Questions and Govt Responses.xlsx

XLSX spreadsheet 32 KB Posted Oct 24, 2023

Attached to: DISA Business Intelligence/Data Warehouse
Solicitation number: 622468295
Issued by: Defense Information Systems Agency

About this file

Written by GovTribe AI · Dec 20, 2023

This document contains questions and responses related to a Request for Information issued by the Defense Information Systems Agency regarding a Business Intelligence/Data Warehouse solution. Key details include that DISA is seeking to consolidate, standardize, and store data from over 16 business systems across domains including finance, human resources, and logistics. The solution should incorporate data integration, user-friendly reporting interfaces, security measures compliant with FedRAMP High and IL4 standards, and business intelligence/analytics capabilities including predictive modeling. Additional requirements include scalability, near real-time data availability, and integration of emerging technologies such as artificial intelligence. Responses to the RFI are due no later than October 30, 2023.

View the file

Other files

File	Type	Posted
RFI AMD 01.pdf	PDF	Oct 24, 2023
RFI.pdf	PDF	Oct 12, 2023
Questions and Govt Responses .xlsx	XLSX spreadsheet	Oct 12, 2023

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Sheet1 DISA Business Intelligence/Data Warehouse RFI Questions and Government Responses

Question	Question/Comment	Government Response	RFI Change	Location of Change
1		RFI Reference:
"The purpose of this RFI is to gather information that can address key aspects of data integration, user experience enhancement, the latest AI technology incorporation, and FedRAMP approved cloud solutions."

Question:

When integrating the latest AI technologies within a FedRAMP approved cloud environment, how does DISA plan to ensure seamless interoperability? Are there specific AI frameworks or platforms, such as TensorFlow or PyTorch, that need to be supported?	No specific networks at this time
2	RFI Reference:

"The organization currently faces significant challenges in accessing and analyzing data from multiple business systems."

Question:

Regarding the data latency challenges, is DISA aiming for near real-time data availability? Are there current benchmarks, such as data being available within minutes, hours, or a day from its creation?	Yes, near real time. Please suggest benchmarks
	3	RFI Reference:

"The analysis of the information received from this RFI may inform a business case that outlines the benefits and potential return on investment (ROI)."

Question:

For evaluating ROI, are there existing metrics or KPIs that DISA is particularly focused on, such as reduced decision-making time, cost savings on data storage, or improved data accuracy rates?	Not answered.
	4	RFI Reference:

"The objective of this project is to consolidate, standardize, and store data from various business systems, enable ad-hoc and business system-specific reporting, and incorporate business intelligence and analytics capabilities."

Question:

With ad-hoc reporting, what's the anticipated query complexity and frequency? For instance, are you expecting mostly standard SQL queries, or is there a need for more complex OLAP operations, such as multi-dimensional analysis?	Yes.
	5	RFI Reference:

"Data integration will enhance the visibility into authoritative sources of data, availability of data elements, and data sharing agreements."

Question:

Can you elaborate on the types of data sharing agreements in place? Are there specific protocols, such as SAML or OAuth, for secure data access across different systems and stakeholders?	Not answered.
	6	RFI Reference:

"Ensure compliance with data privacy and security regulations."

Question:

Apart from FedRAMP and IL4, are there other compliance standards the system should adhere to, such as HIPAA for healthcare data or FISMA for federal information systems?	Platform must be Fedramp and IL4 compliant. Additional privacy and security regulations may be needeed based on future data types ingested.
	7	RFI Reference:

"The absence of business intelligence and analytics capabilities further hampers the organization's competitive edge and impedes its ability to gain valuable insights from data."

Question:

Are there particular analytical insights or competitive areas DISA is aiming to enhance with this initiative? For instance, is there a focus on predictive maintenance for logistics or sentiment analysis for HR processes?	Vendor can suggest predictive maintenance capabilities based on their experience.
	8	RFI Reference:

"Leveraging cloud, machine learning, and artificial intelligence technologies, this system aims to improve decision-making, enhance operational efficiency, and drive business growth."

Question:

In terms of model governance, is there an existing framework DISA follows, especially concerning model explainability and performance monitoring? Are you utilizing specific tools like MLflow or Kubeflow for these purposes?	Nothing at this time
	9	RFI Reference:

"Enable ad-hoc reporting and business system-specific reporting."

Question:

For business system-specific reporting, are there particular legacy reporting tools or platforms, such as SAP Business Objects, IBM Cognos, or Oracle BI, that you wish to retain or integrate? How do these tools influence the reporting capabilities expected from the new system?	Oracle BI, Cognos, and other legacy platforms
	10	RFI Reference:

"This system will enable the organization to efficiently consolidate, standardize, and store data from various business systems, empowering users with ad-hoc reporting and advanced analytics features."

Question:

Regarding advanced analytics, is there an expectation for the system to support self-service capabilities? Will there be different user personas, such as data analysts using tools like Tableau or Power BI and data scientists requiring more advanced capabilities like R or Python scripting?	Yes.
	11	RFI Reference:

"The primary objectives of this project are: Consolidate, standardize, aggregate, and store data from various business systems."

Question:

Considering the diverse range of the 16+ business systems, does DISA currently employ specific data integration platforms or middleware, such as Apache Kafka, MuleSoft, or Dell Boomi, for handling discrepancies in data formats and frequencies? Additionally, is there a leaning towards real-time data streaming versus traditional batch processing methods?	Currently do not have a modern COTS-driven data integration platform
	12	RFI Reference:

"Implement robust security measures to protect the confidentiality and integrity of the data. Use encryption techniques to secure data at rest and during transit."

Question:

Regarding data security, are there specific encryption protocols or standards, such as AES-256 or RSA, that have been mandated for data at rest and in transit within DISA's operational context? How does DISA handle key management and rotation in multi-tenant cloud environments?	NIST 800-171
	13	RFI Reference:

"Incorporate business intelligence and analytics capabilities."

Question:

When integrating BI and analytics capabilities, are there specific models or analytical techniques, such as decision trees, neural networks, or clustering algorithms, that DISA finds particularly beneficial for its operational needs? Additionally, how does DISA approach the challenge of model interpretability in mission-critical applications?	This is focused on business systems, which continue to mature in terms of analytics and machine learning.
	14	RFI Reference:

"Design the data architecture with scalability in mind to accommodate the growing volume of data and increasing user demands."

Question:

In anticipating data growth, is there an expectation for the system to support specific data storage technologies or platforms, such as HDFS, Amazon S3, or Azure Blob Storage? How does DISA foresee handling data retention and lifecycle management with increasing volumes?	Please follow DoD guidance on data retention rules
	15	RFI Reference:

"Creating a user-friendly interface for ad-hoc reporting."

Question:

For the user interface, are there existing standards or frameworks that DISA prefers for dashboard and reporting tools, such as D3.js, Highcharts, or React? Additionally, how critical is mobile responsiveness in DISA's reporting interface strategy?	Will allow vendor to express recommendations based on expertise; Mobile device compatibility is required
	16	RFI Reference:

"Implement data validation procedures to ensure the accuracy and integrity of the consolidated data."

Question:

Could you elaborate on the current strategies employed for data validation? Are there specific tools or frameworks, like Apache Griffin or Talend, that DISA utilizes for data quality assurance? How are data lineage and provenance handled in the current ecosystem?	Current solution fully embedded in legacy system design.
	17	RFI Reference:

"The analysis of the information received from this RFI may inform a business case that outlines the benefits and potential return on investment (ROI) of developing a comprehensive data consolidation and reporting system."

Question:

Regarding the transition to full operational capability, are there preferred project management methodologies, such as Agile, Scrum, or Waterfall, that DISA has found effective in similar past initiatives? How does DISA typically handle change management in such large-scale transitions?	Vendor should be prepared for a hybrid approach.
	18	RFI Reference:

"Migrating existing reporting features of selected business systems to the new system."

Question: In the context of data migration and integration from legacy systems, are there specific formats or protocols, such as ETL processes, flat files, or database replication, that have posed significant challenges in past DISA projects? How has DISA ensured minimal downtime during such migrations?	Data platform must support different connectors including flat files, XML, direct connection etc.
	19	RFI Reference:

Question:

Considering the diverse user roles, does DISA have a framework for user access management and role-based permissions, especially for users handling sensitive data or performing complex data analysis? Are there specific training protocols in place for new system implementations?	New framework should be able to support RBAC/ABAC
	20	RFI Reference:

"The analysis of the information received from this RFI may inform a business case that outlines the benefits and potential return on investment (ROI)..."

Question:

Does DISA rely on specific financial models or cost-benefit analysis frameworks for ROI evaluation? Are there key metrics, such as TCO, payback period, or net present value, that were particularly instrumental in assessing ROI for similar initiatives?	Not answered.
	21	RFI Reference:

"Respondents are requested to identify any requirements included in this RFI that may overly limit or hamper competition."

Question:

When assessing potential solutions, does DISA give special consideration to proven use cases or success stories, especially those demonstrating effective data integrations in highly regulated environments like defense or intelligence agencies?	Use cases as close to the DISA environment/business model possible are anticipated.
	22	RFI Reference:

"Leverage cloud, machine learning, and artificial intelligence technologies."

Question:

In terms of adopting emerging technologies, how receptive is DISA to innovative approaches like blockchain for secure data lineage tracking or federated learning for AI model training while maintaining data privacy? Does DISA have any existing initiatives exploring these areas?	Tell us about your experience
	23	Will this effort require a DD254?	This is an RFI
	24	Should the contractor have a facility clearance (FCL) to compete for this opportunity?	This is an RFI
	25	Typically, mature systems like those described in the RFI have existing data integration which can be extended to connect additional solutions such as a data collection solution described to minimize additional cost:
Does DISA have any integration technologies being used in the business domains listed (finance, hr, etc.) and would DISA consider extending their use for this effort? If so, what technologies are these?	Focus would be on adopting new technologies, though some legacy methods may need to remain for some time such as FTP or Flat File direct upload.
	26	Also, there are several cloud providers including AWS, Azure, Oracle and others with which Vendor name omitted for cofidentiality has mature capabilities.
Does DISA have a strategy and/or roadmap to further extend the use of any of these and if so, which?	One purpose of the RFI is to establish such a strategy
	27	Who is the intended user base for the Business Intelligence/Data Warehouse tool (leadership, managers, general staff, etc.) and how many users does DISA expect the tool to support?	User base covers entire organizational chain of command.
	28	How much and what type of unstructured data does DISA anticipate integrating into the tool?	We will not communicate sizing and types at this time
	29	Of the 16+ systems referenced in Scope of Effort, can DISA provide an estimate of how much data from these systems (daily, weekly, monthly or yearly) needs to be consolidated, standardized, aggregated, and stored?	We will not communicate sizing and types at this time
	30	Description of Procurement - references FedRAMP approved. Architecture Design references IL4. Can the government please confirm whether they expect to run this in a FedRAMP or DoD/IL5 environment?	IL4
	31	Scope of Effort - Can the government provide additional details on the 16+ business systems?	We will not communicate details of the 16 systems at this time
	32	How large does the government estimate that the data warehouse will be? How much data per day will be transferred to the data warehouse? What, if any, latency in the data transfer is acceptable? Can the data updates be batched or should data be transferred in real time?	We will not communicate sizing at this time, however, latency performance should reflect as near real time as possible.
	33	Data Integration - 'migrating existing reporting features of selected business systems'. Can the government provide additional details on the selected 16+ business systems and whether this is all reporting functions for the selected applications or a subset?	We will not provide information on the 16 systems at this time.
	34	Will the selected vendor be responsible for the operations and maintenance of the solution after it is implemented? Will the vendor need to provide training to the government?	Responsibility is TBD depending on solution, however, some amount of training should be anticipated
	35	Where appropriate, will the government consider a hybrid solution consisting of on-premises COTS products and Cloud PaaS services?	The government will consider all reasonable and modern solutions as directed by DoD software modernization strategy.
	36	Is this replacing an existing data warehouse system(s) or a new implementation?	New implementation
	37	What data sources and data types are expected to be consumed and stored by the analytics solution?	Multiple legacy platform business systems consisting of billing, HR, purchasing etc
	38	For performance, to provide AI/ML and data science, and to offload query workloads from the database, can analytics tools cache data for offline analysis?	May be appropriate for part of the solution
	39	There was an RFI posted in May 2023 for a requirement titled "Defense Commissary Agency (DeCA) and Enterprise Data Warehouse / Business Intelligence (EDW/BI) Support" under SAM.gov notice ID: 832366398. Can the Government please clarify if that is separate and unrelated to this "DISA Business Intelligence/Data Warehouse" requirement?	This RFI is mutually exclusive
	40	It is our understanding that this is a new requirement (no incumbent). Can the Government please clarify if there are any related legacy contracts being consolidated into this new requirement?	This is a new requirement.
	41	The scope of the project includes designing and implementing the comprehensive data consolidation system. Will licensing costs for the system be procured through another contract, or is the intent that this contract will include software costs and services?	This is a request for information. Contract types have not yet been determined.
	42	Is the government looking to build a new system from the ground up or is it open to leveraging a pre-existing solution?	New system
	43	Is there a list of data source types to connect to? E.g. relational DBs, NoSQL, flat files, etc.	Not a complete list, however, all of these would apply.
	44	Are there any existing tools/agreements in place that must be part of the solution?	Not answered.
	45	What classification levels are the data sources? (Unclass, Secret, Top Secret, etc.)	Unclass, CUI
	46	If all data types aren’t Unclass/equivalent, is there an existing Cross-Domain Solution (CDS) in place?	No cross domain solution present
	47	Is the intent to store redundant data in the centralized warehouse/repository? (Section 3 – Data Storage)	Yes
	48	Is there any idea of the viewer:creator ratio for the target system? (Goes to designing for cost-efficient scaling)	This is a large government agency with significant user base. The system must be fully scalable.
	49	Are there any specific restrictions on AI technologies within the targeted environments? (Some gov agencies have restricted or banned tools that use LLM/other AI technologies, sometimes by name)	No restrictions at this time
	50	Are there any specific requirements to support use from/at restricted/low/intermittent-bandwidth/connected sites? (e.g. At the edge/in conflict zones/etc.)	Not at this time
	51	Is data expected to be available for queries/reports/dashboards in real-time? If not, what is the SLA for availability once the host data source has been updated/received new data?	There are many near-real time desired scenarios
	52	How much data are you looking to ingest into a consolidated repository?	Not answered.
	53	Do you require a variety of transformation/loading methods (batch, real time) to move data into a consolidated repository? Additionally, where does this data currently reside (on premises, in one-or more clouds and which cloud providers, etc)?	Multiple transformation methods will be necessary, which must be compatible and sustainable. All data is currently on prem.
	54	Are you interested in capabilities to execute distributed/virtualized queries across data silos/warehouses/sources/clouds in addition to consolidation?	Yes
	55	Can you provide information on the structured data formats you need to connect or ingest data from (e.g., Teradata Datawarehouse, Oracle Exadata, etc.)?	Not answered.
	56	Is the main objective of this market research to evaluate technology solutions, consulting services for implementation, or both in a combined manner?	Yes
	57	Can DISA clarify if it is looking for responses from industry relative to particular product features or capabilities in this RFI, or if you are also seeking feedback regarding enhancements to user experiences and operational efficiencies by way of a solution?	Please provide thoughtful responses on potential efficiencies and experiences
	58	Roughly how much data (in GB/TB, etc) would be in the to-be consolidated system? What would be the unstructured data volume?	Not answered.
	59	What are the unstructured data formats?	Not answered.
	60	Are there critical volume/time windows that you need to meet for any data ingestion process (example: you need to move 500 GB on a daily basis, and this needs to occur in an 8 hour window)?	Not answered.
	61	What are the frequencies/periodicities during (range is ok) by which data stores and/or dashboards will be updated?	Near real time data is expected
	62	"Migrating existing reporting features of selected business systems to the new system."
Question: Please clarify which type features you would like to be "migrated" or replicated into the new system?	Reporting
	63	Are the title page and company information (Interested parties are requested to provide the following information: a. Company Information) included in the page count of 15?	Yes.
	64	Can DISA clarify if there existing DISA, DoD, or Federal services (e.g. user authentication, data catalogs, etc.) with which DISA expects this solution to integrate?	Data catalog: Collibra/Advana
	65	Does this effort assume all data will be cataloged in the DISA Enterprise Data Catalog per guidance from the DISA Strategy Implementation Plan (IPlan)?	Yes
	66	Is there an expectation that curated datasets created in this application will need to be transmitted externally to DISA (or other) business systems (e.g. CMIS) such that a bi-directional data flow will be necessary?	Yes
	67	Can DISA clarify if it is contemplating user self-service for BI/dashboard creation as part of this solution, or will one prime vendor team create all dashboards that may then be manipulated by end-users?	The solution design will be evaluated as part of the RFI responses
	68	Can DISA clarify if there are (or will be) requirements for role-based segregation of data access?	Yes, and ABAC as well
	69	Would DISA entertain business process optimization or reengineering to supplement this technical capability?	Out of scope for this RFI
	70	Can DISA clarify if this solution will also include performance of stakeholder outreach to perform things like requirements decomposition and user adoption?	This would be a future exercise
	71	Can DISA clarify what, specifically, is meant by “AI Technology” in terms of features that must be available to users? Also, can clarifications be provided as to whether this is in a self-service or managed service context?	Please suggest based on your expertise
	72	Can DISA clarify where the 16+ business systems are located today? For instance, Mainframe, database, flat files etc.	All of the above
	73	Noting the IL4 requirement, can DISA clarify that none of the business systems to be integrated or relevant datasets are on classified networks?	Confirmed
	74	How do you envision the integration of workflow and automation within the platform to streamline processes for users?	Improve speed of queries and provide transparency of analytical products thus avoiding duplication of effort.
	75	Will you honor existing IL4 ATO reciprocity within DISA?	Not answered.
	76	Is IL4 CAC SSO capability (Okta or other) desired for users accessing the envisioned BI/Data Lake environment?	Yes
	77	Can DISA provide the approximate number of users that would be using the system for Dashboarding/visualization and reporting. Also what would be the approximate number of concurrent users	We are a large government agency
	78	Will non-Cloud Service Offerings be considered?	No
	79	Will you accept a Cloud Service Offering that is currently in process of getting on the FedRAMP marketplace as a FedRAMP High offering?	Possibly
	80	Will you accept a Cloud Service Offering that is currently in process of getting on the DISA Cloud Catalog as an IL4 offering without already being on the FedRAMP maketplace?	Possibly
	81	Page 3 - Data Integration: Does the data integration architecture require support for event-driven and data virtualization architectures?	Yes
	82	Page 4 - Security and Privacy, Scalability and Performance:
Will the consolidated system be accessible to the public, or is it intended for internal use only?	Internal use only, with an eventual path for some users outside of DISA
	83	Page 4 - Security and Privacy, Scalability and Performance:
What is the anticipated user load for the consolidated system?	We are a large government agency
	84	Page 4 - Security and Privacy, Scalability and Performance:
Is there a need for mobile access to the consolidated system?	Yes
	85	Page 5 - AI Technology: Is the Government looking for an exhaustive list of ways to apply Artificial Intelligence (AI) and Machine Learning (ML) to significantly enhance predictive analytics and business intelligence? Ex: Predictive modeling, Grantee Analytics, Forecasting, Anomaly / Fraud detection, etc.	Not exhaustive, but meaningful and relevant and immediately usable
	86	Page 5 - Cloud Solutions (FedRAMP Approved): Please confirm if the Government is looking for a list of FedRAMP High compliant solutions only and there should be no mention of FedRAMP Moderate and Low Impact solutions.	Must be FedRAMP high
	87	Page 6 - Response Guidelines: Will the Government allow 10 point font for tables and graphics?	Font used for graphics shall be no smaller than ten points. Any other text present on any document shall be 12-point font.	Y	Page 6, paragrpah 5
	88	The Government states that there are 16 business systems in which the contractor will be required to consolidate, standardize, agrregate, and store data from. Can the Government identify the 16 systems, along with any contractors or contract numbers that are currently supporting the systems?	We will not provide information on the 16 systems at this time.
	89	Does the government currently have an instantiation or proof of concept (POC)?	No
	90	Is there a preferred technology stack, cloud service provider, or ecosystem for the requirement?
	No
	91	Will the government share whether the system currently has an Authority to Operate (ATO) for the POC?	N/A
	92	Is there an incumbent contract for this work? If so, can the government please provide the vendor and contract number.	No incumbent
	93	Can the government provide more details on which office/division within DISA is leading and driving this effort? Or if this is a cross-functional and cross-organizational effort?	DISA Business Systems 'SD2'
	94	Can the government provide a list of existing tools, platforms, solutions (whether cloud or on-premise) that are already in place (i.e., current state)?	Oracle, Mainframe, Web Server, SQL
	95	Will the Government list the 16+ business systems identified in 2. Scope of Effort?	We will not provide information on the 16 systems at this time.
	96	Has the Government identified preferred business intelligence and visualization tools as mentioned in 2. Scope of Effort, and if so, what are they?	No
	97	“Consolidate, standardize, aggregate, and store data from various business systems.

16+ Business Systems covering the following domains:

l Finance l Human Resource and Learning Management l Acquisition, Procurement, Contracting Data, and Logistics"

Does the Contracting Officer believe having access to the data referenced above creates an OCI due to access to proprietary information that would prevent contractors from competing on other future DISA acquisitions? If yes does the Contracting Office believe that the OCI is mitigable?	IAW with FAR 9.5, at the time of the RFP/RFQ, there will be an opportunity for vendors to address/explain any potential Organizational and Consultant Conflicts of Interest (OCCI) concerns in their formal proposals. This concern is not required to be addressed at the present RFI stage.
	98	Does DISA anticipate this work being procured through the DISA JSP acquisition office or will the execution of the work involve DISA JSP at all?	This is an RFI
	99	Does the government prefer the ability for a vendor to provide the BI Data Warehouse systems only? Or will it require acquisition service support as well?	Provide a complete solution recommendation according to your experience
	100	Can the govenrnment share the 16+ system connection types (e.g. ODBC, flat file, pdf, MS Word, user interface download,..)	This platform should be able to accommodate virtually any connection method
	101	Can the government share their cloud preference - DISA Commuting Environment, MiLCloud, AWS, No preference (just IL4) etc…	No preference
	102	Will the Government consider extending the RFI response due date by one-week from 30 October 2023?	The Government will not be extending the RFI response due date. The formal responses t this RFI remain due NLT 2:00 PM EST on October 30, 2023.

File details come from the government source that posted it. Updated Oct 24, 2023.