A16.-RFI_MSP2.0_061826.docx

SOURCES SOUGHT SYNOPSIS/REQUEST FOR INFORMATION

This is a SOURCES SOUGHT NOTICE (SSN)/REQUEST FOR INFORMATION (RFI) to determine the availability and technical capability of small businesses (and large businesses if required) (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required services. Centers for Disease Control (CDC) is issuing this synopsis as a means of conducting market research to identify parties having an interest in and the resources to support this requirement for Cloud Managed Services Provider Support. The result of this market research will contribute to determining the method of acquisition. The applicable North American Industry Classification System (NAICS) code assigned to this acquisition is 518210.

CDC intends to supplement this SSN through review of small business searches via SAM.gov and HHS SBCX system, capability sources, relevant Governmentwide acquisition vehicles, targeted small business outreach, and other market research methods to assess whether one or more small business set-aside approaches are feasible.

There is no solicitation at this time. This request for capability information does not constitute a request for proposals; submission of any information in response to this market survey is purely voluntary; the Government assumes no financial responsibility for any costs incurred. The Government will not provide feedback or evaluations to companies regarding their submissions in response to this notice.

If your organization has the potential capacity to perform these contract services, please provide the following information:

1. Organization name, address, email address, website address, telephone number, CAGE code, UEI Code, and size and type of ownership for the organization;

1. Prime contract vehicles; to include NIH CIO-SP3, NASA SEWP V, General Service Administration (GSA): ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), small business groupings, or pools), or any other Government-wide contract vehicle that allows for decentralized ordering; and

1. Tailored capability statements addressing the particulars of this effort, with appropriate documentation supporting claims of organizational and staff capability. If significant subcontracting or teaming is anticipated to deliver technical capability, address the administrative and management structure of such arrangements.

Responses should be limited to 10 pages or less including appendices. Respondents need not answer every subpart to be useful to the Government. Where respondents do not have experience matching all stated attributes exactly, respondents may submit analogous experience that demonstrates comparable scale, complexity, operational risk, multi-environment support, transition, security, or service management capabilities.

Per the HHS Acquisition Alert 2025-01, Department-wide Category Management Policy for Mandatory Use and Mandatory Consideration, CDC intends to issue an order using one of the HHS Mandatory-Use Contract Vehicles. There is no preference on which vehicle from the mandatory-use contract list this requirement will be sourced at this time.

Background

CDC Office of the Chief Information Officer (OCIO) manages a broad mission critical portfolio of digital systems that support public health surveillance, research, emergency preparedness and response, and enterprise operations. These systems operate across heterogeneous environments—on-premises private cloud, hybrid, and cloud which have evolved over time as CDC has modernized its technology ecosystem.

CDC’s current support model integrates network engineering, IT Operations, Private/Public cloud management, Database management, and IT service management (ITSM) through standardized processes, proactive monitoring, continual improvement, and governance aligned with ISO standards to ensure secure, reliable, and efficient service delivery.

As OCIO’s cloud environments and operations have matured, OCIO’s cloud capabilities have increasingly overlapped with functions performed in on-premises private cloud data center operations.

To improve operational consistency, remove operational redundancy, and ensure scalable enterprise support, CDC OCIO is contemplating consolidation of all services support for on-premise private cloud hosting services and public cloud based hosting services under a single, unified managed services operating model. The goals of this initiative include:

· Standardizing operations roles, processes, and automation

· Reducing operational costs and duplication

· Increasing service quality and operational efficiency

· Improving governance and lifecycle management

· Creating an acquisition strategy that leverages economies of scope and scale

· Clearly defined CLIN structure and cost model that translates to a chargeback model for on-premise private cloud and cloud hosting services

· Assessing the availability of qualified small business concerns and socioeconomic small businesses

· Evaluating whether the requirement can be structured to maximize competition and small business participation

· Testing whether discrete service areas or functional groupings could support partial set-asides or reserved awards

Market Capability/ Solutions CDC will evaluate market information to ascertain potential market capacity and solutions to fully meet and deliver the CDC requirement by considering potential operating model and acquisition strategy alternatives, which may include a consolidated approach, segmented task areas, partial set-asides, multi-award approaches, or other structures. For the purposes of this notice, the capability to meet and deliver the required services is defined as having recent experience (within the past 5 years) leading and/or executing the delivery of the requirement in similar size, scope, scale and complexity (large Government department or agency). If performed as a subcontractor, joint, or protégé, vendor must describe what role they played in support of the prime and provide contract information. Additionally, CDC is also seeking industry solutions and recommendations to support the contemplated consolidation of services, with the goal of improving operational consistency, eliminating redundancies, and ensuring scalable enterprise support.

Managed Service Provider (MSP)

1. Describe your company’s overall experience and approach in developing, implementing, and supporting highly scalable managed services and IT operations in a fee for service environment operating across on-premise private cloud and public multi-cloud environments as described in the goals listed above.

2. Explain your experience and approach in the consolidation of managed services support and operations for on-premise private cloud and public cloud operations as described in the background information above.

3. Can your firm perform the full contemplated requirement as a prime contractor? If not, identify which discrete functional areas or task areas your firm could perform as a prime, and whether teaming, a joint venture, or a partial/split requirement would make performance feasible, and what percent of the requirement would you subcontract?

4. Describe your company’s overall experience and approach in cloud agnostic services, reference architectures, workload portability and hybrid multi-cloud services, and database/data management in hybrid deployments (on-prem private cloud and public cloud).

5. Describe the risks associated with implementing a consolidation of all services support, including dependencies, knowledge transfer, staffing continuity, and service disruption mitigation.

6. Describe your company’s approach and experience in supporting federal product owners for IT services on engineering, product cost, performance, and lifecycle management.

24 x 7 Support and Operations

7. Describe your organization’s ability to staff and deliver 24x7x365 monitoring, incident response, customer communications, and tiered operational support across on-prem private cloud, hybrid, and public cloud environments.

8. Explain your experience in ensuring operational resilience, including automation, Artificial Intelligence (AI) implementation, Service Level Agreement (SLA) management, escalation processes, and performance metrics such as MTTD (Mean Time to Detect) MTTD/MTTR(Mean Time to Respond).

Security Management

9. Describe your experience and approach in vulnerability detection, prioritization, and remediation and POAM (Plan of Action and Milestones) lifecycle management across public multi-cloud and on-premise private cloud infrastructures.

10. Summarize your experience implementing federal security frameworks (Federal Information Security Management Act (FISMA), Federal Risk and Authorization Management Program (FedRAMP), TIC – Technology Information Center 3.0, Zero Trust, etc.).

11. Summarize your experience in audit response and remediation specifically in a federal Government environment.

Services Support

12. Provide contract information for examples where your firm has provided direct support in service delivery for the following services or technologies (note if your firm subcontracted or performed as a subcontractor for any parts of this work):

· Cloud Platforms (Azure / AWS) and cloud native services and solutions

· Operating systems platforms support and maintenance

· SQL database administration

· Application hosting and modernization

· Colocation infrastructure support

· Server Virtualization services (VMWare, MS Hyper-V, Nutanix, etc)

· Storage management and lifecycle operations

· Akamai and related Content Delivery Network (CDN)/security services

· Web hosting and enterprise-wide web service delivery

ITSM & Program Management

13. Describe your experience developing, implementing and maturing enterprise Information Technology Service Management (ITSM) programs aligned to Information Technology Infrastructure Library (ITIL) across hybrid environments.

14. Explain your program management experience in supporting governance, quality assurance, continuous improvement, and transparent reporting across all aspects of an ITSM Program.

15. Provide examples where automated workflows, Artificial Intelligence (AI) integrated service catalogs, or Configuration Management Database (CMDB) capabilities enhanced service delivery outcomes operationally, and through categorization to manage service level cost and performance. Provide metrics to support claims.

16. Describe your experience in integrating Asset Management with other federal information systems (security, inventory, etc)

17. Describe your experience and approach to supporting Quality Assurance/Quality Control.

18. Describe your experience in providing project management support services in a federal Government environment to include project governance, planning, execution, monitoring, and closeout.

19. Describe your experience in developing and implementing/integrating Event and Incident Management and with systems monitoring across on-prem private data center and public cloud environments. Describe how these capabilities were used to improve service performance and availability and drive operational efficiencies. Provide metrics to support claims.

Contract Recommendations

20. Based on your experience, what solicitation requirement document structure (PWS or SOO) would you recommend to support CDC’s IT Operations consolidation into a highly scalable Managed Service Provider (MSP) model?

21. What Task Areas, CLIN structures, and CLIN types (FFP, LH, T&M), or combinations, would best support scalability, flexibility, efficiency incentives, and alignment with performance outcomes.

22. Identify any current contract vehicles through which your firm can provide these services, including small business and socioeconomic set-aside vehicles, and describe whether those vehicles could support all or part of the contemplated requirement.

23. What contract mechanisms would you suggest to effectively drive innovation, automation, and operational efficiency for large federal MSP.

24. Understanding there are different cost and charge back models for on-prem private cloud and public cloud, please describe and provide a sample cost scenario for such hybrid environments that clearly distinguish between the different environments and include lifecycle management.

25. Identify whether the contemplated services can be broken into logical service towers, phases, or task areas that would preserve mission performance while increasing competition, reducing transition risk, or improving small business participation.

26. If your firm is not a small business, identify the service areas that could reasonably be subcontracted to small business concerns and explain how those opportunities could be structured and what total percentage of the requirement would be subcontracted to small/disadvantaged business.

Submission Instructions: Interested parties who consider themselves qualified to perform the above-listed services are invited to submit a response to this SSN/RFI notice by 2 July 2026. All responses under this notice must be emailed to al00@cdc.gov. Please submit the response in a Microsoft Word or Adobe PDF format.

If you have any questions concerning this opportunity, please contact Won Chung, al00@cdc.gov.