NCODE RFI Questions and Answers- 08January.pdf

1. Does the Government have any or perceive any Conflict of Interest between the requirement of NCODE and the requirements outlined in the C4SB opportunity? Will this remain 2 separate efforts? Answer: NCODE is a continuation of C4SB.

2. Does the Government anticipate that this will be a GOCO or COCO environment? If this is a COCO environment, will a FedRAMP Authorization be required or will the Government consider if individual components of our solution already possess their FedRAMP Authorization as sufficient? Answer: COCO, existing FedRAMP is sufficient. New FedRAMP certifications will be expected as required for new capabilities, following DFARS 252.204 7012 guidance.

3. Is it the Government’s intent to allow a company to move entirely into the VDI environment or will they be expected to maintain a company environment in addition to their use of the VDI environment? Answer: Having both options would be preferred to allow SB customers to determine their desired setup.

4. Does the onboarding / offboarding support include migration activities into and from each company environment? Answer: Preferably yes.

5. The SBA uses a wide variety of sizes to determine what qualifies as a small business. What is the size standard for a company that the Government will approve for use of the VDI environment?

Answer: While not an official definition for small business, the pilot will primarily focus on businesses that have below $2M in DoD-derived revenue. Other SBs may also be included as users based on certain criteria to be further determined.

6. Will companies graduate from the use of this service upon achieving a certain size? At what size will companies be asked to graduate from the use of this service and what is the timeline that will be given to migrate their data into their own tenant? Answer: These considerations will be refined during the pilot. For the purposes of the pilot, we will assume that the size standards of participating SBs would not change during the duration of the pilot.

7. The quantity of licensing that is identified in the RFI, up to 60,000 users, does the Government have an estimate on the number of companies / environments this solution would support?

Answer: Although we anticipate numbers to vary, please assume a planned average of 10 users per small business.

8. Virtual Machine cost is often based on monthly usage or reserving a VM for 1 yr or longer term.

Does the Government prefer a certain type of agreement entered for the VMs used for the overall environment for specialized computing requirements in support of DevSecOps or MDSE tools (e.g. monthly pay as you go, annual, or longer term)? Answer: Please provide a range of pricing options to support varying SB needs.

9. The pricing form calls for DevSecOps and MBSE tools and there can be major cost implications for independent company environments from both a licensing and usage perspective, especially on the MBSE side. Will more details be provided regarding the software and usage limitations each company environment will have for the Small Businesses applying to use the NCODE solution? Answer: Further details on this will be forthcoming. Environments need not be completely independent, so long as protections of SB IP are in place.

10. Does the Government require an audio-conferencing solution with a dial-in number or a VOIP solution as part of the proposed solution for individual environments? Answer: Yes, such as Microsoft Teams or Google Meet.

11. Will the Help Desk Support have to be 24/7 in support of the customer and government environments in the tenant? Answer: These requirements are to be determined. Please provide costing for 9-5 Mn-Fr support and 24/7 support.

12. Does the Government have any specific SLAs for the Help Desk Support that will have to be met?

Will the SLAs differ between business hours and after-business hours? Answer: These will be further developed in the pilot.

13. What specific authentication mechanisms are required for superusers and regular users beyond

FIPS 140-2-compliant MFA (e.g., biometric, hardware tokens, phishing-resistant methods)?

Answer: Phishing-resistant MFA for superusers/system admins.

14. Should the solution support integration with DoD CAC for all users, or is it limited to government personnel? Answer: NCODE must allow SB users to authenticate with commercial MFA. DoD users should be able to authenticate with CACs within 6 months of the start of the pilot.

15. Are there requirements for Single Sign-On (SSO) integration with existing DoD systems or third-party platforms? Answer: No, however CAC authentication for Army users may be federated to

DoD IdPs.

16. What are the expectations for managing roles and permissions, such as Role-Based Access

Control (RBAC) or Privileged Identity Management (PIM)? Answer: Define default roles and permissions for all users, with pathway for superusers/system admins to update roles for others.

17. Should the solution include specific collaboration tools or platforms (e.g., virtual workspaces, enterprise browsers) for vendor and government interactions? Answer: No specific requirements at this time for this. Please provide various options that you offer.

18. What mechanisms should be in place to isolate intellectual property while enabling secure data sharing across vendors and government users? Answer: Vendor will provide their preferred mechanisms that meet this requirement.

19. Are there standards or requirements for bulk data import/export (e.g., encryption protocols for sensitive data transfers)? Answer: There will likely be requirements for secure bulk data import/export in the future.

20. Should workspaces include pre-installed tools (e.g., productivity, DevSecOps, MBSE) or rely on user provisioning? Answer: Workspaces should provide a “marketplace” of tools for users to leverage on an as-needed basis with minimal configuration.

21. Are there preferred hosting environments (e.g., private cloud, public cloud providers like Azure

Government or AWS GovCloud)? Answer: Public cloud is preferred to enable rapid scaling, but private cloud capabilities will be reviewed in responses as well.

22. What are the minimum specifications for compute resources (e.g., CPU, GPU, memory) to support modeling, simulation, and software development? Answer: Minimum specifications will be refined during the Pilot phase. Please provide costing based on your specifications with your assumptions outlined if possible.

23. Should the solution support containerized workloads (e.g., Kubernetes) for enhanced scalability and development workflows? Answer: Yes.

24. Are specific networking configurations (e.g., low-latency VPNs, firewalls, private links) required to ensure secure and efficient connectivity? Answer: All viable network solutions proposed will be evaluated. Please provide your range of options with assumptions outlined.

25. What are the critical monitoring and logging requirements, including retention periods, for compliance and incident response? Answer: Minimum requirements should include log capture as defined in OMB M-21-31. Additional requirements will be evaluated.

26. Are there predefined monitoring frameworks (e.g., managed SIEM solutions) that the solution should integrate with? Answer: All viable monitoring frameworks will be evaluated.

27. What specific metrics or data should be captured for access tracking, system performance, and

CUI manipulation logs? Answer: Requirements will be further refined during the pilot. Please propose recommended metrics or data capture.

28. Should the solution support automated alerting for suspicious activities or compliance violations? Answer: Ideally, yes.

29. Are there specific compliance frameworks the solution must adhere to beyond NIST SP 800-171 and CMMC Level 2, such as FedRAMP Moderate/High or ITAR? Answer: Yes, FedRAMP Moderate or higher and ITAR compliance are additional requirements, and any other requirements as outlined in DFARS 252.204 7012 and other federal regulations.

30. Should the solution provide automated compliance tracking for NIST SP 800-171 and CMMC

Level 2 objectives? Answer: This would be a value add, but not specifically required at this time.

31. What level of adherence to Zero Trust principles is expected, and are there specific tools or strategies to implement these principles? Answer: Zero trust is preferred. Please provide your solution capabilities and assumptions surrounding the level of Zero Trust maturity implemented.

32. Should the solution incorporate NIST SP 800-172 controls as part of future scalability? Answer:

The solution may be expected to implement NIST SP 800-172 controls beyond the pilot phase.

33. What are the expectations for managing and securing Controlled Unclassified Information (CUI) and intellectual property within the environment? Answer: SB customers are expected to be able to effectively secure and manage the distribution of CUI data using the environment. Intellectual property for SB customers shall be secure from other SB customers, unless otherwise shared by owning SB.

34. Are there specific requirements for encryption at rest and in transit (e.g., AES-256, customer-managed keys)? Answer: Encryption should be as specified in NIST SP 800-171 (rev2).

35. Should the solution include automated tools for data classification, tracking, and access control

(e.g., sensitivity labels, data loss prevention)? Answer: This would be a value add, but not specifically required at this time.

36. How should the solution handle data replication, backup, and disaster recovery to ensure availability and integrity? Answer: Please provide viable solutions you offer.

37. Should the solution integrate with existing DoD systems and platforms (e.g., DOD365, SIPRNet)?

Answer: No.

38. Are there expectations for APIs or custom integrations to enable seamless data exchange across platforms? Answer: This would be a value add, but not specifically required at this time.

39. Should the environment support cross-platform workflows (e.g., Office tools working seamlessly with DevSecOps or MBSE environments)? Answer: Anything to enhance user experience in the environment would be welcome.

40. What scalability requirements exist for user capacity, workloads, and data storage during the pilot and potential future expansions? Answer: Specific requirements for these aspects will be defined further in the pilot phase. Please provide recommended specifications and assumptions.

41. Should the solution prioritize reducing control requirements on customer endpoints (e.g., endpoint out-of-scope strategies)? Answer: Yes, where appropriate as defined by SB need.

42. Are there specific user experience requirements for onboarding, collaboration, and compliance management tools? Answer: Requirements will be defined further in pilot phase. User productivity tool suite (e.g., instant messaging, email, video/voice calls, document processing) is a minimum requirement. Please provide recommended solutions that reasonably address these aspects.

43. What are the key performance indicators (KPIs) or success metrics that will define a successful pilot? Answer: These metrics will not be shared at this time.

44. How will small business feedback be collected and incorporated throughout the pilot? Answer:

At a minimum, regular engagement with the providers and SBs will be established for purposes of gathering feedback and facilitation. Further methodologies for collecting and incorporating feedback will be established.

45. Are there predefined timelines for the incremental rollouts of the pilot phases, and what level of reporting is expected during each phase? Answer: There are draft timelines, as presented during the Industry Day briefing on Dec 10th

46. Will the Government require back-up of each Customer or Government environment? Answer:

Backup data and environments as defined in DFARS 252.204 7012 by way of NIST SP 800-171.

Specific details such as cadence of backup, retention policies, etc. will be evaluated further during the pilot. Please propose your organization’s recommended strategy if available.