1.2.1_70FA3125I00000015_Cloud Hosting RFI.docx

Federal Emergency Management Agency (FEMA) Office of the Chief Information Officer (OCIO) Request for Information (RFI) 70FA3125I00000015 09/21/2025

REQUEST FOR INFORMATION (RFI) SUMMARY: The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Office of the Chief Information Officer (OCIO) requires FedRAMP certified, true On-Demand commercial Cloud Service Providers (CSPs) for our Commercial Cloud Hosting Services (CCHS). This includes Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), and Cloud Brokerage Services.

GENERAL INFORMATION: This RFI is issued solely for information gathering purposes to identify sources that can provide support for the OCIO. In accordance with FAR 15.201(e), RFIs may be used when the Government wants to obtain price, delivery, other market information, and capabilities for planning purposes. Responses to these RFIs are not offers and cannot be accepted by the Government to form a binding contract. This RFI shall not be construed as a commitment by the Government for any purpose, nor does it restrict the Government to an ultimate acquisition approach. Respondents are solely responsible for all expenses associated with their RFI response. Respondents will not receive additional information in response to their submittal to the RFI and will not be notified of the resulting market research.

PROPRIETARY INFORMATION AND DISCLAIMERS: Respondents shall identify any proprietary information in its RFI response. Information submitted in response to this RFI will be used at the discretion of the Government. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts. FEMA reserves the right to utilize any non-proprietary technical information in the anticipated PWS or solicitation.

Although it is not necessary to address in their response, respondents shall be aware of any potential, actual, or perceived organizational conflicts of interests. Any real or potential conflicts must be sufficiently mitigated prior to a contract award. For further guidance, refer to the Federal Acquisition Regulation, Part 9.5.

NAICS CODE: 518210, Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

PRODUCT SERVICE CODE (PSC): DC10

ANTICIPATED PERIOD OF PERFORMANCE START DATE: February 27, 2026

ANTICIPATED ACQUISITION STRATEGY: Single Award Blanket Purchase Agreement (BPA) utilizing General Schedule Administration (GSA) Multiple Award Schedule (MAS)

ATTACHMENT: FEMA Cloud Hosting BPA SOW

RFI RESPONSE SUBMITTAL INSTRUCTIONS: Interested contractors shall submit their RFI responses electronically to Ross Wakeman at ross.wakeman@fema.dhs.gov no later than 3:00PM Eastern Time (ET), 10/20/2025. Questions regarding this RFI are due no later than 3:00PM Eastern Time (ET), 10/06/2025. No phone calls will be accepted regarding this RFI.

“VENDOR NAME_RFI Response for FEMA OCIO’s Cloud Hosting BPA” shall be the subject line of your e-mail. All responses shall be unclassified, with proprietary information clearly marked. The document format shall be either Microsoft Word (.doc or .docx), or Adobe Acrobat (.pdf) formats. Pages shall be 8.5 by 11 inch and shall use a type pitch that is no smaller than a standard 11-point font type, with the exception of charts, graphs, or tables, which shall use a pitch not smaller than 10-point font. Responses shall not exceed (page limit) pages in length including images, data displays, charts, graphs, and tables. Page limitation does not include: 1 cover page. Do not include promotional materials.

RFI Responses shall include the following information in the order below:

6. GSA Schedule Number, Contract Number, and Period of Performance and/or DHS Strategic Sourcing Vehicle Category Name and Contract Number, if applicable

C. Contractor RFI Responses to questions (No more than three pages in length)

The responses received will assist FEMA with identifying the number and nature of the entities that consider themselves potential technical solution providers. Each respondent, by submitting a response, agrees that any cost incurred in response to this RFI, or in support of activities associated with this RFI, shall be the sole responsibility of the respondent. FEMA shall incur no obligations or liabilities whatsoever, to anyone, for any costs or expenses incurred by the respondent in responding to this RFI.

REQUEST FOR INFORMATION (RFI) QUESTIONS

1.0 Cloud Service Providers

FEMA’s Office of the Chief Information Officer (OCIO) conducts major IT program reviews for customers to assess mission critical impacts and changes in the FEMA strategic direction the organization collects, manages, stores, controls and monitors its customers’ data to ensure integrity and protection. FEMA, through Mission Support, OCIO, and in collaboration with Directorates and Regions, established requirements for utilizing cloud computing that aligns with current industry and Federal practices.

FEMA’s OCIO intends to leverage a General Support Solution that should enable an enterprise approach to manage its growing portfolio of cloud-based systems using Infrastructure as a service (IaaS) and Platform as a service (PaaS), In addition, FedRAMP JAB Full-ATO at the High Impact Level for IaaS and PaaS.

1.1. Can one vendor offer PAAS and IAAS from the following cloud service providers:

Amazon Web Services (AWS), Microsoft Azure, Oracle Cloud Infrastructure (OCI), and Google Workspace?

1.2. Can one firm provide all four cloud service provider offerings and if not, how would each IAAS or PAAS be provided?

1.3. Can one contract provide a catalog that includes the multiple IAAS, PAAS, and any additional software as a service (SAAS) offering?

1.4. Once a firm receives a contract, how would the firm process and provide invoices?

1.5. Would FEMA OCIO have to provide usage or some other form of data to the firm or would the firm provide a system where FEMA OCIO could enter the data required for invoices?

1.6. Does a firm provide an invoicing system that uses BOTS or artificial intelligence to automate invoicing?

1.7. What dashboards or data collection systems are offered to store and share usage data and optimize cloud start up, terminations, and other management?

2.0 Capabilities

FEMA OCIO desires the following Capabilities and requests information about them:

2.1. Automation: Tools and processes for automated cost allocation, anomaly detection, and reporting.

2.1.1. What tool or tools would be used to allocate costs from multiple cloud service providers among funding from a few FEMA offices and regions?

2.1.2. Are their best practices to suggest from other Government agencies?

2.2. Analytics: Predictive and prescriptive analytics for forecasting cloud spend and identifying optimization opportunities.

2.2. What tool or tools and best practices might be used to analyze data across FEMA cloud usage and financials?

2.3. Integration: Solutions for seamless integration of financial operations (FinOps) practices with existing financial systems and information technology (IT) workflows.

2.4. FEMA currently uses the Cloud BPA financial tools to track usage and provide data. What systems might be utilized to track usage, review requests for cloud services, and other data systems?

2.5. Auditing and Observability: Continuous Improvements and recommendations on current system inventory, provided guidelines for optimization, right sizing, scaling, and lower system costed.

2.5.1. What auditing services can be provided?

3.0 Cost Management and Pricing Transparency

3.1. What pricing models do you support (e.g., pay-as-you-go, reserved instances, enterprise discounts), and how do you ensure cost transparency across multiple providers?

3.2. Do you provide consolidated billing, cost optimization tools, and proactive alerts for budget thresholds under the BPA?

4.0 Integration, Support, and Lifecycle Management

4.1. What capabilities do you provide for onboarding, integration, and lifecycle management of cloud services (e.g., provisioning, orchestration, decommissioning)?

4.2 What levels of support (Tier 1, Tier 2, Tier 3) are included, and how do you escalate issues between your brokerage and the underlying cloud providers?