ANL Request for Information - Network Access Control List (ACL) Life Cycle Management Solution.docx

ANL-651 (August 25, 2025)

SOW for Front End Vacuum Chambers and Spool Assemblies

RFI 6-B162-I-05528-00

Request for Information

Network Access Control List (ACL) Life Cycle Management Solution

DUE DATE FOR QUESTIONS: Wednesday, November 5, 2025 DUE DATE FOR SUBMITTAL OF RESPONSE: Monday, December 1, 2025 RESPONSES SHOULD BE SUBMITTED TO: Jeremy Sladetz, jsladetz@anl.gov

ALL CORRESPONDENCE SHOULD REFERENCE RFI NO.: 6-B162-I-05528-00

UChicago Argonne, LLC, operator of the Argonne National Laboratory (ANL), under prime contract with the U.S. Department of Energy (DOE), is performing a market survey to evaluate obtaining products or services which are the subject of this RFI for planning purposes. This RFI is for informational purposes only and will not necessarily result in a solicitation or an award of a contract. Although "proposal" and "offeror" may be used in this Request for Information, your response will be treated as information only. It shall not be used as a proposal. Responses to this RFI may include proprietary or confidential information. The Offeror shall mark any technical data deemed proprietary or confidential on each specific page of the RFI form, otherwise the Laboratory will have unlimited rights of the information provided in request to the RFI. Argonne assumes no liability for disclosure or use of unmarked data and may use or disclose such data for any purpose. Please note that all responses to this RFI will be nonbinding. Also, this RFI does not commit Argonne to pay any cost for the preparation and submission of any information in response to this RFI.

Background/Introduction

Argonne National Laboratory (ANL) is a U.S. Department of Energy multidisciplinary science and engineering research center, where talented scientists and engineers work together to answer the biggest questions facing humanity. This request for information represents a collaborative initiative across multiple key organizations within Argonne, including the Business and Information Services (BIS), Photon Science (PSC), and Computing, Environment, and Life Sciences (CELS) directorates.

The networking, systems administration, and cybersecurity teams within these directorates are jointly responsible for managing a large, complex, and heterogeneous network infrastructure. This environment consists of routers, switches, and firewalls from numerous Original Equipment Manufacturers (OEMs). A critical function for maintaining the security and operational integrity of this shared network is the management of Access Control Lists (ACLs).

Currently, the process for managing the life cycle of ACLs—from initial request, assessment, implementation, renewal, to decommissioning—is largely manual and fragmented across different teams and tools. This presents operational challenges, increases the risk of human error, and makes governance and compliance difficult to enforce and audit across the laboratory.

ANL is seeking to explore industry solutions for a centralized platform to manage the complete life cycle of ACLs, providing governance, automation, and operational efficiency across our multi-vendor environment.

Objective

The primary objectives of this Request for Information (RFI) are to:

1. Understand the current market landscape and the "art of the possible" for centralized network ACL life cycle management solutions.

2. Gauge the depth and breadth of vendor capabilities to meet Argonne's technical requirements, particularly concerning multi-vendor support, governance, workflow automation, security analysis, and reporting.

3. Gather information on typical implementation approaches, project timelines, and the resources required from Argonne to ensure a successful deployment.

4. Obtain budgetary cost estimates, including details on various pricing and licensing models (e.g., subscription, perpetual, per-device), to aid in future financial planning.

Section 1: Company Information

Section 2: Statement of Work or Technical Requirements

The technical requirements associated with this RFI are as follows. The proposed solution should provide a comprehensive, integrated platform that addresses the following key areas:

1. Multi-Vendor Device Support

1.1. The solution must provide native, out-of-the-box support for managing ACLs on a heterogeneous set of network and security devices, including routers, switches, and firewalls from major OEMs (e.g., Cisco, Juniper, Arista, Palo Alto Networks, Fortinet).

1.2. The solution must provide a clear methodology for integrating and managing devices not natively supported, including custom or less common hardware.

2. ACL Life Cycle Management

2.1. Request: Provide an intuitive, user-facing portal or interface for submitting ACL change requests. The request process should capture necessary business and technical justifications.

2.2. Assessment: Offer tools and workflows to enable technical and security teams to assess the impact of a proposed change before implementation.

2.3. Implementation: Support automated or semi-automated, policy-driven deployment of approved ACL changes to target devices, including pre- and post-change validation checks.

2.4. Renewal & Recertification: Include a systematic process for the periodic review, recertification, and renewal of existing ACLs by their owners to prevent rule bloat and ensure continued relevance.

2.5. Decommissioning: Provide a controlled workflow for identifying and removing unnecessary, expired, or unused ACLs from the environment.

3. Governance and Workflow Automation

3.1. The solution must enable the creation and enforcement of customizable workflows for all life cycle phases, allowing for multi-level approvals from various stakeholders (e.g., system owners, network team, cybersecurity team).

3.2. The solution must support the creation of global governance policies to enforce standardization and security best practices for all ACLs.

4. Security Analysis and Compliance

4.1. The solution must provide tools to aid in the security review of ACLs, including the ability to identify overly permissive, shadowed, redundant, or conflicting rules.

4.2. The solution must offer "what-if" analysis capabilities to simulate the impact of a proposed change on network traffic and security posture.

4.3. The solution must support checks against industry and organizational security policies and compliance standards.

5. Centralized Inventory, Reporting, and Visualization

5.1. The solution must discover and maintain a real-time, centralized inventory of all network devices and their associated ACLs.

5.2. The solution must provide robust, customizable reporting and dashboarding capabilities to provide insights for various stakeholders (e.g., operational metrics for engineers, risk and compliance reports for security, executive summaries for management).

5.3. The solution should offer visualization tools, such as network topology maps, that can illustrate traffic paths and the impact of ACLs.

6. System Administration and Integration

6.1. The solution must incorporate granular Role-Based Access Control (RBAC) to ensure users can only perform actions and view information appropriate to their role.

6.2. The solution must provide a well-documented Application Programming Interface (API), preferably RESTful, to enable integration with other Argonne systems.

6.3. The solution must maintain a comprehensive and immutable audit log of all activities, including requests, approvals, changes, and user actions.

Section 3: SOW - Technical Capabilities Questions

Please provide detailed responses to the following questions, referencing the technical requirements outlined in Section 2.

General Architecture and Approach

1. Provide a high-level overview of your solution's architecture. Is it offered as an on-premise software, cloud-based (SaaS), a hybrid model, or a combination of these? Please describe the components involved in each model.

2. Are there sections of the requirements outlined in Section 2 that you believe present a significant challenge? If so, please explain why and how you would propose to address them.

3. What value engineering ideas or alternative approaches could be beneficial to ANL in achieving its ACL management goals more efficiently or effectively?

Multi-Vendor Device Support

4. Provide a comprehensive list of the network and firewall OEMs and models your solution supports out-of-the-box.

5. Describe the process and level of effort required to add support for a new device type or a device not on your standard support list.

ACL Life Cycle Management

6. Describe in detail how your solution facilitates each phase of the ACL life cycle (Request, Assessment, Implementation, Renewal, and Decommissioning). Please illustrate the end-to-end workflow, perhaps with a diagram or screenshots.

7. How does your solution handle change management and version control for ACLs? Explain the process for rolling back a change if necessary.

Governance and Workflow Automation

8. Explain how your workflow engine can be customized. Can Argonne's teams build and modify approval workflows without vendor assistance?

9. How does your solution allow for the creation and enforcement of global policies to ensure all ACLs adhere to Argonne's security and operational standards?

Security Analysis and Compliance

10. What specific features does your solution offer to help security teams assess the risk of an ACL? Please elaborate on capabilities like "what-if" analysis, shadow/redundancy rule analysis, risk scoring, and compliance checks.

11. How does the solution help in identifying and prioritizing the cleanup of old, unused, or overly permissive rules?

Centralized Inventory, Reporting, and Visualization

12. Please provide examples (e.g., screenshots, mockups) of the dashboards and reports your solution can generate for different stakeholder roles (e.g., a network engineer, a security analyst, an IT manager/CISO).

13. Describe your solution's network and traffic path visualization capabilities. How can it help an administrator understand the real-world impact of an ACL?

System Administration and Integration

14. Describe your solution's Role-Based Access Control (RBAC) capabilities. Can you provide examples of typical roles and their permissions?

15. Detail your solution's API capabilities. What functions are exposed via the API? Do you have pre-built integrations with common enterprise platforms like Fresh Service, ServiceNow, Splunk, or JIRA?

Section 4: Schedules - Rough Schedule for Implementation and Deployment

Please provide the following information to help us understand your typical implementation and deployment process.

1. Provide a sample high-level project plan and an estimated timeline for a typical implementation of your solution. Please assume an environment of a scale and complexity similar to a national laboratory. The plan should outline the major phases (e.g., project kickoff, discovery, installation/configuration, integration, testing, training, go-live).

2. What are the key dependencies on our internal teams (e.g., networking, systems, security, project management) during the implementation and onboarding process? Please describe the roles and expected time commitment from Argonne personnel.

3. What major dependencies or external factors (e.g., internal change control processes, security reviews, procurement of hardware if on-premise) typically influence the implementation schedule?

Section 5: Estimate – Budgetary Estimate

Please provide a budgetary estimate for your solution to help us understand the potential financial investment. Your response should be as detailed as possible to allow for effective planning and comparison.

1. Please provide a budgetary estimate broken down into the following distinct components:

· Software/License Costs: The cost of the software itself.

· Implementation and Professional Services Costs: One-time costs for installation, configuration, integration, and project management.

· Annual Maintenance and Support Costs: Ongoing costs for technical support, software updates, and maintenance.

· Training Costs: Costs associated with training for administrators and end-users.

2. Describe your licensing and pricing model in detail. Please specify if the model is based on:

· Number of devices managed

· Number of users

· A subscription-based model (e.g., annual fee)

· A perpetual license model

· Tiered feature sets (e.g., Basic, Pro, Enterprise)

· Are different modules or capabilities (e.g., advanced security analysis vs. basic workflow) priced separately?

3. To help us compare solutions, please provide a sample 3-year Total Cost of Ownership (TCO) estimate for the following two scenarios:

· Scenario A: 250 managed devices (240 switches/routers, 10 firewalls) and 15 users.

· Scenario B: 1000 managed devices (900 switches/routers, 10 firewalls) and 50 users.

4. Please state any other potential costs not covered above, such as required hardware for an on-premise deployment or fees for custom development.

Section 6: RFI Schedule and Submission Details

RFI Response Schedule

· RFI Questions Due: All questions and clarifications regarding this RFI must be submitted via email on or before 5:00PM CST, November 5, 2025.

· RFI Responses Due: Final responses to this RFI are due by December 1, 2025, at 5:00 PM Central Time.

· Submission Contact: All questions and responses should be submitted electronically to:

· Jeremy Sladetz, Procurement Specialist III

· jsladetz@anl.gov

· Reference Number: The RFI Number 6-B162-I-05528-00 must be referenced in the subject line of all email transmittals related to this RFI.

Use of Information and Potential Future Actions

The information gathered from this RFI is for market research and internal planning purposes only. Responses will be used by Argonne National Laboratory to evaluate the current landscape of available solutions and to determine the most appropriate strategy for managing ACLs.

Based on the analysis of the RFI responses, Argonne may, at its sole discretion, choose to issue a formal solicitation (such as a Request for Proposal), further refine its requirements, or pursue other alternatives. There is no guarantee that a formal solicitation will be issued as a result of this RFI, and this RFI does not commit the Laboratory to procure any products or services.

image2.jpg image1.jpg