ADP2.0_RFI2_ResponseTracker_4Dec2023.pdf

All interested vendors must respond to the RFI questions in order for their responses to be considered

QUESTION GOVERNMENT RESPONSE

1. Who is the current incumbent (if any) related to the sources sought? No incumbent exist as this is a new program. There is a

Production Other Transaction Authority (OTA) in place for the

2. What is the incumbent's current project/job/contract number? W15QKN209P001

3. Is the agency open to placing the prospective requirement into the 8(a) program?

The Army PMO will assess industry responses. The Army's intent is for a multi-vendor contract that will include both large and small

1. Can we include an acronym list for readability that is outside the page count?

Yes, the acronym list may be included as an attachment seperate from the page count. The acronym list should not exceed one

2. Can you provide guidance about graphics to be included in the response. We recommend font sizes not smaller than 9 point Arial in tables and figures. This is especially important for architecture and

Yes, As long as the response does not exceed the suggested page count, the font size is acceptable.

3. Since 15 January is a Federal holiday, we request that the deadline be 2pm ET on 16 January

The RFI is now set to close on 19 January 2024.

1. In reference to sections 8: Identify any approaches or assumptions not explicitly stated in this RFI that would enable the Army to achieve ADP

2.0 objectives. Protect data at rest and in transit using Federal Information Processing 546 Standards (FIPS) 140-2 approved and validated algorithms for encryption, hashing, and 547 signing (e.g., full disk encryption, Kerberos). 548 549

No response.

a) How do you plan to protecting data based on sensitivity levels? We will review and evaluate vendor responses to learn how they propose implementing a data protection solution.

b) What level of FIPS Certification is required? FIPS Level 140-2 -1 or FIPS 140-2-2

c) How are you encrypting sensitive data and managing access control across all your data repositories on file-servers, databases, applications, virtual machines and across cloud providers?

Vendor responses will be reviewed to evaluate the implementation of any key management solution.

d) Do you have a centralized key management solution for managing encryption keys and access control across all these data repositories?

Vendor responses will be reviewed to evaluate the implementation of any key management solution.

e) Does your key management solution come with a built-in HSM or integrated with a network attached HSM for securely storing encryption keys for highest level of assurance?

Vendor responses will be reviewed to evaluate the implementation of any key management solution.

With regards to 10: Can you identify areas of risk? No response.

a) How are your software developers protecting sensitive data using encryption or tokenization in applications today?

No response.

b) How are your developers securing data in Extract- Translate[1]Load(ETL) tools, which needs a way to selectively protect

No response.

c) Do you have access to PKCS#11 libraries or REST APIs that connects your applications and ETL tools to a centralized key

No response.

3. On page 22/26 of the pdf of the document, ‘Attachment_2_ADP2.0 CRD.pdf’, d. Security and Infrastructure (4), there is mention of FIPS 140-

2. Could you please specify which level is being required? In other words, FIPS 140-2, Level 1; FIPS 140-2, Level 2, or FIPS 140-2, Level 3?

FIPS 140-2-2

4. Is it the Government’s intent to consider FIPS 140-3 for future opportunities? FIPS 140-2, includes data input, data output, control input and status output. FIPS 140-3 includes a fifth interface, control output interface for the use of output; i.e., a secure communications link

We will review a vendor solution that includes implementation

IAW FIPS 140-3

5. Could you please clarify if the US Government plans to use native capabilities available in some COTS, like bit locker, Active Directory, etc?

Native, open-architecture capabilities is preferred. We will consider a vendor solution that includes use of native capabilities within COTS.

6. Is there any interest to have an agnostic cryptographic key management solution for an enterprise key management (virtual or hybrid) that offers integration with multiple technologies? Is a Root of Trust of interest to ensure that data is secure, where keys are always

Vendor responses will be reviewed to evaluate the implementation of any key management solution.

7. On page 22/26 of the pdf of the document ‘Attachment_2_ADP2.0 CRD.pdf’ - “With regards to Role and Organizational based access controls that are assignable to individual users or groups of users are

Cannot respond due to incomplete question.

8. With the amount of data that will be stored, accessed, and used for making crucial decisions, is the US Army concerned with ensuring that the EO 14028, NSM-8 or NSM-10 are incorporated within the security architecture at all layers and early in the design phase? Will this include

The Government welcomes industry feedback on this complex issue. No further information on this topic will be provided.

Is it possible to get "the ADP 1.0 code-repo-access", for my programming team to review the existing ADP 1.0 source code?

No code will be provided for this RFI.

Within the ADP 2.0 CRD document (which I have attached in this email), there are multiple references to the Army Vantage Program.

For clarity / confirmation, will this New ADP 2.0 replace the existing Army Vantage Program?

If yes, is there a rough estimate on when the existing Army Vantage Program will be decommissioned?

ADP 2.0 is the Army's next evolution of data analytics. All decisions around Army Vantage are still pre-decisional.

1.The instructions on RFI page 4 state that the White Paper response is limited to ten (10) pages, and that the Cover Sheet is excluded from the page limit.

•Would the government please confirm that the Cover Letter and the

Table of Contents are also excluded from the ten-page limit?

Confirmed.

2.The information the government is requesting in this RFI addresses complex topics that are best explained with appropriate technical graphics, as well as narrative text.

Accommodating the inclusion of such graphics will improve the quality and clarity of the responses the government will receive, and better inform their analysis and planning efforts.

•Would the government please allow offerors to attach an appendix at the end of their ten-page White Paper responses to present relevant graphics, and exclude this appendix from the ten-page limit?

The Government will allow a seperate document for the appendices, this document should not be more than two pages.

1. What are the components of Data Mesh and their functionalities?

Data Mesh is a data architecture based on a federated and decentralized approach to analytical data production, management, and sharing. It is characterized by federated governance, self-service infrastructure platforms, treating and providing data as a product, and autonomous data domains which are responsible for their data. (ASA(ALT) DASA(DES))

2. What is the overall architecture of the Data Mesh? Data Mesh is a data architecture based on a federated and decentralized approach to analytical data production, management, and sharing. It is characterized by federated governance, self-service infrastructure platforms, treating and

3. What types of data sources (structured, semi-structured, unstructured) are currently integrated into the data mesh?

Data Mesh is not currently implemented today, but will be for ADP 2.0. The Government is interested in reviewing vendor approaches to data mesh integration with all types of data sources.

4. What formats are these data sources in (e.g., CSV, JSON, relational databases, APIs)?The data sources can be all types including the examples in the question (e.g. CSV, JSON, relational databases, APIs)

5. Are there any real-time data sources involved? Yes, there can potentially be real-time data sources involved

6. What existing data platforms, data lakes, and data warehouses are currently used?The Government elects not to answer this question at this time as

7. What open-source and commercial data engineering tools are currently utilized?ADP 2.0 is a new program and there are no current open-source and commercial data engineering tools in place. The Government is interested in vendor recommendations on their

8. Are there any specific vendor technologies currently preferred or restricted?The Government is seeking open-architecure technologies with broad interoperability that requiring minimal customization.

9. What are the current and projected data volumes across all sources? That is being estimated now. For planning purposes use 4-6 petabytes

10. What are the latency and performance expectations for data access and processing?

Near-real time access which is defined as within 24-hours

11. What existing CI/CD tools and platforms are in place (e.g., Jenkins, GitLab CI)?

The Government welcomes industry feedback on their recommended/preferred CI/CD tools.

12. What are the current development and deployment workflows for data platform updates?

The Government welcomes industry feedback on their recommended/preferred development and deployment workflow.

13. Is there an existing continuous monitoring and alert infrastructure? The Government welcomes industry feedback on their recommended/preferred continuous monitoring and alert

14. Are there any specific MOSA compliance requirements to adhere to? The Government is interested in reviewing vendor solutions that adhere to all MOSA requirements

15. What level of vendor involvement is desired for MOSA design, acquisition, and implementation?

Please clarify the question. The Government expects the vendor to implement their product within ADP 2.0

16. How will vendors be evaluated and selected for specific tasks? The Government welcomes industry feedback on this topic.

17. What level of collaboration and knowledge sharing is envisioned between vendors within the ecosystem?

The Government anticipates knowledge sharing to the extent that it is beneficial for all parties.

Line 133 Question - Does the Government have a cut off for date and time for final questions related to RFI?

Rationale – Clarification to industry.

The Goverment will accept questions up until the RFI close date with the intent to publish the second round of questions and answers after the close date.

Section 5 Question – Can vendors respond to RFI with 10 Arial point font for tables and Graphics/Proof Points that would be readable to the Government?

Rational – Understand and accept the Arial 12 – point font for text.

However, adding a couple tables and graphics could enhance industry response to several questions.

Yes, As long as the response does not exceed the suggested page count, the font size is acceptable.

Section 5 – Bullet 4 Question - Current deadline for RFI response is set to 12PM on Monday, January 15th. As January 15th is a Federal Holiday (Martin Luther King, Jr. Day), would the Government consider moving the response deadline to mid-week on the week of January 15th?

Rationale – The updated deadline will facilitate the industry personnel to take the federal holiday as scheduled.

The Government extended the RFI response deadline to 19 January 2024.

Figure 1, ADP 2.0 Concept Question – The Army Data Layer depicted in Figure 1, ADP 2.0 concept, include the current Vantage data sources that are being ingested today or is the scope of the data sources greater than what is available today? If broader, can the Government please provide the scope?

The Army's current authoritative data sources form the baseline for ADP 2.0.

Section 6 – Question 10 Question – Can the Government please elaborate on what will be considered as successfully achieving the “Threshold Requirements”?

Rationale – The “Threshold Requirements” are laid out in the CRD separately from the “Transition Requirements.” Does this mean that we can meet the threshold requirements by instantiating a platform that meets the “Threshold Requirements” but does not have the elements laid out in the “Transition Requirements” completed? Understanding this nuance around what qualifies as successfully meeting the “Threshold Requirements” will obviously have a significant impact on the timeline and potentially require asking further questions to estimate the timeline.

The Threshold Requirements as laid out in Section 9.1 is the expectation for ADP 2.0. A transition of data will be a part of entering into production.

Figure 1, ADP 2.0 Concept Question – The Army Data Layer and Data Product Management Engine appear decoupled in Figure 1, ADP 2.0 concept. Does the Government envision the creation, engineering and management of data products to occur outside of the Data Layer?

Rationale – To fully understand the scope of the Data Product Layer in comparison to the Data Layer

The Government welcomes industry feedback on their recommended/preferred method for creation, engineering and management of data products.

CRD Part 2 Section 7-4 – Table 1 – Security & Infrastructure Question – This section describes the need for having the “product and/or capability commercially available now” including the capability of integrating with existing DoD ICAM services and the Cross-Domain Solution (CDS) which only a limited subset of approved DoD Data Platform vendors currently have. However, there is also a requirement for the ability to attain or maintain an ATO and go through the RMF process, to participate in multi-vendor competition, with new features and innovation. Rationale – Clarification on whether Government is seeking vendors that meet all CRD security and infrastructure requirements on day 1. If the analytics layer in terms of bringing your own visualizations and data layer are abstracted so that anyone can retrieve data if they meet security thresholds, but only a limited subset of approved data platforms can compete due to security infrastructure requirements that are

The Government is not seeking vendors that meet all CRD security and infrastructure requirements on day 1. The Government welcomes industry proposals that communicate their approach to meeting the requirements as written in the CRD.

The Government also welcomes vendor recomendations to the

CRD.

Figure 1, ADP 2.0 Concept Question – Within Figure 1 of the ADP 2.0 concept, what layer does the cross-domain solution (CDS) reside, will raw data sources, evolved data products, and/or polished analytic-visualization data be transferred? Additionally, is there a cross domain solution in place today on the Vantage program? Rationale – The government controls a lot of the security around CDS and some vendors like AWS and DISA offer solutions for CDS but they are responsible for the delivery, speed, and technical difficulties in relation to that and we would want to know if everything is to be replicated on higher-level networks or if there are set requirements in phases in regards to the ADP

Raw data sources, evolved data products, and/or polished analytic-visualization data can potentially require a cross-domain solution. There is a CDS in Army Vantage but, ADP 2.0 is a new system. New CDS efforts will need to go through the Army Cross Domain Management Office.

CRD Part 2 Pg 10, Section 7 High Level Objectives Table; User Experience Question – Is there a desire for the mobile solution (all form factors) to have a similar experience across commands/echelons? NIPR, SIPR? Additionally, is there a mobile solution in place today on the Vantage program? Rationale – Determine current capabilities and standards needed for mobile solution.

There a desire for the mobile solution (all form factors) to have a similar experience across commands/echelons on NIPR to the maximum extent possible (especially with the recent BYOD pilots). Army Vantage is a separate system from ADP 2.0.

Do you expect to release an RFP in FY 2024? The Government plans to release a draft RFP in FY 2024 and an RFP in FY 25.

Do you anticipate there will be a Draft RFP prior to RFP release? Yes.

Are you able to provide an estimate of the anticipated contract value should the Government issue an RFP re: the efforts pertaining to the

The Government is aggregating contract cost data at this time and is not prepared to release a contract value estimate.

As we began responding to the Army Data Analytics Platform (ARDAP) RFI, we saw some news today and were wondering if the RFI was still planning on occurring given the news:

https://www.businesswire.com/news/home/20231215388376/en/Palantir- Extends-Work-to-Power-U.S.-Army-Vantage-Program

Yes, the Government intends to execute the RFI as it pertains the Army Data Platform (ADP) 2.0. The article link pertains to Army Vantage and sustaining the current capability.