EWIT Sources Sought Notification Information.pdf

CUI

Enterprise-Wide Information Technology Support –

Sources Sought Notification Information:

Controlled by: Office of Naval Intelligence

Controlled by: N8

CUI Category: PROCURE

Distribution/Dissemination Control: ONI

1. Requirements:

Background The Government is conducting market research to identify capable sources for enterprise-wide information technology (IT) support services. This notice is issued for planning and market-research purposes only. It does not constitute a solicitation, request for proposal, commitment by the Government, or authorization to incur proposal-preparation costs.

The Government anticipates that any future requirement may be structured as a firm-fixed-price order or orders. The Government is therefore seeking industry input on achievable, measurable, and objectively acceptable service packages and recurring service levels.

The Government requires contractor support to operate, maintain, secure, modernize, integrate, and enhance enterprise IT capabilities supporting mission operations.

Performance may occur across Government-designated classified and unclassified networks;

cloud, hybrid, and on-premises environments; enterprise applications; data platforms;

communications environments; and geographically dispersed operating locations. The environment uses industry-standard cloud service provider infrastructure, platform, and serverless capabilities at various impact and classification levels.

The Contractor will perform work using its own management approach, processes, tools, and staffing model, subject to Government-defined requirements, security constraints, interfaces, operational priorities, performance standards, and acceptance criteria.

The service domains under this PWS are:

• Enterprise Architecture, Assessment, Verification, and Transition

Perform architecture, technical assessment, independent verification, configuration-baseline, operational-readiness, transition, or technical analysis activities

• IT Systems Engineering, Operations, and Sustainment The Contractor may be required to provide engineering, operations, sustainment, modernization, migration, integration, and optimization support for Government-designated IT systems and services.

Potential activities may include:

• Cloud and hybrid-environment engineering, tenant or workload onboarding, migration, integration, and sustainment;

• Infrastructure, platform, network, computing, storage, backup, recovery, and disaster-recovery support;

• Configuration, asset, release, and change-management support;

• Monitoring, performance management, troubleshooting, incident coordination, and operational reporting;

• DevSecOps implementation and sustainment, including source-control, build, test, security-evaluation, artifact-management, and deployment workflows;

• Identity, access, logging, monitoring, vulnerability-management, and security-tool integration using Government-designated or approved capabilities;

• Technical documentation, operational procedures, knowledge-management products, and transition support; and

• Coordination with Government personnel, mission partners, and external service providers as required to accomplish authorized work.

The Government will identify applicable systems, environments, interfaces, service levels, security requirements, delivery schedules, and acceptance criteria in the eventual solicitation, task order, or associated performance requirements summary.

• Application Development and Sustainment The Contractor may be required to support the development, modernization, sustainment, integration, migration, deployment, enhancement, and decommissioning of Government-designated mission and business applications.

Potential activities may include:

• Requirements analysis and traceability;

• Solution architecture and technical design;

• Application configuration, development, integration, testing, and quality assurance;

• Deployment, rollback planning, operational transition, and user-support documentation;

• Application sustainment, patching, upgrades, and defect correction;

• Modernization of legacy applications to Government-designated target environments;

and

• Use of secure software development and continuous integration/continuous delivery practices.

Applications may use a variety of commercial, Government, open-source, cloud-native, virtualized, containerized, serverless, database, storage, and traditional computing technologies. Specific technical baselines, interfaces, and target environments will be provided only as necessary for the applicable acquisition action.

• Data Services The Contractor may be required to provide data-management, data-platform, data-engineering, data-science, analytics, automation, super-intelligence/machine-learning, visualization, and secure data-transport support.

Potential activities may include:

• Data cataloging, metadata management, data lineage, and data-quality support;

• Data governance, lifecycle-management, and workflow implementation;

• Data-platform design, implementation, testing, documentation, and transition;

• Data ingestion, extract-transform-load/extract-load-transform pipeline implementation, data loading, and reconciliation;

• Dashboards, automated workflows, metrics, and audit capabilities;

• Data-science and analytical-use-case implementation;

• Configuration or integration of approved super intelligence or machine-learning capabilities; and

• Integration, where authorized, with enterprise-level Department of Defense and Intelligence Community data platforms and analytical repositories.

For any future FFP requirement, the Government anticipates defining the relevant data holdings, interfaces, volume ranges, security constraints, intended users, required outputs, evaluation criteria, and acceptance standards before authorizing performance.

• Cybersecurity Services The Contractor may be required to provide cybersecurity engineering, compliance, authorization-support, assessment, remediation, monitoring, and incident-support services for Government-designated systems, applications, cloud services, networks, and data environments.

Potential activities may include:

• Risk Management Framework (RMF) lifecycle support;

• Development, maintenance, and update of security authorization artifacts;

• Security-control assessment support and evidence development;

• Vulnerability-management, configuration-compliance, audit-record, and security-testing support;

• Risk, finding, remediation, and corrective-action tracking;

• Security engineering and authorization-impact analysis for system changes;

• Support for inspections, audits, recurring assessments, and compliance reporting;

• Cybersecurity monitoring, incident coordination, recovery validation, and trend analysis;

and

• Technical advice to Government personnel concerning cybersecurity requirements, system changes, and compliance considerations.

The Contractor will not make Government authorization decisions, accept residual risk, approve waivers, or perform other inherently governmental functions.

• Program, Service Management, and Transition The Contractor may be required to provide program and service-management support directly associated with performance of defined technical requirements. Potential activities may include:

• Contract-management planning;

• Schedule, risk, issue, corrective-action, and dependency tracking;

• Service-level and performance reporting;

• Configuration- and change-control support;

• Technical meeting support and action-item tracking;

• Knowledge-management and operational-procedure development;

• Asset and documentation management; and

• Transition-in, transition-out, and knowledge-transfer support.

The Government does not intend for program-management requirements to create an open-ended requirement for administrative support. Any future requirement will identify the specific reports, deliverables, service levels, or management products required.

2. Deliverables:

Enterprise Architecture / Technology Assessment Independent Test & Verification Report Configuration & Asset Baseline Enterprise Operations / Monitoring Report IT Service Management / Knowledge Support Package Cloud Migration / Tenant Onboarding Plan Cloud Platform / DevSecOps Implementation Network Installation / Modernization Plan Server / Computing Sustainment Reports Application Development / Enhancement Package Special / Surge / Emergency IT Support Report Data Management / Data Platform Plan Data Science / AI-ML Use Case Cybersecurity / RMF / ATO Package Cybersecurity Operations / Compliance Reports

The contractor will be expected to provide integrated technical and programmatic accountability across the enterprise and meet measurable standards for availability, responsiveness, security, quality, transition, and mission continuity.

3. Recommended Sources Sought Questions:

Company Information and Overall technical and integration capability

• Provide the company name, UEI, CAGE code, business size, socioeconomic status, primary NAICS code, and corresponding size standard.

• State whether the response is based on performance as a single concern, joint venture, mentor-protégé arrangement, or prime with subcontractors. Identify proposed team members to the extent known.

• Identify any organizational conflicts of interest or other limitations that could affect performance.

• Describe the respondent’s capability and recent experience managing an enterprise IT requirement comparable in scope, complexity, geographic distribution, security level, and staffing.

• Explain how the respondent would integrate cybersecurity, infrastructure, cloud, application, data, service-management, and modernization functions under one technical and management framework.

• Provide up to three relevant examples, including contract value, staffing scale, period of performance, clearance environment, role as prime or subcontractor, and measurable results. Do not submit classified information.

• Describe the respondent’s approach to adopting emerging technologies while maintaining cybersecurity, interoperability, configuration control, and continuity of operations.

TS/SCI staffing and classified-performance capability

The anticipated effort will require a fully cleared workforce meeting applicable Top Secret/Sensitive Compartmented Information eligibility and access requirements at contract start for positions requiring such access.

Respondents should describe their ability to recruit, retain, and deploy personnel with the required qualifications, citizenship, clearance eligibility/access, and technical certifications.

Respondents should not provide individual names, clearance details, resumes containing unnecessary personal information, or classified information in response to this notice.

Specific security requirements, work locations, access prerequisites, and contract-security provisions will be identified in any future solicitation and associated security documentation.

• The facility clearance level currently held and whether it is active;

• The approximate number of employees presently available with the required eligibility/access, provided only in aggregate;

• The number that could reasonably be available at contract start;

• The anticipated time required to fill the balance;

• Geographic or labor-market limitations;

• Dependencies on incumbent capture, subcontractors, teaming partners, or government processing;

• Historical vacancy, attrition, and time-to-fill experience for comparable positions;

• The approach to maintaining coverage during clearance delays and personnel turnover;

and

• The ability to scale above the baseline for contingency, cyber-incident, or wartime surge requirements.

• Describe your ability to increase staffing and technical capacity rapidly for contingency operations, cyber incidents, or wartime surge requirements. Identify realistic surge capacity, mobilization time, limiting factors, and any reliance on subcontractors.

• Describe the corporate recruiting, retention, training, and reach-back resources available to support a requirement of this size, particularly for scarce technical skills and TS/SCI-cleared personnel.

• Explain how you would maintain continuity of operations if staffing demand increased significantly or performance locations changed on short notice.