Enterprise Linux Virtualization App RFI.pdf

1019530075

SENSITIVE BUT UNCLASSIFIED

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITIONS (ITA)

REQUEST FOR INFORMATION (RFI) No. 1019530075 for

ENTERPRISE LINUX OPERATING SYSTEM AND VIRTUAL APPLICATION MANAGEMENT

PLATFORM

PART 1: REQUEST FOR INFORMATION BACKGROUND AND OBJECTIVES

1.1 PURPOSE

This Request for Information (RFI) is issued as market research to determine industry’s capabilities to provide an integrated suite of commercial‐off‐the‐shelf (COTS) software solutions to include an enterprise‐grade, Linux‐based operating system and robust application management platform able to effectively operate, automate, monitor, and manage virtual applications, data, memory and storage services which support numerous Department of State (State) missions and business processes.

Additional specific capability requirements are enumerated in Part 2 below.

The U.S. Government (USG) does not commit to award a contract on the basis of this RFI or reimburse any costs associated with the preparation of responses. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI that is marked “Proprietary” will be handled accordingly.

Responses to the RFI will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the USG to form a binding contract. Responses to this RFI will assist State in determining the potential level of interest, competition adequacy, and technical capabilities of commercial vendors to provide the required products and/or services. The USG does not guarantee any action beyond this RFI.

The result of this market research will contribute to determining the acquisition plan and the method of procurement. The anticipated North American Industry Classification System (NAICS) code assigned to this procurement is 541519 with associated small business size standards* and Product service code 7A21.

NAICS Codes NAICS Industry Description

Size standards in millions of dollars

Size standards in number of employees

541519 Other Computer Related Services

$34.0

541519 (Exception) Information Technology Value Added Resellers

1.2 BACKGROUND

State’s mission is to advance the interests of the American people, their safety, and economic prosperity by leading America’s foreign policy through diplomacy, advocacy, and assistance.

The mission of the Bureau of Diplomatic Technology (DT) is to rapidly and securely deliver, anytime and anywhere, the knowledge resources and Information Technology (IT) services needed to support the over 300 sites and 275 missions it services worldwide.

DT is seeking input from industry regarding their capability to provide market‐leading solutions capable of meeting the full breadth of functional requirements outlined in this RFI. State requires access to a platform that is compliant with current federal security requirements, is easy to use, flexible, scalable, customizable, and configurable to meet specific State requirements as further detailed below.

1.3 RFI OVERVIEW

As further detailed in Section 2, State is seeking to identify capable and interested partners able to provide the products and/or services required to meet the full range of functional capabilities outlined in this RFI. Viable partners shall have demonstrated experience deploying hardware solutions and delivering the ongoing support required to maintain, expand, and upgrade the solution over time for an organization of similar size, global scope, and mission complexity as State within the federal market. Information requested in this RFI includes the following categories:

Company Information (Section 1) ‐ Identification of interested vendors, socio‐economic status, and potential acquisition vehicles to inform State’s potential acquisition strategy options.

Capability Assessment Against Functional Requirements (Section 2) ‐ Description of vendor’s proposed technical solution and ability to fully meet all stated functional requirements.

Past Experience (Section 3) ‐ Past project example(s) demonstrating respondent’s experience implementing their proposed solutions in the federal environment to address the needs of an organization of similar size, global scope, and mission complexity to State.

1.4 SUBMISSION INSTRUCTIONS

All written responses should be submitted in Microsoft compatible formats (e.g., Word) or PDF.

Responses must use 12‐point font and 1‐inch margins, including all text, tables, and graphics.

Additional attachments such as data sheets providing additional technical details for proposed solutions may also be provided, if necessary, in addition to the page limits stated below.

General brochures or other marketing materials not directly relevant to the stated requirements are not requested and will not be considered as part of the response. Response page limit(s) by section are noted below.

Section 1 ‐ 1 page

Section 2 ‐ 15 pages

Section 3 ‐ 5 pages

Please submit all materials to John Warner at WarnerJ1@state.gov by Wednesday, February 5, 2025 at 12:00 PM EST.

UNDER NO CIRCUMSTANCES SHALL ANY RESPONDENT CONTACT ANY STATE PERSONNEL

REGARDING THIS NOTICE.

PART 2: REQUESTED INFORMATION

Respondents are asked to provide the information requested below in accordance with the instructions outlined in Section 1.4 above. Submissions not adhering to the submission instructions may be deemed non‐responsive and may receive no further consideration.

SECTION 1 ‐ COMPANY INFORMATION

Please provide the following details regarding your organization:

a) Company name.

b) Company’s point of contact (POC) name.

c) Company’s point of contact (POC) phone number.

d) Company’s point of contact (POC) email address.

e) Company’s URL/web address.

f) Company’s Cage Code.

g) Company’s UEI Number.

h) Company Federal socioeconomic classification(s), if any, based on North American Industry Classification (NAICS) Code that applies to the proposed solution.

i) List of GSA schedule, Government wide acquisition contracts (GWACs), or other federal IDIQs or contracts your company holds that are accessible by State and where the full proposed solution can be procured, including corresponding schedule number or GWAC number.

SECTION 2 ‐ FUNCTIONAL REQUIREMENTS ASSESSMENT

State’s functional requirements for the solution are outlined below. Respondents are asked to provide a structured response that meets the following format requirements:

a) Response shall be structured and annotated to clearly map the detailed description of the proposed solution’s capabilities to the numbered requirements captured in Sections 2.1 – Section 2.7 below. Responses that do not clearly map to the information stated in the listed requirements below or are otherwise unclear regarding where a particular requirement is addressed may be deemed non‐responsive and may not receive further consideration.

b) Response narrative content should provide sufficient details regarding the proposed solution’s specific technical capabilities to demonstrate that the solution is capable of fully satisfying each stated requirement. Responses that lack sufficient detail to explain how and to what extent the solution’s capabilities achieve the stated requirement or simply state the solution meets the requirement, may be deemed unresponsive and may not receive further consideration.

2.1 Mandatory Requirements

The following qualifications and capabilities are mandatory requirements for any potential solutions addressing the needs outlined in this notice. Respondents should assess these requirements carefully, as solutions unable to meet these requirements will not be considered as viable options by State and will not receive further consideration:

a. The solution must provide commercially proven, enterprise‐grade products (custom‐ built solutions are unacceptable) with demonstrated experience successfully deploying and operating in the Federal environment.

b. The solution must be Federal Information Processing Standard (FIPS) 140‐2/3 certified.

Please specify the extent to which the solution is FIPS 140‐2/3 certified.

c. The solution must support State cybersecurity objectives through vendor neutral automation of the systems patching process to comply with the CISA patching Mandate Binding Operational Directive 22‐01 CISA (BOD 22‐01) and Presidential Executive Order 14028 for Cybersecurity, Zero Trust and Secure Software Pipeline (White House EO 14028). Provide details regarding solution functionality focused on helping State meet these federal directives.

d. The solution original equipment manufacturer (OEM) must be an active leader and contributor to the open‐source initiative, helping drive progress and innovation in open‐ source software solutions. Provide details regarding the experience and contributions of the manufacturer of your proposed solution in leading innovation in open‐source software development.

e. The solution must offer a cloud computing platform that is able to support the full spectrum of Intelligence Community security levels by having obtained Department of Defense (DoD) Impact Level 6 (IL6) certification for storage and processing of classified information up to the top‐secret level.

f. The solution must comply with State’s Cybersecurity Supply Chain Risk Management (C‐ SCRM) policy.

o Please review Attachments A (C‐SCRM Attestation Form) & B (C‐SCRM Questionnaire) and note whether your company is able to provide the requested information and attestations for your proposed solution.

2.2 Enterprise Linux Operating System

State requires a commercially proven, enterprise‐grade Linux operating system to support a broad range of mission‐critical applications and workloads across State. Specific requirements that must be demonstrated are noted below.

a. The solution shall ensure stability, reliability, flexibility, and high‐performance across various on‐prem and cloud environments. Provide details on the solution’s features that enable high performance and reliability across demanding workloads.

b. The solution shall offer leading edge security capabilities across both cloud and on‐prem environments. Provide details on the solution’s security features and capabilities that differentiate it from alternative solutions.

c. The solution shall include robust tools for building, testing, and deploying/provisioning applications. Provide details on the solution’s available application management.

d. The solution shall offer automation tools for streamlining the provisioning of servers and applications while ensuring compliance with State policies and security standards.

Provide details on the solution’s capabilities in this area.

e. The solution shall offer management tools leveraging predictive analytics and other advanced techniques to identify potential vulnerabilities and inefficiencies before they affect system performance and provide automated remediation options to reduce system downtime and security risk.

f. The solution shall integrate an artificial intelligence and machine learning (AI/ML) framework to support State’s growing demand for running AI models and conducting complex data analytics in a secure environment. Please provide details on the solution’s ability to support current and future AI/ML use cases and workloads.

g. The solution shall be FIPS 140‐2/3 certified.

h. Please note whether the solution is compliant with Defense Information Systems Agency, Security Technical Implementation Guides (DISA STIGs).

2.3 Application Management and Containerization Platform

State requires a robust application management capability to support the development, deployment, and management of applications across on‐prem, cloud, and edge environments.

a. The solution shall support orchestrations of containerized workloads for application development and management.

b. The solution shall support cloud‐native application development and out‐of‐the‐box integration with robust tools to build, deploy, and scale applications. Provide details of the solution’s capabilities in this area and specific tool sets able to seamlessly integrate with the solution.

c. The solution shall support multi‐cluster management to optimize resources across locations and cloud providers. Provide details on the solution’s capabilities to manage scalability and security across multiple clusters.

d. The solution shall include robust security features to secure containers as part of the software development pipeline and employ automated security updates and compliance management tools to ensure applications and infrastructure remain secure throughout the software lifecycle. Provide details of the solution’s capabilities in this area.

e. The solution shall enable management of both virtual machines (VMs) and containers on the same platform, allowing legacy applications and containerized applications to run alongside each other. Provide details on the solution’s capabilities to colocalize VMs and containers on a single platform.

f. The solution shall support advanced workloads including AI/ML and data analytics.

Provide details on the solution’s capabilities in this area.

g. The solution shall support edge computing to enable extension of applications to remote or distributed locations while maintaining performance and security. Provide details of the solution’s capabilities in edge computing performance and security.

h. The solution shall offer managed service options with major cloud service providers (CSPs) facilitating deployment and management of Kubernetes clusters. Provide details of the solution’s managed service offerings.

i. The solution shall offer among its managed service options one or more offerings with FedRAMP High certification. Please elaborate on the solution’s ability to provide FedRAMP High managed service options.

j. The solution shall meet National Institute of Standards and Technology (NIST) definitions of Cloud Computing as published in NIST Special Publication 800‐145.

2.4 Automation Platform

State requires an enterprise‐grade solution for automating IT processes across diverse environments, including hybrid cloud, on‐premises infrastructure, and edge computing.

a. The solution shall enable a range of automation tasks across State’s infrastructure including, but not limited to, software installation and management, provisioning infrastructure, patching systems, orchestrating complex workflows, and managing security and compliance. Please provide details on the solution’s depth and breadth of automation capabilities.

b. The solution shall include management tools to define, schedule, and centrally monitor automation tasks.

c. The solution shall support scaling of automation across distributed sites or edge environments while maintaining control and visibility over the entire infrastructure.

Provide details on the solution’s capabilities in this area.

d. The solution shall support creation of event‐driven automation workflows responsive to changes in State’s IT environments. Provide details on the solution’s capabilities in this area.

e. The solution shall provide real‐time analytics and dashboards to help teams monitor and optimize automation processes to proactively identify areas for improvement and continuous optimization. Provide details on the solution’s capabilities in this area.

f. The solution shall maximize flexibility and compatibility by being device and system agnostic and streamline ongoing installation and management tasks through use of an agentless platform.

g. The solution shall integrate with an extensive range of cloud providers, network systems, and security services to maximize versatility in managing IT infrastructure in any environment. Provide details on the solution’s breadth of compatibility in these areas.

h. The solution shall provide real‐time analytics and dashboarding capability to allow teams to actively monitor and optimize their automation processes. Provide details regarding the solution’s capabilities in this area.

2.5 Reliability and Availability

a. The solution shall ensure high availability and minimal downtime with features such as clustering, replication, and automated failover to ensure that critical systems always remain operational.

b. The solution shall be able to support active backups and recovery with minimal to no data loss by committing to rapid recovery time agreements (e.g., committing to a service level agreement with State for recovery time and recovery point objectives).

c. The solution shall implement disaster recovery solutions to ensure data integrity and availability in the event of system failures or disasters, including regular backups and failover mechanisms.

d. The solution shall ensure 99.999% up time.

2.6 Integration and Interoperability

a. The solution shall ensure compatibility with existing systems and software platforms used across State’s global enterprise to enable seamless integration and data exchange.

b. The solution shall facilitate secure and efficient data exchange with other federal agencies, internal departments, and external stakeholders to support collaborative efforts and information sharing.

2.7 Maintenance and Support

a. The solution shall include access to vendor support for ongoing maintenance, updates, and troubleshooting to ensure that issues can be resolved promptly and effectively.

b. The solution shall provide tools for centralized management, tracking, ordering, renewing, and accounting for licenses and services for streamlining administrative processes and reducing overhead.

c. The solution shall provide (or support) active monitoring and alerts for usage, storage, and additional attributes that could cause database performance or availability issues.

d. The solution shall have capabilities that allow for automation of maintenance functions to drive potential cost savings on regular operations and maintenance costs.

SECTION 3 ‐ PAST PERFORMANCE

State is seeking a solution that has a proven track record in the USG with demonstrated experience supporting U.S. agencies of similar size, global scope, and mission complexity as State. Such experience is critical to ensuring the solution has been proven to be secure and reliable under the required IT security, data management, privacy, and other federal regulations that IT implementations within the USG environment.

Please provide the following information regarding your experience deploying your solution for USG customers.

a. Please list all U.S. federal agencies where you have successfully deployed your solution in the last five years. For each experience noted, in no more than one paragraph, please provide:

i. U.S. agency and organization name.

ii. Period of performance.

iii. Solutions provided to the U.S. agency.

iv. Point of contact name, email, and phone number State can contact regarding the project background.

b. For at least one, but not more than three, of the federal implementations provided in Section 3.1 above, please provide additional detailed information as requested below to further demonstrate your company’s relevant past experience(s):

i. Dollar value of contract (across full period of performance).

ii. Period of performance dates.

iii. Schedule, GWAC, or contract used for the requirement.

iv. State whether your company was a prime or subcontractor.

v. Customer point of contact (name, title, email, phone) that State may reach out to for more information.

vi. Description of the scope of the work your company performed and its relevance and applicability to demonstrating the solution’s ability to deliver the full set of capabilities outlined above in Section 2.

Disclaimer: This RFI notice is for information gathering purposes only as a means to identify interested and capable sources that can provide a solution that fully meets all requirements outlined in Part 2 of this notice. The information provided in this RFI is subject to change and is not binding on the USG. State has not made a commitment to procure any of the items/services discussed and release of this RFI shall not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought.

State will not publicly disclose proprietary information obtained as a result of this RFI. To the full extent that it is protected by law and regulations, information identified by a respondent as “Proprietary” or “Confidential” will be kept confidential. All submissions become USG property and will not be returned.