25RB034RFI_Atlassian_Final.xlsx
XLSX spreadsheet 35 KB Posted
- Attached to
- FA830725RB034_RFI_Atlassian
- Solicitation number
- FA830725RB034_RFI_Atlassian
About this file
This is a Request for Information (RFI) Excel file seeking information about Atlassian Jira and Confluence licenses or alternative solutions for Platform One (P1), which supports DevSecOps operations across the Department of Defense. The RFI is issued by the Department of the Air Force Materiel Command Lifecycle Management Center at Joint Base San Antonio.
The requirements focus on collaboration tools and service management capabilities that must meet strict DoD security standards, including FedRAMP High certification, NIST compliance, and CMMC Level 3+. Key technical requirements include self-hosting capability in AWS GovCloud, Kubernetes deployment support, SSO integration, and extensive customization options. The solution must provide comprehensive issue tracking, project management, ITSM features, and collaborative documentation capabilities. P1 currently serves the US Space Force and nine other customers, utilizing Atlassian tools for software development, cyber operations, and project management. Vendors are asked to provide detailed information about licensing options, transition costs, training requirements, and pricing plans, including willingness to enter into contracts with a base year and up to four one-year options.
View the file
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFI Excel version of Word sheet
P1 (Platform One) currently utilizes the Atlassian Jira and Confluence licenses on a continuous basis, directly supporting its DevSecOps (Development, Security, and Operations) across the organization. The Atlassian tool suite is used to facilitate and streamline software development and delivery and provides the program efficient methods to capture data and deliverables.
P1's customer includes US Space Force and nine others, which are tasked with synchronizing and coordinating cyberspace planning & operation within the DoD. The approach for strategically collecting, fusing, and processing cyber data and intelligence for situational awareness and battle management. The concept of operations (CONOPS) breaks down into four layers: 1) Infrastructure, 2) Data, 3) Common Services, and 4) Applications. These layers build on each other; P1 is the foundation for the first three (3) layers, and its services are used by developers in the Application layer as well as by cyber operators. Common Services are defined as core services that are common across Joint Cyber Warfighting Architecture (JCWA) components to eliminate unnecessary redundancies in software development.
The Jira and Confluence licenses provide information support and service management for personnel throughout P1 from in/out processing, tracking of office data, project management for simple and complex projects to complete projects efficiently while producing quality results. Jira software is a suite of agile work management solutions that allows collaboration across all teams from conception to the customer. The Confluence tool allows the teams to build, organize, and collaborate on work in one place from virtually anywhere, which is important in today's virtual offices. Confluence aids in fostering a transparent team with every level of the team able to contribute, share, and receive feedback, business status updates and strategic planning to allow the team to turn visions into values. The wider architecture of the Atlassian Suite is already in use by P1 therefore the Jira and Confluence tools of the Atlassian suite will continue to seamlessly integrate with the current architecture. These tools have since become an integral part of P1 operations and customer organizations.
2 For each licensing option/solution set, please provide how it is similar from the listed license.
(Specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities)
3 For each licensing option/solution set, please provide how it meets the above requirements.
(Identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license type.)
4 For each licensing option/solution set, clarify how it meets the above requirements for our logging and monitoring needs.
(Please highlight specific ways in which each licensing tier can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.)
| Pricing Information: | |
| 1 | For each license, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution. |
(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.)
2 For each license, please provide any price plans associated such as monthly, trial, annual.
(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.)
| Other Considerations: | |
| 1 | Are there any additional features or benefits associated with the different licenses that we should consider? |
For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses.
2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?
(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.)
Requirements Capability Sheet
| Atlassian ALTERNATIVE: | [PUT NAME HERE] | ||||
| Instructions: | Please select Y/N | Please type Y if Yes, N if no plans, or N/A if ready on day 1 | Please insert # of days from award to build capability or a date if known | Please insert comments, questions, or concerns for each requirement if needed | |
| Requirement: | Ready on Day 1 | Future Capability | Estimated date of Capability | Comments | |
| Collab Tools & Service Management Tool Requirements | |||||
| 1. General Requirements | |||||
| 1 | All tools must be able to pass security scanning and be available in the Platform One Iron Bank. | ||||
| 2 | Must be allowed to be self-hosted within the DoD's AWS GovCloud environment. | ||||
| 3 | Must be deployable in a Kubernetes (K8s) cluster with support for Helm charts and operator-based deployments. | ||||
| 4 | Must support containerized deployment using Docker or OCI-compliant images with automated vulnerability scanning. | ||||
| 5 | Must comply with DoD security standards, including: | ||||
| Security Technical Implementation Guides (STIGs) | |||||
| FedRAMP High certification | |||||
| NIST 800-171 and NIST 800-53 compliance | |||||
| Cybersecurity Maturity Model Certification (CMMC) Level 3+ | |||||
| 6 | Must allow for extensive customization through: | ||||
| Plugin-based extensions | |||||
| API-based automation | |||||
| Custom script execution within workflows | |||||
| 7 | Must provide full audit logging for: | ||||
| Compliance reporting | |||||
| Security monitoring | |||||
| User activity tracking | |||||
| 8 | Must support Single Sign-On (SSO) via: | ||||
| SAML 2.0 | |||||
| OAuth 2.0 | |||||
| CAC/PIV authentication | |||||
| 9 | Must provide fine-grained role-based access control (RBAC) including: | ||||
| Project-level, group-level, and individual user permissions | |||||
| Attribute-based access control (ABAC) for sensitive data | |||||
| 10 | Must support notification banners for: | ||||
| Classification level indicators | |||||
| System-wide announcements | |||||
| Security and compliance alerts | |||||
| 2. Issue Tracking & Project Management | |||||
| 2.1 Core Functionality | |||||
| 1 | Must support agile methodologies, including: | ||||
| Scrum (sprint planning, backlog grooming, velocity tracking) | |||||
| Kanban (swimlanes, work-in-progress limits, cycle time tracking) | |||||
| 2 | Must provide customizable workflows with: | ||||
| Custom statuses, transitions, and automation rules | |||||
| Conditional logic for workflow transitions | |||||
| Custom script execution within workflows | |||||
| 3 | Must support advanced custom field types, including: | ||||
| Date pickers | |||||
| Multi-select dropdowns | |||||
| Cascading selects | |||||
| Calculated fields | |||||
| 4 | Must provide built-in SLA tracking with: | ||||
| SLA policies per project or issue type | |||||
| Real-time SLA breach alerts | |||||
| SLA compliance reports | |||||
| 5 | Must support multiple issue types, including: | ||||
| Epics, stories, tasks, and bugs | |||||
| Custom issue types based on project needs | |||||
| 6 | Must support bulk issue operations, including: | ||||
| Editing, transitioning, reassigning, cloning, and deleting | |||||
| 7 | Must allow linking issues across different projects with: | ||||
| Dependency tracking (blocks, is blocked by, duplicates, etc.) | |||||
| Cross-project reporting | |||||
| 8 | Must support email-based ticket creation with: | ||||
| Configurable parsing of email subject and body | |||||
| Auto-assignment rules based on email attributes | |||||
| 9 | Must support integration with Chat Ops for: | ||||
| Real-time notifications | |||||
| Automated responses to system events | |||||
| Two-way communication for issue resolution | |||||
| 10 | Must support integration with GitLab, including: | ||||
| Bidirectional issue synchronization | |||||
| CI/CD pipeline triggering from issue status changes | |||||
| Commit and merge request linking | |||||
| Dynamic widgets for real-time updates | |||||
| Drill-down reporting capabilities | |||||
| 11 | Must integrate with source code control platforms like GitLab for: | ||||
| Issue tracking within repositories | |||||
| Automatic linking of commits and pull requests | |||||
| 12 | Must support project data export and import from: | ||||
| Other issue tracking platforms (Jira, ServiceNow, Redmine, etc.) | |||||
| JSON, XML, and CSV formats for archival purposes | |||||
| 2.2 Customization & Extensibility | |||||
| 1 | Must support scripting/custom automation, including: | ||||
| Built-in automation tools | |||||
| Support for Python, Groovy, or JavaScript scripting | |||||
| 2 | Must allow UI modifications via: | ||||
| Custom themes | |||||
| Custom dashboard layouts | |||||
| 3 | Must support webhook-based integrations for: | ||||
| Triggering external workflows | |||||
| Event-driven automation | |||||
| 4 | Must provide REST API and GraphQL endpoints for: | ||||
| CRUD operations on issues, projects, and users | |||||
| Custom integrations with external systems | |||||
| 5 | Must support custom notification schemes for: | ||||
| Granular control over event-based notifications | |||||
| Support for email, Chat Ops, and webhook notifications | |||||
| 2.3 Performance & Scalability | |||||
| 1 | Must support high availability (HA) and disaster recovery, including: | ||||
| Multi-node clustering | |||||
| Zero-downtime upgrades | |||||
| Automated failover mechanisms | |||||
| 2 | Must scale horizontally with: | ||||
| Kubernetes-based auto-scaling | |||||
| Load balancing across multiple nodes | |||||
| 3 | Must support external database configurations, including: | ||||
| PostgreSQL | |||||
| Oracle | |||||
| MS SQL | |||||
| 4 | Must allow indexing optimizations for: | ||||
| Handling large datasets | |||||
| Search performance improvements | |||||
| 3. Service Management & ITSM | |||||
| 3.1 ITSM & Help Desk Features | |||||
| 1 | Must support customizable customer portals with: | ||||
| Self-service options | |||||
| Configurable branding | |||||
| Multi-language support | |||||
| 2 | Must provide ITIL-compliant service request, problem, and change management with: | ||||
| Prebuilt ITIL templates | |||||
| Custom approval workflows | |||||
| 3 | Must integrate with asset management and CMDB solutions for: | ||||
| Tracking IT assets | |||||
| Linking assets to support tickets | |||||
| 4 | Must allow for SLA enforcement with: | ||||
| Automated breach notifications | |||||
| SLA-based ticket prioritization | |||||
| 5 | Must allow dynamic custom forms with: | ||||
| Conditional field visibility | |||||
| Pre-filled field values based on user roles | |||||
| 6 | Must support email-based ticket creation and updates. | ||||
| 7 | Must integrate with knowledge bases for: | ||||
| Self-service troubleshooting | |||||
| Suggested solutions based on ticket data | |||||
| 3.2 Automation & Rules-Based Processing | |||||
| 1 | Must support auto-assigning tickets based on: | ||||
| Load balancing between team members | |||||
| User skillset and expertise | |||||
| 2 | Must provide rules-based ticket categorization with: | ||||
| AI-driven or manually configured rules | |||||
| 3 | Must support multi-level approvals for change management. | ||||
| 4 | Must allow for chatbot-driven automation via Chat Ops. | ||||
| 3.3 Customer Management | |||||
| 1 | Must allow external customer accounts with: | ||||
| Configurable access levels | |||||
| Restricted visibility to only relevant projects | |||||
| 2 | Must allow internal ticket handling across multiple departments. | ||||
| 3 | Must support multi-channel support, including: | ||||
| Email, chat, and customer portals | |||||
| In-app ticket submission | |||||
| 4 | Must provide advanced SLA compliance reporting with: | ||||
| Historical SLA trends | |||||
| Compliance audits |
| 4. Collaborative Documentation & Knowledge Management Software | |
| 4.1 Core Features | |
| 1 | Integration with Issue Tracking & Project Management Software: Seamless integration with software solution discussed in section 2 and ideally section 3, is crucial for linking documentation to issues, epics, sprints, and service requests. |
| 2 | Must support real-time collaborative editing with: |
| Multiple users editing a page simultaneously | |
| Auto-save and conflict resolution features | |
| 3 | Must provide fine-grained permissions on spaces and pages, including: |
| Role-based and individual user access controls | |
| Read, write, and admin permissions per space or page | |
| Access Control: Implement strict access control measures: | |
| Utilize built-in groups and permissions to manage access at a granular level. | |
| Integrate with your identity provider (e.g., Active Directory, Okta) for centralized user management and single sign-on (SSO). | |
| Enforce the principle of least privilege, granting only necessary access to users. | |
| Data Encryption: Ensure data is encrypted both in transit (HTTPS) and at rest. | |
| Audit Logging: Enable and regularly review audit logs to track user activity and detect potential security incidents. | |
| Compliance Requirements: Meet industry-specific compliance requirements (e.g., HIPAA, PCI DSS, GDPR) through configuration, add-ons, or external tools. | |
| 4 | Must allow in-line commenting and discussion threads within documents. |
| 5 | Must provide version control with: |
| Full version history tracking | |
| Rollback to previous versions | |
| 6 | Must support rich media embedding, including: |
| Images, videos, and interactive content | |
| Code snippets with syntax highlighting | |
| 7 | Must provide a robust search function with: |
| Full-text indexing | |
| Advanced filtering and tagging options | |
| 8 | Must allow integration with external documentation sources and APIs for: |
| Automated document updates | |
| External content embedding | |
| 9 | Must support exporting documents in: |
| Word | |
| HTML | |
| 10 | Must allow custom templates and blueprints for standardized document creation. |
| 11 | Must support integration with issue tracking tools for: |
| Linking documentation to tasks and tickets | |
| Automatic updates based on issue status changes | |
| 12 | Knowledge Base: Create a centralized knowledge base for DevSecOps practices, security guidelines, and common procedures. |
| 13 | Automation & Efficiency: |
| Automation Rules: Use automation rules to automate tasks such as: | |
| Notifying stakeholders of updates. | |
| Updating page statuses. | |
| Triggering workflows based on events. | |
| Macros and Add-ons: Utilize built-in macros and explore third-party add-ons to extend functionality: | |
| Security-focused add-ons (e.g., for vulnerability management, security checklists). | |
| Diagraming tools (e.g., draw.io, Gliffy) for visualizing architectures and processes. | |
| Reporting & Dashboards: Generate reports and create dashboards to track key DevSecOps metrics and the status of documentation. |
| Acronym Legend |
| API: Application Programming Interface |
| CAC: Common Access Card |
| CMMC: Cybersecurity Maturity Model Certification |
| CMDB: Configuration Management Database |
| CI/CD: Continuous Integration / Continuous Deployment |
| DoD: Department of Defense |
| ELK: Elasticsearch, Logstash, Kibana |
| FedRAMP: Federal Risk and Authorization Management Program |
| GitLab: A DevOps platform for source code management and CI/CD |
| HA: High Availability |
| ITIL: Information Technology Infrastructure Library |
| ITSM: Information Technology Service Management |
| K8s: Kubernetes |
| OCI: Open Container Initiative |
| PIV: Personal Identity Verification |
| RBAC: Role-Based Access Control |
| REST API: Representational State Transfer Application Programming Interface |
| SAML: Security Assertion Markup Language |
| SIEM: Security Information and Event Management |
| SLA: Service Level Agreement |
| SSO: Single Sign-On |
| STIG: Security Technical Implementation Guide |
| WYSIWYG: What You See Is What You Get |
File details come from the government source that posted it. Updated .