DoD SAFE RFI QA 01092026.xlsx
XLSX spreadsheet 79 KB Posted
- Solicitation number
- 622673683
- Issued by
-
Defense Information Systems Agency
About this file
This document is a Request for Information (RFI) for the Department of Defense Secure Access File Exchange (DoD SAFE) Modernization, containing 30 detailed questions and responses from the Defense Information Systems Agency (DISA). The RFI seeks to gather information about modernizing the existing file transfer system, with key technical requirements including handling unclassified data (CUI, PII, PHI), supporting file transfers up to 10GB (with a future objective of 40GB), and managing monthly file uploads ranging from 30-160 TB. The system must support both authenticated DoD CAC users and guest users, with approximately 40% of current traffic generated by guest users.
Critical technical specifications include operating in parallel with the existing system during transition, providing Identity and Access Management (IAM) services using government-furnished platforms, implementing robust data loss prevention policies, and maintaining comprehensive logging (application logs for 5 years, OS logs for 1 year). The modernization aims to create a scalable, secure file exchange platform with autoscaling capabilities, IPv6 readiness, and the ability to handle sudden traffic spikes (currently up to 110 GB per minute). Vendors are encouraged to propose baseline pricing and optional capabilities, with no mandated specific technologies or NetOps tools, offering flexibility in solution design while meeting DISA's core requirements for a secure, efficient file transfer system.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI DoD SAFE Modernization AMD01.docx | DOCX document | |
| SAFE Technical Characteristics Attachment FINAL 12-22.docx | DOCX document | |
| RFI_DoD SAFE Modernization_FINAL12-22.docx | DOCX document | |
| RFI_DoD SAFE Modernization_FINAL.docx | DOCX document | |
| SAFE Technical Characteristics Attachment.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions
| Question No. | Question | Government Responses |
| 1 | Can government define the "peak use" like number of concurrent users, geographic distrivution or time based surges? And any historical usage metrics available? | DoD SAFE historically sees peak traffic between 0900 - 1700 EST. DoD SAFE sees monthly file uploads totaling between 30 and 160 TB per month with a yearly average of around 100 TB per month. During a surge, DoD SAFE has seen upwards of 110 GB of upload/download traffic per minute. |
| 2 | What percentage of total users expected to be external (guest) users, and what concurrency level should be assumed for external access? | Approximately 40% of user traffic is currently generated by guest users. |
| 3 | Will the modernized solution operate in parallel with the existing DoD SAFE system during tranisition or is a cutover approach anticipated? | Our plan is for the modernized solution to operate in parallel with the existing DoD SAFE system during a designated transition period. |
This approach is intended to ensure service continuity, mitigate migration risks, and allow users to adapt to the new system before the legacy platform is decommissioned. A direct cutover is not anticipated at this time.
| 4 | Will IAM services be Government-furnished, or is the vendor expected to provide and operate IAM components? | IAM services will be required from the vendor, but they will need to utilize government furnished IA platforms and software. |
| 5 | Should ROM pricing include optional capabilities or only baseline requirements? | Yes, we are interested in understanding both the baseline costs and any optional capabilities you recommend. Please structure your pricing response in two distinct parts: |
Baseline ROM Pricing: Provide a ROM estimate that strictly covers the mandatory requirements outlined in the RFI.
Priced Options Menu: Separately, provide an itemized list of any optional features or capabilities you believe would add value. For each item, please include its individual ROM price and a brief explanation of its benefits.
| 6 | How will scalability improvements be measured or evaluated by the Government? | Scalability will be assessed holistically, but important metrics will include speed at which the system can be scaled (is it fast enough to address sudden unexpected spikes in utilization), how scalability will impact service levels and user experience, overall cost to scale, operational impacts, etc. |
| 7 | What data classifications (CUI, PII, PHI, etc.) are expected to be handled by DoD SAFE? | Unclassified to include CUI, PII and PHI. |
| 8 | What audit, reporting, and dashboard capabilities are required by DISA stakeholders? | All user transactions that occur within the application and OS need to be logged. Dashboards should report metrics, such as number of drop-offs within a user defined time period, number of pick-ups, average file sizes, virus reporting and alerts, etc. |
| 9 | Are specific DISA-approved NetOps tools mandated, or may vendors propose equivalent tools? | There is no mandated NetOps tools. Vendors may propose whatever they feel best fits the requirement. |
| 10 | What is the expected lifecycle for guest accounts (creation, expiration, revocation)? | There is no requirement for lifecycle for guest accounts. Vendors are free to propose what they see fit as a part of the overall solution. But the overall solution needs to provide access to guest users and also validation their identity, before allowing them access to the system. |
| 11 | Is there an anticipated timeline or milestone for transitioning DoD SAFE to IPv6-only operation? | DoD has not advertised a transition date for IPv6 only operation, however the proposed solution needs to be positioned to support IPv6 only, once that requirement is mandated. |
| 12 | Are there specific performance metrics or thresholds that the Government expects to be used as triggers for autoscaling? | There is no specific requirement at this point, but autoscaling should be configured such that the service provides a reliable and consistent user experience, regardless of the system utilization at any given time. |
| 13 | Is support for individual file transfers up to 40GB required at initial deployment or considered a future objective? | While 40GB file sizes is desired, proposed solutions only need to meet the initial threshold requirement of 10GB. Providing a modernization pathway to 40GBs or more would be beneficial information to provide, if the objective file transfer size is not initially possible, but could be through continuous modernization, after initial deployment. |
| 14 | How will upload and download traffic volume be measured—system-wide aggregate or per service/component? | Upload and download traffic volumen will be measured System wide. |
| 15 | Over what time period will availability be calculated (monthly, annually, or per incident)? | Availability will be calculated annually. |
| 16 | Does MTTR include security incidents, third-party service failures, and network outages outside the vendor’s direct control? | Yes, any components that vendors select to use should have advertised MTTRs that meet or exceed the requirement. |
| 17 | Are vendors required to integrate with specific DISA NetOps tools, or may equivalent capabilities be proposed? | Vendors may propose any NetOps tools they feel will meet the requirement. There are no mandated NetOps tools or suites. |
| 18 | What identity proofing and validation requirements apply to sponsored guest users prior to system access? | Identity validation requirements apply to all users, including guest users. All users attempting to access DoD SAFE shall be validated prior to gaining access to the service. |
| 19 | Will Data Loss Prevention policies be centrally managed by the Government or configurable by the vendor? | a minimum set of DLP requirements and policies will be dictated by the DoD and DISA and will need to be configured within the solution by the vendor. Those policies do not dictate any specific technologies that a program must use.What we are looking for from vendors is how they propose DLP can be implemented to verify every access request, restrict data access to only those authorized to receive the files and information being shared. |
| 20 | What are the required retention periods for application-level and OS-level logs? | Application logs shall be retained for a period of at least 5 years. OS-level logs shall be retained for 1 year. |
| 21 | Will the Government provide a more detailed breakdown of the modernization requirements, including which legacy components must be replaced, retained, or integrated? Specifically, what is the typical ratio of data egress to external/guest users vs. data transfer within the DoDIN? | This modernization is anticipated to be a complete remove and replace of the current legacy system. DoD SAFE sees monthly file uploads totaling between 30 and 160 TB per month with a yearly average of around 100 TB per month |
| 22 | What are the expected use cases and user scenarios (e.g., peak vs. average usage, types of files, mission-critical vs. routine transfers)? | The DoD SAFE system is available to DoD CAC users (i.e., Authenticated Users) and users without a valid DoD CAC certificate (i.e., Guest Users, having limited access), and provides a secure means of transferring files to mission collaborators inside or outside the DoD, so Mission Partners get important data faster. DoD SAFE is not designated as a mission critical system, therefore, most file transfers are routine DoD SAFE is currently accredited to handle files classified up to CUI to include PII and PHI information. There are three primary uses cases for the DoD SAFE large file transfer capability: |
1. DoD to DoD – e.g. two government civilians that need to share a file that exceeds the 25MB limit in email
2. DoD to non-DoD Government Agency – e.g. a government military or civilians that needs to share military service medical records with Veterans Affairs (VA)
3. Non-DoD to DoD – e.g. Government Contractor that needs to share a large file that exceeds the 25MB limit in email with an authenticated government civilian
| 23 | Are there any specific COTS/GOTS products or technologies that must be used or avoided? | No |
| 24 | What is the current system’s actual usage data (average file size, traffic volume, user concurrency) to inform sizing and scaling? | DoD SAFE sees monthly file uploads totaling between 30 and 160 TB per month with a yearly average of around 100 TB per month. DoD SAFE has experienced sudden spikes in traffic (uploads and downloads combined) up to 110 GB per minute. |
| 25 | What are the required interfaces with existing DoD systems, NetOps tools, and external partner networks? | There are no required interfaces to any NetOps tools or external partner networks. |
| 26 | Are there legacy data migration requirements? | There are no legacy data migration requirements. All files from the legacy system will have expired after a period of 7 days and log data will be retained in government archives. |
| 27 | What is the anticipated growth in user base over the next 3-5 years? | Due to many uncertainties, we cannot anticipate growth over the next 3-5 years. However, DoD SAFE has seen significant growth over the last year with the number of combined uploads and downloads jumping to 3.42 PB per year with a year over year growth rate of around 111%. |
| 28 | Does the Government anticipate users being able to truly customize retention policies, or are there fixed options? | Vendors are free to propose a solution as they see fit, but having fixed options for retention is sufficient as long as those fixed options are tailorable to government requirements, which could change over time. |
| 29 | What are the expectations for ongoing operations, maintenance, and support (e.g., help desk, incident response, admin management)? | Vendors are free to propose solutions as they see fit, however, DISA does provide an Enterprise Global Service Desk (GSD) that we highly recommend vendors will utilized. Vendors should outline how they will support the application in the event of an incident and details any necessary collaboration between government and 3rd parties. |
| 30 | Are there any constraints on allowable costs (e.g., licensing, cloud hosting, labor categories)? | There are no constraints. Vendors are free to propose solutions as they see fit. |
File details come from the government source that posted it. Updated .