AFLCMC_HNIB_Zero Trust Gateways RFI_05 OCT 2022.docx

Request for Information (RFI) For Air Force Life Cycle Management Center, Enterprise IT and Cyber Infrastructure Division (AFLCMC/HNI) In Support of Zero Trust Gateways (ZTG)

5 October 2022

DISTRIBUTION STATEMENT C: Distribution is authorized to U.S. Government agencies and their contractors; other requests for this document shall be referred to AFLCMC/HNIB, Hanscom AFB, MA 01731

Contents

Scope This is a Request for Information (RFI). The Department of the Airforce (DAF) Life Cycle Management Center (LCMC) Enterprise IT & Cyber Infrastructure Division (HNIB) is issuing this RFI to better understand industry’s technical capabilities for a potential enterprise-wide deployment of a Zero Trust Gateway (ZTG) solution/configuration based on National Institute of Standards and Technology (NIST) and Defense Information Systems Agency (DISA) standards. This consists of architecting and deploying ZTG solutions to Component Enterprise Data Centers (CEDC) and base boundaries on both the Non-classified Internet Protocol Router Network and Secret Internet Protocol Router Network (NIPR and SIPR). This is in direct support of the DAF’s Zero Trust Strategy and direction to implement ZT security architecture.

Information provided could include market availability, technical characteristics, cost, and functionality of Information Technology (IT) tools, applications, services or products capable of satisfying the ZTG effort.

Any information submitted by respondents to this request is strictly voluntary. This is not a request for proposal, request for quotation, or invitation for bid, nor does its issuance obligate or restrict the Government to an eventual acquisition approach. The Government does not intend to award a contract on the basis of responses from this RFI or pay for the preparation of any information submitted or for the use of such information. All information received from this RFI will be used for market research purposes only.

Please submit non-proprietary information only. The Government shall not be liable for damages related to proprietary information Purpose This is a sustainment activity to rebuild/replace data center and Air Force’s (AF) base security stacks and protection suites to support the AF’s CEDC and AF base security boundaries with Zero Trust capabilities. See sample Existing Architecture diagram (Figure 1) in Section 10. This is being done IAW the Department of Defense (DoD) Data Center Reference Architecture 3.0 dated 6 Feb 20; DoD Instruction (DoDI) 8010.01 dated 10 Sep 18; DoD Cloud Security Guide 1.3; Office of the Chief Technology Officer (CTO) 16-102; and Executive Order 14208 dated 12 May 21.

The Zero Trust implementation will leverage software defined perimeters that will integrate with AF Identity, Credential, and Access Management (ICAM) instances to ensure only authorized users gain access to AF applications and data based on the attributes resident in the AF ICAM instances. The Zero Trust implementation must sustain a minimum throughput of 10 Gb/s.

There will be 13 CEDC Security Stacks and roughly 187 base-level protection suites on AF NIPRNet and 187 base-level protection suites on AF SIPRNet providing a Secure Access Service Edge (SASE)/Software-Defined Perimeter (SDP). The SASE/SDP will support: Policy Decision Point (PDP), Policy Enforcement Point (PEP), and Client access request for access to all CEDC and DAF-hosted applications. CEDC security stacks will be built on Hyper Converged Infrastructure (HCI) to support Tier III data center requirements, while ZT Protection Suites for the bases will be built to support Tier II data center requirements. This will require redundant DoD Information Networks (DoDIN) access, security stacks for each CEDC, and a single security stack for the base protection suites. The solution must also provide logs to Enterprise Logging Ingest & Cyber Situational Awareness Repository (ELICSAR) to support Defensive Cyberspace Operations (DCO) and DoDIN operation’s big data analytics and must be managed out-of-band.

The Zero Trust implementation must be policy driven with the capability to have the policy engine on premise locally, off premise remotely, or in the cloud. The solution should address how the implementation will be useable in a Denied, Disrupted, Intermittent, and Limited bandwidth (DDIL) environment.

Note: The Air Force has approximately 800,000 users on our network. The larger bases can have up to 35,000 users. The ability for potential vendor products to scale to these numbers will be important.

Responses Although detailed plans are not desired, please include potential products that would meet the below requirements in your response. In this regard, please provide Product Offering Description(s) augmented with product specifications, graphics, figures (e.g., architectures SV-5b), interfaces diagrams, pictures and drawings as appropriate. Also, please provide examples of prior ZTG implementation/installation experiences. In addition, please provide a rough order of magnitude (ROM) for your solution, to include cost. Describe your solutions in a way that specifically addresses the following criteria:

Expected Results:

· Standard enterprise protection suite and high-speed (min: 10Gbs) connection for mission owners

· Protect/defend AF mission through a ZT model

· Leverage a Gov’t provided Identity Credential Access Management (ICAM) solution

· Resiliency/High-availability (99.999%) for each component in the ZT solution

· Standard CEDC enterprise security stack and connections for mission owners

· AF Enclave Security Zone within the SIPR CEDC security stacks that provide a DoD demilitarized zone (DMZ) extension as a SIPR-compliant solution to replace the end-of-life AF SIPR Gateway (Command and Control (C2) nodes)

· APIs for integration with other government provided systems (e.g., Intune, Tanium, ESS, ACAS, and Software as a Service (SaaS))

· Approach to a multi-tier solution that extends the ZTG solution down to individual hosted applications that not only controls N-S access into the base/CEDC perimeter, but also E-W traffic between services/resources.

Requirements:

· Designing/deploying CEDC Security Stacks and ZT Protection Suites to meet DoD requirements to secure/protect data centers

· Separate the CEDC from the base network and provide a direct connection to the Customer Edge (CE) routers (e.g., Service Delivery Points) (on premises)

· Create and extend Security Zones within the security stack to provide a minimum of five Security Zones: Information Systems and Networks (ISN) (core services), Special Purpose Processing Nodes (SPPN) – Warfighter, DMZ, Purgatory, and CEDC mission applications

· Security stacks and protection suites managed through the integrated management system (IMS) and the AFNet out-of-band management (OOBM) Community of Interest via dedicated interfaces

· Capable of automatic fail-over to secondary CEDC in a disconnected state

· Deploy IPv4/IPv6 dual CEDC security stacks

· SASE/SDP to support AF Zero Trust Networks

· Policy Decision Point (PDP) solution for hosted applications

· Policy Enforcement Point (PEP) solution for hosted applications

· Ingesting/incorporating Common Client health assessment solution for hosted applications to inform authorization and access decisions to the applications

· Data center replication and high-speed data transfer between each CEDC and two backup CEDCs

· Secure connection to cloud service providers. Solution should allow for PEPs to also be placed at cloud service providers so users will have access to cloud services directly rather than having to connect to the ZTG at the base perimeter. Solution will support Development, Security, and Operations (DevSecOps), application migration to the cloud, and large-scale file hosting

· Interoperability between ZTGs installed at Enterprise IT as a Service (EITaaS) bases and AFNet

· Capable of being integrated with market leading security information and event management (SIEM) solutions for backup/log storage

· Capable of being integrated with ELICSAR for time-sensitive big data analytics

· Online Certificate Status Protocol (OCSP) responder to accelerate Public Key Infrastructure (PKI) requests

· Forward logs to a government provided enterprise logging & data analytics solution

· ZTG solution must integrate with market leading SIEMs to allow for scalable system capable of growing up to 5 years of data backup and log storage (Security Technical Implementation Guide (STIG) and Air Force Records Information Management System (AFRIM) requirement)

· Replacement of end-of-life CE routers with redundant Software Defined Network (SDN) capable routers (on premises)

· Micro-Segmentation capability in order to isolate workloads from one another to secure lateral movement

· Temporarily retain Enclave Control Node (ECN) third party connection capability to meet DMZ requirements until all applications are migrated to the ZT construct Ancillary Responses One of the objective goals of the AF is to create a multi-modal communications architecture that supports all AF Network (AFNet) and AF Network-Secure (AFNet-S) traffic using Software Defined Networking (SDN), commercial communication – i.e., Black-Core by employing Commercial Solutions for Classified (CSfC) capabilities for encryption, and integrating existing military networks (Non-Classified Internet Protocol Router Network (NIPRNET), Secret Internet Protocol Router Network (SIPRNET), Combined Enterprise Regional Information Exchange System, US/Korea (CENTRIX-K), Battlefield Information Collection and Exploitation Systems Extended (BICES-X), etc.). This is being done to improve communication capabilities at each site, enable the transition to cloud-based operations, and ensure highly reliable communication across the AF Enterprise (i.e., near-zero comm outages) during peacetime and conflict.

Describe solution for Black-Core architecture to include the following capabilities:

· Policy Based Routing & Management

· Integrated Warfighter Network (IWN) on the Edge

· Multi-modal Communications

· Encryption methods/CSfC and Black-Core (integrates with Software-Defined Wide Area Network (SDWAN)) AFLCMC/HNIB will most likely contract a Systems Integrator to accomplish this effort. The Systems Integrator would be responsible for all aspects of the project to include (but not be limited to) design, test, training, Risk Management Framework (RMF), Technical Orders, integration, deployment, maintenance, and support in the creation of all documentation required to support these items. Additional considerations will be made regarding:

· Any past Systems Integrator experience that’s similar to the work being performed and scalable to the entirety of the AF Network.

· Ideas on project durations (Schedule, but rough).

· Ideas on how to transition from existing to new while minimizing disruptions to the users.

· Aspects of work required which the System Integrator will not be able to perform.

References

· DoD Cloud Native Access Point (CNAP) Reference Design, 29 July 2021:

https://dodcio.defense.gov/Portals/0/Documents/Library/CNAP_RefDesign_v1.0.pdf

· DoD Zero Trust Reference Architecture: https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf

· DoD Cybersecurity Discipline Implementation Plan https://dodcio.defense.gov/Portals/0/Documents/Cyber/CyberDis-ImpPlan.pdf

· DoDI 8010.01, DoD Information Network Transport, 10 Sep 18:

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/801001p.pdf

· DoD Cloud Security Guide v1.3:

https://safe.menlosecurity.com/doc/docview/viewer/docNA7F81DB49B433a0001fec2138864c6a5e499b53e14208c613d683199b8a11e4b8159c7846dca

· Executive Order 14208, 12 May 21:

https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/

· DoDI 8510.01, Risk Management Framework for DoD Systems, 19 July 2022:

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001p.pdf

· AFI 17-101, RMF for DAF IT, 10 June 2022:

https://static.e-publishing.af.mil/production/1/saf_cn/publication/afi17-101/afi17-101.pdf

· NIST Special Publication 800-207 Zero Trust Architecture:

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf Contract Questions

· Please state whether you would be interested in submitting a proposal if this effort is released as a competitive action in the future.

· Please identify any Multiple Award Schedules (MAS) or Indefinite Delivery Indefinite Quantity (IDIQ) contracts you hold, and the available NAICS code(s) for each vehicle.

· Please state whether you are a small or large business pursuant to the Small Business Administration’s (SBA) size standards

Additional Information Requested Provide the following business information:

a) Company Name and Commercial and Government Entity (CAGE) Code

b) Telephone Number

c) Email Address

d) Point of Contact for further clarification or questions

e) Optional – Experience related to the type and magnitude of this effort 1 Questions Questions with regard to this RFI are should be submitted by e-mail to Contracting Officer Catherine Frotten, catherine.frotten@us.af.mil and Contract Specialist Robert Hoban, robert.hoban.2@us.af.mil no later than at 1500 hours EDT on the day that marks two weeks from the date the RFI was posted.

2 RFI Response Responses to this RFI are requested to be submitted by e-mail to Contracting Officer Catherine Frotten, catherine.frotten@us.af.mil and Contract Specialist Robert Hoban, robert.hoban.2@us.af.mil no later than 1500 hours EDT on the day that marks four weeks from the date the RFI was posted.

Unclassified responses should be single-spaced, Times New Roman, 12-point font, with one-inch margins all around, compatible with Microsoft Office Word 2010 (or newer) or Adobe PDF, with a total page count not to exceed five (5) pages. Please note that some Email systems may block file types such as .zip or other macro-enabled extensions; respondents should verify legible receipt by email.

Any response submitted by respondents to this request constitutes consent for that submission to be reviewed by military personnel, Government civilians, DoD contractors and MITRE System Engineers. MITRE Corporation is a Federally Funded Research and Development Center (FFRDC) and, as such, fulfills an unbiased, non-profit role for the Air Force. The responses may be forwarded to other Government entities in consideration for applicability to other programs.

The Government is not planning to have one-on-one discussions, but reserves the right to do so. Respondents are advised that the Government is under no obligation to provide feedback with respect to any information submitted. All submissions become Government property and will not be returned.

This RFI is issued solely for information purposes. It does not constitute an RFP or a promise to issue an RFP in the future. This RFI does not commit the U.S. Government to contract for any supply or service in any manner. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested parties’ expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.

3 Appendix Figure 1: Existing Architecture image1.jpeg image2.png