CJIS Professional Environment QA_answered.xlsx
XLSX spreadsheet 30 KB Posted
- Attached to
- FBI CJIS IT Professional Environment RFI
- Solicitation number
- CJISRFI09022025
About this file
This document is a Request for Information (RFI) from the FBI's Criminal Justice Information Services (CJIS) Division seeking industry insights on creating a unified IT professional environment. The RFI aims to standardize environments and toolsets across approximately 10 current self-managed project environments, with roughly 400 users including administrators, testers, and developers. Key requirements include a cloud-native environment hosted on AWS or Azure GovCloud, supporting software development, system administration, security engineering, and testing across multiple programming languages (Java, Python, Node, Perl, C++, C#), with integration capabilities for industry-standard tools like Jira, Confluence, and Bitbucket.
The RFI emphasizes flexibility in toolsets, AI assistant usage, and compliance with Executive Order 14028, requiring Software Bills of Materials (SBOMs) and following FBI AI ethics guidelines. Respondents are expected to provide evidence of technical capabilities without submitting past performance information, with responses due by September 29, 2025, at 12:00 PM ET. The environment should support the entire development lifecycle, accommodate remote and on-site work, implement role-based access controls, and be adaptable to various technological stacks while maintaining cybersecurity standards using DISA STIGs as a baseline. Notably, this is a market research exercise and not a solicitation for services.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI - CJIS IT Professional Environment CJISRFI09022025.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Question # | RFI Page Reference | RFI Reference Text | Question Asked | Answers | |
| 1 | 7 | N/A | May respondents provide tables and figures using a smaller than size 12 pt font, such as 10 pt Arial? | Please utilize the font requirements as listed in the RFI | |
| 2 | 3 | N/A | Does the FBI anticipate requiring active/standby or active/active operations across AWS GovCloud and Azure GovCloud, or should each environment be considered independently? | The FBI has no expectations but is seeking information on how it would be implemented. If that includes active/active or active/passive configuraitons, how can those configurations impact design, cost, and intent. | |
| 3 | 4 | N/A | Should compliance reporting be consolidated across Development, Non-Production, and Production environments, or reported separately by environment? | Compliance reporting will be done on a production environment. | |
| 4 | 5 | N/A | How does the FBI envision aligning this environment with EO 14028 and CISA Zero Trust guidance, particularly regarding continuous authorization and automated remediation? | This environment should follow guidance from EO14028. | |
| 5 | 6 | N/A | Does the FBI require generation of Software Bills of Materials (SBOMs) for builds in this environment, consistent with EO 14028 requirements? | Yes, SBOMs are a necessary part of the EO14028. | |
| 6 | 7 | N/A | Will the FBI AI Approval Board provide standardized guardrails for all AI workloads, or will projects define their own approval criteria? | CJIS will follow the FBI policy, guardrails, and guidelines. This includes following the AI ethics council, financial discipline, and well architected implementations. | |
| 7 | 8 | N/A | Should integrations with Jira, Confluence, and Bitbucket be standardized at the enterprise level, or configured by individual projects? | The environment will integrate at the Enterprise level with those toolsets listed, but integrations should be flexible enough to adopt any toolsets as needed. | |
| 8 | 3 | N/A | Can the Government please elaborate more on the self-managed environments, specifically the toolsets, architectures, and languages currently being used? | CJIS systems have a variety of architectures from serverless using containers lambdas, to server based implementations, to large kubernetes based deployments. There are also a variety of languges being used with some notable ones being java, node, python, and others. | |
| 9 | 5 | N/A | Can the Government share if there are currently any cybersecurity scanning tools and suites that have previously been integrated? | CJIS uses a wide range of programs to help maintain its cybersecurity posture. CJIS is interested in how industry standard tools can exist in a CI/CD pipeline. | |
| 10 | 3 | N/A | Has the Government identified any must-retain legacy toolsets, programming languages, or architectures that vendors need to support? | There should be no signigicant changes made to how systems are implemented. | |
| 11 | 3 | N/A | |||
| Can the Government please give a rough estimate of the number of personnel aligned across the 10 self-managed environments? | Roughly 400 individuals between admins, testers, and developers | ||||
| 12 | N/A | Does the Government anticipate any key personnel and/or resume requirements with the final solicitation? | No, this is not a solicitation for a service. This is an RFI ONLY. | ||
| 13 | N/A | Does the Government anticipate any clearances being needed by personnel performing the work? | No, this is not a solicitation for a service. This is an RFI ONLY. | ||
| 14 | 3 | N/A | Does the Government anticipate having any personnel needing to be located on-site at CJIS in Clarksburg? | No, this is not a solicitation for a service. This is an RFI ONLY. | |
| 15 | 4 | N/A | Would the Government consider adding a row in the table on pg4 for vendors to include additional vehicles they have access to for the Government to consider? | The vendor can add additional vehicles not mentioned on the RFI, on their own response. No edit is necessary. | |
| 16 | N/A | Will CJIS pursue a phased adoption (pilot, incremental rollout), or require a single unified deployment or MVP? | The Government's only intent with this RFI is understand how the industry is doing enterprise development and incorporating AI into it's technical workforce. | ||
| 17 | N/A | Would CJIS consider a phased acquisition approach for the final, potentially considering a recent and relevant past experience exercise and/or oral presentation? | The Government's only intent with this RFI is understand how the industry is doing enterprise development and incorporating AI into it's technical workforce. | ||
| 18 | 3 | N/A | Will the environment require APIs or connectors for interagency/state/local law enforcement systems? | No. This would be something for internal use only. | |
| 19 | 5 | N/A | Will the CJIS require a federated model across existing environments or full consolidation into one unified environment? | No. This would be something for internal use only. | |
| 20 | 5 | N/A | Will the CJIS require a federated model across existing environments or full consolidation into one unified environment? | No. This would be something for internal use only. | |
| 21 | 5 | N/A | Will the CJIS require a federated model across existing environments or full consolidation into one unified environment? | No. This would be something for internal use only. | |
| 22 | 5 | N/A | Will the CJIS require a federated model across existing environments or full consolidation into one unified environment? | No. This would be something for internal use only. | |
| 23 | 5 - Item 1(d) | N/A | The RFI requests a 'simplistic licensing model.' Can the Government clarify whether it prefers enterprise-wide licenses, user-based licenses, or another approach? | Both of those approaches have benefits and detriments, and can both be classified as simplisitics depending greatly on implementation details. | |
| 24 | 5 - Item 3 | N/A | Regarding the requirement to provide access via commodity means (e.g., web browser), can the Government clarify whether there are restrictions on the use of thin-client or VDI solutions if they are cost-effective and secure? | While CJIS would prefer web based development, low administrative burdened thin-clients or VDI solutions could be entertained. | |
| 25 | 5 - Item 6 | N/A | For AI assistants used in IT professional tasks, does the Government anticipate restricting the use of commercial AI models that may transmit data outside CJIS-controlled environments? | Currently, there are several factors regarding the use of AI models including ethics, environment, cost, and licensing. So there will be restrictions on the models used. | |
| 26 | 6 | N/A | Market research pricing and licensing: For informal pricing, how should vendors structure costs (platform run‑rate, licenses, implementation, and support) and what user counts, concurrency, and growth assumptions should we use | The Government's only intent with this RFI is understand how the industry is doing enterprise development and incorporating AI into it's technical workforce. | |
| 27 | 4 | N/A | The RFI asks for a minimal integrated toolset with a simple licensing model. How does the Government define “minimal” in this context, and are there mandated tools we must include or exclude? | There are no mandatory tools that need to included and is seeking information on how industry is doing AI integrated enterprise development, administration, and testing. | |
| 28 | 2 | The key objectives are to standardize environments and toolsets used by IT professionals working, in multiple facets, on various CJIS projects | Does the Government anticipate how many users will be accessing the environment? | Roughly 400 individuals between admins, testers, and developers | |
| 29 | 4 | b) use role-based access controls (RBAC) to allow flexibility of administration including roles across disparate projects. | Does the Government currently have an anticipate availability target for the environment (99%, 99.9%, 99.99%, etc.)? | The Government's only intent with this RFI is understand how the industry is doing enterprise development and incorporating AI into it's technical workforce. | |
| 30 | 4 | 1. Describe a single IT professional environment that can: | |||
| a) be hosted, deployed via automation, administered, and updated in a Government cloud native environment. | Does the Government anticipate this requirement to be on-site or remote? | The solution needs to support both on-site and remote development and should be the same experience regardless of location | |||
| 31 | 5 | 5. The document should include any integrated cybersecurity scanning tools and suites. | Does the Government currently have a preferred cloud hosting environment (Azure, AWS, GCP)? | Currently, AWS and Azure are in use at CJIS. This does not preclude other cloud offerings from being used. | |
| 32 | 4 | d. have a simplistic licensing model. | Is it the Government's intent to procure licensing for the tools through the contractor? | The Government's only intent with this RFI is understand how the industry is doing enterprise development and incorporating AI into it's technical workforce. | |
| 33 | 3, 6 | The following information is requested: |
2. Evidence to show that your company can provide the requested services and/or products required (i.e. technical ability, personnel, and experience).
WHAT SHOULD NOT BE INCLUDED IN YOUR RESPONSE:
| 2. Past performance information or general descriptions of corporate experience. | The RFI requests “evidence” of technical ability/personnel/experience but disallows “past performance” and general corporate experience. Would the Government elaboarate on which forms of evidence are acceptable (e.g., key staff certs/resumes, sample artifacts, demo environments) without violating that prohibition? | The Government's only intent with this RFI is understand how the industry is doing enterprise development and incorporating AI into it's technical workforce. | |
| 34 | 3 | Currently, IT project related activities for CJIS systems have occurred in self-managed environments (estimated 10 total), segregated by projects using various toolsets, architectures, and languages. |
Would the Government be able to provide a of existing toolsets, code libraries and software licenses/versions in use today to assist in planning the future architecture?
| CJIS systems have a variety of architectures from serverless using containers lambdas, to server based implementations, to large kubernetes based deployments. There are also a variety of languages being used with some notable ones being java, node, python, and others. | ||||
| 35 | 3 | Tooling for software development, system administration, automated system and security testing should be included in the final documentation to memorialize | Would the Government provide preffered languages for software development, system adminstration, and testing? | CJIS systems have a variety of architectures from serverless using containers lambdas, to server based implementations, to large kubernetes based deployments. There are also a variety of languages being used with some notable ones being java, node, python, and others. |
| 36 | NA | General Question | Would the Government provide the security baseline requirement for the target architecture? | CJIS Systems use the DISA STIGs as a baseline for hardening and compliance. |
| 37 | 5 | The document should show that an environment can be integrated with existing industry standard software (ticket management, git repository, CI/CD pipelines, wiki). | Would the Government share any planned system integrations with this environment? | All of the systems will need to be able to integrate with development environment |
| 38 | 4 | Facility Clearance (if applicable): | Would the Government provide the anticipated clearance requirements for staffing considerations? | If staffing were needed the staff would require Top Secret clearance. |
| 39 | 3 | Currently, IT project related activities for CJIS systems have occurred in self-managed environments (estimated 10 total), segregated by projects using various toolsets, architectures, and languages. CJIS projects have traditionally operated as autonomous entities and personnel movement between systems often requires retraining in the many aspects of development, administration, testing, and securing projects (e.g., learning new tools and processes, new system logins, administrative burden, etc.). | Does the Government require existing project environments migrate into this unified environment, or is this strictly forward-looking? | The Government will require existing projects to migrate to this unified it professional environment. |
| 40 | 3 | Tooling for software development, system administration, automated system and security testing should be included in the final documentation to memorialize these concepts for later implementation. | Should vendors assume this environment will include operations/maintenance, or just design and proof-of-concept? | This is not a solicitation for a service. Just design and/or proof-of-concept on how the industry meets this requirement is acceptable. |
| 41 | 5 | Describe an environment that can support industry standard techniques using industry standard tools for traditional IT Professional roles, including but not limited to: |
a) System Administration
b) Software Development
c) Database Administration
d) Security Engineering/Analysis
e) Test Engineering
| f) Data Analysts | Should the environment support both development and production workloads, or primarily development/test? | This environment should support the entire lifecycle from Dev/Test to Production | |
| 42 | 5 | Document any use of AI assistants being used by IT professionals and safeguards in place for their use. Particularly used in: |
• Code optimization
• Code scanning
• Code generation
• Automation of tasks
• Security scanning
| • Document generation | Is the FBI open to GovCloud-hosted AI models (Azure OpenAI Gov) or must all AI assistants be self-hosted? | The Government prefers GovCloud-hosted AI models if possible but self-hosted is acceptable if no other options are available. | |||
| 43 | 7 | The written response shall be double spaced, in a times new roman or similar font, size 12. Pages may include images and figures. Responses shall be submitted via Microsoft Word or PDF format. The responses should not exceed 30 pages. | Does the Government allow Timed New Roman pt 8 for graphics/diagrams and Pt 10 for Tables? | Please utilize the font requirements as listed in the RFI | |
| 44 | 2 | N/A | If this ultimately is released as a solicitation, will it be on ITSSS-2 and released within which quarter? | The Government doesn't have a timeline nor has a decision been made on the solicitation vehicle. | |
| 45 | 3 | N/A | Will the Government provide access to a Bidder's library that will provide neccesary information to answer this RFI to include the current toolsets, architectures, and languages in use by the estimated 10 environments; current integrated cybersecurity scanning tools and suites; and any known requirements that help define Service Levels, such as service availability, security compliance, resource monitoring and utilization, redudancy, etc., and Key Performance Indicators such as load times, deployment frequency, storage utilization, etc.,? | The Government will not provide a Bidders library. We can Provie information on current toolsets: CJIS systems have a variety of architectures from serverless using containers lambdas, to server based implementations, to large kubernetes based deployments. There are also a variety of languages being used with some notable ones being java, node, python, and others. CJIS systems are baselined with DISA STIGs for hardening and compliance. | |
| 46 | 4 | N/A | Will the Government consider including the requirement to have partnerships with the 4 major Cloud Service Providers (CSPs). In addition, will the Government consider adding the requirement that Prime is required to have Premier level partnernership with 2 of the 4 CSPs? | The Government is only seeking information at this time. | |
| 47 | 7 | N/A | Can tables, charts, and images use the smaller font of 10pt? | Please utilize the font requirements as listed in the RFI | |
| 48 | 3 - Paragraph 2 | N/A | Can the Government confirm if there any on premises environments remaining to be migrated to the cloud? If so, which Cloud Service Provider is being used? What types of databases (e.g., SQL, graph, etc.,) are in place today? Are the databases on-prem? | The majority of the environments will be in the CSP. There will be on-premise environments mainly consisting of network infrastructure. | |
| 49 | 3 | "Currently, IT project related activities for CJIS systems have occurred in self-managed environments (estimated 10 total), segregated by projects using various toolsets, architectures, and languages." | Can the Government provide an inventory of toolsets and programming languages currently licensed and operating in these approximately 10 self-managed environments? | The Government will not provide a specific inventory but will state that CJIS systems have a variety of architectures from serverless using containers lambdas, to server based implementations, to large kubernetes based deployments. There are also a variety of languages being used with some notable ones being java, node, python, and others. | |
| 50 | General | N/A | Though not explicitly stated in this RFI, it is understood that CJIS is working towards an enterprise-wide implementation of SAFe Agile for systems development and maintenance. Does CJIS anticipate that the CJIS enterprise will follow the same frameworks, processes, meeting and reporting norms or will the implemented solution need to allow for project or organizatrional deviation? | It should be assumed that the CJIS enterprise will follow the same frameworks, processes, meeting and reporting norms. | |
| 51 | General | N/A | Are the individual technical components required to be FedRAMP approved? | Each individual component does not have to be FedRAMP approved. With the caveat that if a component is a service offering from one of the CSPs than that service must be FedRamp High. | |
| 52 | General | N/A | What is the approved Virtual Desktop Infrastructure (VDI) solution? | CJIS can work to get a VDI solution approved if needed. We are more interested in how industry works than ensuring it fits into our current solution. | |
| 53 | 5 | N/A | Can you provide a list of the existing systems that require interconnectivity/integration -- specifically noting the git repository, ticket management, and wiki platforms currently in use? | We use the atlassian suite of tools for ticketing, version control, and documentation. | |
| 54 | 5 | N/A | Can you provide more detail on the specific tasks and tools that the users (e.g., developers, administrators, security engineers) need to perform? | CJIS doesn't do anything that would be considered outside the realm of standard development or (Cloud, Security, Sysadmin, Database) administration, or engineering. | |
| 55 | 5 | N/A | What are the specific database management systems (DBMS) and data platforms currently in use that a future environment would need to support and manage? | Specific data platforms: AWS and Azure GovCloud Database services. Specific DB flavors: Oracle, Postgres, Dynamo, DB2, MySQL, MongoDB | |
| 56 | 4 , 5 | N/A | Is the primary objective to standardize development and administration for applications on the a specific platform, or is this RFI for a universal IT professional environment that will support development across multiple technology stacks (e.g., Java, .NET, Python)? | A "universal" IT professional environment supporting development AND (Cloud, System, Database, and Security)administration across several stacks. | |
| 57 | 3 | N/A | What are the predominant programming languages and database technologies currently used across the 10 self-managed environments mentioned in the RFI? | Java, Python, Node, Perl, C++, C#. | |
| 58 | 3 | N/A | Would the agency be open to migrating some or all of its existing applications to a platform-specific environment? | The agency is open to all ideas that may help it modernize it's toolset and empower it's workforce. | |
| 59 | 4 , 5 | N/A | Is the Government seeking for prospective contractors to present a mock environment design? If not, what specific information are you looking to get out of answers to these questions? | The Government's only intent with this RFI is understand how the industry is doing enterprise development and incorporating AI into it's technical workforce. | |
| 60 | 6 | N/A | In order to provide informal market research pricing, we would need more information on the target environment, including: 1) | How many applications would be supported | |
| 2) | The number of maximum concurrent users for each hosted application | ||||
| 3) | The amount of storge required for the application systems and any storage retention requirements for applications. | ||||
| 4) | System development – what the application code base is | ||||
| 5) | Whether the contractor is expected to host the environment or the Government | ||||
| a. | If the contractor is hosting we would need the estimated server sizes supporting the applications | ||||
| 6) | How many service requests/ITSM tickets are generated which would require engineers, database administrators or system administrators to be involved | CJIS systems have a variety of architectures from serverless using containers lambdas, to server based implementations, to large kubernetes based deployments. There are also a variety of languages being used with some notable ones being java, node, python, and others. There are roughly 400 users. The Government will host the environment in it's approved Government Cloud Environments. | |||
| 61 | RFI, Background | N/A | What does your environment look like now? | CJIS systems have a variety of architectures from serverless using containers lambdas, to server based implementations, to large kubernetes based deployments. There are also a variety of languages being used with some notable ones being java, node, python, and others. | |
| 62 | RFI, Background | N/A | Is the workflow fragmented? | The current workflow is very fragmented as it exists across multiple systems. A goal of this RFI is to understand how to centralize that workflow. | |
| 63 | RFI, Background | N/A | Do you have your own tools installed on desktops? | Yes. Tools are a mix of centralized enterprise tools and separate desktop installs. | |
| 64 | RFI, Background | N/A | Do you have your own environment already established? | Yes. Environments are already established. | |
| 65 | RFI, Background | N/A | Are we enhancing the existing environment or creating a new one? | This would be considered a new environment. | |
| 66 | RFI, Background | N/A | Can you provide the programming languages in use and the number of repositories? | Java, Python, Node, Perl, C++, C#. Number of repositories is in the hundreds | |
| 67 | RFI, Background | N/A | Are you using C#? Python? Both? | Java, Python, Node, Perl, C++, C#. | |
| 68 | RFI, Background | N/A | How resource-intensive or “heavy” is the current environment? | CJIS systems have a variety of architectures from serverless using containers lambdas, to server based implementations, to large kubernetes based deployments. There are also a variety of languages being used with some notable ones being java, node, python, and others. | |
| 69 | RFI, Background | N/A | Are there any existing cloud providers in use? | Yes. AWS and Azure GovClouds are the current approved environments. | |
| 70 | RFI, Background | N/A | Do you have specific requirements for a cloud provider? | Yes. AWS and Azure GovClouds are the current approved environments. | |
| 71 | RFI, Background | N/A | Are there any required configurations for tools or connectivity? | Nothing specifically required other than be able to integrate with industry standard tools. | |
| 72 | RFI, Background | N/A | Does CJIS or other compliance frameworks introduce requirements or controls we need to account for? | No. | |
| 73 | RFI, Background | N/A | What does your current security and compliance posture look like? | Current systems are typically unclassified but sensitive FISMA high systems. | |
| 74 | RFI, Background | N/A | What level of support does the environment require (e.g., 24/7, always-on, always patched, or lock-and-leave)? | While this is not a solicitation for a service, the expectation is that the system be always on, always patched but autoscalable. | |
| 75 | RFI, Background | N/A | Is development expected only during business hours (M–F), with downtime or reduced activity on weekends? | The expectation is that the system be always on, always patched and autoscalable. | |
| 76 | RFI, Background | N/A | Should auto-scaling and right-sizing be applied during non-peak hours? | Yes | |
| 77 | RFI, Background | N/A | How would these operational needs affect your support requirements? | The Government's only intent with this RFI is understand how the industry is doing enterprise development and incorporating AI into it's technical workforce. Operational needs can be addressed in the future. | |
| 78 | RFI, Background | N/A | Are there any existing automation pipelines or code repositories? | Yes. There are multiple automation pipelines and code repositories | |
| 79 | RFI, Background | N/A | What type are they, and what platforms or environments do they run on? | Bitbucket, Jenkins, Gitlab, Gitbucket, Azure DevOps platform. All run in AWS and Azure GovClouds | |
| 80 | RFI, Background | N/A | What is the current development stack and toolchain? | VSCode, Eclipse, Vim, Bitbucket, Jenkins, Gitlab, Gitbucket, Azure DevOps platform. All run in AWS and Azure GovClouds | |
| 81 | RFI, Background | N/A | Which utilities or workflows could be consolidated or pooled? | Everything is on table. We are looking, if possible, for a unified solution | |
| 82 | RFI, Background | N/A | Is there an opportunity to enable agentic workflows without requiring full migration? | Yes |
File details come from the government source that posted it. Updated .