AFLCMC_HNIB_Cyber Support Services Follow-on_CSS3_21August23.pdf

Request for Information (RFI) For

Air Force Life Cycle Management Center (AFLCMC) C3I Infrastructure HNI Cyber Sustainment

Cyber Sustainment Services III Follow-On Contract In

Support of the Air Force Information Network (AFIN)

21 August 2023

Contents 1 Scope

2 Purpose

3 Assumptions

4 Facts

5 Requirements Information

5.1 Service Desk

5.2 Supply Chain Management

5.3 Subject Matter Expert (SME)

5.4 Field Engineering Representative (FER)

5.5 Integrated Test Facility (ITF)

5.6 Technical Publications

5.7 Out of Cycle Obsolescence (OCO)

6 Additional Information Requested

7 Responder’s Questions

8 Responses

1 Scope This is a Request for Information (RFI). The Government is issuing this RFI in an effort to better understand industry’s technical capability with respect to a potential Cyber Support Services follow-on contract (CSS3). The information requested from Contractors could include, but is not limited to, information about market availability, technical capabilities or characteristics, costs, and functionality details for Information Technology (IT) tools, applications, services, and/or products capable of satisfying the CSS3 effort.

CSS3 is comprised of sustainment services and an Out of Cycle Obsolescence (OCO) capability. These services include a 24/7/365 Service Desk, Technical Publications, Integrated Test Facilities, and various miscellaneous capabilities sustaining the Air Force Information Network (AFIN). CSS3 also provides Field Engineering Representatives (FER) and Subject Matter Expert (SME) support to various key CONUS and OCONUS locations in support of specific HNI projects/systems. OCO is a rapid replacement capability for equipment that is at or near end of life/end of support or other natural disaster or unexpected equipment replacements.

Any information submitted by respondents to this request is strictly voluntary. This is not a request for proposal, request for quotation, or invitation for bid, nor does this RFI obligate or restrict the Government to an eventual acquisition approach. The Government does not intend to award a contract on the basis of responses from this RFI or pay for the preparation of any information submitted or for the use of such information. All information received from this RFI will be used for market research purposes only.

Please submit non-proprietary information only. The Government shall not be liable for damages related to proprietary information.

2 Purpose The AFIN is a multi-billion-dollar portfolio of Air Force (AF) programs that ensure an effective worldwide, fixed-base, high-speed, high-capacity, reliable and secure digital communications infrastructure. The AFIN system consists of enterprise-wide tools, equipment and media that provide traditional and wireless base network infrastructure, network monitoring and network defense at Active- Duty Air Force (ADAF), Air Force Reserve (AFR) and Air National Guard (ANG) bases worldwide.

AFLCMC/HNI is responsible for maintaining and sustaining the AFIN, including both Non-Classified Internet Protocol Routed Network (NIPRNET) and Secure Internet Protocol Routed Network (SIPRNET). HNI is planning a follow-on contract effort and is seeking information from Industry prior to developing a sustainment strategy. If the Government pursues this effort, the follow-on contract Request for Proposal (RFP) could post approximately by the first quarter of the calendar year (CY) 2024. This information is for planning purposes only; the Government reserves the right to post earlier, later, or not at all.

At a high level, the contemplated performance-based contract would require contractor employees to work globally (on-site and travel), and would need to include the following services and tasks:

• Service Desk including Duplication Services

• Restore AFIN to an acceptable operational status o Troubleshoot and resolve incidents and problems o Replacement of faulty equipment

• Monitor, test, identify, and publish patches and firmware upgrades

• Technical Orders (TOs) and Time Compliance Technical Orders (TCTOs)

• Produce and analyze metrics, for the purpose of increasing the availability and reliability of the

AFIN

• Track, report, and recommend solutions for product obsolescence

• Out of Cycle Obsolescence (Form/Fit/Function Hardware Replacement) purchases

• Supply Chain Management including equipment; replacement purchases, warehousing, shipping, and inventory

• Provide administration, engineering and management support for systems and equipment in the

Integrated Test Facilities (ITF) / Information Assurance (IA)

• Field Engineering Representatives (FERs) between the AFIN operational community and

Program Management Office (PMO)

• Subject Matter Experts (SMEs) supporting specific AFIN projects, products, and systems

• Report Generation and Metrics for all contract work activities and services

3 Assumptions

• Period of Performance (PoP) for this follow-on contract will be five (5) years, consisting of one base year, plus four (4) one-year options.

• Transition from the current contract to the follow-on is completed in less than two months.

• Assume approximately two hundred and twenty-five (225) incidents per month with less than five percent (5%) high/critical.

• The contemplated contract may be incrementally transitioned during the PoP to a USAF

Enterprise IT as a Service (EITaaS) Multiple Service Integrator (MSI) construct. The exact timeframe is unknown.

• Original Equipment Manufacturer (OEM) Product Support Agreements (PSA) and License administration is not anticipated to be part of this effort.

4 Facts

• The North American Industry Classification System (NAICS) code for this action is 541513, Computer Facilities Management Services.

• The Product and Service Code (PSC) is DG01 IT and Telecom - Network Support Services

(Labor).

• HNIB supports weapon systems, programs, and program offices: the Air Force Intranet Control

(AFINC) weapon system, the Cyberspace Security and Control System (CSCS) weapon system, the Base Information Transport Infrastructure (BITI) ACAT 1 program, the Theatre Deployable Communications (TDC) weapon system, and several miscellaneous programs within the HNIT and HNII portfolios.

• The Prime will ensure all personnel comply with all contractual certifications, evaluation, training, background investigations and experience requirements of Department of Defense Directive (DoDD) 8140.01.

• The Prime will ensure personnel with required skills, experience, and certifications (SEC) are assessed and updated on an on-going basis.

• The Prime will implement a Program Protection Implementation Plan (PPIP) for Critical Program Information (CPI) or critical components.

• The Prime will provide a service desk that has and can maintain NIPRNET and SIPRNET access to the AFIN.

• The Prime will ensure all personnel that require access to evaluate, modify, change, or touch the AFIN, have a valid SECRET security clearance. Some prime personnel may be required to hold an active Top Secret Sensitive Compartmented Information (TS/SCI) clearance.

• HNI currently uses an AF Enterprise Information Technology Service Management (EITSM) system, BMC Remedy or its replacement as the enabler for AFIN Response Center (ARC) functions.

• There is an Air Force wide Cisco and Microsoft Joint Enterprise Level Agreement (JELA) in place. Other OEM Enterprise Level Agreements (ELAs) may be in place by the time of contract award.

5 Requirements Information

5.1 Service Desk

Service Desk Background Information:

The service desk is currently known as the AFIN Response Center, or ARC and must have 24/7/365 coverage in order to support the global AFIN footprint.

Service Desk Requirements:

The service desk must respond to all high/critical service requests, incidents, and problems immediately.

It must respond to all others in < two (2) hours (threshold) / < one (1) hour (objective). Response is commenced by engaging with the issue originator/customer, initiating technical troubleshooting and working toward system resolution.

Non-Contractor driven potential delays:

• Customer unavailable or failing to provide additional required information / actions to assist troubleshooting.

• Customer failing to implement a Contractor provided solution.

• OEM warranty or Product Support Agreement (PSA) terms initially obtained by the PMO outside of a contractual performance requirement.

The Contractor must provide and have in place the following, no later than the end of the transition period:

• A physical location for the service desk that has the capability to:

o Connect to the Air Force Information Network (AFIN).

o Integrate this new effort into your existing facility before the end of the transition period.

o Provide a Continuity of Operations Plan (COOP) that identifies a location able to assume one hundred percent (100%) of Service Desk operations in < four (4) hours (threshold).

Questions for Industry:

1) Question: Currently the ARC is located within the metro-Boston area (~10 mile radius) due to the proximity to a Hanscom AFB based PMO. What is your recommendation for where to locate the ARC, retain near Boston or another CONUS location?

2) Question: Do you have a service location within the Boston area? If so, would there be a cost savings to leverage your existing contractor facility vs. leasing a new (dedicated) facility?

3) Question: What benefit do you see in a Government owned facility vs a contractor owned/leased facility with the expectation of a hybrid work from home environment?

4) Question: How would you propose to leverage and integrate other contractor team members/skillsets within the scope of this contract ie, have the ARC utilize skills and experience that exist in the ITF, as well as sharing knowledge from the SMEs and FERs? Do you have comparable skills and experience as currently exists in the ARC and ITF? How would you staff the locations with experienced SMEs and FERs?

5) Question: What would your process be to assign the right resource with appropriate skills to start problem incident troubleshooting?

6) Question: What are examples of your Service Level Agreements (SLA) and how do you measure them?

7) Question: Do you have experience in operating an enterprise level service center?

5.2 Supply Chain Management

Supply Chain Management Background Information:

It is essential that the right components get to the right place and are installed on-time to maintain and sustain the AFIN. Currently, HNI obtains components through the following activities, listed in order of execution:

• Exercise an OEM warranty or support agreement, if none exists then,

• Ship a component stored in a designated warehouse, if not in stock then,

• Purchase a component through contractor’s procurement office.

Supply Chain Risk Management (SCRM)

Questions for Industry:

1) Question: Do you have a Supply Chain Risk Management Program in place as part of a comprehensive Program Protection Implementation Plan (PPIP) when acquiring hardware and software assets? Does it comply with NIST Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations - SP 800-161r1, NIST Secure Software Development Framework (SSDF) – SP 800-218 and NIST Software Supply Chain Security Guidance?

2) Question: Do you acquire COTS software with a requirement for the vendor to provide an SBOM (Software Bill of Materials)? If yes, do you require the vendor to document the SBOM process in order to meet the guidance put forth in Executive Order 14028?

Supply Chain Management Requirements:

HNI would like to consider all available options for warehousing:

• The Government currently utilizes the Air Force Cryptologic and Cyber Systems Division (AFLCMC/HNC) warehouse in San Antonio, TX and may or may not continue to do so in the future.

• A dedicated warehouse is not the requirement. The requirement is performance-based and is measured by speed of incident resolution.

• The Contractor would be expected to determine what and where to stock components for the AFIN and would be reimbursed material costs based on consumption.

Questions for Industry:

Explain your procurement process from equipment ordering through shipping;

1) Question: What amount/type/location of storage can you dedicate to the contemplated contract?

2) Question: What are your typical response times for shipping from your facility or another designated warehouse to both CONUS and OCONUS locations?

3) Question: Do you have preferred (gold, silver, etc.) partnerships with large or key vendors to help mitigate both issue resolution and costs?

5.3 Subject Matter Expert (SME)

Subject Matter Expert (SME) Background Information:

This contract will include both OEM and non-OEM Subject Matter Experts (SMEs) for specific sustainment capabilities.

SME Requirements:

At a minimum SME’s would be required to perform the following tasks:

• Conduct research, documentation, and testing activities for architecture/systems redesign

• Support system transitions and subsequent integration into new infrastructure environments

• Support programs/projects during acquisition life cycle phases, as required

• Support system engineering and design efforts for change initiatives

• Provide administration, maintenance, and configuration for existing infrastructure components

• Provide support for TO and TCTO development, review and application

• Support information assurance assessments and remediation

• Support compliance inspections as required

Questions for Industry:

1) Question: How is SME knowledge shared with the rest of the support team?

2) Question: How do you measure SME performance?

5.4 Field Engineering Representative (FER)

Field Engineering Representative (FER) Background Information:

• HNI provides FERs to the operational community who act as communication liaisons between the PMO and operational community. These liaisons also obtain current operational data for ongoing programs. The FERs help coordinate the following activities:

• HNI PM activity with the affected Network Operations Squadron (NOS) and installation locations

• Training and installation

• Authorized Service Interruptions (ASI)

• Incident updates and escalations with the ARC

• TCTO development, review, and compliance

• Equipment troubleshooting/resolution and installation actions

• Identify risk and opportunities in the field

Questions for Industry:

1) Question: Which locations would you recommend deploying these personnel and what major activities would they add the most value to?

5.5 Integrated Test Facility (ITF)

Integrated Test Facility (ITF) Background Information:

HNI currently maintains ITFs at Hanscom AFB. It is primarily used for TO and TCTO development, and service desk troubleshooting, but also supports development of future systems. The ITFs contain a subset of the systems and equipment that mirror the deployed AF programs across the AF NIPRNet and SIPRNet.

The ITFs provide the ability to configure, test, and support the computer data network, communication software and equipment, system designs and architectures currently being acquired and implemented throughout the Air Force.

Test Facility Requirements

At a minimum the Contractor shall perform the following tasks:

• Install, support, and maintain systems IAW TOs, Technical Manuals (TMs), TCTOs and Field Change Orders (FCOs)

• Plan and respond to service outages, i.e. Defense Research and Engineering Network (DREN).

• Diagnose software and hardware failures to resolution

• Manage baseline configuration of the ITFs in accordance with the ITF-specific Certification and

Accreditation (C&A) package

• Ensure security preventive measures are fully functional

• Training supported by the ITFs

• Monitor and enhance ITF system performance

• Monitor and administer VMWare vCloud infrastructure and applications

• Maintain a Sandbox environment that allows segregated virtual space to standup and test deployed systems and allow tenants to conduct non-destructive training and knowledge enhancement.

• Track and report metrics such as lab usage, uptime, capacity, etc.

• Interface with other organizations’ test facilities via the DREN

• Create and maintain virtual solutions to support integrated and deployed systems to lessen reliance on hardware requirements.

• Conduct periodic market research to identify emerging technical solutions to maximize resource efficiencies.

• Create test plans, deliver test reports, functionally test installed equipment, provide local and remote access for account holders, manage users accounts.

• Migrate to the cloud-based solution to mirror department initiatives.

Questions for Industry:

1) Question: What is your strategy on continued use of laptops for DREN / Virtual desktop infrastructure (VDI)?

2) Question: What is your approach to wireless ITF access? Would you include test plans, test reports, or test equipment? Please explain remote and local capabilities and discuss both NIPR and SIPR.

3) Question: Based on your experience, how are metrics such as ITF usage, infrastructure uptime, system capacity and performance reported?

4) Question: Other cyber testing facilities exist within the AF. Do you see a benefit to connecting these facilities to the ITF? What concerns would there be in connecting these facilities?

5) Question: Considering current trends within the IT industry to move operations to the cloud;

where do you see the ITF moving in the next 5-10 years?

6) Question: The current ITF is on the DREN. Is there any benefit to using an alternative network.

Are there any disadvantages?

7) Question: Based on your experience, would there be an advantage of having a COOP site for the ITF? How would a COOP site be implemented? How and where (backups, network connectivity)?

8) Question: What method would be applied to assure uninterrupted workflow in the event of personnel turn-over, absenteeism, or other staffing shortages. What process would be applied to maximize retention.

9) Question: What systems, methods or tools would be employed to assure situational awareness is maintained with the ITF Tenants?

10) Question: How would planned and unplanned service outages be managed?

5.6 Technical Publications

Technical Publications Background Information:

Technical Order (TO) lifecycle management of AFLCMC/HNI technical publications is IAW TOs 00-5- 1, 00-5-3, 00-5-15, and 00-5-18, and the HNIB TO Acquisition; TO Lifecycle Management; TCTO Process; and TO Sustainment HNIB Internal Process Guides (IPGs).

The majority of technical publications are internally produced Time Compliance Technical Orders (TCTOs) based on new or existing internally or externally developed Technical Orders (TOs), and other publications/source data (such as Information Assurance Vulnerability Alerts (IAVAs).

Questions for Industry:

1) Question: Explain how you might document the success of an AI technical writing solution?

2) Question: What experience do you expect Government employees who support this effort to have?

3) Question: What is your ratio of production (pages per hour) to documentation capability?

4) Question: What impact do you expect Artificial Intelligence (AI) to have on technical writing and soon do you see this happening. What obstacles and challenges do you foresee?

5) Question: What engineering skills are needed to develop effective Technical Publications?

6) Question: Describe your experience, in incorporating AI solutions into a network?

7) Question: What key deliverable and Evaluation Criteria would the contractor incorporate in an AI solution to enhance technical writing capabilities to improve content quality and increase overall efficiency?

5.7 Out of Cycle Obsolescence (OCO)

Out of Obsolescence (OCO) Background Information:

A portion of the CSS3 effort will include the Contractor actively tracking component End of Sale (EOS) /End of Support Life (EOSL) with respect to hardware status for elements of the AFLCMC/HNI AFIN system. The Contractor would develop a look-ahead Obsolescence Report to communicate the lifecycle status of each system component and provide two recommendations to the government for functional replacements.

OCO Requirements A functional replacement will be required for OCO equipment that is at or near EOS and prior to EOSL.

This capability will allow a rapid response to system obsolescence events, including to unknown and unforeseen threats to system availability and operational capability.

The OCO capability is comprised of a product/equipment procurement with shipping services to CONUS and OCONUS Air Force bases and/or to a Government warehouse in San Antonio, TX or another CONUS facility to be named later.

Questions for industry:

1) Question: Based on your experience, what is the best method to obtain vendor EOL dates/notifications?

2) Question: Please explain your product obsolescence management strategy and approach?

3) Question: Based on your experience, what is the best method of determining the best functional replacement for an obsolete item?

4) Question: Based on your experience, when fielding a form/fit/function replacement for an IT component, is additional training required? If so, then where should these funds come from?

6 Additional Information Requested Provide the following business information:

1) Company Name

2) Telephone Number

3) Email Address

4) Point of Contact for further clarification or questions

5) Optional – Experience related to the type and magnitude of this effort. (Total page count not to exceed four pages.)

6) DUNS#:

7) Cage Code#:

8) Please state whether you would be interested in submitting a proposal if this effort is released as a competitive action in the future.

9) Please identify any Multiple Award Schedules (MAS) or Indefinite Delivery Indefinite Quantity

(IDIQ) contracts you hold.

10) Please identify an appropriate NAICS code(s) available for each vehicle.

11) Please state whether you are a small or large business pursuant to the Small Business

Administration’s (SBA) size standards.

7 Responder’s Questions Questions with regard to this RFI are requested to be submitted by e-mail to Contract Specialist Robert Hoban, robert.hoban.2@us.af.mil and Contracting Officer Catherine Frotten, catherine.frotten@us.af.mil not later than 1500 hours EDT on 11 September 2023.

8 Responses Responses to this RFI are requested to be submitted by e-mail to Contract Specialist Robert Hoban, robert.hoban.2@us.af.miland Contracting Officer Catherine Frotten, catherine.frotten@us.af.mil not later than 1500 hours EDT on 18 September 2023.

Unclassified responses should be single-spaced, Times New Roman, 12-point font, with one-inch margins all around, compatible with MS Office Word 2007 or higher with a total page count not to exceed five (5) pages. Each page of your package shall be printable on 8 ½” x 11” paper. Cover, tab dividers, title pages, glossaries and table of contents are not required. Please note that some Email systems may block file types such as .zip or other macro-enabled extensions; respondents should verify legible receipt by email.

Any response submitted by respondents to this request constitutes consent for that submission to be reviewed by military personnel, Government civilians, DoD contractors and MITRE System Engineers.

MITRE Corporation is a Federally Funded Research and Development Center (FFRDC) and, as such, fulfills an unbiased, non-profit role for the Air Force. The responses may be forwarded to other Government entities in consideration for applicability to other programs.

The Government is not planning to have one-on-one discussions. Respondents are advised that the Government is under no obligation to provide feedback with respect to any information submitted. All submissions become Government property and will not be returned.

This RFI is issued solely for information purposes. It does not constitute an RFP or a promise to issue an RFP in the future. This RFI does not commit the U.S. Government to contract for any supply or service in any manner. Respondents are advised that the U.S. Government will not pay for any information or mailto:robert.hoban.2@us.af.mil administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested parties’ expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.