DISA-OTA-24-R-FANGORNRFI AMD02 Government Responses.pdf

Question # Reference Question Government Response

#1

1) The prototype solution will allow for an integrated hardware and software as a service infrastructure. To include:

Are you considering a multi-vendor award? If not, are you considering a multi-vendor solution within a single award or is this new platform meant to be from a single vendor?

This is a Request for Information (RFI) notice only. This is not a Request for White Paper (RWP) or Request for Proposal (RFP). No solicitation is available at this time.

As this RFI is not a formal RWP or a RFP it should not to be construed as a commitment by the Government to issue a solicitation or ultimately award an agreement.

A future solicitation, if or when made available, will provide this information.

a) Mainframe CPU

b) Storage

c) Standard Software

#2 d) Optional software bundles Are optional software bundles immediate or for future growth?

Immediate. Not every application needs all potential functions so as to keep with a pay for what you use mentality.

Optional bundles for specific functions is an immediate requirement.

2) The prototype solution will consist of a single software-as-a-service software solution for sustaining and modernizing mainframe z/OS applications.

• Can we clarify the definition of "single SaaS solution?" What business requirements to you want to support?

• Is the core zOS operating environment a NEW mainframe, or will it be an existing mainframe asset that will be repurposed?

Can we clarify the definition of "single SaaS solution?" What business requirements to you want to support?

• Meaning everything needed to sustain, maintain, and modernize applications should be included in the solution.

Is the core zOS operating environment a NEW mainframe, or will it be an existing mainframe asset that will be repurposed?

• Either. Looking for industry input on best practices and framework factoring in cost and agility.

a) Standard single software product solutions for z/OS Core Functions What is included in the definition of "z/OS Core Functions"? Supporting software for sustaining, maintaining, and modernizing applications.

#3

b) Optional add-on database stacks for mission partners to consume, when applicable

• Please identify the database stacks in use today that should be part of this solution.

• Can you share the software stacks for each department? Including the vendor and the versions?

These are add-on options; but current demand exists for DB2, Datacom, Adabase, etc.

#4

c) Auxiliary development suites including code discovery, code explanation, code optimization, code translation, and analytics.

Are you open to API enabling existing applications and databases as part of your modernization strategy?

Yes, but this could have an accreditation impact as well as concern for leaving the NIPR net with any of those connections.

#5

3) Provisioning and maintenance of the Operating Environments (OEs) will be built on Infrastructure as Code (IaC) to be leveraged by customers/administrators as part of an agile lifecycle. To be leveraged by the control plane or as part of a CI/CD pipeline for MP applications.

• Does OE (Operating Environment) provisioning also envision that any associated monitoring, automation and management capabilities should be included in the IaC (Infrastructure as a Code) provisioning and maintenance?

• Please clarify this approach. Is DISA trying to modernize its CI/CD pipeline for applications, including runtime definitions with the application?

Does OE (Operating Environment) provisioning also envision that any associated monitoring, automation and management capabilities should be included in the IaC (Infrastructure as a Code) provisioning and maintenance?

• Yes

Please clarify this approach. Is DISA trying to modernize its CI/CD pipeline for applications, including runtime definitions with the application?

• Everything that can be configuration/infrastructure as code should be. Our mission partners own the applications but the Fangorn solution should offer the tools, platform, and pipelines to carry their applications forward with modern design principles.

#6

4) The new infrastructure and control plane will provide a single pane of glass for all J-9’s IBM z environments. The intent is to provide a single location from which customers/administrators can manage all their assets. The new environment will have a central control plane for managing:

Please provide some use cases for the type of management tasks you are looking to have in the central control plane?

Tasks include, System admin (SA) roles, Application administration (AA) roles, Network admin Role, Audit/accreditation, capacity/utilization Dashboard, Financial dashboard, etc.…

a) On-premises cloud environment #7 b) Commercial cloud assets Please provide some examples of Cloud Access JWCC and its providers #8 c) Containers What container technology is in use today at DISA? Varies by application stack but to name a few, Docker, Kubernetes, Cri-o, etc.… #9 d) Traditional virtualized assets What is meant by 'Traditional Virtualized Assets? Linux on z RHEL/SLES virtual operating environments (VOEs), z/OS and z/VM LPARs

#10 e) Dedicated hosts Please explain more about sub-bullet 'e' (Dedicated hosts) in a z/OS mainframe environment.

Any appliances that may be in the supporting infrastructure or part of the app stack. For example, think tools like Guardium, IDAA, etc. that are examples used by our Mission Partners today.

f) Networking

g) Backup/Disaster Recovery

#11 h) Inventory/Configuration Management

• Is ServiceNow currently, or planned to be, your repository for inventory and configuration details (e.g. CMDB)?

• Please describe how J9 plans to leverage a CMDB as a critical aspect of inventory/configuration management of the Fangorn prototype?

Is ServiceNow currently, or planned to be, your repository for inventory and configuration details (e.g. CMDB)?

• That is the current enterprise CMDB at this point. If the proposed solution came with its own CMDB that would eventually federate out to the enterprise solution, all better.

Please describe how J9 plans to leverage a CMDB as a critical aspect of inventory/configuration management of the Fangorn prototype?"

• Per STIG requirements ITIL practices must be followed. CMDB source of truth is also required for other audit/reporting requirements

#12 i) Storage/Compute

What storage solutions are in use today and what are you looking to standardize on for the future?

Does DISA have physical Tape drives that would need to be migrated to virtual Tape or Cloud with the modernization project?

What storage solutions are in use today and what are you looking to standardize on for the future?

• Virtual Tape/DASD. Looking for industry input on best practices and framework i.e. local object storage.

Does DISA have physical Tape drives that would need to be migrated to virtual Tape or Cloud with the modernization project?

• Yes, focusing on on-prem for this solution. Capability to connect to external object storage should be supported

5) The prototype solution will be distributed, hybrid and multi-cloud ready to support interaction from the on-premises control plane to commercial cloud service providers. The prototype solution is intended to allow DISA and its mission partners to be able to provision and manage instances in commercial cloud service provider environments, as well as on prem, in a single interface.

Please clarify that all resources for public & private cloud, and mainframe will be provisioned, managed, and reported out of the single control plane?

As stated in #5 of the RFI, the central control plane should be a one stop shop for all DISA and mission partners to manage environments across commercial and private clouds, which includes on prem resources like z/OS and Linux on Z.

6) The prototype solution will include multi-tenancy support with full customer/account level segmentation. Customers will be able to have all their assets in a single Virtual Datacenter (VDC), Virtual Private Cloud (VPC), or Virtual Cloud Network (VCN). The VDCs or VPCs will be fully segmented from one another and have their own virtual networking capabilities. Multi-tenancy capabilities will include the following:

a) Single management portal for each customer to their entire cloud environment

b) Single control plane representation of all customer assets in one place regardless of location or offering.

c) Customers are separated from each other and exist in isolated environments

d) Data is kept completely private and encrypted

e) Ability for infrastructure and tenant-controlled encryption keys with Virtualized Traditional Physical Module (vTPM) encryption support

f) Network micro-segmentation capabilities Will the Fangorn solution include other hardware platforms in addition to Z and operating systems in addition to z/OS and Linux on Z? If so, which ones?

We understand that not all tooling is compatible with the z architecture and in order to meet our needs there may be non z components. Those components will most likely be on-prem, where applicable, in other J9 hosted capabilities

g) Built-in ability for tenants to analyze network traffic entering or exiting their space

h) Capability to monitor traffic inside the tenant boundary

i) Multi-tenancy of projects/customer control planes separated by Role Based Access Control

#13

7) The prototype solution must be hosted on-premises in a consolidated standardized stack within DISA datacenters. The stack will be standardized and concise, making it ideal for replication when scaling, and used in CONUS and OCONUS locations.

Would this requirement exclude capabilities such as secure immutable backups in an external cloud?

No, same/similar levels of service regardless of hosting location.

#14

8) The prototype solution will allow for the integration and removal of existing IBM z physical hardware into and out of the stack enabling integration, decommissioning, or provisioning of hardware.

Does this include storage hardware? Yes.

11) Post prototype production environment integrations:

#15

a) Be capable of eventual integration into DISA Enterprise Software Management software solutions.

Please provide the list of DISA Enterprise Software Management software solutions.

Can you elaborate further on what is meant by DISA Enterprise Software Management Software Solutions?

Tools that fill the following roles, Asset Monitoring / Management, Network Monitoring, Security, Application Monitoring, and Automation. For example Tivoli, Splunk, Enterprise Security Posture System (ESPS), Service Now, Ansible Automation Platform, etc.….

DISA-OTA-24-R-FANGORNRFI AMD01 Government Responses August 28, 2024

#16

12) The prototype solution will have Role-Based Access Controls (RBAC) to allow customers and administrators to properly assign permission sets. Roles will be fully customizable. Multifactor authentication and single sign-on must support Smart Card / Common Access Card / Personal Identity Verification Card authentication for portal and application access.

• Are we looking to have PIV/CAC authentication at the entry portal while using dynamic methods (tokens / passtickets) for seamless access to downstream applications?

• What is DISA's SSO use-case? PIV/CAC at entry and then using dynamic tokens / passtickets for application-level access? Or, are we looking for OIDC authentication and z/OS Identity Propagation?

• Are we looking at other MFA factors beyond PIV/CAC? e.g., Tokens, Security Key or Push to device?

• Is it envisioned that RBAC would apply to all management software, such as monitoring, automation, database management, AppDev, etc.?

Are we looking to have PIV/CAC authentication at the entry portal while using dynamic methods (tokens / passtickets) for seamless access to downstream applications?

• Yes, Zero Trust / ICAM compliance at all levels. Privileged users require alternate tokens for system access. ICAM integrations may require OIDC

What is DISA's SSO use-case?

• ICAM

PIV/CAC at entry and then using dynamic tokens / passtickets for application-level access? Or, are we looking for OIDC authentication and z/OS Identity Propagation?

• Yes, Zero Trust / ICAM compliance at all levels. Privileged users require alternate tokens for system access. ICAM integrations may require OIDC

Are we looking at other MFA factors beyond PIV/CAC? e.g., Tokens, Security Key or Push to device?

• Yes, Zero Trust / ICAM compliance at all levels. Privileged users require alternate tokens for system access. ICAM integrations may require OIDC

Is it envisioned that RBAC would apply to all management software, such as monitoring, automation, database management, AppDev, etc.?

• Yes

#17

13) The prototype solution will have a Continuous Integration and Continuous Delivery (CI/CD) automation pipeline to handle various integration tasks such as deployments and scaling. This prototype solution shall leverage code-based CI/CD automation, which will execute seamlessly through the central control plane.

• zD&T was mentioned as the development environment, but is this open to other modern development tools like Visual Studio? What Application Architecture documents you can share?

• Please share your current best practice planned Life Cycles & people at each stage needed (Dev-testing-QA-Stage-Prod)? Where will production libraries finally reside with this project?

• Are you planning for Shared or non-Shared load libraries in these new environments?

• What is the roll out plan (phased approach & by certain applications)?

• What Level of Service Management integrations are you requiring? For example, service management requests to drive Development activities & Approvals, or just used for reporting?

• What Audits must be addressed with this solution?

• Does DISA intend to containerize its existing z/OS applications that run in CICS? If so, will it be modeled on the OCI in Cloud?

zD&T was mentioned as the development environment, but is this open to other modern development tools like Visual Studio? What Application Architecture documents you can share?

• zD&T was not mentioned. Solution should be as IDE agnostic as possible. Architecture varies by Mission Partner Application, nothing to share at this time.

Please share your current best practice planned Life Cycles & people at each stage needed (Dev-testing-QA-Stage- Prod)? Where will production libraries finally reside with this project?

• Looking for industry input on best practices and framework. Current source code repos vary by application.

Looking for industry input.

Are you planning for Shared or non-Shared load libraries in these new environments? What is the roll out plan (phased approach & by certain applications)?

• Looking for industry input on best practices and framework. Phased approach for individual app owners as they and we have means for migration.

What Level of Service Management integrations are you requiring? For example, service management requests to drive Development activities & Approvals, or just used for reporting?

• Looking for industry input on best practices and framework

What Audits must be addressed with this solution?

• SSAE18, A&A, Financial audits, etc...

Does DISA intend to containerize its existing z/OS applications that run in CICS? If so, will it be modeled on the OCI in Cloud?

• Depends on the application and desires of that mission partner. Looking for industry input on best practices and framework.

#18

14) The prototype solution will provide interoperability with existing enterprise tools that are critical to the workload but must also include functionality to allow for the integration of new enterprise commercial tools as needed, such as ServiceNow and Splunk.

What are the existing enterprise tools that need integration? See the response to #15 above.

#19

16) The prototype solution will have extensive integrated monitoring and alerting capabilities, such as:

• What type of monitoring data are you looking to leverage? Is monitoring associated with this effort also going to be integrated with distributed environments (not solely mainframe)?

• How many monitoring tools does the J9 have throughout the environment today? How are you currently handling that data to prevent service degradation and proactively ensure service health?

What type of monitoring data are you looking to leverage? Is monitoring associated with this effort also going to be integrated with distributed environments (not solely mainframe)?

• Performance (DevOps), usage (billing), API monitoring, etc.… Yes integrated mainframe and distributed data.

How many monitoring tools does the J9 have throughout the environment today?

• Several but proposed prototype should include monitoring suites not considered in ESM tools.

How are you currently handling that data to prevent service degradation and proactively ensure service health?

• Depends on app owner. There is a lack of tools/knowledge in this area.

#20 a) Realtime insights Is Near Real-Time is sufficient for insights to minimize the expense of OS overhead? Please define Near Real-time? Depends on reasonable acceptability.

b) Alerting features (e.g., email and SMS messaging, alerts that trigger scripts or automation tasks)

#21 c) Cloud-ready manner of monitoring assets/applications/containers/DBs/etc.

Could DISA clarify, expand upon and provide examples of what is meant by "cloud-ready monitoring"?

Integrated mainframe and distributed data.

d) Infrastructure level monitoring and automated handling of events

18) The prototype solution will need to meet industry standard redundancy capabilities and include high availability implementations for resources.

Do any of the current deployments of the MF assets currently leverage GDPS for geographic and regional High Availability?

Not GDPS specifically, but Looking for industry input on best practices and framework

#22

22) The prototype solution will have a full migration solution to allow migration of establish IBM z workload into Fangorn. This migration process and capability will also allow a quick, easy transition of non z/OS assets from one hosting type to another within the solution. The migration solution will:

Does DISA desire to lift/shift mission partner data from mission partner running systems to the new environment? Cloning/moving the data? What about specific mission partner customizations?

Can you elaborate, please?

Does DISA desire to lift/shift mission partner data from mission partner running systems to the new environment?

• Yes. MPs would need that option. We are not intending to discontinue their current environment but would look to simply offer Fangorn as an alternative. This may require production changes in their current environment prior to being able to lift/shift.

Cloning/moving the data?

• Where applicable an per industry migration recommendations.

What about specific mission partner customizations?

• To Be Determined (TBD) as part of potential migration plan for each MP.

Can you elaborate, please?

• Likely to be introduced in if/when a solicitation is available.

a) Be capable of asset migration from varying on-premises and cloud instances to Fangorn

b) Include a containerized environment disaster recovery and migration capability

c) Support migration of current IBM z environments to a new solution with minimal downtime and impact to mission

#23 23) Co-located z/OS, Linux on z and container workloads

• Could DISA Please explain more on this topic? z/OS supported hardware allows z/OS, Linux on z/OS and containers via ZCX or containers via Linux on z/OS to all run in the same physical hardware.

• Does this requirement really mean the monitoring of these components?

Could DISA Please explain more on this topic? z/OS supported hardware allows z/OS, Linux on z/OS and containers via ZCX or containers via Linux on z/OS to all run in the same physical hardware.

• Could be same host or separate hosts but still located at the same site. Looking for industry input on best practices and framework for most cost effective and performant infrastructure.

Does this requirement really mean the monitoring of these components?

• No monitoring is covered elsewhere.

#24

24) The prototype solution will have a billing portal to provide billing management capabilities to the program office as well as environment billing features for customers. The billing portal will include:

• Could DISA explain what level of billing granularity it envisions?

a. At the image level or down to use of specific resources (such as storage, use of specific database stacks, network bandwidth consumption, etc.)?

b. Is this to be similar to a chargeback system, including ability to define variable costs by time of day, day of week, etc.?

• What billing applications are used today, and do you currently provide usage based, Charge Back, Showback capabilities to your affiliates?

• Do all affiliates use the same Billing solutions and if no, is it the desire that all will be consolidated to one common solution?

Could DISA explain what level of billing granularity it envisions?

a. At the image level or down to use of specific resources (such as storage, use of specific database stacks, network bandwidth consumption, etc.)?

• Looking for industry input on best practices and framework for that type of billing structure.

b. Is this to be similar to a chargeback system, including ability to define variable costs by time of day, day of week, etc.?

• Yes the proposed Prototype should include a chargeback system with the level of granularity to be recommended by industry.

What billing applications are used today, and do you currently provide usage based, Charge Back, Showback capabilities to your affiliates?

• Yes, we currently provide usage based billing, though transparency is an area we're looking to improve.

Do all affiliates use the same Billing solutions and if no, is it the desire that all will be consolidated to one common solution?

• All use the same

a) Full cost transparency for tenants

b) Reporting functionality

c) At-a-glance dashboards

d) Budgeting tools such as billing threshold alerts

e) Customer ability to place server orders in the portal and have servers provisioned via integrated automation

f) Consolidated billing view of both on-premises and public cloud assets

#25

28) Fully functional DevSecOps automation pipeline in place to handle the various requirements of the integrated solution. Deployments, scaling, and other integrated actions leveraging written DevSecOps pipeline style automation should happen seamlessly.

• Are there pipeline tools in place that need to be reused? If so, what are they?

• Are you looking for pipeline as code?

• What technologies need to be controlled?

Are there pipeline tools in place that need to be reused? If so, what are they?

• At minimum should be compatible with toolsets like DISA J-9's Vulcan.

Are you looking for pipeline as code?

• Yes. Anything to facilitate agile app dev methodologies.

What technologies need to be controlled?

• Based on the ambiguity of this question the Government is unable to provide response.

#26

31) Vendor will provide training to manage and operate the prototype solution.

What will the format of the Fangorn Industry Networking Day be? Will it be in-person or virtual?

If in-person, where will the location be?

In accordance with the RFI the J-9 Fangorn Industry Networking Day (TechMoot) is scheduled for August 27, 2024, and companies will be given the opportunity to provide a 10–30 minute presentation (participation dependent) on their capabilities, for the purposes of partnering with other companies for the acquisition. The event is currently projected to be held in-person within the National Capital Region. Event location, daily schedule and additional details will be provided to those that RSVP.

#27 General - Reference Unknown Does the Government expect us to demonstrate disaster recovery as part of the Fangorn prototype? Yes.

#28 General - Reference Unknown As part of the Fangorn prototype, will the Government identify all external interoperability software for this OTA?

Where it relates to ESM tools, yes, but provided solution should come with all unique to solution dependencies.

#29 General - Reference Unknown Will there be service availability requirements identified for the Fangorn prototype? The Government is unclear of the basis and reference for this question and unable to provide a clear response.

#30 General - Reference Unknown Will the Fangorn prototype require external environments not specific to the OTA, such as communications?

Prototype is expected to tie into existing network infrastructure for NIPR net but should contain its own comm stack for provisioning/deprovisioning systems.

#31 General - Reference Unknown Will the Government be recording the virtual session on 13 AUG and make it available for listening purposes after the event concludes?

This event will be recorded and transcribed for Government purposes only. Recordings will not be made available for listening purposes. Responses to written questions received in advance of the Q&A session will be posted to SAM.gov as an amendment to this RFI. Verbal questions and answers will not be captured during this event.

#32 General - Reference Unknown

• Could you provide information on what capacity baselines (MIPS, DASD, VTS) should be assumed for the prototype?

• Can you share the total number of MIPS (or MSU) currently utilized, by department if possible and expected growth/decline over the next 5 years?

Could you provide information on what capacity baselines (MIPS, DASD, VTS) should be assumed for the prototype?

• A rough baseline for a prototype could be the following:

MIPS - 650 MIPS

DASD - 30,000 GB

Tape - 150,000 GB uncompressed

Can you share the total number of MIPS (or MSU) currently utilized, by department if possible and expected growth/decline over the next 5 years?

• Not at this time. More finite or detailed functional requirements will be provided if/when a solicitation is announced.

#33 General - Reference Unknown Are there preferences for DASD and VTS vendors (IBM, Dell/EMC, Hitachi etc.)? Whichever provides the best solution taking into account, compatibility, cost, ease of management etc.

#34 General - Reference Unknown At this point can you provide information on what software should be included in the prototype?

Or is that going to be specified later in the process.

More finite or detailed functional requirements will be provided if/when a solicitation is announced.

#35 General - Reference Unknown

Do you envision the modern DevOps and DevSecOps practices relating to IaC, AI for code optimization, use of APIs, et al, to be using distributed and commercial cloud technologies that leverage non-Z platforms and services, or do these practices entirely consist of working within a Z context?

Rely on z wherever we can, but we understand that not all tooling is compatible with the architecture. As stated in the RFI this solution is an on prem solution and any tooling should be able to be deployed on prem even if x86 arch is a requirement.

#36 General - Reference Unknown

Do references to application modernization, stabilization and maintenance refer to in-scope replatforming of current Z apps to non-Z technology platforms such as commercial cloud platforms, including virtual servers, containerization, event-driven architectures on distributed compute, etc.?

Focused primarily on modernizing in place on z because of the inherent cost and risk of re-platforming. That being said, we understand that not all tooling is compatible with the z architecture and, in keeping with the DoD CIO Mandate for a cloud smart approach to IT, certain elements of applications may end up on distributed systems.

#37 General/Formatting Regarding the instructions to provide a 4-Page response, would DISA consider increasing the Page limit of the RFI response?

RFI White Paper response page count has been increased from four (4) pages to six (6) pages. See RFI AMD01 for changes.

#38 Page 2 Background Please describe your definition or vision of hybrid cloud? Does the mainframe fit into this definition and what role will this platform have in the future?

There should be no technical silos resources and compute should be shareable across architectures and the mainframe systems should be able to integrate into that shared computing environment.

#39 Page 2 Background / Par #3 Will you provide detail as to the disparate hardware and software components that you would like to merge?

We will not be providing a current software/hardware list as part of this RFI. What we're asking for with this prototype is everything merged from hardware, to supporting software, in order to run an IBM z shop. To include z/OS applications, Linux on z and z/VM.

#40 Page 2 Background Will you be providing mainframe configurations (and LPARs) for CONUS and OCONUS? Specific configurations will not be shared as part of this RFI.

#41 Page 2 Key Features / #6

6. Utility based billing and reporting (pay-as-you-go)

What additional data will we be provided to vendors to help produce a ROM that aligns with a "pay-as-you-go" model?

Looking for industry input on best practices and framework for utilization based billing to our mission partners.

Some baseline numbers have been included in #32 that can be used for sizing a ROM. Industries assumptions for sizing should be included with their ROM.

#42 Page 2 Key Features / #9

9. Infrastructure as Code ready for Ansible and Terraform

What is your definition of Infrastructure as Code? What platforms are included in this definition?

We seek to manage and provision resources using code rather than interactive configuration tools. Anything that allows for a declarative deployment of resources and plays well into DevSecOps pipelines.

#43 Page 2 Key Features / #10

10. Interoperability support for existing J-9 enterprise level tools

Can DISA provide a definition of "enterprise level tools" and provide examples?

Tools that fill the following roles, Asset Monitoring / Management, Network Monitoring, Security, Application Monitoring, and Automation. For example Tivoli, Splunk, Enterprise Security Posture System (ESPS), Service Now, Ansible Automation Platform, etc.

#44 Page 9 / Par #5 What is the direction for source code management for mainframe code?

Looking for industry input on best practices and framework. Current source code repos vary by application. Looking for industry input. At minimum should be compatible with toolsets like DISA J-9's Vulcan.

#45 Appendix 3 - ROM Template - Page 14 The first section does not have a title. Can you explain the information you seek in first section and provide more clarity on what you seek for other sections?

The first section of the MS Excel ROM Template is left blank for additional inputs that are specific to your solution.

These may be deleted or expanded upon.

#46 General - Reference Unknown What are the expected security levels and do they vary by department?

Prototype is focused on NIPR and additional security requirement information will be included in a solicitation, e.g.

Facility Clearance Level, requirement for DD254, etc.

#47 General - Reference Unknown What encryption is required? FIPS 140-2 is the requirement, FIPS 140-3 should be highly considered. As well as Quantum safe

#48 General - Reference Unknown Is there a reporting requirement that comes with this request?

Is the client looking to say "We are DISA STIG compliant?"

Is there a reporting requirement that comes with this request?

• See #17

Is the client looking to say "We are DISA STIG compliant?"

• Yes among other audit requirements, SSAE18, A&A, Financial audits, etc.…

#49 General - Reference Unknown What is the clients comfort level and aptitude with open source tools? Per DISA STIG we cannot run unsupported tools. Open source isn't an issue as long as we have support for that tool.

#50 General - Reference Unknown Who are the end users of the different application endpoints that the mainframe will connect to? Depends on the application and users are managed by those application owners

#51 General - Reference Unknown What is the current level of all MF HW and SW, and are they all at current support for HW and SW with the OEMs?

Where it concerns this solution all HW and SW are in support

#52 General - Reference Unknown Can you provide a complete list of all MF & SW assets that might come under this new solution? Specific configurations will not be shared as part of this RFI.

#53 General - Reference Unknown Has the J-9 developed a wireframe and operating model plan for the how the single control plane will be implemented and managed in production?

The Government is not able to respond to this question and would need a definition or clarification on what is meant by "wireframe and operating model".

#54 General - Reference Unknown Are any of the MF assets today in production leveraging modern capabilities such as onboard AI and Crypto technologies?

Specific configurations will not be shared as part of this RFI. We are interested in these technologies, where they make sense and offer value.

#55 General - Reference Unknown Do you have a pipeline for human resources for the tasks that your organization will be doing in the environment?

The Government is not able to determine the intent or reference to this question within the context of the RFI.

Vendors, in their response, should describe how they would approach the prototype technical requirements using their determined labor mix.