public Read/Write/Transfer
All users can view, edit, transfer, and report on all records. Only available for cases or leads.

Profiles
A profile contains the settings and permissions that control what users with that profile can do within Salesforce. Profiles control:

Standard and custom apps the user can view (depending on user license) Service providers the user can access
Tabs the user can view (depending on user license and other factors, such as access to Salesforce CRM Content)
Administrative and general permissions the user has for managing the organization and apps within it
Object permissions the user is granted to create, read, edit, and delete records Page layouts a user sees
Field-level security access that the user has to view and edit specific fields Record types are available to the user
Desktop clients users can access and related options
Hours during which and IP addresses from which the user can log in Apex classes a user can execute
Visualforce pages a user can access
User Roles
Every user must be assigned to a role, or their data will not display in opportunity reports, forecast rollups, and other displays based on roles.

All users that require visibility to the entire organization should be assigned the highest level in the hierarchy.

It is not necessary to create individual roles for each title at the company, rather a hierarchy of roles should be defined to control access of information entered by users in lower level roles.

When a user's role is changed, any relevant sharing rules are reevaluated to add or remove access as necessary.

Record Types
If the customer's organization uses record types, edit the record type to modify which pick list values are visible for the record type. A default pick list values can be set based upon the record type for various divisions.

Field Level Security
Field-level security settings let administrators restrict user's access to view and edit specific fields on detail and edit pages and in related lists, list views, reports, Offline Edition, search results, email and mail merge templates, Custom Links, and when synchronizing data.

SOLICITATION # CH16012
36 The fields that users see in detail and edit pages are a combination of page layouts and field-level security settings. The most restrictive field access settings of the two always apply. For example, if a field is required in the page layout and read-only in the field-level security settings, the field-level security overrides the page layout and the field will be read-only for the user.

ServiceNow ServiceNow is a multi-instance architecture that gives every customer its own unique database, which means that it is impossible for your data to be commingled with any other customer. The multi-instance architecture is not built on large centralized database software and infrastructure.

Instead, we deploy instances on a per-customer basis, allowing the multi-instance cloud to scale horizontally and infinitely. For our multi-instance cloud, we deploy separate application logic (Apache Tomcat Java Virtual Machines) and database processes (MySQL) for every customer.

This allows ServiceNow to scale its application servers out horizontally by adding them to the load balancer pools for a particular instance.

QTS Rapid elasticity. Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly out ward and in ward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.

Delivering scalable, secure, high-performing, virtual data centers for government applications QTS is committed to not only giving your cloud the most secure home, but also the ability to utilize bestof-breed technologies.

Flexible, high-performing, future proof infrastructure: Built upon the VMware vCloud® Suite, you’ll benefit from reliable, high-performing infrastructure using a platform that includes VMware, EMC and Cisco. This compatible solution easily integrates with private VMware environments and provides a pathway to a hybrid cloud.Our scalability increases agility, efficiency and productivity:

Your technologists can focus more time on your business and customers, and less time on your infrastructure. Rapid provisioning and improvements in utilization enhances your speed to market, delivers applications faster, and gets projects out the door.

Virtually unlimited bandwidth and communications diversity QTS operates carrier-neutral data center facilities. This means that customers can select their communications service providers from hundreds of carriers, Internet Service Providers, dark fiber and satellite companies to meet their transport requirements. Selecting a provider from such a broad list of options gives customers exceptional route diversity and pricing options, as well as different Service Level Agreements and installation schedules. Customers who need very high amounts of bandwidth to conduct their business efficiently will never have to worry about running out of capacity at a QTS facility. Similarly, customers who require exceedingly high communications security have the benefits of selecting from physically diverse routes between their ends points and dark fiber that is not shared with any other users. In short, there are virtually no limitations to the type, amount, or security of communications available at each QTS data center facility.

SAP Ariba There are no scalability limits with our products. We can scale accordingly to fit any data amount or user volume scenario.

Fieldglass The hosted Fieldglass solution can be horizontally and vertically scaled very quickly as the web server farm is fully virtualized. Only the SQL server is bare metal by design.

Hanna SAP HEC can be rapidly scaled to provision infrastructure & services on demand per customer requests.

SuccessFactors Our solution was designed and developed, from the outset, to be a highly scalable application. We also use the concept of “PODS,” from a hardware perspective. A POD is a fault tolerant cluster of application & DB servers

SOLICITATION # CH16012
37 designed, as a scalable unit, to provide core processing and data storage services for fixed increment of customers.

Attributes include:

A POD is designed to support millions of subscribers. Our current 2nd Generation POD is scaled to 5M+
Multi-Vendor High Performance Blade Servers with 40GBps backplane fabric interconnects
Multiple redundant Application Engines
Clustering for availability and performance
Hardware load balancers to route each new incoming session to the most available web and application processor
Designed to support a high rate of concurrent connections while maintaining sufficient redundant capacity to meet SLA requirements
New production PODs undergo a verification process before being brought into service
Excess capacity PODs are always available on standby (scalability-ondemand) We will increase capacity if data center utilization surpasses the 70% threshold
VMware All vCloud Air offerings partially comply with Rapid Elasticity. vCloud Air can be purchased as a pool of vCPU, vRAM, Network and Storage on shared or dedicated physical infrastructures that can be elastically provisioned and released. VMware's vCloud Air On Demand is fully compliant because capabilities can be elastically provisioned and released. VMware's SaaS Products i.e.

AirWatch, does comply but the NIST requirement is not relevant to SaaS offerings. Note the vCloud Air Hybrid Cloud Manager is not Applicable.

FireEye FireEye cloud environments are continuously monitored by cloud service operations (CSO) personnel to help ensure secure operation and available of the system. Capacity is actively monitored and pro-active upscaling is conducted to ensure resources are always available to endusers. Procedures are in-place for rapidly adding resources in the event the infrastructure approaches capacity.

VirtueStream Virtustream’s self-service portal, ticketing system and also the Technical Account Manager, who is the single point of contact for State of Utah allows for provisioning and deprovisioning of resources and services. In addition, Virtustream is uniquely positioned to provide application level provisioning as part of its standard automation and orchestration tool. Resources can be scaled based on application size, memory, storage, network requirements. xStream utilizes a supply chain to define resource profiles, attributes and offerings than can be provisioned.

8.1.2.5 NIST Characteristic - Measured Service: Provide a brief written description of how the cloud solutions proposed satisfies this NIST Characteristic. Attest capability and briefly describe how measured service technical capability is met.

CA APM Continuous monitoring of all service components (infrastructure and application) is deployed to proactively identify any component or service trending towards failure or approaching capacity. This portion is handled for the underlying cloud infrastructure by AWS with active participation by CA including escalations of issues.

MAA CA MAA systems administrators track the resource consumption of each virtual machine in use. ITIL flows are utilized to ensure service delivery. MAA customers do not need this information in order to use the service, nor do they have access to view it.

SOLICITATION # CH16012
38 CA Agile Continuous monitoring of all service components (infrastructure and application) is deployed to proactively identify any component or service trending towards failure or approaching capacity
CA’s best-of-breed monitoring solutions are deployed and supplemented with vendor specific diagnostic tools where appropriate
24x7 staffed network operation center (NOC) to analyze and respond to automated monitoring alerts
ASM CA ASM systems administrators track the resource consumption of each virtual machine in the cloud. Since this is a SaaS service, ASM customers do not need this information in order to use the service, nor do they have access to view it.

Google Saas, Google Apps is already optimized for unlimited use by all end users. Google ensures high availability, low latency and fault tolerance as a part of the contracted services. No metering or rate limiting would be required as Google does not charge based on bandwidth use.

Paas/IaaS, Google Cloud Platform includes application development tools, Google App Engine, compute resources, Compute Engine and Container Engine, data storage solutions and networking solutions. The pricing model is based on actual usage and that usage can be monitored with Google's Cloud Monitoring Service which also includes options to autoscale a project.

AODocs AODocs is already optimized for unlimited use by all end users. AODocs ensures high availability, low latency and fault tolerance as a part of the contracted services. No metering or rate limiting would be required as AODocs does not charge based on bandwidth use.

Virtru All services in our system monitored for availability, stabiity, security, and intrusion using a combination of tools, such as Dtrace, LogTrail, CloudWatch, DataDog, ElasticSearch and AlienVault.

Salesforce Subscription-based Service
The Salesforce PaaS and SaaS offerings are subscription based and in a per user/month or user/year format billed annually with some of our products offered as total logins per month or by defined number of members billed annually.

Bandwidth
Salesforce is designed to use as little bandwidth as possible so that the site performs adequately over high-speed, dial-up, and wireless Internet connections. While average page size is on the order of 90KB, Salesforce uses compression as defined in the HTTP 1.1 standard to compress the HTML content before it is transmitted as data across the Internet to a user's computer. The compression often reduces the amount of transmitted data to as little as 10KB per page viewed due to the lack of image content. The site was designed with minimum bandwidth requirements in mind, hence are extensive use of color coding instead of images. Our average user also is known to view roughly 120 pages from our site per day. Our application is stateless; therefore, there are no communication requirements in the background once the page loads, like traditional client server applications, e.g., Outlook. Therefore, once the page loads, there are no additional bandwidth requirements until a user queries or writes information to Salesforce.

System Overview
In addition to our Trust site (http://trust.salesforce.com/trust/status), you will also have access to a System Overview, which will help Salesforce customers monitor performance and usage of their own Salesforce org. This overview includes:

Schema - # and % of custom objects and data storage
Business Logic - # and % of Rules, Apex triggers and classes, as well as % of code used Licenses
API Usage - # and % of requests in the last 24 hours
User Interface - # and % of custom apps, sites, flows, custom tabs and pages

SOLICITATION # CH16012
39 Portal
The above list is of all the possible metrics that Salesforce customers may have in their system overview.

ServiceNow ServiceNow is a subscription service measured by number of user accounts or number of managed nodes. ServiceNow has a documented capacity-planning model, which is used to determine sizing requirements and scaling options. The need to address capacity and horizontal system scaling is in the background, transparent to our customers.

Docusign
QTS Measured service. Cloud systems automatically control and optimize resource use by leveraging a metering capability 1 at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

SAP Ariba We have an Internal Tools Development Team which has established active monitoring systems with alerting and automated escalation. This includes log monitoring from the backend of the systems and this is tied to established internal processes related to security incident management. The environment, policies, tickets and reports are reviewed under ISAE 3402 assurance audit every six months.

Fieldglass Fieldglass utilizes various methods to ensure the system is available and is operating as expected.
• Our network performance monitor ensures that all servers and devices are available and performing as expected.
• All devices and servers on our network log into our enterprise SIEM tool. All activity is monitored by the Fieldglass security team to ensure activity does not vary from our known baseline.
• An Active Performance Monitor has been built into the Fieldglass system.

This monitor logs all system activity and enables Fieldglass engineers to drill into data such as concurrent user count, thread count, memory, CPU, SQL duration, server duration, client duration, page hits, etc. This data can be drilled into by day, hour, minute, server, and user.
• Customer SLAs are tracked and communicated on a monthly basis. For 2015 we have a 99.4% success rate in meeting all customer page response time SLAs.

Hanna SAP HEC services are measured via SAP solution manager and reports are shared with the customer on a monthly basis as well as via self-service reports. SAP HEC operations team monitors the customer landscape and any disruption is addressed after reaching out to the customer and associated approval.

SuccessFactors Our hosting sites are designed to accommodate customers desiring a high level of managed service performance. In order to achieve such a level of performance, proactive monitoring is available through a variety of on-line tools that are implemented and managed by Cloud Operations. At a customer management level, the Cloud Operations monitors a series of “key metrics” that measure the results of various processes involved in supporting the business operations and service reliability. These metrics include reports of transaction volumes, latency, system availability, capacity, change management, and help incident response times as compared with established service level goals and standards.

To facilitate required system performance, we monitor and tune the use of resources, and makes projections of future capacity requirements. We employ

SOLICITATION # CH16012
40 a variety of services to monitor and enhance application performance. The network makes extensive use of high availability architecture, and is monitored on a 24x7 basis at multiple levels.

We utilize real time web applications performance monitoring software to do the following:

Sample web traffic in real time via performance analysis software Track web application errors, (e.g. http 4xx-5xx errors) Monitor end-to-end user performance trends
Detailed session analysis for session troubleshooting
This data is reviewed on a daily and weekly basis by Operations Support, and is further supported with automated alerts. We proactively gather performance statistics, set triggers to alert on capacity thresholds, and regularly review utilization trends for capacity planning.

VMware VMware's provides automatic monitoring and metering services to their IaaS and SaaS offerings.

Note the vCloud Hybrid Manager is not applicable as it is not metered, because it is for management.

FireEye FireEye cloud environments are continuously monitored by cloud service operations (CSO) personnel to help ensure secure operation and availability of the system. An internal monitoring system operates 24 hours per day to assess system availability and performance. The system is configured to send email alert notifications to FireEye operations personnel on a real-time basis communicating potential issues with the production systems.

VirtueStream The fundamental of Virtustream solution is based on uVM Technology, which is very unique in terms of billing. Virtustream solution takes average consumption of compute resources, and State of Utah would only pay for actual resources based on a monthly average. This is in comparison with traditional cloud solution, where the billing is based on allocation of resources in T-Shirt size (Micro, S, M, L, XL, XXL), and if the server is up, consumer of the cloud pays, but when it is down, they don’t. In case of the Virtustream solution, customer only pays based on the average of vCPU, RAM, IOPS and Network I/O; the key is average, not aggregate and based on consumption not allocation. In addition, all storage, security, application management services are offered as a monthly fee, based on the VMs; also, Virtustream can provide consultative and project support based on time and materials.

The µVM brings significant benefits: enabling application level performance SLAs – which an average VM cannot. µVMs eliminate wasted headroom in fixed size VMs, generating significant efficiency improvements (up to 40% beyond traditional virtualization) and Virtustream only charges by the µVM so you only pay for the resources you actually consume not what you might need.

Using µVMs also enables applications to be used across multiple hypervisors, across multiple clouds and between different locations – enabling true hybrid clouds. µVM technology allows Virtustream to offer enterprise class clouds capable of running both mission-critical enterprise applications and web-scale applications, delivering the full benefits of cloud to the enterprise.

8.1.3 Offeror must identify for each Solution the subcategories that it offers for each service model. For example if an Offeror provides a SaaS offering then it should be divided into education SaaS offerings, eprocurement SaaS offerings, information SaaS offering, etc.

CA APM In addition to the APIM SaaS offering CA Technologies also offers educational services and consultancy services. CA provides education and training services to its clients.

MAA CA MAA helps app developers visualize, investigate, manage, and support user interactions with their mobile apps. It provides deep insights into the performance, user experience, crash, and log analytics of mobile apps. CA MAA is aimed to help

SOLICITATION # CH16012
41 enterprises understand the experience of mobile app users across the DevOps application lifecycle. Enterprises can accelerate the delivery of user-experiencefocused mobile applications and can achieve faster time to market by continuous application delivery while ensuring robust security.

CA Agile We provide a SaaS offering that is generally used to document and manage work within the SDLC. In addition to the CA Agile offering CA Technologies also offers educational services and consultancy services
ASM CA ASM is a SaaS offering that provides customers with the ability to monitor the availability, health, and performance of network services (web sites, email servers, etc.).

Google Education SaaS offering - Google Apps for Education Messaging SaaS offering - Google Apps for Work, Google Apps Unlimited Collaboration SaaS offering - Google Apps Unlimited
Identity Management SaaS offering - Google Apps SSO
eDiscovery/Archving SaaS offering - Google Apps Vault
Application Development PaaS -
Storage IaaS offering -
AODocs AODocs Team Folders
AODocs Document Management
AODocs Retention Application
AODocs Email Connector
Virtru SaaS email encryption and SaaS file encryption.

Salesforce Salesforce is the enterprise cloud computing leader dedicated to helping companies and government agencies transform into connected organizations through social and mobile technologies.

Over 150,000 Salesforce customers across nearly every industry have successfully transformed their operations including over 1000 government agencies, representing all federal cabinet level agencies and the majority of the United States. Customer examples include: State of Texas, State of Colorado, State of California, GSA, USDA, USAID, and others.

Salesforce was named one of the World’s Most Innovative Companies by Forbes for the last five years in a row. Salesforce is #1 in Enterprise Cloud Computing and #1 in CRM according to IDC.

Salesforce ranks as the Leader in the Gartner Magic Quadrant for “CRM Customer Engagement Centers” (SaaS), “Sales Force Automation” (SaaS), and “Enterprise Platform as a Service” (PaaS).

Government agencies are using Salesforce PaaS and SaaS solutions for a multitude of government functions including grants management, constituent communications and correspondence management, incident and case management, call/contact center management, outreach programs, learning management, volunteer management, project management, and even donor management, among numerous others.

ServiceNow SaaS Offerings:
•Cloud and Infrastructure Management Tools
•Customer Relationship Management
•Project and Portfolio Management (PPM) Tools
•Security
•Workflow and Electronic Signature
•Proposed new category: Information Technology Service Management Tools

SOLICITATION # CH16012
42 QTS QTS has built some of the world’s largest, most robust, and redundant data centers. The company’s innovative 3C product set of custom data center, colocation, and cloud and managed services provides a fully integrated platform and a flexible, scalable level of service that is difficult to match.

Our service categories include:

IaaS Custom Data Center
IaaS Enterprise Cloud
IaaS Managed Cloud
IaaS vCGS Cloud
IaaS Federal Solutions
IaaS Healthcare Solutions
IaaS Financial Service Solutions
Colocation
Connectivity
Critical Facilities Management
Hybrid IT Solutions
Disaster Recovery as a Service (DRaaS)
Managed Services: Managed Hosting, Managed Network, Managed Systems, Managed Security, Managed Storage & Backup, Managed Disaster Recovery, Data Security SAP Ariba We provide solutions that allow enterprises to efficiently manage the purchasing of non-payroll goods and services required to run their business.

We refer to these non-payroll expenses as “spend.""
Our solutions include software, network access, and expertise. They are designed to provide enterprises with technology and business process improvements to better manage spend and, in turn, save money. Our solutions streamline the business processes related to the identification of suppliers of goods and services, the negotiation of the terms of purchases, and ultimately the management of ongoing purchasing and settlement activities.

Our solutions allow enterprises to take a systematic approach with products and services that work together. By combining software, network access and professional services into a comprehensive solution, we help customers to address six key areas of spend management:

Visibility - enhance spend visibility and control across spend categories, disparate systems and corporate divisions
Sourcing - identify top suppliers, negotiate procurement terms, leverage aggregate spend, and manage procurement contracts
Contract Management - streamline and automate from contract creation to compliance
Procurement – streamline requisitioning and procurement across all types of spend
Invoice and Payment - automate invoicing and payment processes Supplier Management - optimize buyer-supplier interactions throughout the spend lifecycle
Fieldglass The SAP Fieldglass Vendor Management System (VMS) application is a workforce management SaaS offering.

Hanna HANA Enterprise Cloud is a private managed cloud primarily for all SAP enterprise-wide SAP applications such as: ERP, CRM, SRM, BW, etc. All SAP applications can be hosted in HANA Enterprise Cloud (via BYOL or Subscription Licensing model)
SuccessFactors Our original product release dates are as follows:

SOLICITATION # CH16012
43 Performance Management – 2001
Goal Management – 2002
360/Multi-Rater Reviews - 2002
Succession Management - 2004
Compensation Management – 2004
Analytics & Reporting – 2005
Learning & Development – 2006
Recruiting Management – 2006
Variable Pay Compensation – 2007
Employee Profile – 2007
Stack Ranker – 2008
Employee Central – 2009
Metrics Navigator – 2009
Goal Execution – 2010
Calibration – 2010
Workforce Planning (Acquisition) – 2010
Workforce Analytics (Acquisition) - 2010
Plateau LMS (Acquisition) – 2011
JAM – 2011
Employee Central Payroll – March 2012
Onboarding (acquisition of KMS) – May 2013
FireEye FireEye is offering 4 distinct cloud solutions that can be classified into the following service categories and sub-categories:

1.Email Threat Prevention (ETP)
Security – SaaS

2.Mobile Threat Prevention (ETP)
Security – SaaS

3.Threat Analytics Platform (TAP)
Threat Intelligence – SaaS

4.FireEye as a Service with Continuous Vigilance (FaaS CV) Managed Security Service – SaaS
VirtueStream Virtustream is an Infrastructure as a Service (IaaS) offering focused on mission critical workloads and applications.

The solution provides as part of the response is IaaS only. Virtustream’s IaaS is targeted for all virtualized, x86 based cloud solution. While we have secured and segmented infrastructure for FedRAMP, FISMA, PCI and other regulated workload, it is best suited for any and all enterprise workload as long as the workload can be virtualized and run on x86 platform. For non x 86 environments, Virtustream provides Collocated areas, which is cross connected with the cloud.

8.1.4 As applicable to an Offeror’s proposal, Offeror must describe its willingness to comply with, the requirements of Attachments C & D.

Carahsoft complies with the requirements in attachment C & D. Cloud service models by vendor are broken out in section 6.6 of this response per the request in attachment C.

8.1.5 As applicable to an Offeror’s proposal, Offeror must describe how its offerings adhere to the services, definitions, and deployment models identified in the Scope of Services, in Attachment D.

Carahsoft’s cloud vendors fit into multiple categories as listed out in Attachment D. Many of our vendors fit a hybrid cloud deployment method with ability to silo off a private cloud if security needs dictate such. Our cloud vendors are broken out by service model in section 6.6 of this response. Carahsoft’s cloud vendors

SOLICITATION # CH16012
44 also fit into many categories as listed in section 1.1.3 of Attachment D. Depending on the type of data and service requested our vendors can support everything from on demand self service delivery to a completely managed and measured service option.

8.2 Subcontractors

8.2.1 Offerors must explain whether they intend to provide all cloud solutions directly or through the use of Subcontractors. Higher points may be earned by providing all services directly or by providing details of highly qualified Subcontractors; lower scores may be earned for failure to provide detailed plans for providing services or failure to provide detail regarding specific Subcontractors. Any Subcontractor that an Offeror chooses to use in fulfilling the requirements of the RFP must also meet all Administrative, Business and Technical Requirements of the RFP, as applicable to the Solutions provided. Subcontractors do not need to comply with Section 6.3.

Carahsoft will be utilizing Subcontractors to provide services and solutions for specific manufacturers within this response. In other cases, Carahsoft will work with the manufacturers to provide these services and solutions to all Participating Entities. All Subcontractors shall be vetted to ensure they have the necessary qualifications to do business within the State of Utah and any applicable Participating States. All Subcontractors will also comply with the applicable terms and conditions of the RFP and subsequent contract, as well as all Participating Addendums for the States they are subcontracting in.

8.2.2 Offeror must describe the extent to which it intends to use subcontractors to perform contract requirements. Include each position providing service and provide a detailed description of how the subcontractors are anticipated to be involved under the Master Agreement.

Carahsoft will use subcontractors as a third party company to provide services in relation to the solutions provided by the manufacturer. No other functions of contract management or execution will be performed by the subcontractor. While Carahsoft cannot determine all roles and responsibilities of the positions for each subcontractor, there are multiple different standards which subcontractors utilize for these types of contracts. Here is an example set of the traditional roles a subcontractor would play on behalf of Carahsoft for this RFP:

Job Title: Consulting Engineer
Functional Responsibility: Working under close supervision, person provides technical or scientific and project support for multiple large-scale projects that cross-cut multiple specialization and product development areas. Applies advanced business and/or technical expertise to assist others with defining, analyzing, validating and documenting complex customer operating environments, states of technology and current engineering processes. Provides advanced technical support to others involved in applying specialized knowledge to complex customer processes and requirements. Supports complex technical investigations through advanced research techniques, analysis or development phases of engineering projects. Works with other engineering disciplines in the development and application of processes to improve quality, reliability, cost customer appeal, and satisfaction.

Job Title: Project Manager

SOLICITATION # CH16012
45 Functional Responsibility: Possesses a thorough understanding of the process requirements and provide both technical and management oversight of the project. Responsible for customer satisfaction, serves as the single point of contact, compliance with the Statement of Work, project planning and management, resource allocation, and reporting.

Job Title: Senior Information Architect
Functional Responsibility: Provides supervision, person designs Intranet/Internet/Extranet architectures and develops implementations plans; administration activity; i.e., hardware, security, firewalls. Implements security architecture using LDAP, SSL and firewalls. Installs, configures and maintains all Intranet/Internet/Extranet tools, databases and features; provides support to e-commerce and other systems. Implements server design, development, and operation as well as analyze and develop requirements for hardware sizing/capacity, data validation, security and integration points to other applications.

Job Title: Information Architect
Functional Responsibility: Designs Intranet/Internet/Extranet architectures and develops implementations plans; administration activity; i.e., hardware, security, firewalls. Implements security architecture using LDAP, SSL and firewalls. Installs, configures and maintains all Intranet/Internet/Extranet tools, databases and features; provides support to e-commerce and other systems. Implements server design, development, and operation as well as analyze and develop requirements for hardware sizing/capacity, data validation, security and integration points to other applications.

Job Title: Senior Consulting Engineer
Functional Responsibility: Provides supervision, person provides technical or scientific and project support for multiple large-scale projects that cross-cut multiple specialization and product development areas.

Applies advanced business and/or technical expertise to assist others with defining, analyzing, validating and documenting complex customer operating environments, states of technology and current engineering processes. Provides advanced technical support to others involved in applying specialized knowledge to complex customer processes and requirements. Supports complex technical investigations through advanced research techniques, analysis or development phases of engineering projects. Works with other engineering disciplines in the development and application of processes to improve quality, reliability, cost customer appeal, and satisfaction.

8.2.3 If the subcontractor is known, provide the qualifications of the subcontractor to provide the services; if not, describe how you will guarantee selection of a subcontractor that meets the experience requirements of the RFP. Include a description of how the Offeror will ensure that all subcontractors and their employees will meet all Statement of Work requirements.

Carahsoft will be making the determination of what subcontractors to include on the NASPO ValuePoint Cloud contract upon time of award. Carahsoft will ensure a subcontractor has all of the necessary certifications to do business in the State before adding them to the contract as a subcontractor. In addition, Carahsoft will do credit checks and meet with the subcontractor on multiple occasions to confirm that they are reliable and exceed expectations as a services and solutions provider. Finally, an agreement will be put in place between Carahsoft and the subcontractor to ensure optimal efficiency with the subcontractor’s responsibilities.

SOLICITATION # CH16012
46 A subcontractor will be actively involved in understanding and shaping any Statements of Work created for the services of a deal in order to make sure that they have the capacity to meet all of the necessary requirements. These Statements of Work will dictate the terms upon which the subcontractor is deployed for services, so Carahsoft will work specifically with subcontractors that are active in the public sector and understand the nuances of selling to government entities.

8.3 Working with Purchasing Entities

8.3.1 Offeror must describe how it will work with Purchasing Entities before, during, and after a Data Breach, as defined in the Attachments and Exhibits. Include information such as:
 Personnel who will be involved at various stages, include detail on how the Contract Manager in Section 7 will be involved;
 Response times;
 Processes and timelines;
 Methods of communication and assistance; and
 Other information vital to understanding the service you provide.

Security is of the uptmost importance to all of the Service providers that Carahsoft is submitting. Should and actual breach occur, it is the first priority of Carahsoft and the service provider to identify the source of the breach and implement safe guards to prevent one from happening in the future. The Service Provider will promptly notify the Purchasing Entity of the incident. Notification of the breach will be provided by the service directly to the security or customer contact that is identified by the Purchasing Entity. Methods of communication could include phone or email notification.

8.3.2 Offeror must describe how it will not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the Participating Entity or the Master Agreement.

Carahsoft ensures that no unwanted marketing efforts are made to customers through an easy to manage opt out system in our database. Carahsoft can also limit communications by vendor to ensure that only those vendors approved by the customer reach out with marketing materials or product updates. Carahsoft will never support or assist in the pushing of adware or unwanted software to participating customers.

8.3.3 Offeror must describe whether its application-hosting environments support a user test/staging environment that is identical to production.

For applicable cloud offerings, user test/ staging environments are available that are identical to real-time production environments.

8.3.4 Offeror must describe whether or not its computer applications and Web sites are be accessible to people with disabilities, and must comply with Participating entity accessibility policies and the Americans with Disability Act, as applicable.

The user interfaces provided for within this proposal are accessible to people with disabilities using assistive technologies.

8.3.5 Offeror must describe whether or not its applications and content delivered through Web browsers are be accessible using current released versions of multiple browser platforms (such as Internet Explorer, Firefox, Chrome, and Safari) at minimum.

SOLICITATION # CH16012
47 All cloud solution offerings within this proposal that are delivered via web browsers are accessible using current releases of common internet browsers such as Internet Explorer, Firefox, Chrome, Safari, and more.

8.3.6 Offeror must describe how it will, prior to the execution of a Service Level Agreement, meet with the Purchasing Entity and cooperate and hold a meeting to determine whether any sensitive or personal information will be stored or used by the Offeror that is subject to any law, rule or regulation providing for specific compliance obligations.

Upon request of the customer, Carahsoft can host meetings via Adobe Connect web conferencing software or travel in person if the need presents itself. Carahsoft is happy to support and comply with any regulations or sensitive data compliance needs that the customer identifies. Carahsoft has the ability to limit customer information to a secure and isolated database if needed.

8.3.7 Offeror must describe any project schedule plans or work plans that Offerors use in implementing their Solutions with customers. Offerors should include timelines for developing, testing, and implementing Solutions for customers.

Project scheduling and work planning documents are developed in conjunction with customer requirements. Project planning activities are conducted with a focus on developing a statement of work that defines deliverables, customer and contractor areas of responsibility, as well as project benchmarks, and deadlines. Project complexity and customer requirements determine the overall timelines for development, testing, and solution implementation.

8.4 Customer Service

8.4.1 Offeror must describe how it ensure excellent customer service is provided to Purchasing Entities.

Include:
 Quality assurance measures;
 Escalation plan for addressing problems and/or complaints; and  Service Level Agreement (SLA).

The core of Carahsoft's business is to provide the best customer service to our government customers and vendor partners. We are an IT solutions provider delivering best-of-breed hardware, software, and support solutions to federal, state and local government agencies since 2004. Carahsoft has built a reputation as a customer-centric realtime organization with unparalleled experience and depth in government sales, marketing, and contract program management. This experience has enabled Carahsoft to achieve the top spot in leading software license GSA resellers. Carahsoft has leveraged its vast contracting experience and extended it to quoting and order management. Carahsoft seamlessly generates quotes within 30 minutes or less and processed over 56,000 orders in 2014 that were each completed the same day received. Over the past ten years Carahsoft has acquired and maintained a wide variety of purchasing contract vehicles for agencies at the state, local, and federal levels.

Associated with all contracts are dedicated and experienced contract management resources. Quality and accuracy is the driving factor behind Carahsoft's successin the government market. All solutions proposals and price quotes that are sent to our customers go through a three step review process for quality. The first is a pricing review that is automatically run against the pricing database to ensure pricing accuracy for the proper contract. The second review is at the certified Account Representative level who will check pricing and configurations for accuary and also review any SOWs that are included. Finally, mangagement review confirms the quality and accuracy of the proposal that will be sent to the Purchasing Entity. Carahsoft has instituted an escalation procedure for any problems or complaints that may arise. There are four levels of escalation and include review by the Account Representative assigned to the

SOLICITATION # CH16012
48 Purchasing Entity, followed by the Regional Manager of the territory, next to the Vice President of State and Local and finally to the President/CEO. Each stage of escalation shall have a response SLA of no more than 24 hours.

8.4.2 Offeror must describe its ability to comply with the following customer service requirements:
a. You must have one lead representative for each entity that executes a Participating Addendum. Contact information shall be kept current.
b. Customer Service Representative(s) must be available by phone or email at a minimum, from 7AM to 6PM on Monday through Sunday for the applicable time zones. c. Customer Service Representative will respond to inquiries within one business day. d. You must provide design services for the applicable categories. e. You must provide Installation Services for the applicable categories.

Carahsoft confirms and agrees that we will name a lead representative for each Participating Addendum. The contact information will be listed on the Carahsoft website and kept current. Carahsoft confirms it will have a representative available by phone and email available 7am-6pm on Monday through Sunday in the applicable time zones. Carahsoft confirms that it will respond to all inquiries within one business day or sooner. Carahsoft will engage with our service providers to provide design services in the applicable categories Carahsoft will engage with our service providers to provide installation services in the applicable categories.

8.5 Security of Information

8.5.1 Offeror must describe the measures it takes to protect data. Include a description of the method by which you will hold, protect, and dispose of data following completion of any contract services.

Security is of the utmost importance to Carahsoft and our service providers. As an example of our Service Provider's security standards, please see the government security response for Salesforce: Government Trusted Security and Infrastructure
Salesforce understands that the confidentiality, integrity, and availability of our customers’ information are vital to their business operations and our own success. We use a multi-layered approach to protect that key information, constantly monitoring and improving our application, systems, and processes to meet the growing demands and challenges of security.

Independent audits confirm that our security goes far beyond what most companies have been able to achieve on their own. Using the latest firewall protection, intrusion detection systems, and TLS encryption, Salesforce Force.com gives you the peace of mind only a world-class security infrastructure can provide.

Third-party validation
Security is a multidimensional business imperative that demands consideration at multiple levels, from security for applications to physical facilities and network security. In addition to the latest technologies, world-class security requires ongoing adherence to best-practice policies. To ensure this adherence, we continually seek relevant third-party certification, including ISO 27001, the SysTrust audit (the recognized standard for system security), and SSAE 16 SOC 1 audit (an examination and assessment of internal corporate controls, previously known as SAS 70 Type II). SOC1, SOC2 and SOC3 audits are performed by third party auditor annually at a minimum. Additional audits and certifications include: CSA ‘Consensus Assessments Initiative’, JIPDC (Japan Privacy Seal), Tuv (Germany Privacy Mark), and TRUSTe.

Protection at the application level

SOLICITATION # CH16012
49 Salesforce protects customer data by ensuring that only authorized users can access it. Administrators assign data security rules that determine which data users can access. Sharing models define companywide defaults and data access based on a role hierarchy. All data is encrypted in transfer. All access is governed by strict password security policies. All passwords are stored in SHA 256 one-way hash format.

Applications are continually monitored for security violation attempts.

Protection at the facilities level
Salesforce security standards are stringent and designed with demanding customers in mind, including the world’s most security-conscious financial institutions. Authorized personnel must pass through five levels of biometric scanning to reach the Salesforce system cages. All buildings are completely anonymous, with bullet-resistant exterior walls and embassy-grade concrete posts and planters around the perimeter. All exterior entrances feature silent alarm systems that notify law enforcement in the event of suspicion or intrusion. Data is backed up to disk or tape. These backups provide a second level of physical protection.

Neither disks nor tapes ever leave the data center.

Protection at the network level
Multilevel security products from leading security vendors and proven security practices ensure network security. To prevent malicious attacks through unmonitored ports, external firewalls allow only http and https traffic on ports 80 and 443, along with ICMP traffic. Switches ensure that the network complies with the RFC 1918 standard, and address translation technologies further enhance network security. IDS sensors protect all network segments. Internal software systems are protected by two-factor authentication, along with the extensive use of technology that controls points of entry. All networks are certified through third-party vulnerability assessment programs.

Trust.salesforce.com is the Salesforce community’s home for real-time information on system performance and security. On this site you'll find:
● Live and historical data on system performance
● Up-to-the minute information on planned maintenance
● Phishing, malicious software, and social engineering threats ● Best security practices for your organization
● Information on how we safeguard your data

8.5.2 Offeror must describe how it intends to comply with all applicable laws and related to data privacy and security.

Carahsoft is happy to support and comply with any regulations or sensitive data compliance needs that the customer identifies. Carahsoft has the ability to limit customer information to a secure and isolated database if needed. Under no circumstances will Carahsoft ever publish or release secure customer data.

Carahsoft’s cloud vendors are all FIPS certified or have equivalent security standards in place to ensure no customer data is released outside of the secure cloud.

8.5.3 Offeror must describe how it will not access a Purchasing Entity’s user accounts or data, except in the course of data center operations, response to service or technical issues, as required by the express terms of the Master Agreement, the applicable Participating Addendum, and/or the applicable Service Level Agreement.

SOLICITATION # CH16012
50 Carahsoft will use customer accounts and data only in the processing of an order and management of the customer’s service entitlements. Carahsoft’s vendors, as outlined in their specific Master Agreements, only us customer account data for the express purpose of providing the service to the customer. Included in that service is implementation, technical support, and training efforts. Under no circumstances will Carahsoft or its cloud partners use customer information outside of normal operating procedures.

8.6 Privacy and Security

8.6.1 Offeror must describe its commitment for its Solutions to comply with NIST, as defined in NIST Special Publication 800-145, and any other relevant industry standards, as it relates to the Scope of Services described in Attachment D, including supporting the different types of data that you may receive.

CA APM CA technologies understands that security is a top concern when evaluating cloudbased applications, which is why CA technologies operations worldwide conform to rigorous certification, compliance and security programs and processes. In addition, we contract with independent auditors to regularly evaluate and validate the security of our service. High risks are identified, validated and remediated before production systems are made available. Medium risks are evaluated and resolved on a priority basis.

MAA
CA Agile We use CIS and NIST standards as baselines for hardening our systems. We are currently working towards a NIST 800-53r4 certification however this is not yet complete. We are continuously reviewing our compliance with these standards. We perform monthly scans against our Production Infrastructure based on CIS standards.

We scan for both vulnerabilites and compliance best practices bases on NIST 800- 53v4 standards. Vulnerabilites are tracked and remidiated based on severity and risk.

ASM Please see our response to APM/MAA
Google Google's currently maintains a FedRAMP Authorization to Operate. FedRAMP incorporates the relevant NIST SP and FIPS security requirements. Further, Google contractually commits to maintaining SOC2 and ISO27001 certifications.

AODocs AODocs is committed to comply SOC2 type 2.

Virtru Virtru's business depends on its ability to support healthcare and criminal justice markets, which requires us to maintain compliance with HIPAA and CJIS standards which both make extensive use of NIST standards
Salesforce On May 23, 2014 Salesforce achieved a FedRAMP Agency Authority to Operate at the moderate impact level (as described in FIPS 199 and 200) issued by Health and Human Services (HHS) for the Salesforce Government Cloud. Additionally, on May 15, 2015, HHS, as the FedRAMP authorizing agency, approved the Salesforce Government Cloud authorization package that was updated based on annual attestation requirements and updates to the FedRAMP baseline which is FISMA compliant and based on the current release of NIST SP 800-53 Rev. 4.

Salesforce provides contractual assurance to its customers that the Customer Data hosted in Salesforce’s services will be kept confidential and not accessed by third parties except under narrow circumstances (such as a customer support issue or as required by law). In the case of customer support, the company's personnel will access a customer's Org only with prior approval and subject to confidentiality obligations.

ServiceNow ServiceNow is a cloud service provider offering a SaaS solution deployed from a private cloud that meets the five essential characteristics of cloud computing as described in 8.1.

ServiceNow applies the same data classification for all hosted customer data. ServiceNow does not inspect or monitor its customers’ information and therefore has no ability to sub-classify

SOLICITATION # CH16012
51 customer data. The overriding requirement of the assigned classification is that customer data remains hosted in the private cloud until the customer terminates their subscription. It is never stored anywhere apart from the private cloud.

Customers remain the data owner and data controller for all data placed into their instance.

ServiceNow does not examine, inspect, monitor or analyze customers’ data.

Customers apply access controls to restrict access to data within their instances based on their own requirements and needs, including their own data classification.

QTS QTS understands the growing number of requirements along with the complexity of managing the high cost-risk if you are not in compliance, and makes compliance a top priority. Our dedicated QTS Internal Audit team is focused on helping you define controls and processes to meet your ever-expanding compliance requirements. We are steadfast in protecting your data with the commitment to allocate required resources, technology and controls to not only help you achieve and maintain compliance today, but to expertly support your needs as they inevitably grow and change in the future.

QTS tackles compliance differently. We provide a flexible, integrated approach to meet the IT compliance and regulatory needs across a wide variety of industries – from Payment Card Industry Data Security Standard (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA) to U.S.–EU Safe Harbor. Our approach reduces the complexity and workload to effectively support their compliance efforts.

SAP Ariba Our security framework, which consists of semi-annual independent third party AICPA audit under the Trusted Services Principles of security, confidentiality, process integrity and availability as well as annual certification by an independent Qualified Security Assessor for PCI DSS, is highly aligned with the NIST controls.

Our security framework and cloud services are designed to receive process and store data sets of a commercial business-to-business nature and are multi-tenant and international in scope. FISMA/NIST is designed to protect US government data that can include classified information as well as sensitive PII such as ePHI and SSN’s or government identifiers.

We practice data avoidance where these data sets are concerned primarily to reduce the risk to us and to our customers but also to avoid additional regulatory compliance which has onerous reporting and high costs which would have to be passed on to our customers. Where FISMA regulated entities can take advantage of our solutions, the data sets they expect to store must be validated to avoid being under regulatory requirements beyond what we can provide in terms of both security as well as reporting.

Fieldglass Fieldglass has based its security program on the ISO 27002 security standard and has maintained its ISO 27001 certification since February 2011.

However, to ensure that a robust security framework was developed, additional controls were added and/or modified based on COBIT DS5 Ensure Systems Security, specific NIST special publications, and vendor specified best practices. Fieldglass uses a SSAE 16 audit with a twelve-month audit cycle to validate that the controls defined within the security framework are operating effectively.

Hanna SAP will show the compliance with the SAP Cloud Security Framework by the compliance audits and/or certification audits only as it pertains to the HANA Enterprise Cloud. SAP Cloud and Infrastructure Delivery’s Security, Risk & Compliance Office has developed the Integrated

SOLICITATION # CH16012
52 Information Security Management System (IISMS) Framework. The IISMS Framework is based on SAP’s corporate quality and security policy as well as the corporate security standards and guidelines relating to information security and business continuity. This IISMS Framework was adapted to SAP Cloud Security Services as SAP Cloud Security Framework (Cloud SFW).

SAP’s security, process and compliance team conducts technical security audits to validate that security concepts have been implemented successfully and to safeguard the usage of newly developed tools.

Compliance Audits
Cloud solutions from SAP have passed ISAE3402/SSAE16-SOC 1 Type II and/or SOC 2 Type II audits (in the following referred to as SOC audits) and can provide the related audit reports on request.

Certification Audits
The SAP HANA Enterprise Cloud has attained certifications according to the following ISO standards are available (related audits are in the following referred to as ISO audits):
• ISO 27001:2013
• ISO 22301:2012
• ISO 9001:2008
SuccessFactors Our IT architecture is aligned with ISO 27002. We are Safe Harbor certified and in alignment with BS10012 and ISO 20000 for Service Delivery. We demonstrate an on-going commitment to protecting the confidentiality, integrity and availability (“CIA”) of data from internal and external threats, making us a reliable and secure system provider.

Our secure multi-tenant Software as a Service (SaaS) platform is designed for availability, security, scalability, and performance. Industry best practices and standards are adopted and incorporated.

Our Network also complies with the Authority to Operate as a Moderate Risk Federal Information System by the Office of Personnel Management and Department of Homeland Security; NIST SP800-53 Security Controls; EU Privacy Directive 95/46/EC for EU and non-EU customer data; Payment Card Industry (PCI) Data Security Standard (DSS) v 2.0; Safe Harbor.

We provide privacy compliant data center facilities not only in the United States but also as a Member State of the European Union (EU) or a state of the European Economic Area (EEA). Currently, such data centers are certified for ISO27001, ISO9001 and PCI-DSS compliance.

Our security services provide complete and thorough monitoring of all traffic on the network on a 24x7x365 basis, and include security technology, alert services and incident management support. We are audited twice annually to SSAE16 (US) or ISAE 3402 (international) accounting standards.

VMware VMware is fully committed to complying with NIST and all other relevant industry standards including FedRAMP, FISMA, PCI, CSA CAIQ, etc. This is demonstrated by VMware’s track record of pursuing and obtaining certifications such as those listed above. vCloud Government Service has been certified to store and secure Low Risk Level and Moderate Risk Level data as defined by FIPS PUB 199. In addition, VMware is capable of enhancing the vCloud Government Service to meet participating State’s requirements to be able to store data that is defined by FIPS Pub 199 as High Risk Data.

VMware is committed to maintaining compliance with all of our existing and future compliance certifications. Our ability to remain competitive as a software and services provider in the public sector depends upon it. Thus we have established a comprehensive security and compliance team to ensure that we maintain compliance as well as a strong security posture.

SOLICITATION # CH16012
53 VMWare supports regular internal and external audits to ensure compliance with its certifications as required.

The AirWatch Information Security Program is built on the security framework laid out in NIST 800-

53. Although AirWatch is not required to register with any regulatory agencies, we provide a suite of tools for our customer’s to maintain industry-relevant compliance guidelines within their mobile device fleets. AirWatch has recently been awarded the HP-IAPP Privacy Innovation Award for Most Innovative Privacy Technology by the International Association of Privacy Professionals (IAPP) for our commitment to delivering an EMM platform focused on end-user privacy. To help ensure the confidentiality, integrity, and availability of our cloud offering, we comply with the European Data Protection Directive (95/46/EC) and our top-tier data center partners have undergone SSAE16 SOC2 Type II audits and have ISO 27001 certifications.

FireEye FireEye has mature and well documented security and privacy programs. The programs include third party certifications for SSAE 16 SOC 2, FedRAMP certifications, Model clauses, Privacy and security standards among others. The data that FireEye receives is only in conjunction with the malware analysis.

VirtueStream The Virtustream Federal Cloud (IaaS) has met the requirements for a FedRAMP moderate P-ATO.

The IAAS is assessed annually by a FedRAMP certified 3rd Party Assessment Organization (3PAO). The annual assessment will review a subset of the NIST 800-53 Revision 4 controls as designated by FedRAMP. Virtustream’s 3PAO shall demonstrate impartiality throughout the assessment to accurately assess the status of all security controls in place.

8.6.2 Offeror must list all government or standards organization security certifications it currently holds that apply specifically to the Offeror’s proposal, as well as those in process at time of response. Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800-171, and FIPS 200 if they apply.

CA APM AWS EC2 datacenters annually undergo SOC 3 audits.

The application currently does not hold a Soc 2 attestation.

MAA CA MAA is certified for SOC 2 Type 1 Security Audit.

CA Agile Our data center provider has a SOC 2 audit report that can be provided upon request.

Our application does not currently have such certifications.

ASM Rackspace datacenters annually undergo various certification including SOC 3 audits.

The application currently does not hold a Soc 2 attestation.

Google Google has a FedRAMP ATO at the Moderate impact baseline. FedRAMP incorporates many NIST SPs and FIPS including 800-53, FIPS 199, FIPS 200), and has a specific offering. Google Apps for Education that is FERPA and COPPA compliant. Other compliance standards such as HIPAA and CJIS don't offer certification per se, but are commonly accommodated (i.e. Google will sign a BAA to meet HiTECH/HIPAA requirements, and has numerous customers who bear responsibility for meeting CJI processing requirements). PCI DSS is generally not applicable to SaaS systems (though we can do email hygiene processing to protect against incidental usage), but Google IaaS/PaaS does meet PCI DSS v3 standards. Google also holds and is committed to maintaining SOC2 and ISO27001 certifications.

AODocs AODocs doens't hold an HIPAA certifications per se, but are commonly accommodated to meet HIPAA requirements signing a BAA.

Virtru HIPAA, FERPA, CJIS, NIST 800-53, NIST SP-800
Salesforce Salesforce and the Salesforce Force platform is ISO 27001 certified and PCI-DSS compliant. SOC1, SOC2 and SOC3 audits are performed by third party auditor annually at a minimum. Additional audits and certifications include:

SOLICITATION # CH16012
54 FedRAMP Authority to Operate from Department of Health and Human Services CSA ‘Consensus Assessments Initiative’
JIPDC (Japan Privacy Seal)
Tuv (Germany Privacy Mark)
TRUSTe
HIPAA
In provisioning and operating the services, Salesforce complies with the provisions of HIPAA’s Privacy Rule and Security and the HITECH Act that are applicable to business associates. Salesforce’s customers are still responsible for complying with the same in their capacity as a covered entity or business associate using the Salesforce services. The services’ features permit customers to customize use as per a compliance program for HIPAA (including the HITECH Act) and many customers store protected health information (PHI) on our service. From a legal standpoint, some of our customers have asked Salesforce to assist them in meeting their compliance obligations; for example, by entering into business associate agreements (BAA) to address formal legal requirements pertaining to use and disclosure of protected health information (PHI).

FERPA
Salesforce maintains appropriate administrative, physical, and technical safeguards to help protect the security, confidentiality, and integrity of data our customers submit to the Salesforce Services as Customer Data. Salesforce's customers are responsible for ensuring the security of their Customer Data in their use of the service and implementing any necessary customer-controlled settings. To aid, Salesforce offers robust security functionality that provides our customers the flexibility to use the application in a configuration that furthers compliance with local data protection laws and regulations.

While Salesforce complies with applicable law in provisioning and operating the Salesforce services, it is the sole responsibility of Salesforce’s customers to ensure compliance with applicable laws in their respective uses of the Salesforce services.PCI-DSSSalesforce is PCI Level 1 compliant and has received a signed Attestation of Compliance (AoC) for the Payment Card Industry Data Security Standard (PCI-DSS). Salesforce customers who must adhere to PCI compliance may store personal account numbers (“PAN” or “credit card numbers”) in Salesforce, with the following caveats:
- PANs may only be stored in a custom field encrypted via Classic Encryption or supported field types via the Platform Encryption functionality. PANs must not be stored in clear text fields, attached files, or any other location.
- Customer administrators must configure Salesforce features to support their organization’s PCI controls.NIST SP 800-171NIST Special Publication 800-171 is intended for use by federal agencies when agencies are providing CUI to nonfederal organizations (or when CUI is developed by those organizations for federal agencies) for purposes unrelated to information processing. In other words, the nonfederal organizations are not operating their information systems to process agency data, including CUI, on behalf of the agency but rather for other purposes (e.g., when designing or producing an aircraft, performing a study, or conducting background investigations for security clearances).

Salesforce recommends that its customers use the classifications as detailed in FIPS 199.

FIPS 140-2, FIPS 197, FIPS 199, and FIPS 200
On May 23, 2014 Salesforce achieved a FedRAMP Agency Authority to Operate at the moderate impact level (as described in FIPS 199 and 200) issued by Health and Human Services (HHS) for the Salesforce Government Cloud. Additionally, on May 15, 2015, HHS, as the FedRAMP authorizing agency, approved the Salesforce Government Cloud authorization package that was updated based on annual attestation requirements and updates to the FedRAMP baseline which is FISMA compliant and based on the current release of NIST SP 800-53 Rev. 4.

SOLICITATION # CH16012
55 As part of the Salesforce Government Cloud, Salesforce is capable of responding to FIPS 140-2/3 cryptographic implementations for data being transferred between the customer’s web browser and Salesforce. Data that resides within Salesforce’s protected boundary does not use FIPS 140-2 validated encryption as compensating/mitigating controls are in place to protect data.

Additional information is provided below.

Data Transmission between the customer’s web browser and Salesforce:

Salesforce employs cryptographic mechanisms to protect information during transmission. All transmissions between the user and Salesforce are encrypted by default with a 2048-bit Public Key.

Our service uses International/Global Step Up certificates. We support one-way TLS, in which customers create secure connections before sharing private data. Secure routing and traffic flow policies ensure that customer traffic is encrypted entering Salesforce until the load balancer decrypts the traffic. The load balancers decrypting the traffic are FIPS 140-2 compliant and are located inside of the Salesforce Government Cloud isolation boundary.

Data Transmission for Backup Media:

Media containing customer data is not transported outside of controlled salesforce.com areas and therefore relies on physical access controls to protect the data.

Data at Rest:

NIST 800-53 Rev. 3 states in SC-28, “Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system.” SC-28 also states, “Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate.” All secondary storage media (hard drives, disk drives, and tapes) containing customer data are maintained within Salesforce's secure production data centers until the media has been sanitized and destroyed. Salesforce relies on physical access controls as a compensating control to protect the data.

Primary Data Storage:

User passwords are stored in the RDBMS encrypted via the SHA algorithm with a 256-bit hash. This is a one way hash. The passwords are encrypted by the application.

For primary data storage, Salesforce provides customers with a built-in capability to apply field-level encryption, using 128-bit keys with Advanced Encryption Standard (AES) encryption (as defined by FIPS 197), for a selection of custom fields included in the Salesforce Platform and CRM applications.

Field-level encryption ensures the data associated with designated fields is encrypted in storage.

ServiceNow ServiceNow’s security policy is based on ISO27001:2013 and has been since 2012. ServiceNow also has annual SSAE 16 SOC 1 Type 2 and SOC2 Type 2 attestations with controls being based off NIST 800-53.

The ServiceNow Service Automation Government Cloud Suite is a FedRAMP Compliant Cloud System with a JAB Provisional Authorization. This cloud offering has regulatory restrictions to the types of tenants that can use it. ServiceNow’s FedRAMP compliant and standard commercial datacenter environments are virtually identical. The differences that do exist, such as only allowing access to specially adjudicated US citizens, exist for regulatory reasons not because the environment is superior in some way.

QTS QTS assists with mapping between DOD IT RMF/DIACAP and NIST as well as International Standards Organization (ISO) standards and many others.

QTS maintains control mappings that include:
• NIST 800-53/FedRAMP (Low/Moderate/High)

SOLICITATION # CH16012
56 • DOD IT RMF/DIACAP (MAC I/II/III Sensitive & Public) • HIPAA-HITECH-Omnibus
• PCI-DSS
• ISO/NATO
• CNSS/ICD/DCID/NISPOM
SAP Ariba We are audited and certified by independent third-party auditor PricewaterhouseCoopers (PwC) for compliance with ISAE 3402 SOC1 Type II, SOC2 and SOC3 every six months. Upon completion of the audit, an attestation letter is issued, stating our compliance. In addition, our primary hosting facility (Equinix) infrastructure is audited for compliance with SSAE 16 SOC1 Type II.

The Service Organization Controls report (SOC) is aimed at three different audiences. SOC1 (aimed at financial auditors) is the same type of report as the SAS70 but also includes an attestation letter signed by both our company and the auditor. SOC2 is aimed at IT and security practitioners. The SOC3 is the publicly viewable web seal to show that we have been audited.

In addition, we have attained PCI (Payment Card Industry) - DSS (Data Security Standard) certification as a Level 1 Service Provider and compliance with the Visa USA Cardholder Information Security Program (CISP) and MasterCard Site Data Protection (SDP) program. These programs were created specifically for merchants and service providers who process, store, or transmit cardholder data.

The PCI DSS is a set of comprehensive requirements for enhancing payment account data security which was developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc. It was developed to help facilitate the broad adoption of consistent data security measures on a global basis. The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures. This comprehensive standard is intended to help organizations proactively protect customer account data. CISP and SDP reflect Visa's and MasterCard's respective longstanding commitment to information security.

Fieldglass SAP Fieldglass has achieved the following certifications:
• ISO 27001
• SSAE 16 SOC 1 and SOC 2
HIPPA
Fieldglass does not store Protected Health Information (PHI) on its system and is not required to comply with the Health Insurance Portability and Accountability Act.

PCI
The Fieldglass application does not process credit card information.

We are not (and are not required to be) PCI compliant.

Hanna Please see response to 8.6.1
Hybris The Savvis datacenter located in Boston, MA is SSAE16 Type II SOC I Compliant.

This replaces the older SAS70 Type II audit standard.

SuccessFactors We have been audited to the SOC 2 Trust Services Criteria. This signifies that our control objectives and control activities have been examined by an independent accounting and auditing firm, and that these controls fairly presented the controls in operation as of a specific date and were suitably designed to achieve the control objectives. Our SOC 2 audits are conducted semi-annually (May, November) by PricewaterhouseCoopers (PwC). We also hold US Federal FISMA Moderate

SOLICITATION # CH16012
57 Authority to Operate with both OPM and NTIS. We are compliant with EU Privacy Directive 95/46/EC and are Safe Harbor self-certified.
https://safeharbor.export.gov/companyinfo.aspx?id=26196We are aligned with ISO 27001 for Information Security, BS 10012 for Data Protection, and ISO 20000 for Service Delivery to create an Integrated Compliance Framework (“ICF”). Where these standards overlap in subject matter, Information Security ISO 27001 takes precedence. Our Network also complies with Authority to Operate as a Moderate Risk Federal Information System by the Office of Personnel Management and Department of Homeland Security; NIST SP800-53 Security Controls; EU Privacy Directive 95/46/EC for EU and non-EU customer data; Payment Card Industry (PCI) Data Security Standard (DSS) v 2.0; Safe Harbor.

We are aligned with ISO 27001 for Information Security, BS 10012 for Data Protection, and ISO 20000 for Service Delivery to create an Integrated Compliance Framework (“ICF”). Where these standards overlap in subject matter, Information Security ISO 27001 takes precedence. Our Network also complies with Authority to Operate as a Moderate Risk Federal Information System by the Office of Personnel Management and Department of Homeland Security; NIST SP800-53 Security Controls; EU Privacy Directive 95/46/EC for EU and non-EU customer data; Payment Card Industry (PCI) Data Security Standard (DSS) v 2.0; Safe Harbor.

VMware VMware IaaS Services
ISO/IEC 27001: ISO/IEC 27001 is a globally recognized standard for the establishment and certification of an information security management system (ISMS). vCloud Air continues to maintain a current ISO/IEC 27001 Certification and has recently issued updated certification for ISO/IEC 27001:2013. Achieving certification means that VMware has implemented a holistic security program that conforms with the ISO 27001 standard requirements, both in the security management system and control activities. The audit of the ISMS was completed by Brightline CPAs and Associates - an ANAB accredited certification body.

HIPAA: The Health Insurance Portability and Accountability Act of 1996(HIPAA), which has incorporated requirements from the Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009, established national standards for the security and privacy of Protected Health Information (PHI) in the United States. To help customers comply with HIPAA, VMware offers a Business Associate Agreement (BAA) to all interested customers using our US-based data centers.

The BAA was designed in conjunction with a leading law firm with expertise in HIPAA and provides fair and reasonable terms for healthcare providers, insurers, and other organizations. VMware has completed an independent third party examination of vCloud Air against applicable controls of HIPAA.

SOC 1 (SSAE16/ISAE 3402): Service Organization Control (SOC) 1 reports are conducted in accordance with Statement on Standards for Attestation Engagements (SSAE) No. 16 put forth by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPS).

The SOC 1 framework reports on internal controls over financial reporting for any service organization such as VMware vCloud Air. SOC 1 aligns to the International Standard on Assurance Engagements (ISAE) 3402 international reporting standards. SOC 1 examinations are specifically intended to meet the needs of the managements of vCloud Air's customers and vCloud Air's customers' auditors, as they evaluate the effect of the controls at vCloud Air on the clients' financial statement assertions.

VMware has completed an independent third-party examination of vCloud Air which spans a twelve (12) month review period.

SOC 2: The Service Organization Control 2 (SOC 2) report is composed of a comprehensive set of criteria on security, availability, processing integrity, confidentiality, and privacy and is similarly set forth by the America Institute of Certified Public Accountants (AICPA). The SOC 2 reports are

SOLICITATION # CH16012
58 intended for use by stakeholders (e.g. customers, regulators, business partners, suppliers, directors) of the service organization that have a thorough understanding of the service organization and its internal controls. VMware has completed an independent third-party examination of vCloud Air that also spans a twelve (12) month review period.

SOC 3: Trust Services Report for Service Organizations Control 3 (SOC 3) reports are designed to meet the needs of customers who want assurance on the controls at a service organization related to security, availability, processing integrity, confidentiality, or privacy. vCloud Air has completed an independent third-party SOC 3 examination of VMware vCloud Air. SOC 3 is composed of a comprehensive set of trust principles including security, availability, processing integrity, confidentiality and privacy.

Cloud Security Alliance: VMware vCloud Air has completed the Cloud Security Alliance (CSA) Consensus Assessments Initiative Questionnaire (CAIQ). CAIQ provides industry-accepted ways to document what security controls exist in IaaS, PaaS and SaaS offerings.

FedRAMP Provisional Authority: VMware vCloud Government Service, provided by Carpathian, now has FedRAMP Provisional Authority to Operate issued by the Joint Authorization Board (JAB).

FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This approach uses a ""do once, use many times"" framework that can reduce government organizations' costs, time, and staff required to conduct redundant agency security assessments. U.S. government agencies can now leverage vCloud Government Service to meet the stringent security and privacy requirements of FedRAMP.

FIPS 140-2: VMware vCloud Government Service is fully FIPS 140-2 compliant including hardware which provides its 2-Factor Authentication capabilities.

FIPS Pub 199: As discussed previously, vCloud Government Services is certified to store and secure Low Risk Data and Moderate Risk Data as defined by FIPS Pub 199. VMware is willing to work with participating States that require High Risk Data Storage to enhance vCloud Government Services to store and secure this data.

FIPS Pub 199: As discussed previously, vCloud Government Services is certified to store and secure Low Risk Data and Moderate Risk Data as defined by FIPS Pub 199. VMware is willing to work with participating States that require High Risk Data Storage to enhance vCloud Government Services to store and secure this data.

CJIS: vCGS recently underwent a CJIS assessment by CoalFire, Inc. CJIS is not a certification, it is a policy that must be followed and accredited for each deployment which requires it. The goal of VMware’s CoalFire assessment was to create a baseline configuration that can be reused across any CJIS opportunity to accelerate the implementation and accreditation timeframes.

FERPA: Like CJIS, FERPA compliance is assessed and confirmed for each deployment that requires it. VMware’s vCloud Government Service FedRamp certification and others provide evidence that the underlying infrastructure is capable of meeting rigorous information security and availability requirements. VMware will work with Participating Entities to meet FERPA requirements on a task order basis.

PCI Data Security Standards (DSS): Neither vCloud Air nor vCGS are currently PCI certified at this time. VMware will work with Participating Entities to meet PCI requirements on a task order basis.

IRS Publication 1075: Because both IRS 1075 and FedRAMP are based on NIST 800-53, the compliance boundary for IRS 1075 is the same as the FedRAMP authorization. This, vCGS complies with IRS Publication 1075 on the basis that it is FedRAMP certified.

FISMA: vCGS is FISMA Low and Moderate compliant.

SOLICITATION # CH16012
59 NIST 800-53: NIST 800-53 provides the core controls that must be met to achieve FedRAMP compliance. VMware vCloud Government Service has FedRAMP Provisional Authority to Operate issued by the Joint Authorization Board (JAB), thus we are compliant with NIST 800-53.

NIST SP 800-171: VMware vCloud Government Service has FedRAMP Provisional Authority to Operate issued by the Joint Authorization Board (JAB). NIST 800-171 outlines a subset of the NIST 800-53 requirements, and as stated above, VMware vCloud Government Service is compliant with these guidelines. Since NIST 800-171 outlines a subset of the NIST 800-53 requirements, VMware vCloud Government Service is compliant with NIST SP 800-171.

FIPS 200: Neither vCloud Air nor vCGS are currently FIPS 200 certified at this time. VMware will work with Participating Entities to meet PCI requirements on a task order basis.

VMWare AirWatch
The AirWatch Information Security Program is built on the security framework laid out in NIST 800-53.

Although AirWatch is not required to register with any regulatory agencies, we provide a suite of tools for our customer’s to maintain industry-relevant compliance guidelines within their mobile device fleets. AirWatch has recently been awarded the HP-IAPP Privacy Innovation Award for Most Innovative Privacy Technology by the International Association of Privacy Professionals (IAPP) for our commitment to delivering an EMM platform focused on end-user privacy. To help ensure the confidentiality, integrity, and availability of our cloud offering, we comply with the European Data Protection Directive (95/46/EC) and our top-tier data center partners have undergone SSAE16 SOC2 Type II audits.

FireEye Currently the standards that apply are SSAE 16 SOC 2 Type 2, with a FedRAMP ATO in place and full FedRAMP certification in process. We are also in the process of becoming FedRAMP ISO 2700x certified.

VirtueStream Security is the foundation of our business. Virtustream's xStream™ cloud software assists our customers to meet mandatory Legislative requirements, and achieve and maintain SSAE16, ISAE3402, PCI-DSS 3.0, FISMA, IS0 27001-2005/2013, ISO 9001-2008, HIPAA, CSA STAR and other leading cloud certifications and compliance frameworks in the customer's own environment (when coupled with identified operational and management controls).

8.6.3 Offeror must describe its security practices in place to secure data and applications, including threats from outside the service center as well as other customers co-located within the same service center.

CA APM CA technologies understands that security is a top concern when evaluating cloudbased applications, which is why CA technologies operations worldwide conform to rigorous certification, compliance and security programs and processes. In addition, we contract with independent auditors to regularly evaluate and validate the security of our service. High risks are identified, validated and remediated before production systems are made available. Medium risks are evaluated and resolved on a priority basis.

MAA All MAA core servers are behind firewalls; only systems administrators have access to the servers; all data is encrypted when transmitted between data centers. The MAA dashboard and API are protected with HTTPS/TLS encryption, and users are required to authenticate in order to access these.

CA Agile We use a co-located data center provider and within that environment we have a dedicated cage to which only our Operations Team has access. We also monitor all traffic across our systems using HIDS (OSSEC) and NIDS (Snort) to notify of any suspicious activity.

ASM All ASM core servers are behind firewalls; only systems administrators have access to the servers; all data is encrypted when transmitted between data centers. The ASM dashboard and API are protected with HTTPS/TLS encryption, and users are required to use a username and password to login to their accounts.

SOLICITATION # CH16012
60 Google In this DPA the obligations of Google to hold all customer data as confidential and wholly owned by the customer is detailed.

Google’s internal data access processes and policies are designed to prevent unauthorized persons and/or systems from gaining access to systems used to process personal data. Google aims to design its systems to: (i) only allow authorized persons to access data they are authorized to access; and (ii) ensure that personal data cannot be read, copied, altered or removed without authorization during processing, use and after recording. The systems are designed to detect any inappropriate access. Google employs a centralized access management system to control personnel access to production servers, and only provides access to a limited number of authorized personnel. LDAP, Kerberos and a proprietary system utilizing RSA keys are designed to provide Google with secure and flexible access mechanisms. These mechanisms are designed to grant only approved access rights to site hosts, logs, data and configuration information. Google requires the use of unique user IDs, strong passwords; two factor authentication and carefully monitored access lists to minimize the potential for unauthorized account use. The granting or modification of access rights is based on: the authorized personnel’s job responsibilities; job duty requirements necessary to perform authorized tasks; a need to know basis; and must be in accordance with Google’s internal data access policies and training. Approvals are managed by workflow tools that maintain audit records of all changes. Access to systems is logged to create an audit trail for accountability. Where passwords are employed for authentication (e.g., login to workstations), password policies that follow at least industry standard practices are implemented.

These standards include password expiry, restrictions on password reuse and sufficient password strength. For access to extremely sensitive information (e.g., credit card data), Google uses hardware tokens.

AODocs AODocs being built in Google AppEngine and Google Drive.

Virtru Please see the Virtru Security Policies and Procedures and the Virtru Privacy Policies and Procedures provided in the Supplemental Information section of this response.

Salesforce Government Trusted Security and Infrastructure Salesforce understands that the confidentiality, integrity, and availability of our customers’ information are vital to their business operations and our own success. We use a multi-layered approach to protect that key information, constantly monitoring and improving our application, systems, and processes to meet the growing demands and challenges of security.

Independent audits confirm that our security goes far beyond what most companies have been able to achieve on their own. Using the latest firewall protection, intrusion detection systems, and TLS encryption, Salesforce Force.com gives you the peace of mind only a world-class security infrastructure can provide.

Third-party validation
Security is a multidimensional business imperative that demands consideration at multiple levels, from security for applications to physical facilities and network security. In addition to the latest technologies, world-class security requires ongoing adherence to best-practice policies. To ensure this adherence, we continually seek relevant third-party certification, including ISO 27001, the SysTrust audit (the recognized standard for system security), and SSAE 16 SOC 1 audit (an examination and assessment of internal corporate controls, previously known as SAS 70 Type II).

SOC1, SOC2 and SOC3 audits are performed by third party auditor annually at a minimum.

Additional audits and certifications include: CSA ‘Consensus Assessments Initiative’, JIPDC (Japan Privacy Seal), Tuv (Germany Privacy Mark), and TRUSTe.

Protection at the application level

SOLICITATION # CH16012
61 Salesforce protects customer data by ensuring that only authorized users can access it.

Administrators assign data security rules that determine which data users can access. Sharing models define company-wide defaults and data access based on a role hierarchy. All data is encrypted in transfer. All access is governed by strict password security policies. All passwords are stored in SHA 256 one-way hash format. Applications are continually monitored for security violation attempts.

Protection at the facilities level
Salesforce security standards are stringent and designed with demanding customers in mind, including the world’s most security-conscious financial institutions. Authorized personnel must pass through five levels of biometric scanning to reach the Salesforce system cages. All buildings are completely anonymous, with bullet-resistant exterior walls and embassy-grade concrete posts and planters around the perimeter. All exterior entrances feature silent alarm systems that notify law enforcement in the event of suspicion or intrusion. Data is backed up to disk or tape. These backups provide a second level of physical protection. Neither disks nor tapes ever leave the data center.

Protection at the network level
Multilevel security products from leading security vendors and proven security practices ensure network security. To prevent malicious attacks through unmonitored ports, external firewalls allow only http and https traffic on ports 80 and 443, along with ICMP traffic. Switches ensure that the network complies with the RFC 1918 standard, and address translation technologies further enhance network security. IDS sensors protect all network segments. Internal software systems are protected by two-factor authentication, along with the extensive use of technology that controls points of entry. All networks are certified through third-party vulnerability assessment programs.

Secure Data Centers
Data centers provide only power, environmental controls, and physical security. Salesforce employees manage all other aspects of the service at the data centers. Colocation data center personnel do not have network or logon access to the Salesforce systems. Colocation personnel have physical access to the
Salesforce secure server room in the event of an emergency, but do not have keys to the individual racks containing hardware. Data centers maintain a common baseline of physical and environmental controls across data centers.

The exterior perimeter of each anonymous data center building is bullet resistant, has concrete vehicle barriers, closed-circuit television coverage, alarm systems, and manned 24/7 guard stations that together help defend against non-entrance attack points. Inside each building, multiple biometric scans and guards limit access through interior doors and to the Salesforce secure rooms at all times.

Access to Salesforce’s secure server rooms in the datacenter is authorized based on position or role. Additional access controls enforced by an electronic key box are implemented for the dedicated Salesforce Government Cloud racks to ensure that access is limited to Qualified U.S.

Citizens. Salesforce has an established process to review data center access logs to the server room. Additionally, an at
least annual assessment of the data center is performed to ensure the data centers are meeting Salesforce’s security control requirements.

In addition to securing the data center locations, it is critical that the data center facilities maintain robust critical infrastructure to support Salesforce through the following services:

SOLICITATION # CH16012
62 Temperature and Humidity Controls
• Humidity and temperature control
• Redundant (N+1) cooling system
Power
• Underground utility power feed
• Redundant (N+1) CPS/UPS systems
• Redundant power distribution units (PDUs)
• Redundant (N+1) diesel generators with on-site diesel fuel storage Secure Network Logistics
• Concrete vaults for fiber entry
• Redundant internal networks
• Network neutral; connects to all major carriers and located near major Internet hubs • High bandwidth capacity
Fire Detection and Suppression
• VESDA (very early smoke detection apparatus)
• Dual-alarmed, dual-interlock, multi-zone, pre-action dry pipe water-based fire suppression ServiceNow The ServiceNow cloud is built for the enterprise customer with every aspect aimed towards meeting the customer’s demand for reliability, availability and security. ServiceNow’s comprehensive approach to address this demand is enabled by the following: (a) ServiceNow’s robust cloud infrastructure runs on its own applications and utilizes industry best-of-breed technology to automate mission critical functionalities in the cloud service with around-the-clock and around-the-world delivery; (b) ServiceNow achieves flexibility and control in its ability to deliver a stable user experience to the customer by having a logical single tenant architecture; (c) ServiceNow’s application development which has a paramount focus on quality, security, and the user experience is closely connected to the operations of delivering those applications in a reliable and secure cloud environment; (d) ServiceNow invests in a comprehensive compliance strategy that allows its customers to attain their own compliance to applicable laws by obtaining attestations and certifications and running its subscription service from paired data centers situated close to where its customers are located; and (e) ServiceNow’s homogeneous environment where all applications are on a single platform offers ServiceNow a competitive advantage in being able to concentrate its efforts to make the customer’s user experience the best possible.

The “Data Security Guide” contained within the “Subscription Service Guide” included with this response describes the measures ServiceNow takes to protect Customer Data when it resides in the ServiceNow cloud.

QTS The QTS Information System Security Officer (ISSO) develops, disseminates, annually reviews and updates a formal, documented access control policy; System and Communications Protection and addresses the following:
•Purpose and scope
•Roles, responsibilities
•Compliance
QTS develops, disseminates, and annually reviews/updates a formal, documented security policy executive summary, SP Executive Summary - Information System Security Program Policies, which addresses:
•management commitment
•coordination among customer entities

SOLICITATION # CH16012
63 QTS cloud’s Policies are maintained within a biometric secure office located in the Suwanee facility at 300 Satellite Blvd, Suwanee, GA 30024. It is disseminated to all individuals, including but not limited to employees, contractors, consultants, temporaries, and other personnel affiliated with third parties, who use any QTS Information Resource that is owned or leased by QTS. This policy is consistent with QTS’s mission and functions and with applicable laws, directives, policies, regulations, standards, and guidance.

The previously mentioned artifacts are disseminated via a centralized secure document repository among all QTS cloud’s personnel who have any service operations or service delivery role for QTS cloud’s IaaS offerings system environments, and is to be individually or by group reviewed semi-annually, especially by any personnel who have administrative access.

QTS can provide its Information Security Policies as required:
• IT_POL_03_System_and_Communications_Protection_Policy (v1.2 – 1/17/14) SAP Ariba We are committed to the security and integrity of customer information. We utilize security measures to protect against the loss, misuse or alteration of the information under our control. To prevent unauthorized access, maintain data accuracy, and facilitate the correct use of information, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect within the solution.

Fieldglass Please see the Fieldglass Security and Hosting Overview provided in the Supplemental Information section of this response.

Hanna Communication between data centers is via VPN or MPLS; VPN is encrypted by default and MPLS can be encrypted as well.

Internet facing customer systems are protected by perimeter protection systems using technologies such as web application firewall (WAF) or intrusion prevention systems (IPS). Perimeter protection systems operate by monitoring traffic and blocking attaches towards SAP HANA Enterprise Cloud customer systems.

Hybris Both IDS and IPS are included the SAP Hybris Commerce, Cloud Edition The security infrastructure includes firewall security and hardened security policies on all servers. Log management procedures are in-place for log review for firewall, applications, network devices, including file-integrity management. SAP Hybris utilizes technologies from leading security firms for Log Management and File Integrity Management. SAP Hybris employs twofactor authentication across its network. SAP Hybris undergoes vulnerability and penetration testing. SAP Hybris validates against requirements for PCI DSS 2.0.

The infrastructure also includes Web Application Firewalls and DDoS Mitigation Services.

In addition, security policies and change management policies are in-place ensuring that all access and changes to customer systems and information is accessible only by SAP Hybris staff with access authorization.

Security of the software application which is controlled by the Customer (or its implementation partner) remains the responsibility of the Customer.

SuccessFactors Technologies and measures used to help protect the security of customer data include:

Redundant firewalls in a dedicated environment
Network intrusion detection to help guard against attacks by monitoring all data center traffic around-the-clock and notifying operations and security teams in the event of an imminent threat
Vulnerability scanning to proactively test internet-connected web servers by searching for weaknesses in the same way that a hacker would

SOLICITATION # CH16012
64 Penetration testing at least annually
Security teams monitoring the infrastructure 24x7x365
Any security issues discovered are reported in real time to information security staff and IT management, entered into our ticketing system for follow-up investigation, and tracked to resolution. All actions taken to resolve the problem are documented, allowing all problems to be tracked to completion.

We provide application level memory separation between each client instance as well as data level segmentation and separation with each customer's data residing in its own schema and table space at the database tier. The database tier provides isolation and security of data, and the use of application clustering provides availability, reliability and scalability.

Each customer’s data is maintained in a separate database schema with its own discrete set of tables, facilitating a high degree of data isolation thus preventing potential for data segmentation breaches
Flexibility to backup individual customer table spaces without affecting adjacent customers
Each schema has separate authentication credentials and assigned resource profile to restrict access rights and resource consumption VMware The VMWare Approach to Compliance
Many organizations have initiatives to virtualize their Information Technology (IT) infrastructure, or to move to a Cloud Computing model. However, these initiatives are often complicated by the increasing number of regulatory compliance requirements, which require protection of data such as PCI, HIPAA, FISMA, DIACAP, FedRAMP, GLBA, and other State and Federal requirements.

Organizations are increasingly concerned with the complexity, risk, and impact that a new technology can bring to their existing environments.

VMware addresses these challenges by establishing a Compliance Reference Architecture Framework (RAF) that provides a consistent method for VMware, its partners, and customers to assess and evaluate the impact of regulations on virtual and cloud environments. The intent of the RAF is to provide a single framework for VMware, its partners, and organizations to address a variety of compliance requirements across an IT infrastructure.

We designed our security architecture using a defense-in-depth approach to implement multiple layers of security throughout the SaaS environment and to mitigate any potential attacks through multiple safeguards, including:
• Access control mechanisms, firewalls, anti-virus/malware software, auditing mechanisms, network controls, maintaining defined configuration settings, etc.

We perform regular internal scans to assess the vulnerability of our internal network.

FireEye All data is stored within locked and monitored cages in secure data centers. Customer data is restricted to a need to know basis. Data is logically tagged and virtually segregated in our cloud services. Access is managed and only given to those with need to know including internal employees and customers.

VirtueStream All data for this environment will remain in the United States. Customers can elect Intel's TxT technology to demonstrate geo-fencing of data to specific data centers.

Virtustream data centers are physically accessible by designated employees and approved employees only. Virtustream employees who are assigned to the data center are issued a proximity card which is required to access the data center. Once inside, physical access to the data processing areas is further restricted to specific employees. Physical access to the data processing areas is protected by biometric locks on the doors. Data center personnel maintain a list of all approved personnel who have access to the data center offices and who have access to the data processing areas.

Virtustream offers security solutions which customers can select to protect their data while in transit and at rest. Customers are responsible for the protection of their data within their customer

SOLICITATION # CH16012
65 zone. Virtustream does not process, store, or disseminate customer data within the Virtustreamcontrolled management zone.

Virtustream invokes a defense-in-depth model for monitoring the management zone with tools such as Splunk, Trend Micro, Fortinet, and Tenable. These tools are available for customers to select as a managed service.

8.6.4 Offeror must describe its data confidentiality standards and practices that are in place to ensure data confidentiality. This must include not only prevention of exposure to unauthorized personnel, but also managing and reviewing access that administrators have to stored data. Include information on your hardware policies (laptops, mobile etc).

CA APM All personnel with access to client data undergo annual, mandatory security training and are covered under the CA Technologies NDA. Violations of security policies are grounds for termination. All access to data and other resources used to deliver the service are granted under the least principle.

MAA Customer accounts are password protected, and users can only access their data in their accounts. System administrators have access to MAA servers, and database administrators have access to database servers. Account access is reviewed periodically.

CA Agile All customer data is treated as confidental and as a policy we do not access customer data without explicit written consent. Access to systems containing customer data is restricted to our Operations Team according to our Elevated Permissions Policy.

ASM Customer accounts are password protected, and users can only access their data in their accounts. System administrators have access to ASM servers, and database administrators have access to database servers. Account access is reviewed periodically. All data on CA laptops are encrypted and a PIN is required to boot.

AODocs The data stored in Google AppEngine are backed up every day.

The application is hosted on Google Cloud Platform infrastructure and benefits from the network security.

Virtru See 'Virtru Security Policies and Procedures' and 'Virtru Privacy Policies and Procedures' Salesforce Logical Access Control
Salesforce provides contractual assurance to its customers that the data hosted in the Salesforce Services will be kept confidential and not accessed except under narrow circumstances (such as a support issue) and only for a set amount of time chosen by customer. In such circumstances, we will access your org only with prior approval and subject to a Non-Disclosure Agreement (NDA).

To protect against access through the application, Salesforce employees don't have access at the application level for any customers, unless the customer grants access through the “login as” feature.

Access to the production environment infrastructure is restricted to a very limited number of fulltime Salesforce employees required to manage the service. Salesforce's Technical Operations team and Release Managers have logical access to servers. These employees must authenticate to the production environment via a secure server (Secure Global Desktop) using 2 points of RSA two-factor authentication. This tool provides pixel data only to these administrators. Systems access is role-based and controlled and logged. DBAs do not have login access to customer's instances (org) and do not see customer data in an assembled manner. They manage the system in aggregate-performance tuning, allocating space, building indices, etc. The Oracle tables and rows in our infrastructure do not reflect the view of a single customer instance (org) since we are multi-tenant and the data is spread across multiple disk arrays.

SOLICITATION # CH16012
66 Database administrator account activity is logged. These logs are sent to the security information and event management (SIEM) system. These database activities logs are reviewed for appropriateness by the Computer Security Incident Response Team (CSIRT) team on a regular basis. This log data is also available as a forensic audit trail to support CSIRT during incident investigations.

A customer's instance (org) of Salesforce is an aggregate of the raw data. The data model is very complicated, normalized, and the rows are identified by base62 encoded keys (primary and foreign). Re-establishing data ownership and a business context for the data would be very difficult to do at the database level. In order to reassemble any given customer's application (org), someone would need access to our source code in order to reassemble the raw data in a manner that could be interpreted and understood, and would need the entire set of tapes or disks/arrays supporting a given Instance, as the data for any one customer is spread across several tapes/disks. Data center engineers with physical access to the servers do not have logical access to the production environment and administrators with logical access to the systems do not have physical access to the data centers.

ServiceNow ServiceNow applies the same data classification for all hosted customer data. ServiceNow does not inspect or monitor its customers’ information and therefore has no ability to sub-classify customer data. The overriding requirement of the assigned classification is that customer data remains hosted in the private cloud until the customer terminates their subscription. It is never stored anywhere apart from the private cloud.

Customers remain the data owner and data controller for all data placed into their instance.

ServiceNow does not examine, inspect, monitor or analyze customers’ data.

Customers apply access controls to restrict access to data within their instances based on their own requirements and needs, including their own data classification.

QTS The customer will be assigned one or more Org Administrators. All users will be configured with RSA AD two-factor Risk Based authentication as a requirement for cloud portal access.

SAP Ariba We participate in the following national and international standards committees:

WebTrust: (2001 - current) The Security, Availability, Processing Integrity and Confidentiality of our applications are based on the Trust Services Principles now incorporated into the SSAE16/ISAE 3000 SOC 2 standards SSAE16: (formerly SAS 70) certification: (Since 2011)
ISAE 3402: (The International Standard on Assurance Engagements since 2014) every six months we undergo a rigorous ISAE 3402 audit by independent auditor PricewaterhouseCoopers (PwC)
Payment Card Industry (PCI) Data Security Standard (DSS): (Since 2008) we have adopted and adhere to the PCI-DSS). PCI certification and compliance with the Visa USA Cardholder Information Security Program (CISP) and MasterCard Site Data Protection (SDP) program
Safe Harbor: (Since 2007) Current on the Safe Harbor list for ""Online Data"" for the ASN and Cloud Solutions/Services
A firewall separates the Ariba corporate network from Ariba infrastructure computers. Therefore, unauthorized Ariba employees cannot access Ariba data from the Ariba corporate network infrastructure. Access is limited to specific roles or functions within Ariba Operations. Additionally, access is managed on an “exception” basis whereby personnel need clearance to be