RFI - Update 1.docx

REQUEST FOR INFORMATION

The Defense Information Systems Agency (DISA) Services Directorate is seeking information from industry to assist with the development and planning of a potential new requirement.

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE ONLY. THIS IS NOT A REQUEST FOR PROPOSALS (RFP). NO SOLICITATION IS AVAILABLE AT THIS TIME.

1. Overview/Purpose/Description of Procurement DISA seeks technology upgrades and solutions to the Department of Defense (DoD) Secure Access File Exchange (SAFE) application. The objective is to introduce a new modernized SAFE application and back-end architecture that can continue to support the DoD file sharing capability with the growing requirement set to provide a more secure file sharing capability that supports larger file sizes to a continuously growing set of users.

DISA is in the need of a modernized DoD SAFE file sharing capability to allow for larger file sizes of 40GB or larger to be shared between DoD users and supporting parties through a secured design architecture, built on zero-trust principals that is also scalable to meet growing demands on the system from higher utilization and larger file sizes. The solution will need to be hosted either through an On-Premises solution or through a GovCloud FedRAMP hosted solution provider and meet all applicable STIGS, privacy laws, regulation, and Executive Orders to include but not limited to the Privacy Act of 1974, e-Government Act of 2002 and the Right to Financial Privacy Act Regulations (32 CFR Part 275). The solution is expected to comply with the DoD’s emerging Zero Trust Framework and will need to be capable of achieving a Provisional Authority to Operate.

In December 2018, DISA tasked the Services Directorate with developing and fielding a DoD file sharing service to fill the capability gap that would be left by the decommissioning of the Aviation and Missile Research, Development and Engineering Center (AMRDEC) SAFE file sharing platform. Since that time, DISA has leveraged a number of requirements on the program in order to safeguard the system and improve the level of service and capability in order to better serve users.

The purpose of this RFI is to capture information on new file sharing technologies and capabilities that can be employed to modernize the DoD SAFE file sharing capability that can support both Impact Level 5 (IL5) and Impact Level 6 (IL6) standards for deployment to both the Non-Classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet). DISA is looking to gather Rough Order of Magnitude information for such technologies, along with information on innovative strategies for the development of a resilient, scalable architecture that will support the current and future demands placed on the system as the user base and file size demands continue to grow. The objective for this upgrade will be fielding of the capability within 12 months of award.

Current Environment The current version of DoD SAFE is built on top of ZendTo, an open-source web-based file transfer application framework. This framework was originally adopted by the AMRDEC SAFE platform and later reused to stand up the initial DISA DoD SAFE application. Since that time, the application has received many new version releases and software updates. Due to the limitations of the original ZendTo framework, some of these updates required a significant amount of patchwork within the code, which has become cumbersome to maintain and inefficient to execute. Now that the program is faced with developing more modern capabilities and advanced security features, the program has reached a point where it can no longer continue to maintain the current code base and modernize the capabilities and security features that DoD SAFE offers.

2. Scope of Effort The scope of the DoD SAFE project will involve the upgrade or removal and replacement of the current applications with a modernized solution.

3. Requested Information

Fielding Descriptions The following fielding conditions are baselined on the need to operate file sharing capabilities at both the Unclassified and Secret classification level.

DoD SAFE Unclassified (IL5) NIPR Solution

DoD SAFE Unclassified solution will support the bulk of DoD SAFE file transfers due to a unique requirement to provide file sharing capabilities across the DoD and 3rd party supporting organizations, such as non-DoD governmental agencies, industry, and academia. This solution will need to be capable of transmitting files, containing documents with the classification marking for Controlled Unclassified Information (CUI), as well as files containing Personal Identifiable Information (PII) and Protected Health Information (PHI).

DoD SAFE Secret (IL6) SIPR Solution

The DoD SAFE Secret solution will provide file transfer and sharing capabilities to DoD service members, government civilians and contractors, who are SIPR Token holders and have access to SIPR terminals. This capability will only exist to fill a capability gap in file sharing between SIPR token holders that reside on different tenants or SIPR enclaves and are unable to share large files through other means, such as SharePoint, Teams, One Drive or other DoD365 file sharing capabilities. While it is not a defined requirement, DISA would also like to know if the proposed solution could provide one-way cross-domain file sharing from SAFE NIPR to SAFE SIPR and details on how this could be accomplished.

DoD SAFE Requirements The requirements are defined as operational and system-based requirements. Solutions will need to pass the Joint Interoperability Test Command (JITC) testing process which includes interoperability (IO) testing based on the functional element requirements, and cybersecurity testing which is an assessment based on active scanning and STIGs. All requirements need to be addressed with a solution for each fielding condition in the response. For requirements that are not currently supported please provide capabilities roadmap documenting when requirement would be supported. The DoD SAFE requirements are as follows:

· Provide DoD SAFE DoD Government and military employees, contractors, academia and DoD Supporting agencies and organizations the ability to share files up to 40GB or larger

· Provides a simple and intuitive interface to users that requires minimal or no training to use

· Provide a scalable architecture that can quickly respond to sudden spikes in utilizations and meet the continuously growing demand for file sharing

· Provides a zero-trust architecture with Multi-Factor Authentication that will allow access to all DoD military, civilian and authorized contractor personnel, while only allowing guest access to other users

· Requires DoD military, civilian and authorized contractor personnel to “sponsor” all file sharing transactions and prohibits guest users from sharing files without a “drop-off request” from a sponsoring DoD authorized user

· Provides the ability to set file sharing controls to allow, limit or prohibit re-sharing of the files received by a user

· Provides a platform that can support both Impact Level 5 (IL5) and Impact Level (IL6) for file sharing on both the Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet)

· Provide file encryption of data in transit and at rest to comply with the FIPS 140-2 standards

· Provides the required security to allow users to share files, marked as Personal Identifiable Information/Protected Health Information (PII/PHI)

· Provides a virus scanning capability that prohibits uploads, containing malicious file signatures

· Provide a NetOps toolset and analytics capability to provide visualization of system utilization metrics and to help monitor and detect malicious user activity

· Provides privileged administrator access for the purpose of managing resources, administering audits and quickly addressing spillage incidences

· Provides a logging capability to capture and retain transaction details to aid in potential audits, analysis of cyber threats or answer requests for information to aid in criminal and legal investigations

· Meets all applicable STIGS, privacy laws, regulations, and executive orders to include by not limited to the Privacy Act of 1974, e-Government Act of 2002 and the Right to Financial Privacy Act Regulations (32 CFR Part 275)

Solution Questions to be Answered

The following questions pertain to DoD SAFE and require a response:

Questions:

· How would an authorized DoD user share files with other authorized DoD users?

· How would an authorized DoD user share files with “guest” users?

· How would a “guest” user share a file with an authorized DoD user?

· How would the system protect against unauthorized file pick-ups or a file pick-up by a user other than the intended recipient?

· If possible, how would respondent address Cross Domain (NIPR to SIPR) requirement?

· What security measure would be put in place to allow for the transmission of files marked CUI, PII and PHI on NIPR and SECRET on SIPR?

· How would the system defend against malicious file uploads and other cyber threats to the system?

· What level of access would be provided to an administrator and what features and capabilities would be available to them for the purpose of audits, security and aiding in criminal investigations?

· What events will be logged by the system?

· What NetOps tools would be provided to system administrators?

· Can the system respond to sudden spikes in demand to protect against degradations in service?

· From date of contract award, what is estimated timeframe for completion of each fielding condition? With the Plan of Action and Milestones (POAM) please identify any dependencies and/or risks that could impact the schedule.

Interested parties are requested to respond to this Request for Information (RFI) with a white paper. Submissions cannot exceed 10 single-spaced pages, 12-point type with at least one-inch margins on 8 1/2” X 11” page size. The response should not exceed a 5 MB email limit for all items associated with the RFI response. The following items will not be considered when calculating page limits: cover page, table of contents, glossary, and executive summary. Page limitations shall not be circumvented by including text boxes/pop-ups or Internet links to additional information; such inclusions will not be considered. Responses must specifically describe the contractor’s capability to meet the requirements outlined in this RFI. Oral communications are not permissible. SAM.gov will be the sole repository for all information related to this RFI.

Submission Details- Responses should include:

1) Company name, address, and contact details/

2) UEI and CAGE number.

3) Business Classification / Socio-economic status (e.g., large, small, 8(a), women owned, HUBZone, SDB, Service-Disabled Veteran Owned).

4)Industry (NAICS) Codes (North American Industry Classification System).

5)Vehicles and contracts held (vehicle, agency, expiration date), including GSA Federal Supply Schedule contracts or other Government-wide Acquisition Contracts (GWACs) vehicles (i.e., NITAAC, GSA Alliant, etc.).

(This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Companies who wish to respond to this RFI should send responses via email no later than 12 April 2024 at 1:00 PM EST to Corey Wollard at corey.j.wollard.civ@mail.mil or Michael Pirone at michael.e.pirone.civ@mail.mil.

Industry Discussions DISA representatives may choose to meet with respondents who may be potential offerors and hold one-on-one informational discussions. Such informational discussions would only be intended to obtain further clarification of potential capability to meet the requirements, including any development and certification risks. Individual meetings with respondents are solely at the discretion of the Government.

Questions Questions regarding this announcement shall be submitted in writing by email to corey.j.wollard.civ@mail.mil or michael.e.pirone.civ@mail.mil. Verbal questions will NOT be accepted. Answers to questions will be posted to SAM.gov. The Government does not guarantee that questions received after 12 April 2024 at 1:00 PM EST will be answered. The Government will not reimburse companies for any costs associated with the submissions of their responses.

Disclaimer This RFI is not an RFP. This RFI does not constitute a solicitation and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses in any form are not offers and the Government is under no obligation to award a contract as a result of this RFI. No funds are available to pay for the preparation of responses to this announcement and any information submitted by respondents to this RFI is strictly voluntary. Responses will not be considered as proposals, nor will any award be made as a result of this RFI.

All information contained in the RFI is preliminary as well as subject to modification and is in no way binding on the Government. FAR clause 52.215-3, “Request for Information or Solicitation for Planning Purposes,” is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Responders to this RFI are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on capabilities available. This RFI is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received in this RFI that is marked “Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.