852571198 - JWCC Next RFI.docx

REQUEST FOR INFORMATION

Defense Information Systems Agency (DISA), Joint Warfighting Cloud Capability (JWCC)/Defense Information Technology Contracting Organization (DITCO) is seeking information from industry to assist with the development and planning of a potential new requirement called JWCC Next.

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE ONLY. THIS IS NOT A REQUEST FOR PROPOSALS (RFP). NO SOLICITATION IS AVAILABLE AT THIS TIME.

1. Overview On February 1, 2022, the Deputy Secretary of Defense approved and signed the Department of Defense (DoD) Software Modernization Strategy, setting the Department on a path to deliver resilient software capabilities at the speed of relevance. The DoD Software Modernization Strategy compels DoD to be bold in pursuing the shift of secure software delivery through modern infrastructure and platforms, which emphasizes the importance of commercial partnerships through the adoption of cloud. The mission value delivered from an advanced, resilient cloud-computing environment is directly related to the adoption and use of the cloud environment by the Department’s Information Technology (IT) programs and mission systems. Driving increased adoption of cloud environments, to include edge offerings (see section 4.5 below), requires DoD Components to rationalize their current IT environment, make cloud smart decisions, and optimize their IT investments to leverage cloud services throughout the DoD. To meet this challenge DISA created the JWCC contract vehicle to enable the DoD to increase cloud modernization and governance across the enterprise.

Looking beyond the current JWCC Contract, DISA has been tasked with expanding DoD cloud capabilities to include more than hyperscale services. Currently, JWCC provides a path forward in a rapidly evolving digital landscape to include a multi-cloud strategy, which involves utilizing cloud services from multiple providers. This offers DoD an enhanced flexibility, resilience, and optimization of resources, while enabling Warfighters with computing services at edge locations.

This RFI seeks to identify leading edge cloud capabilities to position the Department for the future.

2. Scope of Effort JWCC Next is intended to expand the current DoD enterprise cloud contract while identifying gaps in the current strategy and leveraging additional cloud capabilities to include Anything as a Service (XaaS) across the Department. The JWCC Next contract will provide the Department XaaS, at all classification levels, from the strategic level to the tactical edge, to include Disconnected, Disrupted, Intermittent and Limited Connectivity (DDIL) environments and closed loop networks.

3. Technical Characteristics DISA desires to seek and understand the various cloud services and offerings that are being developed by industry with the goal to expand the DoD software and hardware modernization to support the warfighter. These foundational technologies are needed for the DoD to capitalize on current cloud services and offerings, commercial innovation, and Artificial Intelligence (AI) and Machine Learning (ML) capabilities, at scale. These capabilities should have the ability to support multiple classifications and/or various impact levels (ILs) out to the different edge computing devices and locations. The capability must also include a number of crucial attributes, including but not limited to:

· Capabilities at any of the three classification levels

· Parity of services across all Security Domains

· Integrated Cross-Domain Solutions

· Global availability, inclusive of tactical edge environments

· Enhanced cybersecurity controls

· Edge capabilities

· Emerging technologies

4. The following is a list of Capabilities that DISA is seeking information on from industry as it relates to paragraph 3. Responses should be formulated in a white paper and may be organized in any manner that articulates the information DISA is seeking.

4.1 Desired Capabilities: What collection of tools and resources help you design, develop, and deploy responsible AI or ML applications.

4.1.1 Describe your ability to implement a multi-cloud strategy to leverage the strengths of commercial providers to include AI capabilities leveraging hyper-scalers.

4.1.2 How does your platform handle dynamic scaling for AI processing needs?

4.1.3 Describe your experiences implementing AI & ML solutions and safeguards with regards to the following:

· Providing new capabilities to support the Government and enable the warfighter at the tactical, operational, and strategic levels deployed as stand-alone and within the DoD cloud;

· A multi-cloud strategy to leverage the strengths of commercial providers to include AI capabilities leveraging hyper-scalers;

· Managing dynamic scaling for AI processing requirements;

· Ensuring the responsible usage of performance related data with AI (i.e. not used for unintended or unethical purposes)

4.1.4. What capabilities do you have addressing quantum computing and post-quantum cryptography?

4.2 Software-as-a-Service (SaaS)/Third (3rd) Party Marketplace: A cloud service model where the customer is provided a capability that is leveraging dedicated cloud infrastructure. 3rd Party Marketplace shall be a capability the DoD can utilize to enable a capability that is either hosted as a Software-as-a-Service or Infrastructure-as-a-Service (Saas/IaaS) offering.

4.2.1 Describe your experience supporting the Government for offering or enabling SaaS solutions and providing new capabilities to support the DoD and enable the warfighter at the tactical, operational, and strategic levels.

· Does your current SaaS Capability currently hold a FedRAMP or DoD Provisional Authorizations and support DoD Workloads at any of the Impact Levels?

· How does your solution(s) interoperate with existing Cloud Service Providers and hyper-scalers?

· What unique capabilities does your service bring to the Government?

· What compliance certifications and security standards does the service adhere to (e.g., FedRAMP, FISMA)?

4.3 Cybersecurity & Risk Management: An ability to demonstrate to maintain/operate a Secure system according to DoD and Commercial security standards and guidance. Strategic process that helps organizations identify, assess, and reduce the risk of cyberattacks on their IT infrastructure.

4.3.1 Describe how automation and cybersecurity best practices are leveraged and employed across your catalog and capabilities.

4.3.2. In what ways do your cloud services help manage vast amounts of sensitive data (e.g., PII, HIPAA, national defense, intelligence) while adhering to stringent Government regulations like Federal Information Processing Standards and National Institute Standards and Technology standards?

4.3.3 How do you provide full auditability of AI decisions and ensure compliance with Government audit standards?

4.3.4 Describe your security and verification process for ensuring each XaaS is secure and meets the DoD requirements for supporting DoD workloads?

4.3.5. What efforts are you making to obtain FedRAMP and DoD authorizations for your offerings?

4.4 Zero-Trust (ZT) Principles: Framework that requires strict identity verification, network segmentation, real-time monitoring and continuous authentication for all user(s) and devices, regardless of location to minimize implicit trust and prevent unauthorized access.

4.4.1 What services do you offer that assist in meeting the ZT principles and the DoD ZT reference architecture.

4.4.2 What services do you offer to support identity federation?

4.4.3 What current Multi-factor Authentication do you support in your current offerings?

4.5 Edge Capabilities & Offerings: Subset of cloud computing solutions that extend computational power, data processing, and storage closer to the edge of the network, where data is generated.

4.5.1 What services and offerings do you possess to address use cases at the edge? Describe how these capabilities fall into Tactical (ruggedized and mobile/man-portable, survivability in DDIL environments, Operational (non-ruggedized and non-mobile/man-portable), or other edge categories.

4.5.2 What are the differences between services that operate locally on each edge device and those equivalent services on the cloud region?

4.5.3 What are the statuses of the authorizations for each edge capability and offering?

4.6 Global Accessibility: A service/offering that is able to operate and maintain a presence across CONUS and OCONUS to enable to the DoD Warfighter.

4.6.1 Describe your ability to provide global access to your service offerings.

4.6.2 Do you have partnerships with local providers in regions where you do not have a direct presence?

4.6.3 How do you ensure consistent service levels across different regions?

4.7 Available and Resilient Services: Services must be highly available, resilient, reliable, durable, and able to continue operating despite catastrophic failure of portions of the infrastructure.

4.7.1 What is your resiliency plan to maintain availability of services?

4.7.2 What is your approach to meeting outages or handling outages/incidents? What is your mean time to resolution?

4.7.3 Do you use any 3rd party providers, subcontractors, or foreign entities for any part of your cloud services (e.g. data storage, processing, or support)? Please provide a list of dependencies/sub-service entities.

4.7.4 How do you ensure compliance with US Data residency and sovereignty requirements?

4.8 Centralized Management Distributed Control (CMDC): This oversight and management include the ability to apply security policies, monitor network security compliance and service usage, promulgate standardized service configurations, and automate and distribute the account provisioning process.

4.8.1 What tools and services do you provide that allow visibility of a customer’s environment and services and the ability to apply a hierarchical governance construct involving multiple levels, where each level could have an exception to the overarching governance policy?

4.8.2 When multiple tenants are involved, how does the DoD get a granular understanding of how it's spending its money on your services?

4.8.3 Please describe your capabilities or mechanisms to accomplish CMDC for a SaaS provider.

4.8.4 Please describe your capabilities or mechanisms to accomplish CMDC for hyper-scaler cloud providers.

What capabilities do u offer to extend the network closer to the DoD presence (CO

RESPONSE GUIDELINES:

Interested parties are requested to respond to this RFI with a white paper. Submissions cannot exceed 20, single spaced, 12-point type with at least one-inch margins on 8 1/2” X 11” page size. The response should not exceed a 5 MB e-mail limit for all items associated with the RFI response. Responses must specifically describe the contractor’s capability to meet the requirements outlined in this RFI. Oral communications are not permissible. SAM.gov will be the sole repository for all information related to this RFI.

Companies who wish to respond to this RFI should send responses via email no later than December 04, 2024 at 12:00pm CT to DISA Ft Meade J-9 List jwcc-next: disa.meade.j-9.list.jwcc-next@mail.mil.

INDUSTRY DISCUSSIONS:

DISA representatives may choose to meet with potential offerors and hold one-on-one discussions. Such discussions would only be intended to obtain further clarification of potential capability to meet the requirements, including any development and certification risks.

QUESTIONS:

Questions regarding this announcement shall be submitted in writing by e-mail to megan.c.toennies.civ@mail.mil. Verbal questions will NOT be accepted. Answers to questions will be posted to SAM.gov. The Government does not guarantee that questions received after November 22, 2024 at 12:00pm CT will be answered. The Government will not reimburse companies for any costs associated with the submissions of their responses.

DISCLAIMER:

This RFI is not an RFP and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals, nor will any award be made as a result of this synopsis.

All information contained in this RFI is preliminary as well as subject to modification and is in no way binding on the Government. Federal Acquisition Regulation (FAR) clause 52.215-3, “Request for Information or Solicitation for Planning Purposes”, is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Responders to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on capabilities available. This RFI is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received in this RFI that is marked “Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned nor will receipt be confirmed. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.