The file's text, extracted by GovTribe without its formatting.
Global Hardware (19AQMM25B0123) Questions and Responses
| 1 |
| Under 2.2.2 Overseas Units – Complete Prebuilt Half-Rack: |
| 1) | Oracle RAC Server. How many Oracle RAC servers are required? |
| 2) | Backup Server. What type of backup software will reside on the server (example: Commvault, Veeam, NetBackup)? Does the customer need us to quote the backup software as well? |
| 1 – The amount needed will vary from year to year. |
2 - Multi functional sever that is ESXi compatible - backup software of DoS choice
| 2 |
| Section 2.2.1 paragraph “o” states FIPS 140-3 certification of cryptographic modules as a requirement for all hardware/software in the solutions that leverages encryption. |
While FIPS 140-3 represents the latest evolution in cryptographic security standards, customers should recognize that the majority of vendors have not yet completed the transition from FIPS 140-2 validation. The process of achieving FIPS 140-3 certification is complex, resource-intensive, and time-consuming, requiring vendors to undergo a rigorous evaluation under updated testing methodologies. As a result, many trusted cryptographic solutions that were previously validated under FIPS 140-2 remain in use and fully compliant with current security requirements. Since NIST has allowed FIPS 140-2 validations to remain active through September 2026, organizations can continue relying on these well-established modules without compromising security or regulatory compliance.
Insisting on immediate FIPS 140-3 validation could unnecessarily limit product choices and create procurement bottlenecks, as only a small percentage of vendors have completed the transition. Many industry-leading cryptographic libraries, hardware security modules (HSMs), and security appliances are still undergoing certification, meaning that organizations that demand FIPS 140-3 today may face delayed deployments, higher costs, and fewer or no available solutions. Rather than focusing solely on validation status, customers should evaluate the security posture of a product holistically—ensuring it adheres to best practices, meets their risk management needs, and has a clear roadmap for future compliance. Flexibility during this transition period allows for a smoother and more strategic adoption of FIPS 140-3 without disrupting current operations or security investments.
Would the Department of State consider easing this requirement and mandate FIPS 140-2 certification instead?
140-2 certified (must provide module certificate number) is acceptable for now but will need proof of 140-3 submittal to NIST.
| 3 |
| 2.2.2 ORAC Cluster – Customer is looking for older intel CPUs. We are shipping Gen 6 latest Intel CPU based servers. Are we allowed to propose alternate solution in addition to what Dept of State has asked for |
| CPUs must be Intel 16 core – the newest generation is acceptable |
| 4 |
| 2.2.2.h –[Question] JBOD requirements. Need clarification if it’s 1 JBOD per system, or 1 JBOD for the 2 systems they requested. |
| Each rack has a single SAN and each SAN has a JBOD of 16 disks. |
| 5 |
| 2.2.3 f. ii. (Large Site) vs 2.2.3 e. ii. (Small Medium sites) – Both ask for 5 nodes, but Large asks for “12 total rack units” and Small/Med asks for “10 total rack units”. Please confirm if both Large and Small/Med sites need back up server. |
| Backup server is not required for domestic sites. |
| 6 |
| 2.2.3 f. ii. [Question] Is the 5 node cluster a typo and it is really supposed to be 6 nodes? 16 Core * 6 CPU = 96 Cores. |
| 16 core per server is what is needed. |
| 7 |
| Is there a min/max rack height, width, depth & weight? |
The solution is geared toward a standard full or half rack. Minimizing weight is ideal.
| 8 |
| What type of AC power inputs are available, 16A, 32A, 30A, 50A or 60A? Single or 3Phase? 208V, 400V, 415V, 480V? |
Post is 15AMP 100-120V single and Domestic 30AMP 200-240V single
| 9 |
| Is there a preference on PDU type? Basic, Metered or Switched? |
| The current Post solution uses a CS-FED-AP9562 for the PDU. This is 15AMP, 120V, basic. |
Domestic solutions may have higher power and more advanced PDU.
| 10 |
| 2.2.2.h [Question] - JBOD requirements. Need clarification if it’s 1 JBOD per Oracle RAC system, or 1 JBOD for the 2 Oracle RAC systems they requested. |
| Each rack has a single SAN and each SAN has a JBOD of 16 disks. |
| 11 |
| 2.2.3 [Question] - For Large Site, we assume 2.2.3.e. are the spec requirements 6 hypervisor servers , and 2.2.5. Are the spec requirements for the 3 SAN devices connected to the 6 hypervisor servers? |
| No. Those are independent. |
| 12 |
| 2.2.3 [Question] - For Small/Medium Site, we assume 2.2.3.f. are the spec requirements 6 hypervisor servers , and 2.2.5. Are the spec requirements for the 3 SAN devices connected to the 6 hypervisor servers? Is this correct? |
| No. Those are independent. |
| 13 |
| 2.2.4 [Question] - What are Converged Hardware requirements here? It looks like a total capacity requirement, are there specific quantity requirements? |
| No – quantities will be determined for individual procurements. |
| 14 |
| What SW defined storage solution are they using? |
| Need more information. If you are referring to object storage, CEPH and vSAN |
| 15 |
| Will the State Department grant an extension for the due date of the RFI? |
No
| 16 |
| Does the Overseas Half Rack require SAN storage in addition to the SAN storage? (for DOS) |
The solution is self-contained in a single unit to support Oracle real application cluster database
| 17 |
| For the 2.2.3 and 2.2.4 requirements, are the total node counts required for application performance or to meet vSAN data protection policies? |
The architecture includes both concepts
| 18 |
| Would a backup configuration using a system (physical or virtual) storing backups on a dedicated SAN/NAS be acceptable instead of a backup server with only local storage? |
No – servers acting in a storage capacity are future proofed for different workloads
| 19 |
| Does the platform need to be able to meet the requirement to be compatible with alternate hypervisors for future growth? |
Anything needs to be able to work with a top tier hypervisor but is now geared toward VMWare certifications
| 20 |
| will the customer also accept “hyper-converged” (HCI) hardware solutions as the requirements only list “converged” infrastructure? |
| Only hyperconverged hardware would be for datacenters. Overseas hardware cannot be hyper-converged nor does the architecture allow for it. Any solution should be 2N+1. |
| 21 |
| While FIPS 140-3 is the latest cryptographic security standard, NIST has yet to fully complete the transition and certification process for many vendors. As a result, most solutions are still validated under FIPS 140-2, which remains compliant with current security requirements until September 2026. Insisting on immediate FIPS 140-3 certification could limit options and delay deployments, as NIST's slow pace of certification means fewer solutions are available. Customers should focus on a product’s overall security posture, ensuring it meets their needs while being adaptable to future compliance. Given this, would it be possible to adjust the requirement to FIPS 140-2 for now? |
| 140-2 certified (must provide module certificate number) is acceptable for now but will need proof of 140-3 submittal to NIST. |
| 22 |
| Please define "transferrable component". What is the overall intent of this statement? |
| Individual hardware needs to be able to be swapped to any other site. Looking for hardware uniformity to fit in rack. |
| 23 |
| Does the Govt anticipate making an award off the RFI or will there be a follow on RFP/RFQ based upon the information provided in the RFI responses? |
To be determined. An RFI does not commit the Government to awarding a contract.
| 24 |
| VMware is mentioned throughout the RFI. Will a VMWare alternative be considered or will the Govt be issuing a sole source procurement? |
| Solution is currently VMware. Alternate solution could be considered but would need to be certified by alternate vendor as to not void any vendor support. |
2/28/2025
