Attachment 1 - Desired Solution Attributes.pdf

Attachment 1 – Desired Solution Attributes

1. Integrated Hardware and Software as a Service (SaaS) infrastructure. The prototype will allow for an integrated hardware and SaaS infrastructure while remaining flexible to support emerging technologies. These technologies include:

a. Mainframe CPU

b. Storage

c. Standard core software bundle(s)

d. Optional software bundle(s)

2. Single SaaS solution. The prototype will consist of a single software-as-a-service software solution;

everything needed to sustain, maintain, and modernize applications based on z/OS, zVM, Linux on z, and container on z technologies. Solution will co-locate z/OS, Linux on z and container workloads according to best practices, cost, and performance benefits. The prototype should reflect industry best practices and framework(s) for most cost effective and performant infrastructure.

2.1. For z/OS

2.1.1. Standard z/OS single software product solutions for z/OS Core Functions. To include but not limited to the following functions:

AI Ops tool IPL information display

API lifecycle manager JCL syntax checker

Application Program Manager Language Support

Application performance tuning Message transmission/delivery

Asset Manager Discovery Monitoring (system, network, and application)

Audit Utility Multi-Factor Authentication (MFA)

Automated testing Network Monitoring

Automation/Scheduler Open-source tools

Catalog Manager/Recovery PDS management

Chargeback Utility Report/Output management

CHPID Mapping tool SAF Support Utility (zSecure)

Code Analysis SAF Utility

Data Transfer Session Emulator

Development Suites Session Manager

Event Pusher Sort Utility

Fault analysis Storage Management (Tape and DASD)

File manipulation Storage Utility

Git support System Programmer Utilities

Hardware Configuration Definition (HCD) Test debugging software

HCM ZIP Utility

IDE integration tools ZOWE support

2.1.2. The prototype will include an optional add-on database stack for customers to consume, when applicable. Software bundle(s) to include but not limited to the following function(s).

2.1.2.1. DB2 and supporting software:

a. DB2 Accessories Suite for z/OS

b. DB2 Utilities Suite

c. DB2 Change management solutions pack

d. DB2 Log Analysis Tool

e. DB2 Query Monitor

f. DB2 CA

g. DB2 CAC

2.1.3. Optional add-on database stacks (not included in Core stack) for customers to consume, when applicable. Software bundle(s) to include but not limited to the following function(s):

a. DB2 and supporting software

b. Datacom and supporting software

c. Supra and supporting software

d. IDMS and supporting software

e. ADABASE and supporting software

f. M204 and supporting software

2.1.4. Auxiliary development suites including the following functions:

a. Code discovery

b. Code explanation

c. Code optimization

d. Code translation

e. Analytics

2.2. The prototype will include the ability to provision, sustain, and maintain Linux on z Operating Environments (OEs).

2.2.1. Core functionality of the hypervisor and infrastructure management to include, but not limited to the following:

a. Account Management

b. Audit Utility

c. Automation/Scheduler

d. Backup and Recovery Manager

e. Capable of running Oracle databases in Linux on z OEs

f. Chargeback Utility

g. Data Transfer

h. Event Pusher

i. Fault analysis

j. git support

k. IPL information display

l. Linux on z Orchestration

m. Monitoring (system, network, and application)

n. Multi-Factor Authentication (MFA)

o. Network Monitoring

p. Security Management

q. Session Emulator

r. Session Manager

s. Storage Management (Tape and DASD)

t. Storage Utility

u. System Programmer Utilities

2.3. The prototype will include the ability to provision, sustain, and maintain containers on z.

2.3.1. Core functionality to include, but not limited to the following functions:

a. Container Orchestration

b. Chargeback Utility

c. Fault analysis

d. git support

e. Storage Utility

f. Event Pusher

g. Monitoring

h. Security Management

3. Hosted on-premises. The prototype must be hosted on-premises in a consolidated standardized stack within DISA datacenters. The stack will be standardized and concise, making it ideal for replication when scaling, and used in CONUS and OCONUS locations.

4. Unified and customizable control plane. The prototype’s infrastructure and control plane will provide a single pane of glass for all J-9’s IBM z environments and a single location from which customers and administrators can manage all their assets. The portal must be customizable to facilitate DISA branding and appropriate banners and markings. The prototype will support interaction from the on-premises control plane to commercial cloud service providers. The prototype will allow DISA and its mission partners to be able to provision and manage instances in commercial cloud service provider environments, as well as on prem, in a single interface. The control plane should be capable of acting as a federation source or destination for similar control planes. The control plane will need to be easily customizable for additional internal services/modules, integration with various DISA services, and future capabilities. The central control plane will have dashboards for managing:

a. On-premises cloud environment

b. Commercial cloud assets

c. Container technologies (e.g., Docker, Kubernetes, Cri-o, etc.)

d. Traditional virtualized assets (e.g., Linux on z RHEL/SLES virtual operating environments (VOEs), z/OS and z/VM LPARs)

e. Dedicated hosts (e.g., any appliances that may be in the supporting infrastructure or part of the app stack, such as Guardium, IDAA, etc.)

f. Networking

g. Backup/Disaster Recovery

h. Inventory/Configuration Management and automation (ServiceNow is DISA’s current enterprise CMDB at this point)

i. Storage/Compute

j. Cyber/Compliance dashboard (centralized portal for security posture) including:

i. Full spectrum security reports itemized by environment

ii. Reporting capability accessible by customers for on demand generated reports regarding the posture of their environment

iii. Security Technical Implementation Guide (STIG) compliance and enforcement

k. Billing Portal, including:

i. Full cost transparency for tenants

ii. Reporting functionality

iii. At-a-glance dashboards

iv. Budgeting tools such as billing threshold alerts

v. Customer ability to place server orders in the portal and have servers provisioned via integrated automation

vi. Consolidated billing view of both on-premises and public cloud assets

l. Developer portal

5. Multi-tenancy support. The prototype will include multi-tenancy support with full customer/account level segmentation. Customers will be able to have all their assets in a single Virtual Datacenter (VDC), Virtual Private Cloud (VPC), or Virtual Cloud Network (VCN). The VDCs or VPCs will be fully segmented from one another and have their own virtual networking capabilities. Multi-tenancy capabilities will include the following:

a. Single management portal for each customer to their entire cloud environment

b. Single control plane representation of all customer assets in one place regardless of location or offering.

c. Customers are separated from each other and exist in isolated environments

d. Data is kept completely private and encrypted

e. Ability for infrastructure and tenant-controlled encryption keys with Virtualized Traditional Physical Module (vTPM) encryption support

f. Network micro-segmentation capabilities

g. Built-in ability for tenants to analyze network traffic entering or exiting their space

h. Capability to monitor traffic inside the tenant boundary

i. Multi-tenancy of projects/customer control planes separated by Role Based Access Control

6. Utility based billing and reporting. The prototype will permit utility-based billing and reporting (pay-as-you-go). This will facilitate capacity scaling (up or down), decommissioning or provisioning of hardware as needed, with everything from hardware to software handled at the vendor level to ensure J9 and mission partners only pay for what is used (i.e., consumed).

7. Elasticity and Automated Scalability. The prototype will have elastic automated scalability of IBM z mainframe physical hardware, to attach additional or remove existing physical hardware into the stack, connected to asset management systems for automated asset tracking alongside scaling, while also facilitating a seamless tech refresh process for future upgrades.

8. Role-Based Access Controls (RBAC). The prototype will have Role-Based Access Controls (RBAC) to allow customers and administrators to assign permission sets. Roles will be fully customizable.

Multifactor authentication and single sign-on must support Smart Card / Common Access Card / Personal Identity Verification Card authentication for portal, system, and application access. Privileged users requiring alternate tokens for elevated admin system access. All access controls should leverage CIO mandated identity providers (i.e. ICAM) ICAM integrations may require OIDC.

9. Interoperability Support. The prototype, upon transition to a production environment, will provide interoperability with existing enterprise tools that are critical to the workload but must also include functionality to allow for the integration of new enterprise commercial tools as needed. The solution must be capable integration into DISA Enterprise Software Management software solutions. Including but not limited to tools that fill the following roles:

a. Asset Monitoring / Management (e.g., Tivoli, Splunk, Service Now)

b. Network Monitoring

c. Security (e.g., Enterprise Security Posture System (ESPS))

d. Application Monitoring

e. Automation (e.g., Ansible Automation Platform)

10. Monitoring and Alerting. The prototype will have extensive integrated monitoring and alerting capabilities of both mainframe and non-mainframe components, such as:

a. Realtime insights

b. Alerting features (e.g., email and SMS messaging, alerts that trigger scripts or automation tasks)

c. Cloud-ready manner of monitoring assets/applications/containers/DBs

d. Infrastructure and application-level monitoring and automated handling of events

e. Performance (DevOps)

f. Usage (billing)

g. API monitoring

h. The prototype will have AI/ML leveraged against cyber data. This will give the product the ability to identify exploited vulnerabilities through learned behaviors based on a constant in-depth analysis of events.

i. AI Ops (artificial intelligence and machine learning (AI/ML))

j. Security Technical Implementation Guide (STIG) compliance

11. Integrated File and Image Level Backup. The prototype must have an integrated backup capability that meets government backup requirements. The backup service must be agnostic and function across all asset types. Integrated file and image level backups are required for:

a. Virtual Tape

b. Virtual DASD

c. Independent disks

d. Network file storage

e. Storage attached networks

f. Object storage

12. Disaster Recovery and Migration. The prototype will have a full disaster recovery and migration solution to allow agnostic migration capabilities. The disaster recovery capability will facilitate a seamless migration of IBM z environments. The disaster recovery solution will be capable of disaster recovery to a specific snapshot in time.

13. Application Development Features. The prototype will have an integrated solution to address the key areas of application development for application modernization, stabilization, and maintenance. This includes:

a. Application Program Management

b. Code Analysis (including artificial intelligence (AI))

c. Automated testing

d. Debugging, Integrated Development Environment (IDE) software integration tools

e. Application Programming Interface (API) lifecycle manager

f. Application performance tuning

g. Code based Continuous Integration and Continuous Delivery (CI/CD) automation pipeline

h. Fully functional DevSecOps automation pipeline

i. Code repository for application source code as well as the capability to tie into external repositories

14. User Training. The solution must include user-training on how to manage and operate the prototype.

15. Infrastructure as Code (IaC) and Configuration as Code (CaC). Provisioning and maintenance of the Operating Environments (OEs) will be built on IaC and CaC to be leveraged by customers and administrators as part of an agile lifecycle and by the control plane or as part of a CI/CD pipeline. The prototype will manage and provision resources using code rather than interactive configuration tools, allow for a declarative deployment of resources, and integrate with DevSecOps pipelines. The IaC and CaC should include full OS patch management resources for all IBM z, Linux on z environments. The prototype will include a code repository for IaC source code as well as the capability to tie into external repositories. IaC and CaC will be leveraged to enforce Security Technical Implementation Guide (STIG) compliance of managed endpoints.

16. Automated Asset Scalability. Provisioned assets will have lifecycle options available during the provisioning process allowing users and systems administrators to assign an end-of-life date to the asset.

17. Zero-Trust Architecture. The prototype will be designed to address Zero-Trust architectures where possible and allow for overlapping organizational solutions.

18. High Availability implementations. The prototype will need to meet industry standard redundancy capabilities and include high availability implementations for resources.

19. Migration Services. The prototype will have a full migration solution to allow migration of established IBM z workloads. This migration process and capability will allow a quick, easy transition of non z/OS assets from one hosting type to another within the solution. The migration solution will:

a. Support migration of existing IBM z environments to the prototype with minimal downtime and impact to mission.

b. Be capable of asset migration from varying on-premises and cloud instances to the prototype.