AOI - NG SAP v3 13Feb25.pdf

Area of Interest (AOI) for Next Generation Special Access Programs (NG – SAP)

Note: Please advise the Agreements Officer as soon as possible via the email above if your organization intends to submit a Solution Brief to DISA in response to this AOI.

*Any submissions that are received by the Agreements Officer after the suspense date/time listed above will be deemed late and not evaluated. It is the sole responsibility of the company to ensure that its submission is received in the inbox listed above before the deadline specified.

This AOI may result in the Government awarding a prototype OT in accordance with 10 U.S.C. § 4022. This AOI, and any OT awarded from this AOI, is not subject to the Federal

Acquisition Regulations (FAR) or its supplements.

Project Number DISA-OTA-25-R-NGSAP

Commercial Solutions Opening Number HC108425S0001

AOI Title NG-SAP

Issued By Defense Information Systems Agency (DISA) | www.disa.mil Defense Information Technology Contracting Office (DITCO)

Submission Instructions To respond to this AOI, please refer to paragraph 4 of the AOI and the Commercial Solutions Opening, section 3.1, General Guidelines and section 3.2, Phase 1 Solution Briefs.

*Solution Briefs Due Date/Time (Suspense) 28 February 2025, 4:00 p.m., CST

Submit Solution Brief To

DITCO OTA Team:

disa.scott.ditco.mbx.ps84-other-transaction-authority@mail.mil Agreements Officer: Shaun Bright Agreements Specialist: Megan Roy http://www.disa.mil/ mailto:disa.scott.ditco.mbx.ps84-other-transaction-authority@mail.mil

1. BACKGROUND

Special Access Programs (SAPs) are a special designation of Department of Defense (DoD) programs established for a specific class of classified information that imposes safeguarding and access requirements that exceed those normally required for information at the same classification level. SAPs restrict access to sensitive military, intelligence, and national security data through advanced information technology (IT) and technical segmentation techniques, and stringent personnel security practices that limit access to SAP information to highly vetted staff with a “need to know.” SAPs exist across not only the DoD, but also within the Defense Industrial Base (DIB) and Intelligence Community (IC).

SAPs are dependent on common IT capabilities to enable staff “read-in” to a SAP to complete their job duties. These common IT needs include the ability to send and receive emails and files;

collaborate on documents, spreadsheets, and presentations; and make and receive highly secured voice and video calls. Additionally, some SAPs require the ability to directly interface with other SAPs, requiring rich connectivity between compartmentalized environments. However, due to the unique security considerations associated with SAPs, commercial solutions may not be suitable to meet the standards for SAPs and provide secure, common IT support.

Today, DoD lacks a single, enterprise, common operating environment for SAPs that can meet the unique compartmentalization, data tagging, availability/uptime, and data retention requirements to which SAPs are subject. Current SAP infrastructure is also prone to issues faced by aging infrastructures, compounded by the fact that updates, upgrades, and refreshes are far more complex in SAPs due to its highly secured nature and air-gapped environment. The DoD Chief Information Officer (CIO) SAP IT Office is leading an effort to establish a cloud-enabled enterprise SAP IT collaboration and desktop platform to address existing functionality gaps, modernize user capabilities, and enable SAP reform.

2. PROBLEM STATEMENT

DoD Components have historically purchased and managed IT assets for SAPs based on individual program needs. This has led to inconsistent capabilities; disjointed, disconnected, and fragmented IT infrastructure; a disadvantaged cyber workforce; and duplicated IT assets, configurations, and costs. As a result, the SAP community uses outdated, siloed desktop productivity and collaboration tools that do not maximize worker productivity and efficiency.

These legacy tools are not aligned with current Department and DoD CIO strategic thrusts, including SAP Enterprise Reform and the Fulcrum strategy, and do not capitalize on modern technologies and capabilities leveraging cloud technology and managed service provider (MSP) services. For example, the DoD CIO Fulcrum Strategy promotes the need to foster data driven automation, increase automation of records management, decrease the number of duplicative capabilities, and reduce delivery cycle timelines—all of which cannot be met by continuing to use the legacy SAP environments. In addition, the SAP community will not be compliant with the DoD Cloud Strategy, the DoD Zero Trust Strategy or the 2023 Data, Analytics and Artificial Intelligence Adoption Strategy without investing in wholesale changes to the IT operating environment. However, migrating to an enterprise, cloud-based, common operating environment, using a MSP support model, would align with these strategic goals.

To improve the security and collaboration capabilities of SAP IT, the SAP IT Office seeks to deploy a Next Generation SAP (NG SAP) that provides enhanced operability, secure SAP and Controlled Access Program (CAP) integration, voice/video/collaboration, and a compliant design that aligns with DoD CIO mandates, including zero trust–with the benefits of a MSP model. The purpose of this NG SAP prototype is to make common cloud services, including Virtual Desktop Infrastructure (VDI), Identity Credential and Access Management (ICAM), secure voice and video communication, file and print services, email services, and cross-domain exchange, available to SAPs, prototyping the “next generation” SAP environment. This enhances the efficiency and security of DoD operations, while incorporating a MSP model that allows the infrastructure to evolve and update at the speed of industry.

3. DESIRED SOLUTION ATTRIBUTES

A fully functional prototype must include the following unique or innovative capabilities, functions, and/or features:

a. Virtual Desktop Interface (VDI) Services. The solution must provide a scalable, cloud-based VDI solution enabling DoD users to access virtual desktops securely from anywhere. The solution must offer elastic, real-time scaling on demand.

b. Secure Voice and Video Services. The solution must provide integration with existing secure voice and video services for real-time communication among DoD users. The services must support secure conferencing, screen sharing, instant messaging, and the capability to record meetings and maintain logs for audit purposes.

c. File and Print Services. The solution must provide file and print functionality to support efficient document sharing and printing capabilities, using a managed services support model. It must ensure role-based access to shared files and leverage zero trust principles and secure print release functionality. The solution must integrate with existing DoD document management systems to facilitate seamless collaboration.

d. Email Services. The solution must provide a secure email system that includes advanced encryption and archiving capabilities, using a managed services support model. The email services must integrate seamlessly with other provided services, ensuring a consistent user experience. The solution must also implement data loss prevention (DLP) measures, phishing protection, and support for a variety of classification markings. Email retention policies must be configurable.

e. Identity, Credential, and Access Management (ICAM). The solution must implement ICAM, to include authentication, authorization, and auditing capabilities, to ensure secure access to DoD resources. The solution must integrate with existing DoD identity management systems and provide user activity monitoring and regular access reviews to enhance security.

f. Data Migration from Legacy Systems. The solution must provide services to migrate data from existing legacy systems to the new cloud-based infrastructure. The data migration must ensure data integrity and minimize downtime, and include a comprehensive migration plan, with data mapping, validation, testing, and rollback procedures to ensure a smooth transition.

g. Monitoring, Automation Orchestration, Cyber Security, and Protection Level 3 (PL3) Security.

The solution must provide comprehensive monitoring, automation orchestration, and cybersecurity solutions to ensure the security, availability, and efficiency of the cloud-based infrastructure. The solution must achieve a minimum of PL3 security compliance, which includes implementing advanced threat detection, automated response capabilities, and system hardening measures. The solution must provide detailed monitoring dashboards, automated workflows for incident response, and compliance auditing to meet DoD requirements.

h. Cross Domain Solution (CDS). The solution must provide a cross-domain capability that allows secure data transfer between different security domains, ensuring that classified information is appropriately protected while facilitating authorized data sharing. The CDS must provide automated filtering and sanitization of data to prevent unauthorized transfer of sensitive information. The solution must also provide auditing and reporting capabilities for all cross-domain transfers.

i. Additional Considerations and Universal Requirements. The solution must utilize the Department of Defense Information Network (DoDIN) for transport to the greatest extent possible, especially for edge connectivity scenarios. In addition, the solution must leverage Joint Enterprise License Agreements (JELA) to license assets used in the design to the maximum extent possible. The solution must encrypt all data in flight and at rest, while adhering to all applicable DoD and Federal policies including those listed in Appendix A. The solution must implement a zero-trust architecture, multi-layer security, provide seamless integration with existing DoD infrastructure, along with support for classified environments. The solution should support high availability, redundancy, and disaster recovery capabilities to minimize downtime, while including system logs (syslog) or equivalent feeds from applications, services, equipment, and security appliances. The solution must also support access to “network taps” or equivalent in key network segments to allow DoD security teams to audit, collect and analyze the data as needed. Additionally, the solution must be accompanied by a per user cost model that can help the government understand, communicate, and ultimately request sharing of costs associated with the development, operations, maintenance, and enhancement of system.

In all cases, the appropriate safeguards must be in place to protect classified information to include guidelines and policies outlined in:

• Committee on National Security Systems Instruction No. 1253 (CNSSI 1253), Security Categorization and Control Selection for National Security Systems

• The National Institute of Standards and Technology (NIST) Special Publication SP 800- 59, Guideline for Identifying an Information System as a National Security System

• The National Institute of Standards and Technology (NIST) Special Publication SP 800- 53, Security and Privacy Controls for Federal Information Systems and Organizations

• DoD CIO memorandum, Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services, 15 December 2014

• Cloud Computing Security Requirments Guide, FedRAMP Security Controls, Section 5.1.1.

• DoD Instruction 8510.01, DoD Risk Management Framework (RMF) for DoD Information Technology (IT)

• NIST SP 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

4. AWARDING INSTRUMENT

This AOI solicitation will be awarded in accordance with the Commercial Solutions Opening (CSO) procedures detailed within HC108425S0001 (DISA CSO), posted to SAM.gov on 8 January 2025. The CSO outlines the guidelines for submitting solution briefs, pitches, and proposals and how the Government will evaluate responses to this AOI. The CSO can be found at: https://sam.gov/opp/ab7f01c6d012442992cb1a80d698b2ea/view.

As identified in paragraph 3.2 of the CSO, the Affirmation of Business Status Certification and Intellectual Property Statement/Agreement/Disclosures are attached to this AOI.

5. SOLICITATION NOTES

In addition to the general guidelines included in the CSO, the following guidelines apply to this

AOI.

• The Government will give preference to submissions that demonstrate an innovative, existing, and reference-verifiable commercial ability to accomplish the desired solution attributes (a) through (i) listed above.

• If the Government does not receive any solution briefs that demonstrate an innovative, existing, and reference-verifiable commercial ability to accomplish the desired solution attributes (a) through (i) listed above, preference will be given to submissions demonstrating existing and recent products that can be adapted for the solicited purpose with the least amount of non-recurrent-engineering effort.

• Resellers and academic research proposals are not desired.

• The period of performance / schedule for any Solution Brief or proposal submitted under this

AOI should generally be no greater than 9-months.

https://sam.gov/opp/ab7f01c6d012442992cb1a80d698b2ea/view

6. NON-GOVERNMENT ADVISORS

As identified in section 9 of the CSO, non-government advisors may be used in the evaluation of Solution Briefs, Pitches, and during proposal development and negotiation. For this AOI, the Government anticipates using non-government advisors from the following contractors:

• Northern Technology Group (NTG)

• Snowcreek Consulting

• Red River

• GCyber

7. FOLLOW-ON PRODUCTION

Companies are advised that any prototype Other Transaction (OT) agreement awarded in response to this AOI may result in the award of a follow-on production contract or transaction without the use of further competitive procedures. The follow-on production contract or transaction will be available for use by one or more organizations in the Department of Defense and, as a result, the magnitude of the follow-on production contract or agreement could be significantly larger than that of the prototype OT. As such, any prototype OT will include the following statement relative to the potential for follow-on production: "In accordance with 10 U.S.C. 4022(f), and upon a determination that the prototype project for this transaction has been successfully completed, this competitively awarded prototype OT may result in the award of a follow-on production contract or transaction without the use of competitive procedures.”

APPENDIX A – STANDARDS, REFERENCES & POLICIES

1) FIPS PUB 199 - Standards for Security Categorization of Federal Information and Information Systems - February 2004.

2) DoDM 5205.07 Special Access Program (SAP) Security Manual, Volumes 1 – 4

3) DoD Instruction 8510.01 DoD Risk Management Framework (RMF) for DoD Information Technology (IT)

4) DoD Joint Special Access Program (SAP) Implementation Guide (JSIG)

5) DoD SAP Program Manager's Handbook to the JSIG and RMF

6) NIST SP 800-30 Guide for Conducting Risk Assessments

7) NIST SP 800-37 Risk Management Framework for Information Systems and Organizations:

A System Life Cycle Approach for Security and Privacy

8) NIST SP 800-39 Managing Information Security Risk: Organization, Mission, and Information System View

9) NIST SP 800-53 Security and Privacy Controls for Information Systems and Organizations

10) NIST SP 800-59 Guideline for Identifying an Information System as a National Security System

11) CNSSI 1253 Security Categorization and Control Selection for National Security Systems

12) CMMC Scoping Guide Level 3 – DODCIO