Customizable VM_Cloud Computing Platform_RFI.pdf

SENSITIVE BUT UNCLASSIFIED

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITIONS (ITA)

REQUEST FOR INFORMATION (RFI)

for

CUSTOMIZABLE VIRTUAL MACHINE AND CLOUD COMPUTING PLATFORM

PART 1: RFI BACKGROUND AND OBJECTIVES

1.1 PURPOSE

This Request for Information (RFI) is issued as market research to determine industry’s capabilities to provide a proven commercial-off-the-shelf (COTS) cloud service solution that can provide customizable virtual machine instances, provide predefined and custom machine types, and serverless computing that allow developers to perform event-driven functions without the need to manage servers. The solution must also offer data centers that are globally located across multiple regions and able to ensure data accessibility and optimal performance through high-speed data transfer and low-latency connections. The solution must be commercially proven to provide a virtual cloud service platform for data storage, computing, and infrastructure; in a secure, scalable, and flexible information technology (IT) environment.

Additional specific capability requirements are enumerated in Part 2 below.

The U.S. Government (USG) does not commit to award a contract on the basis of this RFI or reimburse any costs associated with the preparation of responses.

This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI that is marked “Proprietary” will be handled accordingly. Responses to the RFI will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the USG to form a binding contract. Responses to this RFI will assist the Department of State (Department) in determining the potential level of interest, competition adequacy, and technical capabilities of commercial vendors to provide the required products and/or services. The USG does not guarantee any action beyond this RFI.

The result of this market research will contribute to determining the acquisition plan and the method of procurement. The anticipated North American Industry Classification System (NAICS) code assigned to this procurement is 541519 with associated small business size standards* and Product service code DA10 - Business Application/Application Development Software As A Service.

NAICS Codes NAICS Industry Description

Size standards in millions of dollars

Size standards in number of employees

541519 Other Computer Related Services

$34.0

541519 (Exception)

Information Technology Value Added Resellers

1.2 BACKGROUND

The Department’s mission is to advance the interests of the American people, their safety, and economic prosperity by leading America’s foreign policy through diplomacy, advocacy, and assistance. The mission of the Bureau of Diplomatic Technology (DT) is to rapidly and securely deliver, anytime and anywhere, the knowledge resources and Information Technology (IT) services needed to support the over 300 sites and 275 missions it services worldwide.

DT is seeking input from industry regarding their capability to provide market-leading solutions capable of meeting the full breadth of functional requirements outlined in this RFI. The Department requires access to a platform that is compliant with current federal security requirements, is easy to use, flexible, scalable, customizable, and configurable to meet specific requirements as further detailed below.

1.3 RFI OVERVIEW

As further detailed in Section 2, the Department is seeking to identify capable and interested partners able to provide the products and/or services required to meet the full range of functional capabilities outlined in this RFI. Viable partners should have demonstrated experience deploying cloud-based solutions and delivering the ongoing support required to maintain, expand, and upgrade the solution over time for an organization of similar size, global scope, and mission complexity as the Department. Information requested in this RFI includes the following categories:

• Company Information (Section 1) - Identification of interested vendors, socio-economic status, and potential acquisition vehicles to inform the Department’s potential acquisition strategy options.

• Capability to meet the Functional Requirements (Section 2) - Description of vendor’s technical solution to fully the Department’s functional requirements.

• Past Experience (Section 3) - Past project example(s) demonstrating respondent’s experience implementing their proposed solutions to address the needs of an organization of similar size, global scope, and mission complexity to the Department.

1.4 SUBMISSION INSTRUCTIONS

All written responses should be submitted in Microsoft compatible formats (e.g., Word) or PDF.

Responses must use 12-point font and 1-inch margins, including all text, tables, and graphics. Additional attachments such as data sheets providing additional technical details for proposed solutions may also be provided, if necessary, in addition to the page limits the Department below. General brochures or other marketing materials not directly relevant to the Department requirements are not requested and will not be considered as part of the response. Response page limit(s) by section are noted below.

• Section 1 - 1 page

• Section 2 - 25 pages

• Section 3 - 5 pages

Please submit all materials to Andrew Rothstein at RothsteinAT@state.gov no later than Day, Friday February 7, 2025@ 3:00PM ET.

The Government will not accept questions after Friday, January 31, 2025, at 3:00PM ET Please submit questions to RothsteinAT@state.gov.

mailto:RothsteinAT@state.gov mailto:RothsteinAT@state.gov

The Government will post the questions and responses on GSA E-buy with sufficient time for vendors to complete their responses. Please be advised that all submissions become Government property and will not be returned.

UNDER NO CIRCUMSTANCES SHALL ANY RESPONDENT CONTACT ANY THE

DEPARTMENT PERSONNEL REGARDING THIS NOTICE.

PART 2: REQUESTED INFORMATION

Respondents are asked to provide the information requested below in accordance with the instructions outlined in Section 1.4 above.

SECTION 1 - COMPANY INFORMATION

Please provide the following details regarding your organization:

a. Company name.

b. Company’s point of contact (POC) name.

c. Company’s point of contact (POC) phone number.

d. Company’s point of contact (POC) email address.

e. Company’s URL/web address.

f. Company Federal socioeconomic classification(s), if any, based on North American Industry Classification (NAICS) Code 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services.

g. List of GSA schedule, Government wide acquisition contracts (GWACs), or other federal IDIQs or contracts your company holds that are accessible by The Department and where the full proposed solution can be procured, including corresponding schedule number or GWAC number.

SECTION 2 - FUNCTIONAL REQUIREMENTS

The Department’s functional requirements are outlined below. Respondents are asked to provide a structured response that meets the following format requirements:

a. Response shall be structured and annotated to clearly map the detailed description of the proposed solution’s capabilities to the numbered requirements captured in the sections below. Responses should clearly map to the information the Department’s requirements below.

b. Response narrative content should provide sufficient details regarding the proposed solution’s specific technical capabilities to demonstrate that the solution is capable of fully satisfying the Department’s requirements.

2.1 Mandatory Qualifications

The following qualifications and capabilities are mandatory requirements for any potential solution addressing the needs outlined in this notice. Vendors must assess these requirements carefully and fully describe their ability to meet them.

Key requirements are as follows:

a. The solution must provide commercially proven, enterprise-grade products (custom-built solutions are unacceptable) with demonstrated experience successfully deploying and operating the solution

b. The solution must possess significant out-of-the-box functionality enabling it to be deployable on day one of the project, while also supporting custom configuration within expedited timelines.

c. The solution must be built as a single, vertically integrated platform with end-to-end solutions leveraging seamless integration across capabilities and tool sets.

d. The solution must be accredited at DoD Impact Level 5 (IL5), as defined in the U.S. Department of Defense (DoD) Cloud Computing Security Requirements Guide (CC SRG), in alignment with NIST 800-53, as well as air-gapped infrastructure.

e. The solution must currently operate a Government Community Cloud FedRAMP High-accredited data centers in the continental U.S. (CONUS) and FedRAMP-moderate accredited data centers in outside the continental U.S. (OCONUS). The solution must offer single, physical global scale infrastructure.

f. The solution must be capable of encrypting data, both at rest and in transit, via mechanisms compliant with Federal Information Processing Standard (FIPS) Publication 140-2.

g. The solution must provide demonstrable evidence of continuous innovation and investment in its cloud services and future products across the ecosystem of its offering (e.g., AI/ML, databases, data analytics, security).

h. The solution provider must own 100% of its fiber optic cable network that connects its datacenters. The solution provider must not operate datacenters in or through mainland China.

i. The solution must be able to comply with the Department’s Cybersecurity Supply Chain Risk Management (C-SCRM) policy. The vendor shall describe its ability to keep its software and product supply chains secure in accordance with NIST SP 800-53.

2.2 Enterprise Cloud Services

The Department is interested in an enterprise-class, geographically diverse cloud solution that offers essential cloud characteristics such as on-demand self-service, resource pooling, rapid elasticity, and measured service. Key capabilities must include:

a. The solution offers a Cloud Management Platform (CMP) on-premises software.

b. The solution provides the capability to dynamically monitor system usage and incorporate processes that allow for the full resiliency of a cloud solution.

c. The solution provides an Application Programming Interface (API) Management solution that is available both on-premises and across multiple clouds, and allows customers to design, secure, deploy, and monitor APIs everywhere with a cross-cloud API management platform.

d. The solution is scalable on an enterprise level to multiple geographically diverse locations and may consist of one or more tools/components.

e. The solution provides on-demand self-service, broad network access, and rapid elasticity.

f. The solution provides resources pooled to serve multiple consumers using a multi-tenant model.

g. The solution provides automatic provisioning of computing capability.

h. The solution is consumable by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, desktops.)

i. The solution has the capability to operate multiple virtual systems while providing a separation between the environments.

j. The PaaS solution enables users to deploy custom or acquired application onto cloud infrastructure.

k. The IaaS solution provides the capability to run virtual machines.

2.3 Security, Identity, Access Controls, and Data Governance

The Department requires a highly secure solution that offers comprehensive access controls and robust data governance methods to ensure the protection and proper management of sensitive information. Key capabilities must include:

a. The solution must support secure handling of information of various classification levels, up to Top-Secret for domestic and overseas solutions, and provide access controls to ensure users have access to only the data and information aligned to their level of security clearance.

b. The solution shall have a security and auditing subsystem to enforce security in the solution. The solution must provide authorization of resource access to users who have been authenticated.

o Captures audit logs on all resource access requests throughout the system, including import, read, write, search, export, and deletion attempts along with the user, time, date, and action.

c. The solution shall have security and access controls that include:

o Multi-source authentication (enterprise LDAP, PKI, Active Directory, etc.) as well as Single Sign-On (SSO) capabilities.

o Exposed OAuth 2.0 interfaces to facilitate authorization with external applications with either Authorization Code Grant or Client Credentials flows.

d. The solution shall have proven API Integrations with:

o Privacy-preserving record linkage (PPRL) solutions providers to facilitate secure data linkage.

o External third-party systems for pass-through of credentials to facilitate rapid access to external data and/or the running of jobs on external systems directly from the platform.

e. The solution shall be able to assign individual users granular permissions to data access (including ownership, read, write, access denied, etc.).

f. The solution shall manage user identities and access. The solution must determine which users can access which resources and provide granular control over user permissions and actions.

o Offers the ability to assign roles to users and groups, while only authorized individuals can perform specific actions. The solution must sync user accounts across applications and projects.

o Handles user authentication through various methods that include email/password, multi-factor authentication, and Single Sign-On and integrate with other identity providers.

o Allows administrators to manage access rights efficiently without manually assigning individual permissions.

o Allows for specified user actions like read, write, and delete.

o Provides those identified as administrator the ability to track user activity.

o Detects misconfigurations, vulnerabilities and compromised identities.

g. The solution must have the ability to redact sensitive information and automatically encrypt non-active data.

h. The solution must automatically and continuously assess the security infrastructure against the latest attack techniques to identify weaknesses and enhance overall security.

2.4 Scalability and Customization

The Department requires a COTS solution to be flexible and scalable to enable expansion of AI features and broader analytical functionality to keep pace with the rapid evolution of AI technologies and the continuously evolving mission requirements at The Department. Key capabilities must include:

a. The solution must be a highly customizable COTS platform that enables applications, analyses, and workflows to be tailored to meet specific mission needs and user requirements.

b. The solution must have the ability to scale with increasing users, data, and pipeline complexity, while providing fine-grained ways to adjust resource consumption-including auto-scalable containerized compute. In addition, solution must have a proven ability to scale up to thousands of users (including thousands of potential outside collaborators globally), petabytes of raw and processed data, daily updates in the terabytes, and management of thousands of complex pipelines requiring processing components developed in a variety of languages and environments.

2.5 Storage and Databases

The Department requires a solution that will provide high-performance storage that is flexible and scalable across mobile and web environments. The solution must have the capability to store large amounts of data. Key capabilities must include:

a. The solution must provide high-performance storage and databases and be flexible and scalable across mobile and web environments.

b. The solution must have the capability to store large amounts of consistent and unstructured data and object storage with integrated edge caching.

c. The solution must have the ability to utilize Structured Query Language to create, manage and access data in tables.

o Offers a storage service that defines how data is organized and shows the relations between tables.

o Able to organize data with clusters, databases, schemas, tables, column, indexes, views, function, triggers, and sequences.

o Allows scalability, the correct security standards, and utilize resources efficiently.

o Enforces the rules that users set to ensure performance is streamlined.

o Ensures data remains accurate and secure using atomicity, consistency, Isolation and durability (ACID).

o Uses vacuum process to clean up entries.

o Uses the client-server model to store and retrieve data requested by other software applications on internal or external hardware.

d. The solution must be able to add more resources by scaling horizontally.

e. The solution must be able to automatically replicate data across multiple servers, data centers, and cloud resources.

f. The solution must improve performance by utilizing data denormalization, caching, and in-memory storage.

2.6 Networking

Key capabilities must include:

a. The solution allows for global virtual private clouds with subnets in every datacenter globally (no peering required).

b. The solution must give users the ability to create a secure network that spans multiple regions without using public internet.

o Supports one or more subnets with its own IP address ranges.

o Provides user the ability to create firewall rules to manage traffic within the network and the internet.

o Allows communication within the perimeter and block external communication.

o Allows growth without causing workload downtime.

b. The solution must distribute traffic to backend instances or services using a single external IP address if a component fails.

o Distributes traffic based on configured rules or algorithms.

o Ensures that health check is regular and monitor the readiness of backends to receive connections and move traffic if primary backends become unhealthy.

o Untethered from any single device or instance and deploy external or internal load balancers.

c. The solution must provide a domain name system that publishes domain names to a global DNS.

o Allows secure, low-latency and private connectivity between VPC networks.

o Able to automatically create DNS names for VMs and internal load balancers.

d. The solution provides secure, scalable, and flexible networking functionality for cloud-based resources, and acts as a private, isolated network that allows users to control how resources communicate through custom firewall rules.

o Provides secure and customizable network environment for cloud-based application and services across regions.

o Ensures privacy by utilizing separate VPC within the same or separate project.

o Divides into subnets that can be in different regions.

o Offers the ability to direct traffic by creating custom routes within or out of network.

o Allows for flexible deployment of applications.

2.7 Internet of Things

The Department is seeking a solution that allows users to connect, manage, and ingest data from various internet-connected devices. The solution must utilize protocols like Message Queuing Telemetry Transport (MQTT) that will receive data streams and distribute to other services and allow real-time monitoring and data visualization across applications. Key capabilities must include:

a. The solution must use secure authentication methods.

b. The solution must allow efficient data distribution to various downstream application and data processing pipelines.

c. The solution must allow users to remotely manage connected devices, and send configuring update s, manage device the Department and triggering action based on specific data conditions.

d. The solution must contain Two Step Verification Cryptographic Key Management:

o Provides users two-step verification based on a security key.

o Scans and detects repositories for leaked keys.

o Allows users to create import, and manage cryptographic keys for their cloud service, while also allowing users to perform cryptographic operations in a centralized cloud service.

o Allows users to set rotation schedules for symmetric keys to automatically generate new keys at fixed time intervals.

e. The solution must allow users to manage permissions on individual keys through integration with Identity and Access Management.

2.8 Artificial Intelligence (AI)/Machine Learning (ML)

Key capabilities must include:

a. The solution provides a FedRAMP-accredited, geospatial analytics cloud-based platform, leveraging global satellite imagery for analysis.

b. The solution can create silicon in-house specifically for Cloud use (e.g., GPU, TPU, CPU), which enhances AI services at the hardware level.

c. The solution is able to prioritize national security considerations by training its AI models in the U.S. and supporting a variety of AI models to offer flexibility and choice.

d. The solution offers Generative AI and Large Language Model (LLM) summarization capability for multiple languages.

o Offers translation services for at least 100 languages.

e. The solution provides a FedRAMP-High cloud-based platform that combines AI with omni-channel contact center capabilities.

f. The solution provides a single, vertically integrated platform that offers a selection of at least 120 machine learning models.

g. The solution’s AI / ML platform seamlessly integrates with other cloud service platform data warehousing and analysis services.

h. The solution offers an AI infused document processing solution for processing for handwritten documents into digital format.

2.9 Developer Tools

The Department requires a solution that allows developers to write, deploy, debug and manage applications. Key capabilities must include:

a. The solution must allow continuous integration and delivery by providing a service that automatically builds, test, and deploys applications based on custom configurations.

b. The solution must provide a ready-to-use development environment with pre-installed tools.

c. The solution must provide the ability to write code locally.

2.10 Data Analytics

The Department requires a solution that allows users to ingest, store, process, analyze, and visualize data from various sources. Key capabilities must include:

a. The solution provides a fully managed, petabyte-scale serverless data warehouse capability, vertically integrated with artificial intelligence.

b. The solution provides a Petabyte-scale data warehouse created to separate Compute from Storage with zero cache, including built-in Machine Learning for predictive analysis embedded directly into SQL the Department, with 99.99% availability.

c. The solution must allow data to be incorporated from multiple databases, applications, APIs, and external data sources.

d. The solution must be able to handle batch and streaming data ingestion.

e. The solution must provide efficient querying by utilizing columnar storage format.

f. The solution must allow for complex data pipelines with parallel processing capabilities.

g. The solution must allow users to view data insights visually.

2.11 Training and Support

Adoption of innovative technologies requires significant change to the Department’s business processes, tactics, techniques, and procedures. Key capabilities must include:

a. The solution provider must offer comprehensive access to training, certification, and support services.

b. Description of training, certification, and support services capabilities.

2.12 Other Considerations

Please provide information on the solution’s capabilities related to the following:

a. Given the continuously evolving nature of cloud computing and AI capability, please provide information on any additional unique capabilities or practical experience your solution can bring to support The Department’s cloud infrastructure requirements.

b. Does your solution currently have an active or provisional The Department Authority to Operate (ATO)? If your solution has an active or provisional, please provide an overview of the ATO, including the scope and what it covers.

SECTION 3 - PAST PERFORMANCE

The Department prefers a vendor that has a proven track record in the USG with demonstrated experience supporting U.S. agencies of similar size, global scope, and mission complexity as The Department. Such experience is critical to ensuring the solution has been proven to be secure and reliable under the required IT security, data management, privacy, and other federal regulations that IT implementations within the USG environment.

Please provide the following information regarding your experience deploying your solution for USG customers.

a. Please list (no more than three (3)) USG agencies where you have successfully deployed the proposed solution in the last three years. For each experience noted, in no more than one paragraph, please provide:

o U.S. agency and organization name.

o Period of performance.

o Solution provided to the USG agency.

Disclaimer: This RFI notice is for information gathering purposes only as a means to identify interested and capable sources that can provide a solution that fully meets all requirements outlined in Part 2 of this notice. The information provided in this RFI is subject to change and is not binding on the USG. The Department has not made a commitment to procure any of the items/services discussed and release of this RFI shall not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought.

The Department will not publicly disclose proprietary information obtained as a result of this RFI. To the full extent that it is protected by law and regulations, information identified by a respondent as “Proprietary” or “Confidential” will be kept confidential. All submissions become USG property and will not be returned.