ENTERPRISE REMOTE ACCESSS (ERA)_RFI.pdf

UNCLASSIFIED

REQUEST FOR INFORMATION (RFI) / SOURCES SOUGHT (SS) NOTICE FOR

ENTERPRISE REMOTE ACCESSS (ERA)

(U) The Government is requesting information on Enterprise Remote Access (ERA).

(U) THIS IS A REQUEST FOR INFORMATION (RFI) AND NOT A SOLICITATION. This RFI is for planning purposes only and shall not be considered an invitation for bid, request for quotation, request for proposal, or as an obligation on the part of the Government to acquire any products or services. Your response to this RFI will be treated as information only and will follow a three-phase timeline (please see below timeline section). No entitlement to payment of direct or indirect cost or charges by the Government will arise because of contractor submission of responses to this announcement or the Government’s use of such information. This request does not constitute a request for proposals or the authority to enter negotiations to award a contract. No funds have been authorized, appropriated, or received for this effort. The information provided may be used by the

Government in developing an acquisition strategy, or performance work statements, or specifications. Interested parties are responsible for adequately marking proprietary or competition sensitive information contained in their responses. The Government is not required to award a contract based on this RFI or to otherwise pay for the information submitted in response to this RFI.

(U) By submitting information in response to this RFI, respondents consent to the release and dissemination of submitted information to any Government entity. As such, to the extent that any information submitted in response to this RFI is marked as, or construed to be proprietary or business-sensitive, respondents are hereby notified (a) of the potential that such information may be disclosed to third party (support contractor) and (b) that submission of information in response to this RFI constitutes consent to disclosure of submitted information. The Government expects to have third party support during its review of RFI responses. Industry Partners (IP) who require a

Non-Disclosure Agreement (NDA) arrangement shall coordinate with and submit its corporate NDA to the POC listed below, specifically referencing this RFI's number and title in the NDA’s scope.

The completed NDA will be promptly returned to the IP.

POC: Casey Nau

Email: casey.nau@gsa.gov

(U) NO phone calls and/or requests for a Solicitation will be accepted or acknowledged. Company

Brochures are NOT desired.

(U) Technical questions regarding this RFI should be directed to Renee Grace (renee.grace@gsa.gov) and Casey Nau (casey.nau@gsa.gov) no later than (NLT) 11:00 a.m.

ET on February 12, 2024. Phone calls will not be accepted.

(U) The Government requests responses to this RFI to be submitted NLT February 20, 2024, at

3:00 PM ET. All interested parties should submit in writing (no more than 20 pages, single-spaced) their capabilities, experience, and familiarity with providing the services stated below.

Responses to identified capabilities should be clearly marked within the response with the ability to meet threshold and/or objective requirements clearly identified within the response. A response of ‘no’ or ‘not provided’ with the given architecture is an appropriate answer. The complete response to this RFI is limited to a total of 20 pages. The Government is not seeking marketing materials in response to the RFI. The responses should be in Adobe Acrobat Portable Document Format (PDF) or in a format compatible with Microsoft Office. Please submit your responses via email to Renee Grace (renee.grace@gsa.gov) and Casey Nau (casey.nau@gsa.gov) NLT 3:00 PM ET on

February 20, 2024. Phone calls will not be accepted.

SCOPE:

(U) This request is for information only regarding Enterprise Remote Access tools which support dynamic and secure means to access domains in a multi-classification Department of Defense (DoD) network architecture following the DoD Zero Trust (ZT) paradigm. The capabilities have been grouped into eight components that support: IT architecture, infrastructure, security, compliance, software tools, storage, usability, and training. Failure to identify a capability in one category will not be identified as a failure in another category. Collaboration may be possible between Industry partners to provide an integrated solution for Enterprise Remote Access which meets DoD governing policies and desired functionality.

(U) The Government understands that for listed capabilities, there may be no product that can deliver the listed capability. While there are eight components (Tables 1 – 3) to this RFI, a response with answers for the component is also appropriate since this is a development effort and collaboration on different capabilities may be possible, for example, one response identifies viable solutions to maintain existing capabilities, while another response identifies viable solutions to enhance ERA for the IT architecture. The Government is requesting that responders address on-premises, hybrid, or cloud service solutions regardless of respective section being considered. The listed objectives and thresholds serve to validate the ultimate ERA requirements.

PURPOSE:

(U) The Government is requesting information on ERA to identify solutions to improve warfighter capabilities in support of Special Operations Forces (SOF). This effort will improve IT architecture across the enterprise, to include enhancing capabilities to remotely access required networks to support command and control, telework functions, and maintain a collaborative environment across geographically dispersed forces. The Government is requesting that responders address on-premises, hybrid, or cloud service solutions regardless of respective section being considered. The listed objectives and thresholds serve to validate the ultimate ERA requirements.

(U) The ERA solutions for the IT architecture should allow end-users to access classified networks remotely which requires specific security protocols, hardware, software, and policies to implement this capability. ERA solutions should enhance and ensure end-users with reliable access to classified networks remotely. Solutions must enhance and develop a flexible network architecture (hardware and software) with sufficient bandwidth, secure encryption protocols, collaboration tools, network monitoring, training needs, and IT architecture maintenance. Additionally, the solutions must integrate the Zero Trust model into its IT infrastructure to enhance security controls for remote access to classified networks.

TIMELINE:

(U) Phase 0 – Request for Information: ERA RFI submitted to Industry January 17, 2024.

(U) Phase 1 – RFI Responses: Industry Partners with technology capabilities that potentially meet the areas of interest are encouraged to submit RFI responses NLT February 20, 2024. Note: The Government will respond to questions about the RFI that are provided to the Contracting Officer NLT February 12, 2024. All correspondence (questions and answers) will be by email to the Contracting Officer.

(U) Phase 2 – Immediate Post RFI Actions: RFI responses that were reviewed and determined to have the highest potential to satisfy the technology requirements for ERA may be contacted for additional information requests. For technology that did not meet the potential to satisfy technology requirements, industry partners will be notified by email with additional detail.

(U) Phase 3 – Follow-on Efforts: The Government will decide if testing or a potential future competitive acquisition is desired based on review of the RFI response.

Table 1: Enterprise Remote Access (Unclassified)

Enterprise Remote Access

Component Capability Attribute Performance Threshold Objective

IT Architecture

Availability &

Reliability

Service Level

Agreements (SLAs)

Require a vendor agnostic provider with experience hosting sensitive government applications.

Partner with professional services to understand

DoD strategies and challenges developing a one size meets all approach to the architecture.

Service providers adhere to agreed-upon SLAs, ensuring services are delivered as per the defined parameters.

T = O

System Availability

Tracks the time taken to retrieve requested data storage systems, ensuring quick access with minimal latency.

Shall maintain network connectivity.

Shall communicate to network services and establish remote services within 5 minutes.

Shall communicate to network services and establish remote services within 5 seconds.

Mean time between

Failures

Measures the time required to recover services after system failure.

Ability to restore communications.

Automatically responds to failure events and restores network within 30 seconds (autonomously).

Automatically responds to failure events and restores network within 15 seconds

(autonomously).

End Points with

Remote Access Network size.

Shall establish remote access for end points.

Shall support up to

1,200 users to access classified network concurrently remotely.

Shall support up to 3,000 nodes to access classified network concurrently remotely.

*Note: The Government objectives listed in the table above are for initial solution(s). The listed objectives and threshold will serve to validate solution(s).

Table 2: Enterprise Remote Access (Unclassified)

Infrastructure

Auto-scaling

Capabilities

Ability for the infrastructure to scale resources up or down based on demand.

Shall measure factors such as auto-scaling capabilities, resource provisioning speed, and workload performance during scaling events.

System resources

(storage, computer, bandwidth) are allocated based upon user role.

T=O

Resource

Provisioning Speed

Considers the entire portfolio of applications, aligning the systems / applications to migration goals and organization’s mission requirements.

Measures the percentage of server capacity being utilized in the infrastructure, ensuring optimal resource allocation.

Shall allow allocation and de-allocation of resources as per user demands.

T=O

Resiliency

Establishes comprehensive operations

/ infrastructure plan that considers growth, compliance with security, flexibility to scale supporting operations, and technological advancements.

Measures the infrastructure, ensuring efficient resource allocation and avoid unexpected resource shortages.

Shall provide graceful degradation of services while operating in denied, degraded, intermittent, and low-bandwidth (DDIL) environments.

T=O

Zero Trust

Comprehensive methods to maintain security at multiple levels for all endpoint connections.

Implementation of all requirements defined by

DoD CIO Zero Trust framework.

Shall implement DoD

CIO Zero Trust

Target requirements prior to FY2028.

T=O

Security and Compliance

Secure Connection

Enhances the security through authentication, digital signatures, and encryption for DoD information systems.

Leverages DoD standards for access to classified data.

Shall support Type-1 infrastructure or Commercial

Solutions for

Classified (CSfC).

T=O

Quantum Safe

Encryption

Leverages emerging encryption techniques.

End to end encryption / decryption of quantum safe algorithms.

System utilizes quantum-safe encryption by 2035.

System utilizes quantum-safe encryption by 2025.

Vulnerability Management

Monitor and manage the environments to maximize elasticity, performance, and security.

Monitor and assess performance, reliability, security, and compliance.

Shall use advanced security mechanism to mitigate cybersecurity threats to ports and protocols.

T=O

*Note: The Government objectives listed in the table above are for initial solution(s). The listed objectives and thresholds will serve to

Table 3: Enterprise Remote Access (Unclassified)

Policies and

Governing Documents (Governance and

Control)

Data Access and

Control

Ability to decide, with high confidence, who and what is allowed to access data and programs, and the ability to perform actions (such as erasing data or disconnecting a network) with high confidence that the actions have been taken and that no additional actions were taken.

Define processes for agility, rapid deployment, iterative improvements, and monitoring data across the enterprise architecture and strategy.

Shall monitor data control, including comprehensive performance, standardized configuration management, and customizable workflows across the enterprise.

Cross-domain functionality.

System Owners System Owners accountable for DoD

Security controls, policies/directives, and mandates.

Enables System Owners to migrate, organically mature and evolve continuously while maintaining performance objectives.

Shall leverage best practices for security, privacy, and auditing providing assurance that effective physical and logical security controls are in place.

T = O

Security Governance Applicable security policies.

Security policies relevant to remote network access.

Follows guidance outlined in NIST 800- 53, JSOC 380-1, and

JSOC SCG, as well as

J62 policy and guidance.

T = O

Software, Applications, and Collaboration Tools

Collaboration

Across Services

Defines necessary tools and services needed by end users to perform assigned duties.

Tools and services needed and desired to perform assigned duties.

Shall provide continuous access to email, chat, and file sharing.

Shall provide continuous access to full motion video, SVTC, SVOIP.

Data Storage and

Retrieval

Data Storage User data is stored and retrievable.

Ability for users to access profiles and files globally.

Data is accessible across 80% of the globe.

Data is accessible across

99% of the globe.

Performance Ability to store, send, and receive data across the enterprise.

System is capable of ensuring high availability and minimal downtime of data services.

Data access shall remain operational at least 90% of the time.

Server access should remain operational at least 99% of the time.

User Experience (UX) / User Interface (UI)

Self-service Capabilities

Self-service provisioning services to provide comprehensive performance, standardized configuration management, and customizable workflows.

Ability to access self-service capabilities to monitor performance and workflows.

Respond to user requests and gives the user the ability to escalate issues to system administrators.

T=O

User Satisfaction Assesses the overall user experience using the infrastructure.

Maintain user feedback to improve ease of use, self-service, and user satisfaction.

Ability to receive and respond to user feedback (reconcile issues) in a timely manner.

T=O

Training Training Program Training program implemented across the enterprise.

Training program tailored to roles.

Shall provide training resources across the enterprise including all roles pertaining to setup, operation, maintenance, sustainment, use, and modernization.

T=O

*Note: The Government objectives listed in the table above are for initial solution(s). The listed objectives and thresholds will serve to