DISA-OTA-24-R-FANGORNRFI AMD01 Government Responses.pdf

DISA-OTA-24-R-FANGORNRFI Amendment 1 (AMD 01) August 16, 2024

Question

Reference Question Government Response

#1 1) The prototype solution will allow for an integrated hardware and software as a service infrastructure.

To include:

Are you considering a multi-vendor award? If not, are you considering a multi-vendor solution within a single award or is this new platform meant to be from a single vendor?

This is a Request for Information (RFI) notice only. This is not a Request for White Paper (RWP) or a Request for Proposal (RFP).

No solicitation is available at this time.

As this RFI is not a formal RWP or a RFP it should not to be construed as a commitment by the Government to issue a solicitation or ultimately award an agreement.

A future solicitation, if or when made available, will provide this information.

a) Mainframe CPU

b) Storage

c) Standard Software

#2 d) Optional software bundles Are optional software bundles immediate or for future growth?

Immediate. Not every application needs all potential functions so as to keep with a pay for what you use mentality. Optional bundles for specific functions are an immediate requirement.

2) The prototype solution will consist of a single software-as-a-service software solution for sustaining and modernizing mainframe z/OS applications.

a) Standard single software product solutions for z/OS Core Functions

#3 b) Optional add-on database stacks for mission partners to consume, when applicable

Please identify the database stacks in use today that should be part of this solution.

These are add-on options;

but current demand exists for DB2, Datacom, Adabase, etc.

#4 c) Auxiliary development suites including code discovery, code explanation, code optimization, code translation, and analytics.

Are you open to API enabling existing applications and databases as part of your modernization strategy?

Yes, but this could have an accreditation impact as well as concern for leaving the NIPR net with any of those connections.

#5 3) Provisioning and maintenance of the Operating Environments (OEs) will be built on Infrastructure as Code (IaC) to be leveraged by customers/administrators as part of an agile lifecycle. To be leveraged by the control plane or as part of a CI/CD pipeline for MP applications.

Does OE (Operating Environment) provisioning also envision that any associated monitoring, automation and management capabilities should be included in the IaC (Infrastructure as a Code) provisioning and maintenance?

Yes

#6 4) The new infrastructure and control plane will provide a single pane of glass for all J-9’s IBM z environments. The intent is to provide a single location from which customers/administrators can manage all their assets. The new environment will have a central control plane for managing:

Please provide some use cases for the type of management tasks you are looking to have in the central control plane?

Tasks include, System admin (SA) roles, Application administration (AA) roles, Network admin Role, Audit/accreditation, capacity/utilization Dashboard, Financial dashboard, etc.…

a) On-premises cloud environment

#7 b) Commercial cloud assets Please provide some examples of Cloud Access

JWCC and its providers

#8 c) Containers What container technology is in use today at DISA?

Varies by application stack but to name a few, Docker, Kubernetes, Cri-o, etc.…

#9 d) Traditional virtualized assets What is meant by 'Traditional Virtualized Assets?

Linux on z RHEL/SLES virtual operating environments (VOEs), z/OS and z/VM LPARs

#10 e) Dedicated hosts Please explain more about sub-bullet 'e' (Dedicated hosts) in a z/OS mainframe environment.

Any appliances that may be in the supporting infrastructure or part of the app stack. For example, think tools like Guardium, IDAA, etc. that are examples used by our Mission Partners today.

f) Networking

g) Backup/Disaster Recovery

#11 h) Inventory/Configuration Management

Is ServiceNow currently, or planned to be, your repository for inventory and configuration details (e.g. CMDB)?

Please describe how J9 plans to leverage a CMDB as a critical aspect of inventory/configuration management of the Fangorn prototype?

Is ServiceNow currently, or planned to be, your repository for inventory and configuration details (e.g.

CMDB)?

>>That is the current enterprise CMDB at this point. If the proposed solution came with its own CMDB that would eventually federate out to the enterprise solution, all better.

Please describe how J9 plans to leverage a CMDB as a critical aspect of inventory/configuration management of the Fangorn prototype?"

>>Per STIG requirements ITIL practices must be followed. CMDB source of truth is also required for other audit/reporting requirements

#12 i) Storage/Compute What storage solutions are in use today and what are you looking to standardize on for the future?

Looking for best case scenario when it comes to storage. Standardized storage makes logical sense.

#13 7) The prototype solution must be hosted on-premises in a consolidated standardized stack within DISA datacenters. The stack will be standardized and concise, making it ideal for replication when scaling, and used in CONUS and OCONUS locations.

Would this requirement exclude capabilities such as secure immutable backups in an external cloud?

No, same/similar levels of service regardless of hosting location.

#14 8) The prototype solution will allow for the integration and removal of existing IBM z physical hardware into and out of the stack enabling integration, decommissioning, or provisioning of hardware.

Does this include storage hardware?

Yes

11) Post prototype production environment integrations:

#15 a) Be capable of eventual integration into DISA Enterprise Software Management software solutions.

Please provide the list of DISA Enterprise Software Management software solutions.

Can you elaborate further on what is meant by DISA Enterprise Software Management Software Solutions?

Tools that fill the following roles, Asset Monitoring / Management, Network Monitoring, Security, Application Monitoring, and Automation. For example, Tivoli, Splunk, Enterprise Security Posture System (ESPS), Service Now, Ansible Automation Platform, etc.….

#16 12) The prototype solution will have Role-Based Access Controls (RBAC) to allow customers and administrators to properly assign permission sets. Roles will be fully customizable. Multifactor authentication and single sign-on must support Smart Card / Common Access Card / Personal Identity Verification Card authentication for portal and application access.

• Are we looking to have PIV/CAC authentication at the entry portal while using dynamic methods (tokens / passtickets) for seamless access to downstream applications?

• What is DISA's SSO use-case? PIV/CAC at entry and then using dynamic tokens / passtickets for application-level access?

Or, are we looking for OIDC authentication and z/OS Identity Propagation?

• Are we looking at other MFA factors beyond PIV/CAC? e.g., Tokens, Security Key or Push to device?

• Is it envisioned that RBAC would apply to all management software, such as monitoring, automation, database management, AppDev, etc?

Are we looking to have PIV/CAC authentication at the entry portal while using dynamic methods (tokens / passtickets) for seamless access to downstream applications?

>>Yes, Zero Trust / ICAM compliance at all levels.

Privileged users require alternate tokens for system access. ICAM integrations may require OIDC

What is DISA's SSO use-case?

>>ICAM

PIV/CAC at entry and then using dynamic tokens / passtickets for application-level access? Or, are we looking for OIDC authentication and z/OS Identity Propagation?

>>Yes, Zero Trust / ICAM compliance at all levels.

Privileged users require alternate tokens for system access. ICAM integrations may require OIDC

Are we looking at other MFA factors beyond PIV/CAC? e.g., Tokens, Security Key or Push to device?

>>Yes, Zero Trust / ICAM compliance at all levels.

Privileged users require alternate tokens for system access. ICAM integrations may require OIDC

Is it envisioned that RBAC would apply to all management software, such as monitoring, automation, database management, AppDev, etc?

>>Yes

#17 13) The prototype solution will have a Continuous Integration and Continuous Delivery (CI/CD) automation pipeline to handle various integration tasks such as deployments and scaling. This prototype solution shall leverage code-based CI/CD automation, which will execute seamlessly through the central control plane.

• zD&T was mentioned as the development environment, but is this open to other modern development tools like Visual Studio? What Application Architecture documents you can share?

• Please share your current best practice planned Life Cycles & people at each stage needed (Dev-testing- QA-Stage-Prod)? Where will production libraries finally reside with this project?

• Are you planning for Shared or non-Shared load libraries in these new environments?

• What is the roll out plan (phased approach & by certain applications)

• What Level of Service Management integrations are you requiring? For example, service management requests to drive Development activities & Approvals, or just used for reporting?

• What Audits must be addressed with this solution?

zD&T was mentioned as the development environment, but is this open to other modern development tools like Visual Studio? What Application Architecture documents you can share?

>> zD&T was not mentioned. Solution should be as IDE agnostic as possible. Architecture varies by Mission Partner Application, nothing to share at this time.

Please share your current best practice planned Life Cycles & people at each stage needed (Dev-testing- QA-Stage-Prod)? Where will production libraries finally reside with this project?

>> Looking for industry input on best practices and framework. Current source code repos vary by application. Looking for industry input.

Are you planning for Shared or non-Shared load libraries in these new environments What is the roll out plan (phased approach & by certain applications) >> Looking for industry input on best practices and framework. Phased approach for individual app owners as they and we have means for migration.

What Level of Service Management integrations are you requiring? For example, service management requests to drive Development activities & Approvals, or just used for reporting?

>> Looking for industry input on best practices and framework

What Audits must be addressed with this solution?

>> SSAE18, A&A,

Financial audits, etc...

#18 14) The prototype solution will provide interoperability with existing enterprise tools that are critical to the workload but must also include functionality to allow for the integration of new enterprise commercial tools as needed, such as ServiceNow and Splunk.

What are the existing enterprise tools that need integration?

See the response to #15 above.

#19 16) The prototype solution will have extensive integrated monitoring and alerting capabilities, such as:

• What type of monitoring data are you looking to leverage? Is monitoring associated with this effort also going to be integrated with distributed environments (not solely mainframe)?

• How many monitoring tools does the J9 have throughout the environment today? How are you currently handling that data to prevent service degradation and proactively ensure service health?

What type of monitoring data are you looking to leverage? Is monitoring associated with this effort also going to be integrated with distributed environments (not solely mainframe)?

>>Performance (DevOps), usage (billing), API monitoring, etc.… Yes, integrated mainframe and distributed data.

How many monitoring tools does the J9 have throughout the environment today?

>>Several but proposed prototype should include monitoring suites not considered in ESM tools.

How are you currently handling that data to prevent service degradation and proactively ensure service health?

>>Depends on app owner.

There is a lack of tools/knowledge in this area.

#20 a) Realtime insights Is Near Real-Time is sufficient for insights to minimize the expense of OS overhead?

Please define Near Real-time? Depends on reasonable acceptability.

b) Alerting features (e.g., email and SMS messaging, alerts that trigger scripts or automation tasks)

#21 c) Cloud-ready manner of monitoring assets/applications/containers/DBs/etc.

Could DISA clarify, expand upon and provide examples of what is meant by "cloud-ready monitoring"?

Integrated mainframe and distributed data.

d) Infrastructure level monitoring and automated handling of events

#22 22) The prototype solution will have a full migration solution to allow migration of establish IBM z workload into Fangorn. This migration process and capability will also allow a quick, easy transition of non z/OS assets from one hosting type to another within the solution. The migration solution will:

Does DISA desire to lift/shift mission partner data from mission partner running systems to the new environment?

Cloning/moving the data?

What about specific mission partner customizations? Can you elaborate, please?

Does DISA desire to lift/shift mission partner data from mission partner running systems to the new environment?

>>Yes. MPs would need that option. We are not intending to discontinue their current environment but would look to simply offer Fangorn as an alternative. This may require production changes in their current environment prior to being able to lift/shift.

Cloning/moving the data?

>>Where applicable and per industry migration recommendations.

What about specific mission partner customizations?

>>To Be Determined (TBD) as part of potential migration plan for each MP.

Can you elaborate, please?

>>Likely to be introduced in if/when a solicitation is available.

a) Be capable of asset migration from varying on-premises and cloud instances to Fangorn

b) Include a containerized environment disaster recovery and migration capability

c) Support migration of current IBM z environments to a new solution with minimal downtime and impact to mission

#23 23) Co-located z/OS, Linux on z and container workloads

Could DISA Please explain more on this topic? z/OS supported hardware allows z/OS, Linux on z/OS and containers via ZCX or containers via Linux on z/OS to all run in the same physical hardware.

Does this requirement really mean the monitoring of these components?

Could DISA Please explain more on this topic? z/OS supported hardware allows z/OS, Linux on z/OS and containers via ZCX or containers via Linux on z/OS to all run in the same physical hardware.

>>Could be same host or separate hosts but still located at the same site.

Looking for industry input on best practices and framework for most cost effective and performant infrastructure.

Does this requirement really mean the monitoring of these components?

>>No monitoring is covered elsewhere.

#24 24) The prototype solution will have a billing portal to provide billing management capabilities to the program office as well as environment billing features for customers. The billing portal will include:

Could DISA explain what level of billing granularity it envisions?

a. At the image level or down to use of specific resources (such as storage, use of specific database stacks, network bandwidth consumption, etc.)?

b. Is this to be similar to a chargeback system, including ability to define variable costs by time of day, day of week, etc.?

a. Looking for industry input on best practices and framework for that type of billing structure.

b. Yes, the proposed Prototype should include a chargeback system with the level of granularity to be recommended by industry.

a) Full cost transparency for tenants

b) Reporting functionality

c) At-a-glance dashboards

d) Budgeting tools such as billing threshold alerts

e) Customer ability to place server orders in the portal and have servers provisioned via integrated automation

f) Consolidated billing view of both on-premises and public cloud assets

#25 28) Fully functional DevSecOps automation pipeline in place to handle the various requirements of the integrated solution.

Deployments, scaling, and other integrated actions leveraging written DevSecOps pipeline style automation should happen seamlessly.

• Are there pipeline tools in place that need to be reused? If so, what are they?

• Are you looking for pipeline as code?

• What technologies need to be controlled?

Are there pipeline tools in place that need to be reused? If so, what are they?

>> At minimum should be compatible with toolsets like DISA J-9's Vulcan.

Are you looking for pipeline as code?

>> Yes. Anything to facilitate agile app dev methodologies.

What technologies need to be controlled?

>> Based on the ambiguity of this question the Government is unable to provide response.

#26 31) Vendor will provide training to manage and operate the prototype solution.

What will the format of the Fangorn Industry Networking Day be? Will it be in-person or virtual?

If in-person, where will the location be?

In accordance with the RFI the J-9 Fangorn Industry Networking Day (TechMoot) is scheduled for August 27, 2024, and companies will be given the opportunity to provide a 10–30-minute presentation (participation dependent) on their capabilities, for the purposes of partnering with other companies for the acquisition. The event is currently projected to be held in-person within the National Capital Region.

Event location, daily schedule and additional details will be provided to those that RSVP.

#27 General - Reference Unknown Does the Government expect us to demonstrate disaster recovery as part of the Fangorn prototype?

Yes.

#28 General - Reference Unknown As part of the Fangorn prototype, will the Government identify all external interoperability software for this OTA?

Where it relates to ESM tools, yes, but provided solution should come with all unique to solution dependencies.

#29 General - Reference Unknown Will there be service availability requirements identified for the Fangorn prototype?

The Government is unclear of the basis and reference for this question and unable to provide a clear response.

#30 General - Reference Unknown Will the Fangorn prototype require external environments not specific to the OTA, such as communications?

Prototype is expected to tie into existing network infrastructure for NIPR net but should contain its own comm stack for provisioning/deprovisioning systems.

#31 General - Reference Unknown Will the Government be recording the virtual session on 13 AUG and make it available for listening purposes after the event concludes?

This event will be recorded and transcribed for Government purposes only.

Recordings will not be made available for listening purposes. Responses to written questions received in advance of the Q&A session will be posted to SAM.gov as an amendment to this RFI. Verbal questions and answers will not be captured during this event.

#32 General - Reference Unknown Could you provide information on what capacity baselines (MIPS, DASD, VTS) should be assumed for the prototype?

A rough baseline for a prototype could be the following:

MIPS - 650 MIPS

DASD - 30,000 GB

Tape - 150,000 GB uncompressed

#33 General - Reference Unknown Are there preferences for DASD and VTS vendors (IBM, Dell/EMC, Hitachi etc.)?

Whichever provides the best solution taking into account, compatibility, cost, ease of management etc.

#34 General - Reference Unknown At this point can you provide information on what software should be included in the prototype?

Or is that going to be specified later in the process.

More finite or detailed functional requirements will be provided if/when a solicitation is announced.

#35 General - Reference Unknown Do you envision the modern DevOps and DevSecOps practices relating to IaC, AI for code optimization, use of APIs, et al, to be using distributed and commercial cloud technologies that leverage non-Z platforms and services, or do these practices entirely consist of working within a Z context?

Rely on z wherever we can, but we understand that not all tooling is compatible with the architecture. As stated in the RFI this solution is an on prem solution and any tooling should be able to be deployed on prem even if x86 arch is a requirement.

#36 General - Reference Unknown Do references to application modernization, stabilization and maintenance refer to in-scope replatforming of current Z apps to non-Z technology platforms such as commercial cloud platforms, including virtual servers, containerization, event-driven architectures on distributed compute, etc.?

Focused primarily on modernizing in place on z because of the inherent cost and risk of re-platforming.

That being said, we understand that not all tooling is compatible with the z architecture and, in keeping with the DoD CIO Mandate for a cloud smart approach to IT, certain elements of applications may end up on distributed systems.

#37 General/Formatting Regarding the instructions to provide a 4-Page response, would DISA consider increasing the

RFI White Paper response page count has been increased from four (4)

Page limit of the RFI response?

pages to six (6) pages. See RFI AMD01 for changes.

#38 Page 2 Background Please describe your definition or vision of hybrid cloud? Does the mainframe fit into this definition and what role will this platform have in the future?

There should be no technical silos resources and compute should be shareable across architectures and the mainframe systems should be able to integrate into that shared computing environment.

#39 Page 2 Background / Par #3 Will you provide detail as to the disparate hardware and software components that you would like to merge?

We will not be providing a current software/hardware list as part of this RFI.

What we're asking for with this prototype is everything merged from hardware, to supporting software, in order to run an IBM z shop.

To include z/OS applications, Linux on z and z/VM.

#40 Page 2 Background Will you be providing mainframe configurations (and LPARs) for CONUS and OCONUS?

Specific configurations will not be shared as part of this

RFI.

#41 Page 2 Key Features / #6

6. Utility based billing and reporting (pay-as-you-go)

What additional data will we be provided to vendors to help produce a ROM that aligns with a "pay-as-you-go" model?

Looking for industry input on best practices and framework for utilization based billing to our mission partners. Some baseline numbers have been included in #32 that can be used for sizing a ROM.

Industries assumptions for sizing should be included with their ROM.

#42 Page 2 Key Features / #9

9. Infrastructure as Code ready for Ansible and Terraform

What is your definition of Infrastructure as Code?

What platforms are included in this definition?

We seek to manage and provision resources using code rather than interactive configuration tools.

Anything that allows for a declarative deployment of resources and plays well into DevSecOps pipelines.

#43 Page 2 Key Features / #10

10. Interoperability support for existing J-9 enterprise level tools

Can DISA provide a definition of "enterprise level tools" and provide examples?

Tools that fill the following roles, Asset Monitoring / Management, Network Monitoring, Security, Application Monitoring, and Automation. For example Tivoli, Splunk, Enterprise Security Posture System (ESPS), Service Now, Ansible Automation Platform, etc.

#44 Page 9 / Par #5 What is the direction for source code management for mainframe code?

Looking for industry input on best practices and framework. Current source code repos vary by application. Looking for industry input. At minimum should be compatible with toolsets like DISA J-9's Vulcan.

#45 Appendix 3 - ROM Template - Page

The first section does not have a title. Can you explain the information you seek in first section and provide more clarity on what you seek for other sections?

The first section of the MS Excel ROM Template is left blank for additional inputs that are specific to your solution. These may be deleted or expanded upon.