ENTERPRISE CROSS DOMAIN SOLUTIONS (CDS)_RFI.pdf

UNCLASSIFIED

REQUEST FOR INFORMATION (RFI) / SOURCES SOUGHT (SS) NOTICE FOR

ENTERPRISE CROSS DOMAIN SOLUTIONS (CDS)

(U) The Government is requesting information on Enterprise Cross Domain Solutions (CDS).

(U) THIS IS A REQUEST FOR INFORMATION (RFI) AND NOT A SOLICITATION. This

RFI is for planning purposes only and shall not be considered an invitation for bid, request for quotation, request for proposal, or as an obligation on the part of the Government to acquire any products or services. Your response to this RFI will be treated as information only and will follow a three-phase timeline (please see below timeline section). No entitlement to payment of direct or indirect cost or charges by the Government will arise because of contractor submission of responses to this announcement or the Government’s use of such information. This request does not constitute a request for proposals or the authority to enter negotiations to award a contract. No funds have been authorized, appropriated, or received for this effort. The information provided may be used by the Government in developing an acquisition strategy, or performance work statements, or specifications. Interested parties are responsible for adequately marking proprietary or competition sensitive information contained in their responses. The Government is not required to award a contract based on this RFI or to otherwise pay for the information submitted in response to this RFI.

(U) By submitting information in response to this RFI, respondents consent to the release and dissemination of submitted information to any Government entity. As such, to the extent that any information submitted in response to this RFI is marked as, or construed to be proprietary or business-sensitive, respondents are hereby notified (a) of the potential that such information may be disclosed to third party (support contractor) and (b) that submission of information in response to this RFI constitutes consent to disclosure of submitted information. The

Government expects to have third party support during its review of RFI responses. Industry

Partners (IP) who require a Non-Disclosure Agreement (NDA) arrangement shall coordinate with and submit its corporate NDA to the POC listed below, specifically referencing this RFI's number and title in the NDA’s scope. The completed NDA will be promptly returned to the IP.

POC: Casey Nau

Email: casey.nau@gsa.gov

(U) NO phone calls and/or requests for a Solicitation will be accepted or acknowledged.

Company Brochures are NOT desired.

(U) Technical questions regarding this RFI should be directed to Renee Grace (renee.grace@gsa.gov) and Casey Nau (casey.nau@gsa.gov) no later than (NLT) 11:00 a.m. ET on February 12, 2024. Phone calls will not be accepted.

(U) The Government requests responses to this RFI to be submitted NLT February 20, 2024, at 3:00 PM ET. All interested parties should submit in writing (no more than 20 pages, single-spaced) their capabilities, experience, and familiarity with providing the services stated below. Responses to identified capabilities should be clearly marked within the response with the ability to meet threshold and/or objective requirements clearly identified within the response. A response of ‘no’ or ‘not provided’ with the given architecture is an appropriate answer. The complete response to this RFI is limited to a total of 20 pages. The Government is not seeking marketing materials in response to the RFI. The responses should be in Adobe Acrobat Portable Document Format (PDF) or in a format compatible with Microsoft Office.

Please submit your responses via email to Renee Grace (renee.grace@gsa.gov) and Casey Nau (casey.nau@gsa.gov) NLT 3:00 PM ET on February 20, 2024. Phone calls will not be accepted.

SCOPE:

(U) This request is for information only regarding the implementation, operation, and maintenance of an Enterprise Cross Domain Solutions which support data flows and transfer in a multi-classification Department of Defense (DoD) architecture. The requirements have been grouped by into five high level capabilities: Low to High Dataflow, High to Low Dataflow, Security, Communication, and Personnel. Failure to identify a capability from the listed requirements will not be identified as a failure in another category. Collaboration may be possible between industry partners to provide an integrated solution for Enterprise Cross Domain

Solutions which meets regulatory requirements and desired functionality.

PURPOSE:

(U) The Government is requesting information on Enterprise Cross Domain Solutions. The purpose is to enhance or replace the existing Enterprise Cross Domain Solution with regards to future proofing for the near-term future and at least five years onward. The Government is requesting that responders address on-premises, hybrid, or cloud service solutions regardless of respective section being considered.

TIMELINE:

(U) Phase 0 – Request for Information: Cross Domain Solutions (RFI) submitted to Industry

January 17, 2024.

(U) Phase 1 – RFI Responses: Industry Partners with technology capabilities that potentially meet the areas of interest are encouraged to submit RFI responses NLT February 20, 2024.

Note: The Government will respond to questions about the RFI that are provided to the

Contracting Officer NLT February 12, 2024. All correspondence (questions and answers) will be by email to the Contracting Officer.

(U) Phase 2 – Immediate Post RFI Actions: RFI responses that were reviewed and determined to have the highest potential to satisfy the technology requirements for Cross Domain Solutions may be contacted for additional information requests. For technology that did not meet the potential to satisfy technology requirements, industry partners will be notified by email with additional detail.

(U) Phase 3 – Follow-on Efforts: The Government will decide if testing or a potential future competitive acquisition is desired based on review of the RFI response.

Table 1: Enterprise Cross Domain Solutions (Unclassified)

Enterprise Cross Domain Solutions

Capability Attribute Performance Threshold Objective

Low to High

Dataflow

• Unclassified and/or

High Threat Network to

Secret Network

• Secret Network to Top

Secret Network

Fully supports commonly used

Microsoft office, image, text, xml, and compressed archive types

RTB 4.1 Compliant • Microsoft: Visio, PowerPoint, Excel, Word

• PDF

• Images: Bitmap, TIF, JPEG 2000, JPEG/JPG, PNG, gif

• Text: ASCII, UTF-8, UTF-16, UTF-32

• XML: WL, XML

• Archive: Gzip, Rpm, Tar, zip, bziP2, cpio, ISO

Supports the Cross Domain

Unstructured Data Exchange

(CDUX) conversion, transmission, and validation processes

Validation with 1gb validator constraint per file (example

Docker to binary) Supports industry standard video file formats to include high-definition formats

/-MPEG-2, MPEG-

4/h.264, HEVC/h.265

Supports the transmission of the

Cursor-on-Target (CoT) standard

XML (using Google

Protobuf OMNI protocol) Provides a framework to transmit

Logs

Log validator for validating against the RFC

(request for comment) Ability to automatically detect malicious software by scanning a file’s content and metadata

Command Line Interface

Antivirus scanner

Automatic ability to deny a file based on filtering by content and metadata

T=O

Automatic ability to sanitize and transform a file based on content filters

T=O

Maintains a consistent bandwidth within an acceptable range

3MBs

Maintains as minimal a network latency between the initiation of a request and the response to that request as possible

Near to real time

Maintains the required number of simultaneous streams

• 1114 FMV Streams

• 200 multicast streams

• 100 unicast cast to multicast streams

• 512 CoT streams

• 3 Streams for logs

• 3 Unstructured data streams

*Per data flow

Capability Attribute Performance Threshold Objective

High to Low

Dataflow

Top Secret Network to

Secret Network

Fully supports commonly used

Microsoft office, image, text, xml, and compressed archive types

RTB 4.1 Compliant • Microsoft: Visio, PowerPoint, Excel, Word

• PDF

• Images: Bitmap, TIF, JPEG 2000, JPEG/JPG, PNG, gif

• Text: ASCII, UTF-8, UTF-16, UTF-32

• XML: WL, XML

• Archive: Gzip, Rpm, Tar, zip, bziP2, cpio, ISO

Supports the Cross Domain

Unstructured Data Exchange

(CDUX) conversion, transmission, and validation processes

Validation with 1gb validator constraint per file

Supports industry standard video file formats to include high-definition formats

/-MPEG-2, MPEG-

4/h.264, HEVC/h.265

Supports the transmission of the

Cursor-on-Target (CoT) standard

XML (using Google

Protobuf OMNI protocol)

Provides a framework to transmit

Logs

Log validator for validating against the RFC

(request for comment)

Ability to automatically detect malicious software by scanning a file’s content and metadata

Command Line Interface

Antivirus scanner

Automatic ability to deny a file based on filtering by content and metadata

T=O

Automatic ability to sanitize and transform a file based on content filters

T=O

Maintains a consistent bandwidth within an acceptable range

3MBs

Maintains as minimal a network latency between the initiation of a request and the response to that request as possible

Near to real time

Maintains the required number of simultaneous streams

• 1114 FMV Streams

• 100 unicast cast to multicast streams

• 512 CoT streams

• 3 Streams for logs

• 3 Unstructured data streams

Two-person content approval T=O

Security

User Authentication Compatible with the roles, polices, and procedures of Public Key

Infrastructure (PKI) to effectively create and manage the digital certificates and public key encryptions to provide user authentication

RTB 4.1 Complaint T=O

Capability Attribute Performance Threshold Objective

Classification Tagging The ability to integrate with Digital

Rights Management solutions to support Alternative Compensatory

Control Measures (ACCM)/

Special Access Program (SAP) separation enforcement and data tags

RTB 4.1 Complaint T=O

Communication

Chat Application Establish and maintain a high assurance solution for the exchange of Extensible Messaging and

Presence Protocol (XMPP)

NCDSMO compliant T=O

Personnel

The Ability to Become a Content Releaser

Provides the training required for selected individuals to acquire the knowledge to apply RTB standards for content approval

RTB 4.1 Complaint T=O

Onsite Engineers Vendor CDS engineers 2 T=O

Command CDS engineer 1 T=O