A14_MR_Questions_and_Answers_-_AI_Vendor_Responses_per_RFI_(1)_2.pdf

Category Question Answer

1 Incumbent Contract Information Are there current contracts and contractors performing any of these tasks? If so, what are the contractor names and contract numbers? No, we currently do not have any contracts or contractors performing these tasks.

2 Architecture & Mainframe Environment What specific mainframe platforms and programming environments are currently in use (e.g., z/OS, ADABAS/Natural, COBOL versions)? Most specifically, ADABAS/Natural, JCL

3 Architecture & Mainframe Environment What enterprise scheduler is used for batch orchestration, and how are job dependencies and execution comparisons currently managed? Control M and Control O

4 Architecture & Mainframe Environment Is the governent expecting to convert and migrate mainframe applications to cloud platforms? Possibly, although we have not arrived there yet. It has been in discussions.

5 Payroll Operational Constraints What is the payroll processing frequency and peak processing window?

Bi-weekly processing. Peak processing is within 4th quarter of calendar year and most likely due to year-end processing.

6 Payroll Operational Constraints May AI-enabled capabilities participate in controlled execution workflows under defined safeguards?

In some areas, possibly. We would want to ensure security and privacy standards are honored and held intact.

7 Data & Database Management What database platforms support payroll and personnel systems, and how is schema or configuration change management handled across environments? Database platforms which support our payroll/personnel systems include

8 Data & Database Management What are the approximate database sizes and daily transaction volumes supporting payroll and personnel operations? Database size approx. 35 TB, daily transactions approx. 1.2 Million/ 4.8 million per week

9 Data & Database Management Can you clarify the intended meaning of 'ability to scan various LLMs (large language models) in its entirety' under the Analyze Code and Infrastructures objective?

Because our codebase is fairly extensive and nearly 30 years old, we would like for the tool to assist with identifyng specific areas in the code. Example, timeframes when code was modified or seek bugs within the code. Is there potential to translate the code to a different langauge base?

10 AI Model Usage & Data Sensitivity Must AI capabilities operate exclusively within DOI-controlled infrastructure?

For our payroll/personnel system, yes that is the preference. Pertaining to sub and supporting systems which do not contain PII data, we may have flexibility.

11 AI Model Usage & Data Sensitivity Are probabilistic AI outputs expected to be limited to analytical and advisory use cases, or may they support operational workflows under defined governance and audit controls? The output will likely support defined operational work flows.

12 AI Model Usage & Data Sensitivity Will the AI solution need to process, access, or be trained on data containing PII? If so, are there data residency or data handling requirements beyond FedRAMP alignment?

Yes, data may contain PII. This may also involve standards outlined by FISMA, NIST 800-53 (for authentication), Privacy Act of 1974, Zero Trust Alignment

13 Integration Architecture Are integrations with external partners (e.g., OPM, IRS, SSPs) primarily file-based, API-based, message-queue based, or hybrid? External integrations are primarily file based.

14 Integration Architecture Are integrations strictly batch-driven, or are near real-time capabilities required in certain domains? Primarily Batch-driven via transmission files.

15 Security & Compliance Does IBC-HRD require an existing FedRAMP Authorization at a specific baseline, or will a Government-owned, Contractor-operated deployment aligned to the applicable NIST 800-53 baseline within DOI’s security boundary be acceptable? If the application will be cloud based, FedRAMP will be required.

16 Security & Compliance What logging, auditability, and retention requirements apply to AI-generated outputs and automation workflows? Audit requirements would be focused on our primary systems and not on AI output.

17 Scalability & Resilience What peak concurrency and throughput expectations should proposed AI-enabled solutions be architected to support? Unknown at this time

18 Scalability & Resilience What Recovery Time Objective (RTO) and Recovery Point Objective (RPO) thresholds must be met for AI-enabled systems operating in payroll-supporting environments? 24 hour RTO/RPO

19 Scalability & Resilience Of the 300,000+ employees serviced by HRD systems, how many concurrent users are anticipated for the AI-enabled tools and applications? Are usage patterns expected to be steady-state or concentrated around payroll cycles and peak processing windows? HRD PERS #

20 Governance & Oversight Is there an established AI governance framework that proposed tools must align with? YES - DOI (OCIO) POLICY AND MEMORANDUMS. USG (??)

21 Governance & Oversight Which mission-critical workflows require mandatory human review or approval before production execution?

Medium and High Risk enhancments/features/capabilities require System Owner approvals before migration/deployment into production environments.

22 Testing & Modular Architecture Does IBC-HRD require the proposed AI tool to natively provide automated testing capabilities, or will integrated testing automation delivered through complementary enterprise platforms be considered acceptable? Hybrid - depending on Testing being completed (Role based)

23 Strategic Alignment & Implementation Does IBC-HRD anticipate prioritizing specific capability domains for initial implementation phases? To be determined

24 Strategic Alignment & Implementation Which of the listed objectives represent the greatest operational risk or resource burden within the current HRD environment? refer back to RFI objetctives (mainframe)

25 Strategic Alignment & Implementation Is the primary intent to enhance the existing mainframe-centric architecture, or to support longer-term modernization initiatives?

Initial intent would be support for existing systems/architecture. Long term support will likely be for modernization initiatives

26 Strategic Alignment & Implementation What measurable performance improvements will define success for AI-enabled automation? Efficiencies in processes for reduces labor force.

27 Strategic Alignment & Implementation Will AI-enabled customer service capabilities support internal HRD staff only, or external federal employees serviced by HRD?

Currently it will support HRD staff only but could support cutstomer service processes for IBC customers as well.

28 Submission Clarification Given the 7-page maximum for Section 2 and the breadth of objectives listed, should vendors address all objectives at a summary level or prioritize a subset in greater depth? Vendor's discretion

Scope of Solution Integration

Does HRD anticipate a single integrated AI platform addressing all listed domains (testing automation, batch processing, database management, code analysis, documentation, customer service automation, etc.), or are modular, multi‑vendor solutions acceptable if they meet interoperability and security requirements?

No, open to options. All options must meet FEDRAMP specifications/certifications.

Clarification on “LLM Scanning”

The RFI references the ability to “scan various LLMs in its entirety.” Can HRD clarify whether this refers to scanning large language models, legacy language modules, or both? Both

Non‑Multi‑Tenant Requirement

For the requirement that the AI tool “will not be a multi tenant environment for users outside of IBC HRD,” is a logically isolated single tenant environment within a FedRAMP authorized boundary acceptable, or is physical isolation required? FedRamp authorized boundary

FedRAMP Alignment vs. Authorization

The RFI states that solutions must “align with FedRAMP controls.” Is FedRAMP authorization required at this stage, or is alignment with the controls sufficient for RFI purposes? Controls must be going through FedRamp authorization process; or already approved.

Availability of Sample Artifacts

Will HRD provide sample JCL, anonymized payroll scenarios, or representative data structures to help vendors accurately scope automation capabilities? Samples maybe provided during Technical Evaluation period.

Integration Expectations with Federal Partner

For integrations with OPM, IRS, SSPs, AQD, FMD, and OMB, should vendors assume real‑time interoperability, batch‑based exchanges, or both? Both

ROM Pricing Granularity

Does HRD prefer ROM pricing broken out by major capability area (e.g., testing automation, database automation, payroll automation), or at the overall solution level? Yes- broken out by major capability area.

Vendor One‑on‑One Sessions

If HRD conducts one‑on‑one sessions, will vendors be notified in advance of the specific capabilities or focus areas HRD wishes to review?

Some focal points will be provided but a high level overview of application capabilities will be appreciated.

37 Is there a timeline and/or milestone for mainframe modernization (components) to cloud infrastructure?

To be determined

38 Is a hybrid cloud deployment model part of the mainframe modernization strategy?" To be determined 39 What is the current operating system and version for the mainframe? ZOS 2.5 (3.2 scheduled for migration this FY) 40 If legacy, are you willing to upgrade to the latest mainframe operating system? Yes 41 What is the current mainframe database and version? ADABAS 8.6

42 What are the data native formats, record formats, and compatibility requirements for running data preprocessing for machine learning on the mainframe? EBCDIC

43 If data moves off mainframe, are there requirements in how data quality, privacy, and security shall be managed? Yes, must meet NIST requirements

44 What are the different mainframe tools/software components being used for the DB query, transaction processing, configuration management, workload, file, security access, etc. No specific tools

45 Are there interests to expand to Quantum? Would be interested to learn more about 46 What does success look like? What are the specific business objectives and desired results? See RFI 47 Is real-time data actions needed or will batch processing suffice majority of the requirements? Both

Are you prioritizing on-platform inference (mainframe-centric) running machine learning directly on the mainframe for the Online/Production jobs or can offloading to a cloud/hybrid environment (using AWS/Azure/GCP) be consider? Open to options or consideration

For the Customer Service Ticket Generation objectives (customer service workflow), do you consider this sub system complement as ancillary in support of the mainframe. Example, support system (e.g. like ServiceNow)? Verse this is on-platform sub system mainframe feature running inside the mainframe.

Ancillary support system (ie. ServiceNow)

50 For the Self Help Feature objectives in support of customer service do you consider these ancillary in support or also seeking support that require features to be on-platform running inside the mainframe.

Ancillary 51 Please provide number of end users and administrators in related to training. Range up to 175 personnel. Depends upon Application / Mainframe 52 Is there a page limit, font requirement for the Rough Order of Magnitude in Section 3? 2 pages limit

“IBC’s Human Resources Directorate seeks information from industry on AI tools and applications capable of securely supporting… across the full systems software development lifecycle…”

To take full advantage of best‑in‑class AI capabilities, does IBC‑HRD consider a combination of complementary AI platforms and tools—working together within a cohesive, secure architecture—to be responsive, rather than requiring a single, monolithic AI platform? Combination.

54 “Mainframe‑centric, payroll‑focused, PII‑regulated environment…” Should vendors assume direct integration with the existing mainframe payroll environment? Yes

“Additional areas of interest include AI‑enabled code and infrastructure analysis and refactoring (mainframe module assessment, call‑routine mapping, bug identification, historical change analysis, and LLM‑based scanning)…”

Does DOI IBC envision the future of FPPS as a modernization of the existing mainframe platform (e.g., incremental enhancement and refactoring), a partial refactor with selective component replacement, or a full system replacement? Please describe the desired end‑state and planning horizon, if defined. To be determined

Analyze code and infrastructures – Ability to scan various LLMs (large language models) in its entirety

Can HRD clarify the intent of "ability to scan various LLMs in its entirety"? Is this referring to evaluating LLM outputs for accuracy, bias, and security, or describing the use of LLMs to scan HRD’s codebase? Intent is for both

“IBC Policies and Security – FedRAMP-aligned controls”

To take full advantage of emerging commercial products and technologies, does IBC‑HRD consider phased FedRAMP authorization approaches—such as government sponsorship, interim deployment models, or limited‑scope authorizations—acceptable for solutions that are not yet fully FedRAMP authorized? Yes

58 Please limit your response to each business requirement to 2 pages... (7-page maximum)

To accommodate vendors with multiple relevant solutions, would the government revise this requirement to a 10-page overall limit for section 2, with no limit per individual requirement? No - prioritize recommended solution

59 “IBC‑HRD welcomes a wide range of submission formats…”

Are architecture diagrams, workflow visuals, screenshots, or process flows counted toward the seven‑page limit, or may they be included as embedded graphics or appendices? May be included as embedded graphics or appendicies

60 Creative Pricing Expectations Is there a ceiling or budget range HRD can share for planning purposes? To be determined

Are there specific performance metrics or KPIs that HRD will use to evaluate the effectiveness of AI tools?

Policy and expectations are being provided by DOI/OCIO and internally to IBC

What are the performance and scalability requirements for AI tools (e.g. concurrent batch jobs, throughput)?

Unknown at this time

Could you provide more detail on the types of external systems and integration points that AI solutions must support and any associated security or compliance constraints? Ticketing, Time & Attendance, workforce tracking, learning management, data warehouse, change management systems must all maintain standards outlined by FISMA, NIST 800-53 (for authentication), Privacy Act of 1974, Zero Trust Alignment

Can you confirm any constraints on AI model training or inference with PII data, including restrictions on what artifacts or training materials the AI is permitted to access? Must be FedRamp or going through Fedramp approvals/certification

What CI/CD processes do you currently have, what is the maturity level, and where are the key capability gaps? No processes currently CI/CD

Can the government provide a technical systems architecture diagram of the integrated personnel/payroll system and its supporting sub systems? Not at this time

Can the government provide a network topology diagram, including existing cloud connections (if any)?

Not at this time

Can the government provide an inventory of the integrated personnel/payroll system and its subsystems, and confirm whether existing external system agreements allow AI interaction and require AI to reconcile or map data across partners like OPM, IRS, SSA, SSPs, FMD, and AQD? DOI and OCIO have provided policy and guidance

Is there a SIEM/SOAR solution with centralized security logs and responses?

No 70 What is HRD’s preferred timeline for AI solution implementation and deployment? To be determined

What system documentation and training materials currently exist and at what levels (code, system, business processes)? Internal to HRD and ranges between working groups dependent on roles/duties

What existing software, processes, and approach do you use for Cross platform compatibility? Are there preferred orchestration tools (Control‑M, CA7, Jenkins, GitLab, Azure DevOps)? Control-M/JCL/Interface Files

What existing software, processes, and approach do you use for Testing/automated testing, if anything? Are there preferred orchestration tools (Control‑M, CA7, Jenkins, GitLab, Azure DevOps)?

Currently, no automated testing 74 How do you currently do job batch processing (Automated job run and compares) today? Automated and manual.

What existing software, processes, and approach do you use for analyzing code and infrastructures, if anything? Are there preferred orchestration tools? Mostly manually conducted and stored internally

What existing software, processes, and approach do you use for system documentation and training materials, if anything? Are there preferred tools? Mostly manually conducted and stored internally

What existing software, processes, and approach do you use for data analysis reports among systems, if any?

Are there preferred tools? Mostly manually conducted and stored internally

What existing software, processes, and approach do you use for Self Help Features, if any? Are there preferred tools?

None exist currently, only internal job aids are produced from one area to the next nor are maintained

To what extent does HRD expect AI tools to automate business‑rule‑aware validation for W‑2, ACA, locality pay, retroactive pay logic, and other HRD‑specific calculations? Automated for compare versions per prompts

Section 2 – HRD AI Tools and Automations Requirements of the RFI lists access to sandbox environment for hands-on exploration that can include guided demo sessions, sample data sets, or interactive tutorials. For realistic demo sessions, will HRD provide sample, historical, or synthetic partner files for development and testing?

Upon direct market research and or pilot sessions, this is possible and To be determined how in depth or to what quantity

One of DOI IBC-HRD's objectives is "Create system documentation.. .". For what functions should new documentation be generated (i.e., code documentation, system technical designs, business processes), and what formats are preferred (DITA, XML, PDF, Word, Confluence)? Any and all - To be determined and discussed internally and with vendor

Must all AI components run inside a non‑multi‑tenant, FedRAMP High or Moderate-aligned environment?

Must be FedRamp or going through Fedramp approvals/certification

What processes and software are used for capturing service tickets? ServiceNow - ticekts generated by HRD staff, customer clients, and customer service

Tier 1

What is the current ticketing/service management system and its integration requirements? ServiceNow - no current integration developed and maintained outside of mainframe or other sub systems 85 Does HRD have well documented data catalogs for AI analysis of databases? Yes but mostly conducted manually and stored internally

What are HRD’s rules for AI access to production PII data, and what data access models are approved (e.g., direct, anonymized, synthetic)? To be determined

Is a Privacy Impact Assessment (PIA) required for AI tools that access or process PII? Must maintain and adhere to standards outlined by FISMA, NIST 800-53

(for authentication), Privacy Act of 1974, Zero Trust Alignment 88 What de‑identification or masking tools does HRD currently support for PII? Internally conducted

What audit logging, monitoring, and interpretability standards must AI follow (including SIEM/SOAR integration)? To be determined

90 What data residency or sovereignty constraints apply to AI data, models, and outputs? OMB and DOI policies

How must AI‑generated outputs containing PII be handled, retained, and disposed? Must maintain and adhere to standards outlined by FISMA, NIST 800-53

(for authentication), Privacy Act of 1974, Zero Trust Alignment

Which manual SDLC tasks should AI automate first (e.g., builds, tests, deployments, change validation)?

To be determined 93 What development tools and IDEs are used? Software AG, Natural for AJAX (Natural One)

94 Purpose of RFI

When the RFI references database management capabilities such as capacity, drift detection, patching, migrations, conversions, and integrity, should vendors assume these requirements apply only to non-production support tooling, or also to production database operations?

Example: Advisory support only in lower environments, or direct production monitoring and controlled remediation. Intention is application and utilization for all environments. Production, development, test

95 Purpose of RFI Is there a preferred deployment model for the solution, such as on-premises, private enclave, or government-authorized cloud?

Example: On-prem only, agency enclave in cloud, or hybrid deployment. To be determined

96 Purpose of RFI What forms of AI usage are acceptable in this environment?

Example: Human-in-the-loop copilots, retrieval-augmented generation, offline models, no public API calls, and deterministic rule-based outputs. Open to options or consideration and dependent for each environment

97 Purpose of RFI Are there restrictions on where model inference, training, indexing, or vector storage may occur?

Example: U.S.-only hosting, no external LLM endpoints, no training on government data, and vector databases hosted only in an agency enclave. US Hosting Only, Rest of question To be determined

98 Purpose of RFI

What auditability requirements apply to AI-generated outputs for payroll, HR, legal guidance, documentation generation, and ticket routing?

Example: Full prompt logging, output traceability, approval workflows, immutable audit histories, and versioned model records. Yes to all here

Section 2 – HRD AI Tools and Automations Requirements;

Purpose of RFI

The RFI states "Additional areas of interest include AI-enabled code and infrastructure analysis and refactoring (mainframe module assessment, call-routine mapping, bug identification, historical change analysis, and LLM-based scanning), automated generation of system documentation, training materials, and analytical reports, and customer service workflow automation (ticket creation and routing, self-service tools, legal and payroll guidance)."

Could the Government clarify whether vendors will receive access to the existing mainframe source code and database schemas to support automated code analysis and refactoring activities, or whether such tools must be deployed directly within the Government’s secured environment to perform those functions?

Upon direct market research and or pilot sessions, this is possible and TBD how in depth or to what quantity and extent

100 Background: IBC as a Shared Services Provider

What primary source technologies are currently used across the IBC-HRD environment for application code, batch processing, database access, and interface handling?

Example: COBOL, JCL, Natural, Easytrieve, REXX, SQL scripts, PowerShell, .NET, Java, file-transfer scripts, and scheduler definitions. JCL, Natural, SQL scripts, Java, Flat files, SFTP, Connect Direct, 101 Background: IBC as a Shared Services Provider

What language variants, versions, compilers, and runtime environments are currently in use across the mainframe-centric payroll systems and supporting subsystems?

Example: Enterprise COBOL 6.x, Natural 9.x, JCL on z/OS 2.5, DB2 utilities, WebSphere version, scheduler version, and Linux runtime versions. Natural 9x, JCL, ZOS 2.5

102 Background: IBC as a Shared Services Provider

If Natural or other programming languages are used, what is the estimated number of programs and total lines of code for each?

Example: 1,200 Natural programs totaling 850,000 lines of code. Upwards of 5mill for mainframe

103 Background: IBC as a Shared Services Provider

If Natural is present in the environment, is it associated with ADABAS, and if so, what is the scope of ADABAS usage in terms of applications, files, and dependencies?

Example: Natural/ADABAS used for payroll history, 40 ADABAS files, 12 dependent batch jobs, and 8 interfaces. 3,691 data elements,488 file definitions

104 Background: IBC as a Shared Services Provider

The RFI references extensive “JCL, ADBAS, batch scheduling, and interface dependencies.” Please confirm whether “ADBAS” refers to ADABAS, and if so, which related products, utilities, and dependencies are in scope.

Example: ADABAS, Natural, EntireX, Com-Plete, user exits, file loaders, and archive utilities. ADABAS, Natural, file loaders, and archive utilities

105 Background: IBC as a Shared Services Provider

If JCL is used, what is the approximate number of JCL members, procedures, and total lines of code?

Example: 3,500 JCL members, 600 PROCs, and 275,000 total lines.

JCL 7, 796 jobs, 477,194 lines of code (JCL approx. 1311 jobs with 93,00 line of code)

106 Background: IBC as a Shared Services Provider

What is the approximate source code volume by language or artifact type across the in-scope environment?

Example: COBOL 6.2M LOC, JCL 275k LOC, Natural 850k LOC, SQL scripts 120k LOC, and PowerShell 40k LOC.

Natural - Upwards of 7 mill for mainframe

107 Background: IBC as a Shared Services Provider

Can IBC-HRD provide an approximate breakdown of the application landscape by function?

Example: Payroll core 35 percent, personnel actions 15 percent, reporting 10 percent, ticketing 10 percent, batch processing 20 percent, and document generation 10 percent. personnel 50% payroll 50%

108 Background: IBC as a Shared Services Provider

What portion of the environment remains mainframe-resident versus distributed, and which major functions are still exclusively tied to the mainframe estate?

Example: Payroll calculation and year-end processing remain on z/OS, while reporting and portals are distributed. 80% mainframe/20% Natural AJAX/Linux

109 Background: IBC as a Shared Services Provider

What is the current batch-processing footprint in terms of job counts, processing frequency, runtime windows, scheduling dependencies, and critical payroll cycles?

Example: 2,000 daily jobs, 400 biweekly payroll jobs, a 6-hour overnight processing window, and year-end W-2 and ACA peaks. See above

110 Background: IBC as a Shared Services Provider Which job scheduling platforms and operational control tools are currently in use?

Example: Control-M, CA-7, IBM Workload Scheduler, custom scheduler dashboards, and alerting tools. Control-M

111 Background: IBC as a Shared Services Provider

What are the current database platforms, versions, and primary data management tools used across payroll and supporting subsystems?

Example: DB2 12 for z/OS, ADABAS 8.x, SQL Server 2019, Oracle 19c, along with administration, backup, and monitoring tools. ADABAS 8.6

112 Background: IBC as a Shared Services Provider

What is the approximate size of the data estate that may need to be assessed by the proposed AI tools?

Example: 25 databases, 2,500 tables or files, 30 TB of structured data, and 5 TB of archived reports and documents.

35 TB

113 Objectives - "Automate and Produce" For automated testing, what baseline artifacts are currently available?

Example: Existing test cases, regression scripts, expected batch outputs, compare files, masked payroll datasets, and historical test run results. No automated testing.

114 Objectives - "Automate and Produce"

For batch job-run comparisons and JCL validation, what are the highest-priority use cases for automation?

Example: Return-code validation, spool comparison, dataset comparison, schedule dependency checks, and restartability checks.

Unknown at this time

115 Objectives - "Automate and Produce"

What test environments and sanitized or masked datasets can be made available for tool evaluation or future implementation?

Example: Masked payroll extracts, synthetic personnel files, and prior production snapshots in a test enclave.Upon direct market research and or pilot sessions, this is possible and TBD how in depth or to what quantity and extent. Possibly to be conducted during a technical session

116 Objectives - "Online/Production" What categories of payroll errors (retroactivity, ACA, W‑2, locality tax, timekeeping anomalies) must automation detect, explain, or avoid introducing? Any and all - To be determined and discussed internally and with vendor

117 Objectives - "Online/Production" What audit trails exist today for payroll adjustments, and how must AI-enhanced workflows maintain or expand these?

Audit trails are kept internally and stored in arhcived drives along within our current change management system

118 Objectives - "Analyze code and infrastructures"

When the RFI asks for the ability to “scan various LLMs in its entirety,” does IBC-HRD mean scanning source code and infrastructure using LLM-enabled capabilities, or evaluating and governing multiple third-party LLM models within the environment?

Example: Model security scanning, prompt and output monitoring, benchmark testing, or codebase analysis using AI tools. Any and all - To be determined and discussed internally and with vendor

119 Objectives - "Self Help Feature" Are there existing service management, knowledge management, or ticketing platforms that the solution mus integrate with for customer service workflow automation?

Example: ServiceNow, Jira, Remedy, SharePoint, Confluence, and custom DOI ticketing tools. ServiceNow

120 Objectives - "Self Help Feature"

For the self-help and customer service capabilities, is the expectation employee-facing, agency HR staff-facing, payroll operations-facing, or all of the above?

Example: Self-service for employees, case-assist for HR staff, and triage-assist for payroll operations.

Yes to all here

121 Objectives - "Self Help Feature"

For customer support and self-help automation, can the government elaborate on requirements, including:

records retention requirements, integration with existing DOI knowledge repositories, or multilingual requirements?

Example: English-only or multilingual support, seven-year retention, and integration with SharePoint or existing knowledge bases.

English only, I think seven-year retention, and yes likely potential integration with other existing knowledge bases (To be determined)

122 IBC-HRD Essentials - "Non-multi-tenant environments"

For “non-multi-tenant environments,” is the expectation a single-tenant SaaS model, a customer-dedicated cloud enclave, an isolated private hosting model, or a fully on-premises deployment?

Example: Dedicated government tenant with logical isolation, or a fully separate infrastructure stack. To be determined

123 IBC-HRD Essentials - "Non-multi-tenant environments"

What level of FedRAMP maturity is expected for the proposed solution?

Must be FedRamp or going through Fedramp approvals/certification

124 Objectives - "Cross platform compatibility" What are the primary interface types in the current environment?

Example: Flat files, MQ, APIs, SFTP, Connect:Direct, email notifications, and scheduler-triggered handoffs.

Flat files, SFTP, Connect Direct, email notifications, scheduled triggered

125 IBC-HRD Essentials Are there minimum availability, disaster recovery, or continuity of operations requirements that the solution must meet to be considered viable for payroll-related use?

Example: 99.9 percent uptime, 4-hour RTO, 1-hour RPO, and year-end blackout support. Yes, SLA uptime 95%; Disaster Recory within 24 hours RTO

126 Objectives - "Cross platform compatibility" What standard interfaces and API specifications exist today for integrations with IRS, OPM, Treasury, and other SSPs (e.g., file formats, transport protocols, API definitions, exchange schedules)? Flat files, SFTP, Connect Direct, batch retrieval and delivery, exchange schedules, APIs between Mulesoft and internal systems

127 Objectives - "Cross platform compatibility" What evaluation criteria will HRD use to assess the maturity of AI tools (e.g., prior federal ATOs, model governance, explainability, reproducibility, performance benchmarks, accessibility conformance)?

Any and all - To be determined and discussed internally and with vendor

128 Section 2 – HRD AI Tools and Automations Requirements

Will access to representative source code, job control artifacts, interface definitions, and documentation be made available in any future assessment, pilot, or proofing activity so vendors can validate automation feasibility and implementation assumptions?

Example: Read-only access to sample COBOL, JCL, Natural, interface specifications, test artifacts, and architecture diagrams.

Upon direct market research and or pilot sessions, this is possible and TBD how in depth or to what quantity and extent and read only

129 Section 2 – HRD AI Tools and Automations Requirements

Are there restrictions on vendor use of automated analysis, refactoring, documentation, or testing tools during any future assessment or implementation effort?

Example: No cloud-based scanning, no public LLMs, no source export, and use of approved tool lists only. Upon direct market research and or pilot sessions, this is possible and TBD how in depth or to what quantity and extent and read only

130 Section 2 – HRD AI Tools and Automations Requirements

Will vendors be expected to deliver production-ready, security-reviewed, and fully validated capabilities, or should vendors assume that portions of validation, accreditation, or final operational acceptance will be performed by DOI or another government support organization?

Example: Vendor delivers deployment-ready capability, while DOI performs ATO, operational validation, and final acceptance testing. To be determined - we acknowledge this may be a collaborative effort and open to further discussion

131 Section 2 – HRD AI Tools and Automations Requirements

Will vendors be provided with existing process documentation, workflow maps, business rules, ticket-routing logic, and knowledge-base content to support automation accuracy and reduce reverse-engineering effort?

Example: SOPs, routing rules, service desk categories, decision trees, payroll process maps, and knowledge articles. Upon direct market research and or pilot sessions, this is possible and TBD how in depth or to what quantity and extent

132 Section 2 – HRD AI Tools and Automations Requirements

Are there any incumbent tools, licenses, or platform investments already in place that DOI expects vendors to leverage, integrate with, or avoid duplicating?

Example: Existing ServiceNow licenses, Splunk, SharePoint, Atlassian stack, database tools, and document repositories. Preferred

133 Section 2 – HRD AI Tools and Automations Requirements

Are there any unique data-sharing, privacy, labor, union, or policy constraints specific to payroll and HR operations that could limit AI-assisted recommendations, automated actions, or user-facing self-service capabilities?

Example: Approval requirements for HR actions, limits on PII exposure, union review requirements, and records retention constraints. Yes

Section 2 – HRD AI Tools and Automations Requirements;

Security and Compliance

If an Authority to Operate (ATO) is required, can HRD outline the anticipated path, roles (e.g., ISSO, AO), documentation expectations (SSP, POA&M), and a notional timeline for AI tooling to achieve ATO within HRD’s environment? Notional timeline 8 - 12 months

135 Section 2 – HRD AI Tools and Automations Requirements

Is HRD open to AI‑enabled code conversion or selective mainframe‑to‑cloud augmentation (e.g., non‑production analysis services, read‑only mirrors, or batch offload), or must all automation operate entirely within the existing mainframe and Government‑managed environments? Yes and open to further discussion

Section 2 – HRD AI Tools and Automations Requirements;

Security and Compliance

Are there planned modernization efforts (e.g., rehosting, database upgrades, interface refreshes) that the AI solution should align with, and can HRD share relevant roadmaps or constraints?

TBD and open to further discussion

Section 2 – HRD AI Tools and Automations Requirements;

Governance and Controls

What records‑retention and eDiscovery expectations apply to AI‑generated content and logs (e.g., prompt/output logs, model versions, routing decisions), and should vendors ensure that these records are stored in a way that prevents anyone from changing or deleting them, so they can be preserved for retention and legal discovery requirements? Depends on record type, payroll requires min. 50 years retention.

138 Section 3 – Rough Order of Magnitude Annual Operations and Maintenance Costs

For annual operations and maintenance, should vendors include only tool support and hosting, or also ongoing tuning, model governance, test maintenance, integration support, and customer support services?

Example: Hosting only, or a full managed service including monitoring, retraining, reporting, and user support.

Provide all, listed as separte line items

Objectives: Assess production and Test datab

Can you provide more detail regarding your description of conversion of software? We'd like to ensure our definitions and expectations are aligned. Unknown at this time

Objectives: Analyze code and infrastructure

Can you provide more detail regarding your description of refactoring code? We'd like to ensure our definitions and expectations are aligned. Unknown at this time

141 Objectives: Customer service ticket generatio What ticketing system do you use? ServiceNow

Objectives: Cross platform compatibility

Does integration with non-HRD systems mean managing file transfers, or are there direct application integrations? Both

Mainframe Platform and OS Version

What IBM z/OS version and hardware generation is the IBC-HRD mainframe environment running?

Understanding the platform baseline is necessary to assess AI code scanning and analysis tool compatibility. ZOS 2.5 (3.2 scheduled for migration this FY)

Programming Language Stack

What is the primary language composition of the mainframe codebase (e.g., COBOL, PL/I, Assembler)? Is an approximate module count or lines-of-code estimate available to help vendors scope the code analysis workstream? Natural 9.x, approx. 7 mil lines of code with over 100,000 modules.

ADBAS Database Clarification

The RFI references "ADBAS." Does this refer to ADABAS (Software AG's Natural/ADABAS platform)? If so, what version is in use? This is a critical compatibility factor for any AI-based database assessment or code analysis tool. Yes

FedRAMP Authorized vs. FedRAMP-Aligned

The RFI states solutions must support "FedRAMP-aligned controls." Does IBC-HRD require that AI tools be FedRAMP Authorized (active listing on the FedRAMP Marketplace), or is it sufficient to demonstrate alignment with FedRAMP control families without formal authorization? This distinction directly affects vendor qualification. Must be FedRamp or going through Fedramp approvals/certification

Data Classification

What data classification levels are in scope? Is this PII only, or does the environment also include Controlled Unclassified Information (CUI) or other designations that would impose additional security control requirements on the AI tool? PII and CUI are handling classifications to be employed. Data is primarially UNCLASS

Deployment Environment

Will the AI tool be required to deploy within IBC-owned on-premises infrastructure, or is deployment to a FedRAMP-authorized government cloud environment (e.g., AWS GovCloud, Azure Government) acceptable provided the non-multi-tenant requirement is satisfied? No not a requirements. All off premise recommendations must be FedRamp.

Contract Vehicle

Does IBC-HRD have a preferred acquisition vehicle for this procurement (e.g., GSA MAS, CIO-SP4, Alliant 2, or a standalone contract)? Confirming vehicle eligibility is a prerequisite for vendor participation planning.To be determined

Contract Period of Performance

What is the anticipated base period and option year structure? The RFI requests pricing scenarios across 5, 7, and 10-year horizons - is a 10-year period of performance under active consideration? To be determined

151 Contract Vehicle Partner Does IBC-HRD have a preferred partner with a contract vehicle? No