CSCS - SIPR ISN Follow-On RFI Final for Legal Rev 25 Sep 24_KD.docx

Secret Internet Protocol Router (SIPR) Installation Service Node (ISN) Enterprise Modernization

Request for Information (RFI)

25 Sep 24

Connect Branch (AFLCMC/HNIB)

Notice to Offeror(s)/Supplier(s): This RFI is being conducted to collaborate with potential sources that may possess the expertise, capabilities, and experience to meet the requirements for Secret Internet Protocol Router (SIPR) Installation Service Node (ISN) Enterprise Modernization, Enterprise Information Technology as-a-Service (EITaaS) effort. While industry sources are requested to provide full and comprehensive responses to this request, they are reminded that all information is voluntary. Please note, there is no solicitation available at this time and any requests for a solicitation will not receive a response. No award will be made under this Request for Information (RFI). Funds are not available for this effort. In the event the Government cancels this RFI, respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future solicitation, if any is issued.

No proprietary, classified, confidential, or sensitive information should be included in your response. The Department of the Air Force reserves the right to use any non-proprietary technical information in any resultant solicitation(s). Please be advised that all submissions become Government property and will not be returned. Respondents are advised that the U.S. Government is under no obligation to provide feedback with respect to any information submitted.

Contracting Activity The contracting organization responsible for this RFI is Department of the Air Force Material Command (AFMC) Department of the Air Force Life Cycle Management Center (AFLCMC), AFPEO C3I&N (AFLCMC/HN), Enterprise IT and Cyber Infrastructure Division (AFLCMC/HNI), Contracting Office (AFLCMC/HNIK), 15 Eglin St, Bldg 1612, Hanscom AFB, MA 01731.

Bottom Line Up Front: The Department of Air Force (DAF) requests industry feedback to complete the Secret Internet Protocol Router (SIPR) Installation Service Node (ISN) Enterprise Modernization program. The SIPR ISN program is a part of the Cyberspace Security and Control System (CSCS) Program. This follow-on effort SIPR ISN effort will operate, maintain, discover, update, expand, and sustain previously fielded capabilities:

· Enterprise Core “e.g., Directory” Services[footnoteRef:2] deployed, operated, maintained, and managed by a contractor through an “as-a-Service” Government Owned, Contractor Operated (GOCO) Model. [2: Reference Air Combat Command’s 30 Jan 2023 approved SIPR ISN Concept of Employment for a more detailed discussion on Enterprise Core Services and GOCO Roles and Responsibilities. ]

· Base level Infrastructure operated, maintained, and managed by a contractor. This includes management of client endpoint scans, patches, base-local privileged user access on the AFNet-S, and assist with base level services (i.e., print services, VDI, etc.)

· Enterprise monitoring and management capability for base level infrastructure leveraged and maintained across the DAF to include Vulnerability Management functions for end points and servers.

· Maintain the single forest Air Force SIPRNet enterprise domain (AFNet-S)

· Continue to assist with integration of other mission/functional applications into the AFNet-S At a macro-level the DAF's requirement is to operate, maintain, sustain and tech refresh the modernized SIPR ISN AFNet-S:

· SIPR ISN Enterprise Data Center (EDCs) host root applications and management servers, to enable centralized remote EITSM, and enable centralized remote management of the ISNs. The EITSM solutions shall enable the contractor to perform Service Incident Management, Problem Management, Change Management, Configuration Management, End-to-End, Performance Monitoring.

· In addition, the SIPR ISN Enterprise Management Centers (EMCs) provide enterprise operations and management of the AFNet-S, enterprise core services, and base level infrastructure.

· The EDCs and EMCs operate 24x7x365 days a year

· 2 continental United States (CONUS) Enterprise Management Centers

· 2 outside continental United States (OCONUS) Enterprise Management Centers

· The approved Government facilities for the EDCs and EMS are: Joint Base San Antonio Lackland, TX; Peterson AFB, CO; Langley AFB, VA; Scott Air Force Base (AFB), IL; Wright Patterson AFB, OH; Hickam AFB, HI; and at Ramstein Air Base, Ramstein-Miesenbach, Germany.

· Complete and or expand Base level AFNET-S infrastructure deployed, operated, maintained and managed by a contractor for up to 192 bases worldwide

The expected NAICS code for the SIPR ISN follow-on effort is:518210 - Data Processing, Hosting, and Related Services.

Questions (5 page limit) Detailed designs are not desired and responses should specifically cover the following areas:

1. Given the SIPR ISN Follow-On effort requirements outline above, what is your relevant experience with classified IT network projects of similar scope? Be sure to provide supporting rationale/examples of how you have handled large/similar projects that operate 24x7x365 days a year across multiple times zones. Please include relevant contract information e.g., contract number, agency supported, and Government Points of Contacts along with a recommended NAICS code(s) and your Facility Clearance information.

2. What would your staffing strategy and recommendations to provide experienced IT staff (e.g., vendor product consultants/SMEs) to handle SIPR ISN operations, maintenance, sustainment and Enterprise Information Technology Service Management (EITSM) across multiple locations across the DAF. Please consider your subcontractor management strategy.

3. What experience do you have providing EITSM that conforms with industry “best practices” e.g., ITIL, DESMEF, SLAs etc? The government is keenly interested in this Service Area and how your firm has leveraged technology to deliver world class EISTM via automated tools/tooling and or artificial intelligence for help desk operations, vulnerability management, application reporting, systems and operating systems management, deployment, patching and network management services etc. Be sure to provide concrete examples by citing contract numbers and agency you are/have supported. Work with Government representatives to assist with or provide Touch Maintenance,Tier I, II and III support for core services hardware/software.

4. How would you coordinate the deployment of multiple teams this project requires to complete the requirements of SIPR ISN Follow-On effort detailed above?

Supplemental Company Specific information (1 Page Limit)

1. Company Name:

2. CAGE Code:

3. Point of Contact for further clarification or questions

4. Business Address:

5. Telephone Number:

6. Email Address

7. Primary of applicable NAICS code and corresponding business size

8. Based on the above NAICS Code, state whether your company is:

9. Please identify your company as domestically or foreign owned (if foreign, please indicate the country of ownership).:

10. Please identify your company’s existing DoD or GWAC contract vehicles with relevance to the requirements of this RFI.

Interested parties should submit a response package, with a cover letter, that is brief and concise. Include the company name and address on any submitted document and cover letter. The response package can be contractor selected format and shall not exceed five single-spaced pages, 12 point points type with at least a 1” margin printable on on 8 ½” x 11” paper. Be advised: Emails containing file types such as: .zip, .xlsx, .docx, or other macro-enabled extensions might be stripped by the Air Force boundary prior to the email arriving at its intended destination. Respondents are advised that the Government is under no obligation to provide feedback to respondents with respect to any information submitted.

1. Supplemental Company specific information shall be provided as an attachment and shall not exceed one single-spaced page, 12 points typed with at least 1” margins. Each page of the attachment shall be printable on 8 ½” x 11” paper. Please note: Emails containing file types such as: .zip, .xlsx, .docx, or other macro-enabled extensions, may not be delivered to the intended recipients

2. Responses are to be submitted addressed to kathleen.delgado@us.af.mil, Contracting Officer, no later than 04 Oct 24 at 5:00 PM EST. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed.

3. If further information/clarification is needed, please contact Ms. Kathleen Delgado, Contracting Officer, at kathleen.delgado@us.af.mil

4. Support Contractors: The Department of the Air Force intends to use third party, non-Government (i.e., contractor) support personnel as subject matter experts in the review of responses received, including the review of any marked or unmarked proprietary information provided. Appropriate nondisclosure agreements will be executed between the third party, non-Government support personnel and the Department of the Air Force.

DISCLAIMER AND NOTICE: This RFI is issued solely for information purposes. It does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the U.S. Government to contract for any supply or service in any manner. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested parties' expense. Not responding to this RFI does not preclude participation in any future RFP, if any.

Definitions/Key Terms of Reference

Directory Services AFI 33-115 para 5.2.8 defines directory services as: “the activities, methods, processes, procedures, capabilities, tools, and resources that provide, operate, and maintain a global directory of AFIN users, objects, and resources. Directory services include appropriate identity and attribute information, allowing effective enterprise-wide identity management, authentication, and authorization to AFIN resources. Directory services are sourced from and rely on a number of AF and DoD organizations for account management and data accuracy.

”Specific procedures for Directory Services will be in the Directory Services MPTO.

End-to-End Performance Monitoring AFI 33-115 para 5.1.9 defines end-to-end performance monitoring as “deliberate, proactive monitoring and capacity planning of all the hardware and software components of the AFIN which enables all AF IT services including mission/functional unique applications. It supports mission assurance by including the end user experience and the warfighter's ability to access critical information. End-to-end performance monitoring includes the activities, methods, processes, procedures, capabilities, tools, and resources which allow cyberspace professionals to rapidly identify, isolate, and resolve service incidents before they cause significant degradation or poor performance resulting in mission impact. Monitoring, measuring, performance analysis, and optimizing networks and networked systems are included in the scope. Capacity planning includes the long trend analysis of network devices including servers, and should be performed in order to identify future constraints with the results incorporated into either future technical baselines. Service and application performance is affected by both the performance of the network and performance of the servers and applications providing the service. As the operator of the network, 16 AF has the ultimate responsibility for determining the network elements to be monitored, the thresholds that must be established, and the appropriate responses to results that fall outside the established thresholds. 16 AF must coordinate with the network owner (e.g., DISA, Army, etc.) if monitoring spans networks outside of AF control. End-to-end performance monitoring applies to the NIPRNET and the SIPRNET, and all other terrestrial, space and airborne networks – anywhere a network can be hosted – for all entities (Active, Guard, & Reserve). ”Specific procedures for End-to-end performance monitoring will be in the End-to- End Performance Monitoring MPTO.

Enterprise Information Services AFI 33-115 para 5.2.4 defines “Enterprise Information Services (EIS)” as those services that “will provide a solution across the entire AF by enabling organizations to communicate and collaborate vertically and horizontally with all EIS capabilities, optimizing the use of available bandwidth by using the most effective capabilities for the operational environment. Warfighters will utilize Knowledge Operations (KO) capabilities to drive operational effects through improved decision making processes. Warfighters will pull required information and knowledge smartly, push information for continuous collaboration across the unified communications domain, and receive the right information at the right time and in the right format through advanced collaboration techniques (i.e., integrated people, processes and technology) via a proactive push from all integrated operations and support functions. EIS effectively capitalize upon KO performed by commanders, who integrate all AF functional areas into refined staff organizations, internal battle rhythms, and routine interactive sessions with subordinate commanders worldwide. The KO vision of a “One AF—One Enterprise” to fundamentally change the way the AF uses, delivers, and manages knowledge to perform peacetime missions and wartime operations across an integrated AF enterprise recognizes the imperative for a proactive means to promote collaboration, the sharing of ideas, and to find solutions to common problems across the entire AF. It also promotes the ability to learn, innovate, decide, and act, faster than our adversaries while operating in a condition of persistent conflict. EIS is established as the capabilities and resources supporting the security, reliable storage, timely delivery and deduplication of information across the AFIN enterprise. Examples include common and private data/file service, workflow management service, and enterprise print service. These services will be implemented and sustained according to AFPD 33-3, information management. Specific procedures for information management will be in the Discovery and Information Management MPTO.

Network Management AFI 33-115 para 5.1.2 defines network management as: “the ability to monitor, control, configure, and optimize networks, systems, services and the underlying physical assets that provide end-user services, as well as connectivity to enterprise application services all in accordance with the applicable DISA STIGs. Network management includes the activities, methods, processes, procedures, capabilities, tools, and resources that pertain to the operation, administration, logging, maintenance, and provisioning of networked systems. Network management begins with the background situational awareness of network configuration and performance of networks.” Network management shall have and use automated Configuration Management and Policy Based Network Management (PBNM) according to DoDI 8410.03.

Specific procedures are in MPTO 00-33A-1106, Air Force Information Network (AFIN)

Vulnerability Management AFI 33-115 para 5.1.1 establishes vulnerability management as: “the practice of identifying AFIN hardware and software vulnerabilities, performing risk analysis, prioritizing mitigation actions based on levels of risk deemed acceptable by an appropriate commander, and remediating and/or mitigating the vulnerabilities to proactively prevent exploitation. This service area includes all AFIN systems and components and the complete cycle of identification, classification, remediation, and mitigation of vulnerabilities. Vulnerability management also includes patching, tracking, and testing.” Note: Special precautions are taken with command, control, intelligence, surveillance, and reconnaissance mission systems and non-standard or legacy systems to ensure automated vulnerability fix actions do not degrade operational missions. Specific methods and procedures are in MPTO 00-33A-1109, Vulnerability Management. This includes use of automated tools, tooling and artificial intelligence for event logging and alerting.

Tier I support The lowest level of privileged access and network rights. Includes subscribers who service and maintain single endpoint devices; cannot access or modify networks; can install software; can modify network settings; and enable or disable services on individual computers. Tier I privileged subscribers include local-system administrators and client support team members.

Tier II support Subscribers who can access more than the local system but have restrictions and are generally responsible for upgrading, installing, or repairing systems. Tier II privileged subscribers include most AFNET administrators who have an administrator account and subscribers who have the responsibility to secure information systems.

Tier III support Individuals who have access rights across most areas of the infrastructure. Members of this group often have full administrative control of domains within the enterprise. Tier III privileged subscribers include domain administrators, enterprise administrators, and network administrators.

Touch Maintenance Natural/man-made disaster that requires local equipment shutdowns or restarts.

Remove, replace, and dispose of drives, servers, or other ISN/IPN components and consumables like backup tapes, if used as directed Physical restart/reset/power cycling of equipment (router, server, or switch) to clear faults unable to be cleared remotely (coordinating w/SIPR ISN contractors).

Verifying cable integrity and connections.

Providing visual verifications to assist remote troubleshooting.

Inserting a Compact Disk (CD) in a drive.

Assisting with uncrating, Return Material Authorization (RMA), and shipping of replaced equipment.

List of SIPR ISN Program Management Office Advisory and Assistance Support contractors that may/will have access to the SIPR ISN RFI submittals:

Company

Quantech Services, Inc

Mantech

Abacus Technology

Abacus

Astrion

Quantech Services, Inc

Applied Research Solutions (ARS)