25RB034RFI_Atlassian_Final.xlsx

XLSX spreadsheet 35 KB Posted

Attached to
FA830725RB034_RFI_Atlassian
Solicitation number
FA830725RB034_RFI_Atlassian
Issued by

About this file

This is a Request for Information (RFI) Excel file seeking information about Atlassian Jira and Confluence licenses or alternative solutions for Platform One (P1), which supports DevSecOps operations across the Department of Defense. The RFI is issued by the Department of the Air Force Materiel Command Lifecycle Management Center at Joint Base San Antonio.

The requirements focus on collaboration tools and service management capabilities that must meet strict DoD security standards, including FedRAMP High certification, NIST compliance, and CMMC Level 3+. Key technical requirements include self-hosting capability in AWS GovCloud, Kubernetes deployment support, SSO integration, and extensive customization options. The solution must provide comprehensive issue tracking, project management, ITSM features, and collaborative documentation capabilities. P1 currently serves the US Space Force and nine other customers, utilizing Atlassian tools for software development, cyber operations, and project management. Vendors are asked to provide detailed information about licensing options, transition costs, training requirements, and pricing plans, including willingness to enter into contracts with a base year and up to four one-year options.

View the file

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

RFI Excel version of Word sheet

P1 (Platform One) currently utilizes the Atlassian Jira and Confluence licenses on a continuous basis, directly supporting its DevSecOps (Development, Security, and Operations) across the organization. The Atlassian tool suite is used to facilitate and streamline software development and delivery and provides the program efficient methods to capture data and deliverables.

P1's customer includes US Space Force and nine others, which are tasked with synchronizing and coordinating cyberspace planning & operation within the DoD. The approach for strategically collecting, fusing, and processing cyber data and intelligence for situational awareness and battle management. The concept of operations (CONOPS) breaks down into four layers: 1) Infrastructure, 2) Data, 3) Common Services, and 4) Applications. These layers build on each other; P1 is the foundation for the first three (3) layers, and its services are used by developers in the Application layer as well as by cyber operators. Common Services are defined as core services that are common across Joint Cyber Warfighting Architecture (JCWA) components to eliminate unnecessary redundancies in software development.

The Jira and Confluence licenses provide information support and service management for personnel throughout P1 from in/out processing, tracking of office data, project management for simple and complex projects to complete projects efficiently while producing quality results. Jira software is a suite of agile work management solutions that allows collaboration across all teams from conception to the customer. The Confluence tool allows the teams to build, organize, and collaborate on work in one place from virtually anywhere, which is important in today's virtual offices. Confluence aids in fostering a transparent team with every level of the team able to contribute, share, and receive feedback, business status updates and strategic planning to allow the team to turn visions into values. The wider architecture of the Atlassian Suite is already in use by P1 therefore the Jira and Confluence tools of the Atlassian suite will continue to seamlessly integrate with the current architecture. These tools have since become an integral part of P1 operations and customer organizations.

2 For each licensing option/solution set, please provide how it is similar from the listed license.

(Specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities)

3 For each licensing option/solution set, please provide how it meets the above requirements.

(Identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license type.)

4 For each licensing option/solution set, clarify how it meets the above requirements for our logging and monitoring needs.

(Please highlight specific ways in which each licensing tier can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.)

Pricing Information:
1For each license, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution.

(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.)

2 For each license, please provide any price plans associated such as monthly, trial, annual.

(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.)

Other Considerations:
1Are there any additional features or benefits associated with the different licenses that we should consider?

For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses.

2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?

(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.)

Requirements Capability Sheet

Atlassian ALTERNATIVE:[PUT NAME HERE]
Instructions:Please select Y/NPlease type Y if Yes, N if no plans, or N/A if ready on day 1Please insert # of days from award to build capability or a date if knownPlease insert comments, questions, or concerns for each requirement if needed
Requirement:Ready on Day 1Future CapabilityEstimated date of CapabilityComments
Collab Tools & Service Management Tool Requirements
1. General Requirements
1All tools must be able to pass security scanning and be available in the Platform One Iron Bank.
2Must be allowed to be self-hosted within the DoD's AWS GovCloud environment.
3Must be deployable in a Kubernetes (K8s) cluster with support for Helm charts and operator-based deployments.
4Must support containerized deployment using Docker or OCI-compliant images with automated vulnerability scanning.
5Must comply with DoD security standards, including:
Security Technical Implementation Guides (STIGs)
FedRAMP High certification
NIST 800-171 and NIST 800-53 compliance
Cybersecurity Maturity Model Certification (CMMC) Level 3+
6Must allow for extensive customization through:
Plugin-based extensions
API-based automation
Custom script execution within workflows
7Must provide full audit logging for:
Compliance reporting
Security monitoring
User activity tracking
8Must support Single Sign-On (SSO) via:
SAML 2.0
OAuth 2.0
CAC/PIV authentication
9Must provide fine-grained role-based access control (RBAC) including:
Project-level, group-level, and individual user permissions
Attribute-based access control (ABAC) for sensitive data
10Must support notification banners for:
Classification level indicators
System-wide announcements
Security and compliance alerts
2. Issue Tracking & Project Management
2.1 Core Functionality
1Must support agile methodologies, including:
Scrum (sprint planning, backlog grooming, velocity tracking)
Kanban (swimlanes, work-in-progress limits, cycle time tracking)
2Must provide customizable workflows with:
Custom statuses, transitions, and automation rules
Conditional logic for workflow transitions
Custom script execution within workflows
3Must support advanced custom field types, including:
Date pickers
Multi-select dropdowns
Cascading selects
Calculated fields
4Must provide built-in SLA tracking with:
SLA policies per project or issue type
Real-time SLA breach alerts
SLA compliance reports
5Must support multiple issue types, including:
Epics, stories, tasks, and bugs
Custom issue types based on project needs
6Must support bulk issue operations, including:
Editing, transitioning, reassigning, cloning, and deleting
7Must allow linking issues across different projects with:
Dependency tracking (blocks, is blocked by, duplicates, etc.)
Cross-project reporting
8Must support email-based ticket creation with:
Configurable parsing of email subject and body
Auto-assignment rules based on email attributes
9Must support integration with Chat Ops for:
Real-time notifications
Automated responses to system events
Two-way communication for issue resolution
10Must support integration with GitLab, including:
Bidirectional issue synchronization
CI/CD pipeline triggering from issue status changes
Commit and merge request linking
Dynamic widgets for real-time updates
Drill-down reporting capabilities
11Must integrate with source code control platforms like GitLab for:
Issue tracking within repositories
Automatic linking of commits and pull requests
12Must support project data export and import from:
Other issue tracking platforms (Jira, ServiceNow, Redmine, etc.)
JSON, XML, and CSV formats for archival purposes
2.2 Customization & Extensibility
1Must support scripting/custom automation, including:
Built-in automation tools
Support for Python, Groovy, or JavaScript scripting
2Must allow UI modifications via:
Custom themes
Custom dashboard layouts
3Must support webhook-based integrations for:
Triggering external workflows
Event-driven automation
4Must provide REST API and GraphQL endpoints for:
CRUD operations on issues, projects, and users
Custom integrations with external systems
5Must support custom notification schemes for:
Granular control over event-based notifications
Support for email, Chat Ops, and webhook notifications
2.3 Performance & Scalability
1Must support high availability (HA) and disaster recovery, including:
Multi-node clustering
Zero-downtime upgrades
Automated failover mechanisms
2Must scale horizontally with:
Kubernetes-based auto-scaling
Load balancing across multiple nodes
3Must support external database configurations, including:
PostgreSQL
Oracle
MS SQL
4Must allow indexing optimizations for:
Handling large datasets
Search performance improvements
3. Service Management & ITSM
3.1 ITSM & Help Desk Features
1Must support customizable customer portals with:
Self-service options
Configurable branding
Multi-language support
2Must provide ITIL-compliant service request, problem, and change management with:
Prebuilt ITIL templates
Custom approval workflows
3Must integrate with asset management and CMDB solutions for:
Tracking IT assets
Linking assets to support tickets
4Must allow for SLA enforcement with:
Automated breach notifications
SLA-based ticket prioritization
5Must allow dynamic custom forms with:
Conditional field visibility
Pre-filled field values based on user roles
6Must support email-based ticket creation and updates.
7Must integrate with knowledge bases for:
Self-service troubleshooting
Suggested solutions based on ticket data
3.2 Automation & Rules-Based Processing
1Must support auto-assigning tickets based on:
Load balancing between team members
User skillset and expertise
2Must provide rules-based ticket categorization with:
AI-driven or manually configured rules
3Must support multi-level approvals for change management.
4Must allow for chatbot-driven automation via Chat Ops.
3.3 Customer Management
1Must allow external customer accounts with:
Configurable access levels
Restricted visibility to only relevant projects
2Must allow internal ticket handling across multiple departments.
3Must support multi-channel support, including:
Email, chat, and customer portals
In-app ticket submission
4Must provide advanced SLA compliance reporting with:
Historical SLA trends
Compliance audits
4. Collaborative Documentation & Knowledge Management Software
4.1 Core Features
1Integration with Issue Tracking & Project Management Software: Seamless integration with software solution discussed in section 2 and ideally section 3, is crucial for linking documentation to issues, epics, sprints, and service requests.
2Must support real-time collaborative editing with:
Multiple users editing a page simultaneously
Auto-save and conflict resolution features
3Must provide fine-grained permissions on spaces and pages, including:
Role-based and individual user access controls
Read, write, and admin permissions per space or page
Access Control: Implement strict access control measures:
Utilize built-in groups and permissions to manage access at a granular level.
Integrate with your identity provider (e.g., Active Directory, Okta) for centralized user management and single sign-on (SSO).
Enforce the principle of least privilege, granting only necessary access to users.
Data Encryption: Ensure data is encrypted both in transit (HTTPS) and at rest.
Audit Logging: Enable and regularly review audit logs to track user activity and detect potential security incidents.
Compliance Requirements: Meet industry-specific compliance requirements (e.g., HIPAA, PCI DSS, GDPR) through configuration, add-ons, or external tools.
4Must allow in-line commenting and discussion threads within documents.
5Must provide version control with:
Full version history tracking
Rollback to previous versions
6Must support rich media embedding, including:
Images, videos, and interactive content
Code snippets with syntax highlighting
7Must provide a robust search function with:
Full-text indexing
Advanced filtering and tagging options
8Must allow integration with external documentation sources and APIs for:
Automated document updates
External content embedding
9Must support exporting documents in:
PDF
Word
HTML
10Must allow custom templates and blueprints for standardized document creation.
11Must support integration with issue tracking tools for:
Linking documentation to tasks and tickets
Automatic updates based on issue status changes
12Knowledge Base: Create a centralized knowledge base for DevSecOps practices, security guidelines, and common procedures.
13Automation & Efficiency:
Automation Rules: Use automation rules to automate tasks such as:
Notifying stakeholders of updates.
Updating page statuses.
Triggering workflows based on events.
Macros and Add-ons: Utilize built-in macros and explore third-party add-ons to extend functionality:
Security-focused add-ons (e.g., for vulnerability management, security checklists).
Diagraming tools (e.g., draw.io, Gliffy) for visualizing architectures and processes.
Reporting & Dashboards: Generate reports and create dashboards to track key DevSecOps metrics and the status of documentation.
Acronym Legend
API: Application Programming Interface
CAC: Common Access Card
CMMC: Cybersecurity Maturity Model Certification
CMDB: Configuration Management Database
CI/CD: Continuous Integration / Continuous Deployment
DoD: Department of Defense
ELK: Elasticsearch, Logstash, Kibana
FedRAMP: Federal Risk and Authorization Management Program
GitLab: A DevOps platform for source code management and CI/CD
HA: High Availability
ITIL: Information Technology Infrastructure Library
ITSM: Information Technology Service Management
K8s: Kubernetes
OCI: Open Container Initiative
PIV: Personal Identity Verification
RBAC: Role-Based Access Control
REST API: Representational State Transfer Application Programming Interface
SAML: Security Assertion Markup Language
SIEM: Security Information and Event Management
SLA: Service Level Agreement
SSO: Single Sign-On
STIG: Security Technical Implementation Guide
WYSIWYG: What You See Is What You Get

File details come from the government source that posted it. Updated .