Vitualization RFI Final.docx

RFI Virtualization Enterprise Software Solutions (Final) For: Virtualization Enterprise Software Solutions for the Department of War (DoW) RFI Number: 842674441 Issuing Agency: Defense Information Systems Agency (DISA) Date of Issuance: April 24, 2026 Response Due Date: 15 Days Post-Release

1.0 INTRODUCTION & PURPOSE

The Defense Information Systems Agency (DISA), on behalf of the Department of War (DoW), is issuing this Request for Information (RFI) to conduct market research. The purpose of this RFI is to identify qualified sources capable of providing a standardized, enterprise-scalable virtualization software solution, to include all associated software sustainment, upgrades, and technical support services under an enterprise-wide agreement within the next 12 months.

The objective is to establish a centralized, efficient, and cost-effective procurement vehicle. The Government intends to establish a Blanket Purchase Agreement (BPA) with a five-year ordering period (one-year base period and four one-year options) to procure products and services for the DoW, including 4th Estate Agencies, Combatant Commands (COCOMs), and Military Departments (MILDEPs), against the GSA Multiple Award Schedule (MAS) Information Technology category.

This is an RFI only. This is not a solicitation or Request for Quote (RFQ) and does not commit the Government to award a contract. The Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI are solely at the interested party's expense.

2.0 BACKGROUND AND CURRENT VIRTUALIZATION ENVIRONMENT

The Department of War (DoW) is committed to leveraging advanced technologies to enhance the security and effectiveness of its IT operations. DISA is collaborating with DoW components to create an enterprise-wide solution for procuring commercial-off-the-shelf (COTS) virtualization software. This initiative aims to consolidate numerous existing contracts and streamline vendor management for critical Virtualization products supporting server virtualization, cybersecurity, endpoint protection, and network management across the DoW's IT infrastructure.

The DoW’s virtualization environment is a critical component of its global IT infrastructure, providing enterprise compute capabilities supporting approximately 700,000 cores. This environment is characterized by its significant scale, geographic diversity, and complex security requirements, with resources deployed across CONUS and OCONUS locations. These include DoW data centers, enterprise computing facilities, and tactical/forward-deployed environments, spanning multiple security domains and classification levels.

All solutions must align with DoW enterprise architecture, cybersecurity (e.g., STIGs, Impact Levels), and lifecycle sustainment requirements. The platform primarily supports the following use cases:

· Mission Application Hosting: Serving as the foundation for critical warfighting and business systems.

· Development & Testing: Providing sandboxed environments for developing and testing new capabilities.

· End-User Computing (EUC): Supporting Virtual Desktop Infrastructure (VDI) and other virtualized user-facing services.

3.0 SCOPE OF REQUIREMENTS

The Government requires a comprehensive virtualization portfolio to support an estimated 700,000 subscriptions. The proposed solution must be structured to accommodate diverse client needs through offerings like tiered bundles, individual licenses, and hybrid models. A comprehensive migration plan with a detailed timeline is mandatory. This plan must detail the strategy for transitioning from the current VMware framework to the proposed solution with minimal disruption to mission-critical operations.

The plan must also explicitly describe how Artificial Intelligence (AI) will be leveraged to drive automation, reduce administrative overhead, and simplify the deployment, management, and security of the platform. Furthermore, all proposed capabilities must be designed to integrate with DoW regulations and frameworks, and must minimally address the following core areas:

3.1. Core Platform Capabilities

· Virtualization: Provide a solution that supports both full virtualization and paravirtualization to consolidate applications and establish cloud or VDI environments. It must include live VM migration, storage migration, and seamless import/export functionality, including cross-migration, all managed from a unified administration plane.

· Disaster Recovery & Backup: Deliver robust business continuity through VM-centric snapshots, clones, and replication. The solution must support enterprise-grade backup and recovery via modern APIs (e.g., VSS) and allow for granular recovery (file/folder, full VM, disk-level) across data centers.

· Application & Data Virtualization: Provide capabilities to decouple applications from the underlying OS (application virtualization) and to abstract and integrate disparate data sources without requiring data movement (data virtualization).

· Remote & Automated Management: Enable remote management and monitoring of all infrastructure, including direct remote console access. A comprehensive REST API for programmatic automation and third-party integration is mandatory.

3.2. Management, Analytics, and Security

· Cybersecurity: Deliver advanced threat detection and incident response. This must include Secure Boot, shielded VMs, and native micro-segmentation for application-centric security policies. The system must use AI-driven insights for self-healing security configurations to maintain compliance.

· Asset Management: Provide a centralized dashboard to discover, track, monitor, and manage all physical and virtual IT assets. Crucially, this tool must operate across the DoW's globally distributed and logically partitioned network boundaries, providing a unified view of real-time asset utilization.

· Network Management & Security: Offer solutions for network monitoring, management, and security, including capabilities for SD-WAN, web/email security, and virtual networking.

· Logging, Analytics, and Reporting:

· Log Management: Ingest syslog and custom logs from all platform components (hypervisors, hosts) and retain them for at least one year.

· Analytics & Search: Provide real-time search and analytics to correlate events across all layers (hosts, clusters, VMs, applications, storage).

· Performance & Capacity: Offer real-time and historical analytics (CPU, memory, storage, network) with one-year data retention. The platform must provide forecasting, capacity planning, and "what-if" modeling for workload placement.

· Alerting & Notifications: Support threshold-based and dynamic anomaly detection alerts, with routing to multiple platforms via email, webhooks, and REST API integrations.

3.3. Security, Compliance, and Workforce Enablement

· Security and Compliance:

· DoW Impact Level: Products must meet a minimum of DoW Impact Level 5 (IL5) certification, with a clearly defined roadmap to achieve IL6.

· Authentication: The solution must support two-factor authentication via SAML 2.0 or OIDC to ensure integration with the DoW Enterprise Identity, Credential, and Access Management (E-ICAM) solution.

· Training and Continuous Learning:

· Foundational Awareness: Introductory training for all technical staff to build a baseline understanding of the new platform's architecture, terminology, and core concepts.

· Deep Technical Training: An intensive, hands-on curriculum for senior engineers and the core migration team covering platform administration, advanced networking, security configuration, and migration-specific tooling.

· Operational Enablement: Role-based training for day-to-day operations teams focused on new Standard Operating Procedures (SOPs), common administrative tasks, and basic troubleshooting.

· Continuous Learning: A strategy for ongoing education, including hands-on labs, to keep staff skills current on new features, performance optimization, and advanced security practices.

3.4. Operational Use Cases

The following use cases represent critical operational scenarios that the proposed virtualization solution must support. Vendors must address the specific technical challenges and provide detailed responses to the requirements outlined in each scenario.

· Use Case 1: Hypervisor-Native Hybrid Cloud and Workload Mobility

· Operational Scenario: During a large-scale joint training exercise, a wargaming simulation application exhausts the compute resources of the local Department of War (DoW) cluster and requires immediate expansion into a commercial cloud.

· Technical Challenge: The virtualization platform must seamlessly extend its software-defined data center (SDDC) to a DoD-approved Impact Level 5 (IL5) commercial cloud. This must be accomplished without application refactoring by leveraging bare-metal cloud instances to maintain a single, unified management plane.

· Required Vendor Response:

1. Detail the platform's ability to deploy its native hypervisor stack onto bare-metal IL5 cloud infrastructure, creating a single, stretched logical cluster.

2. Explain the storage replication protocols and memory-state synchronization algorithms that enable live virtual machine (VM) and container migration across the WAN.

3. Describe how the software-defined networking (SDN) controller uses overlay protocols (e.g., GENEVE, VXLAN) at the hypervisor kernel level to stretch Layer 2 networks to the cloud provider.

· Use Case 2: Zero Trust Architecture with Hypervisor-Level Micro-Segmentation

· Operational Scenario: A hyper-converged DoW environment hosts hundreds of transient VMs and containers, mixing workloads that process Controlled Unclassified Information (CUI) with unclassified tasks on the same physical servers.

· Technical Challenge: Security boundaries must be enforced at the VM level. The virtualization software must natively block unauthorized East-West traffic at the virtual network interface before it reaches the physical network, using hypervisor-level controls.

· Required Vendor Response:

1. Describe the platform's distributed firewall (DFW) architecture and how it operates within the hypervisor kernel, independent of the guest operating system.

2. Detail how the platform uses Guest Introspection APIs to enable agentless anti-malware scans and file integrity monitoring for CUI workloads.

3. Explain the cryptographic mechanisms built into the software-defined storage (SDS) and SDN layers that provide native encryption for data-at-rest and data-in-transit.

· Use Case 3: High-Fidelity Secure Virtual Desktops with GPU Virtualization

· Operational Scenario: Geographically dispersed intelligence analysts require real-time, interactive access to 3D geospatial rendering applications (e.g., ArcGIS) and CUI databases from thin clients.

· Technical Challenge: The virtualization platform must deliver a high-performance graphical experience comparable to a local workstation while ensuring all compute, memory, and data remain physically secured within the IL5 data center.

· Required Vendor Response:

1. Outline the Virtual Desktop Infrastructure (VDI) connection broker architecture and how its display protocol (e.g., Blast Extreme, PCoIP, HDX) dynamically adapts encoding based on real-time network conditions.

2. Detail the platform's ability to abstract physical GPUs into virtual GPU (vGPU) profiles and algorithmically schedule frame buffer allocation to individual desktop VMs.

3. Explain how the connection broker enforces DoD CAC/PIV cryptographic authentication and applies granular policy restrictions (e.g., blocking USB drives, clipboard access, and local printing) to prevent data exfiltration.

4.0 INFORMATION REQUESTED

Interested parties are requested to provide a response that addresses the following areas:

4.1. Company Information

· Company Name, Address, and Website.

· Point of Contact (Name, Title, Email, and Phone Number).

· CAGE Code and Unique Entity ID (UEI).

· Business size and any applicable socioeconomic status.

4.2. Capability Statement

· A detailed response addressing your company’s capabilities for all requirements outlined in Section 3.0. This should include specific responses to the following areas:

· ROI and Value: Describe how your solution provides a clear return on investment (ROI) and long-term value, covering Total Cost of Ownership (TCO), quantifiable ROI metrics, cost effectiveness, enterprise scalability, and strategic modernization value.

· Migration Strategy: Outline a phased migration framework (discovery, pilot, full-scale) from legacy virtualization, addressing DoW's scale and decentralized network. Include plans for risk mitigation, business continuity, and rollback.

· Technology & Commercial Outlook: Provide a 3-5 year technology outlook for virtualization, detailing your product roadmap alignment with trends like sovereign clouds and AI/ML. Describe alternative and predictable consumption pricing models.

· Security & Supply Chain: Detail your corporate security posture, compliance framework (e.g., IL5), and Secure Software Development Lifecycle (SSDLC) practices.

· Global Technical Support: Present a detailed technical support framework for a globally distributed organization, including a sample SLA matrix. Confirm U.S. citizen support and the availability of cleared personnel.

· Program Management: Describe your program management approach, account team structure, and governance model. Provide a sample Executive Dashboard or QBR template.

· Training & Adoption: Outline your continuous adoption plan for establishing a Center of Excellence (CoE) and ensuring long-term user proficiency.

4.3. Contracting and Strategy

· Provide a list of all GSA Schedules or other Government-wide Acquisition Contracts (GWACs) your company holds.

· Provide confirmation of your status as an authorized reseller/distributor for the proposed products, including the OEM Letter of Authorization.

· Provide substantive feedback on the Government's proposed acquisition strategy, commenting on the suitability of Enterprise License Agreements (ELAs) vs. consumption-based models.

· Describe your license management methodology for an enterprise of DoW's scale, providing a case study from a comparable Federal agency.

4.4. Cost - Rough Order of Magnitude (ROM)

· Submit a high-level, non-binding Cost ROM for all requirements, based on an estimated 700,000 subscriptions, detailing varied offerings (tiered, individual, hybrid).

· The ROM should estimate total cost for a one-year base period and four one-year option periods – state your approach.

· What is the pricing mechanism for integrating additional DoW agencies beyond the initial enrollees and/or 700,000 subscriptions throughout the contract lifecycle.

· If proposing a consumption-based model instead of an enterprise agreement, how is predictability guaranteed?

· Submit a separate, non-binding Cost ROM detailing all one-time migration costs (e.g., professional services, training). Optional template provided.

5.0 RESPONSE INSTRUCTIONS

· Submission POC: Responses shall be submitted electronically to christinia.f.rhem.civ@mail.mil.

· Email Subject Line: The subject line must read: “Response to RFI-DISA-VIRTUALIZATION-2026.”

· Format: Responses should be submitted in Microsoft Word, Microsoft Excel, or Adobe PDF formats.

· Page Limit: Responses are limited to 25 pages. The Title Page, Table of Contents, and OEM Letters of Authorization will not count against this limit.

· Response Deadline: Responses are due no later than 10:00 AM CST May 12, 2026. Late submissions may not be accepted.

· Follow-On Engagement: After reviewing RFI responses, the Government may schedule follow-up activities. These could include industry days, one-on-one meetings, or requests for product demonstrations.