Questions and Answers_ Enterprise Virtualization Rapid Integration Solution (EVRIS)_FINAL_7AUG2026.xlsx

Sheet1

post Industry Day (30JUL26) What are your imperatives for transitioning to HCI or containerized workloads? As vendors release containerized versions of their applications, having support for containers natively in the Hypervisor removes the need for deployment of additional software and management components.

There is no imperative for HCI, however, having vendors support HCI natively provides for a cohesive solution.

What is the planned integration environment for the full capability? Implementing multiple hypervisors to provide vendor diversification will require:

Support for existing tools used by the Army. e.g.

Veeam for backups Tenable Nessus and Elastic Defend for cyber security This prevents having to deploy another suite of tools in order to support a specific virtualization vendor.

The support for migrating virtual workloads (VMs) between hypervisors with minimum downtime is also key to integrating new virtualization providers.

The CSO addresses software licensing requirements extensively and spends less space asking about migration services and migration approach. Is the governments approach to request a licensing model as well as services for application migration timelines and approach and potentially containerization? The Government is requesting information pertaining to commerical offerings related to products, license models, hardware compatability link, migration, support, ability to migrate and rough orders of magnitude. Army requests respondent advise the Army what they can provide related to license models, types, quantities and environments.

The Government does not intend to offer multiple awards to vendors for software, support, migration; please review the ROM and CFS.

Help desk/ ITSM & ITAM (SAM/HAM) are within AESMP.

For a replacement solution, the proposed platform must natively integrate with the Army’s core enterprise architecture to achieve an Authority to Operate and fit within the cARMY enterprise cloud framework managed by the Enterprise Cloud Management Agency. Under the Army’s "right to integrate" and modern API initiatives, integrations are prioritized by operational necessity.

Mandatory at Submission (Phase 1) Phase 1 focuses entirely on security, identity, and core platform compliance to ensure the replacement infrastructure doesn't violate DoD Zero Trust or network security policies. Identity & Access Management: Solutions must immediately utilize Common Access Card / PKI token authentication and hook into the Army Identity, Credential, and Access Management solution for role-based access controls across NIPRNET and SIPRNET. Governance & Compliance, Enterprise Mission Assurance Support Service (eMASS): Proposals must provide a predefined Risk Management Framework package or inherit controls via eMASS. Systems must also demonstrate immediate automated compliance with DISA Security Technical Implementation Guides, vulnerability management, Assured Compliance Assessment Solution (ACAS). The hypervisor management layer must be immediately discoverable and scannable by the ACAS. The OEM solution will feed real-time alerts into the local Cyber Security Service Provider (CSSP) nodes to maintain continuous monitoring under DoD zero-trust boundaries.

- local storage

- software defined storage

- physical SAN Storage (FC, iSCSI, NFS)

- boot from SAN.

Inventory and environment examples will be provided in later phases so that Army may review solutions to include migration, products and pricing.

Please clarify the intended scope and basis of the Phase 1 ROM. Specifically: Call for Solution has been updated to only request the SKUs that will be used for Tiers that OEMs are proposing. Phase 1 is technology based; how can respondents satisfy the Army's stated needs with their capabilities, at what estimated cost (ROM). This will /may include license capabilities, overarching solution set, support, migration, etc.

Inventory and environment examples will be provided in later phases so that Army may review solutions to include migration, products and pricing.

Should the ROM include target-state virtualization, management, security, and related software licensing or subscriptions, including maintenance and support? Call for Solution has been updated to only request the SKUs that will be used for Tiers that OEMs are proposing. Phase 1 is technology based; how can respondents satisfy the Army's stated needs with their capabilities, at what estimated cost (ROM). This will /may include license capabilities, overarching solution set, support, migration, etc.

Inventory and environment examples will be provided in later phases so that Army may review solutions to include migration, products and pricing.

Should the ROM include migration labor and professional services, such as discovery, assessment, dependency mapping, architecture, wave planning, workload conversion, testing, cutover, validation, rollback support, RMF/ATO support, training, program management, and transition to Army operations? Call for Solution has been updated to only request the SKUs that will be used for Tiers that OEMs are proposing. Phase 1 is technology based; how can respondents satisfy the Army's stated needs with their capabilities, at what estimated cost (ROM). This will /may include license capabilities, overarching solution set, support, migration, etc.

Inventory and environment examples will be provided in later phases so that Army may review solutions to include migration, products and pricing.

Should the ROM separately include software licenses, subscriptions, or tooling used specifically to perform the migration, even when those tools will not remain part of the target production environment? Call for Solution has been updated to only request the SKUs that will be used for Tiers that OEMs are proposing. Phase 1 is technology based; how can respondents satisfy the Army's stated needs with their capabilities, at what estimated cost (ROM). This will /may include license capabilities, overarching solution set, support, migration, etc.

Inventory and environment examples will be provided in later phases so that Army may review solutions to include migration, products and pricing.

Should the ROM include target-environment hardware and infrastructure costs, including compute, storage, networking, hyperconverged infrastructure, graphics processing, or other equipment required to operate the proposed solution? Call for Solution has been updated to only request the SKUs that will be used for Tiers that OEMs are proposing. Phase 1 is technology based; how can respondents satisfy the Army's stated needs with their capabilities, at what estimated cost (ROM). This will /may include license capabilities, overarching solution set, support, migration, etc.

Inventory and environment examples will be provided in later phases so that Army may review solutions to include migration, products and pricing.

Should the ROM include post-migration operations and support services? If so, what period of performance and service levels should offerors assume? Call for Solution has been updated to only request the SKUs that will be used for Tiers that OEMs are proposing. Phase 1 is technology based; how can respondents satisfy the Army's stated needs with their capabilities, at what estimated cost (ROM). This will /may include license capabilities, overarching solution set, support, migration, etc.

Inventory and environment examples will be provided in later phases so that Army may review solutions to include migration, products and pricing.

If any of these elements are required, will the Government provide a common representative scenario and quantities for each Tier/AOI, including the number of hosts, cores, sockets, virtual machines, users, locations, security domains, storage capacity, migration waves, and support period? Alternatively, should offerors establish and clearly document their own assumptions and provide unit prices, representative configurations, migration unit rates, and volume-discount schedules rather than a single total program price? Yes. An example per tier to indicate common sizes will be provided within Phase 2 for unit. Pricing for units, solution, migration, unique or proprietary products or asset that would benefit the Army pricing.

Respondents should be able to articulate their assumptions more clearly during Phase 2.

Solutions presented to the Army, whether licenses, migration tools or services must be fully developed and approved for use. Solutions not yet developed or approved cannot be accepted.

OEMs are able to acquire back office support as required by their abilities to successfully support the Army.

If existing Army migration-tool licenses are available, should the ROM treat those as no-added-license-cost dependencies while separately identifying any required integration, implementation, or migration services? The OEM should document what migration tools are required either from their proprietary capability and tool set or existing Army toolset. Please note Army's existing license if known, or state unknown.

Solutions presented to the Army, whether licenses, migration tools or services must be fully developed and approved for use. Solutions not yet developed or approved cannot be accepted.

OEMs are able to acquire back office support as required by their abilities to successfully support the Army.

Eliminate of waste - Anti-Shelfware Guarantee replaces rigid product quantities with a Flexible Consumption Framework (FCF) governed by four core contractual protections:

License Sharing / Episodic Usage: The Army purchases fluid "capacity units" that can be dynamically reallocated across across the Army's requiring activities, multiple environments and classifications without conversion fees or contract modifications.

Zero-Cost Delayed Activation: Licensing billing only begins when workloads are actively deployed; dormant licenses awaiting hardware or network provisioning remain at $0 cost.

Periodic True-Up / True-Down: The Army will perform self-audits and review all available licensing information in order to allow the Army to "true-down" and return unused capacity back to the central enterprise pool or credit the balance sheet.

Modular Capability Unbundling: Software is unbundled so the Army only pays for the exact tier of capability a workload executes, preventing premium pricing for basic environments. Conversely, the Army may ask a vendor to create a specific gathering of products if required.

Inventory and environment examples will be provided in later phases so that Army may review solutions to include migration, products and pricing.

Is there a baseline environment or representative sizing scenario that all offerors should use when preparing their Phase 1 ROM? The CFS specifies tiers for solutions. Examples of sizes in these tiers are for guidance only. Further information will be discussed in follow on Phases (2 and 3):

Tier 2: 256 cores Tier 3: >5000 cores Tier 4: >10000 cores These numbers are for guidance only and do not limit the size of these tiers.

Tiers are defined by function not be size.

DISA STIG Support (MANDATORY EVIDENCE), vendors must provide existing, verified compliance at the time of submission. This requires automated Security Content Automation Protocol scan results or Assured Compliance Assessment Solution reports proving the hypervisor and management console can ingest and enforce current DISA STIGs, alongside a detailed line-by-line compliance matrix mapped to DoDI 8500.01 standards. If any non-compliant controls exist, a formal fallback strategy consisting of documented remediation steps or draft POA&M entries must be included.

IL5 (NIPR) and IL6 (SIPR) Suitability (PATHWAY ALLOWED), a documented pathway is acceptable provided it leverages an existing FedRAMP High P-ATO or DoD IL4 baseline authorization, as completely uncertified products are deemed too high-risk. Submissions must include System Security Plan boundary diagrams detailing the logical and physical isolation required to transition workloads between IL5 and IL6. Additionally, vendors must deliver a time-phased milestone schedule mapping the strategy and 3PAO testing timelines to achieve an Army cARMY or DISA continuous ATO (cATO).

Cross-Domain Compatibility (CAPABILITY PROOF + PATHWAY), submissions must show architectural proof of compatibility with existing Army and DISA cross-domain solutions (CDS). This requires interface and API documentation demonstrating that management interfaces, logging, and replication can natively communicate through a DISA-approved CDS without proprietary, un-encryptable protocols. Finally, an integration blueprint topology diagram must illustrate how data and management traffic safely transition across security boundaries in strict compliance with NSA Cross-Domain Strategy requirements.

Vendors providing additional solutions may included as part of the implementation of selected OEM solutions in future.

At this phase the evaluation is based on the completeness of the OEM's solution and it's ability to both migrate and operate workloads at the specified tier.

Rollback will be dependent on the environment being migrated and if it is brownfield or greenfield.

Coexistence may be necessary until the migration is completed successfully.

The ability to migrate an exisitng environment with a minimum of downtime is a KPI..

Unified Management Requirements: Is a single pane of glass mandatory across all awarded tiers? Can third-party management tools be used to satisfy unified management requirements? What operational functions must be centralized? Provisioning? Monitoring? Security? Compliance? Licensing? Are disconnected tactical environments expected to synchronize automatically once connectivity is restored? How often must management data replicate between disconnected environments and higher echelons? A single pane of glass is not mandatory across all tiers.

Third party tools may be used, however, if they are, costs of these tools must be included in the solution.

Functions can be centralized or decentralized depending on the mission requirement and connectivity of the system. Offline environments must be able to maintain all required services.

Automatic resynchronization of tactical environments will be bandwidth dependent and ability to manage synchronization should be controllable.

Replication of management data will be mission dependent.

Security & Accreditation: RMF / ATO: Are there existing ATO packages that can be leveraged? Is reciprocity acceptable from other DoD programs? Are provisional authorizations acceptable during transition? Existing ATO packages may be leveraged and reciprocity is acceptable.

Provisional authorizations are acceptable during transition.

Log retention requirements are defined by the STIGs appropriate to the environment where the solution is deployed.

Centralized logging is a requirement for all environments and tiers. For disconnected environments, the SIEM may be centralized but local to the environment.

- Training environments

- Exercise environments

- Admin systems (PAWS)

- Secure IL6 virtual desktop environments VDI Architecture: User Experience: What minimum latency thresholds are acceptable? Are GPU workloads expected? What CAD, GIS, simulation, and modeling applications require support? Latency must not adversely impact user functionality and requirements to meet user performance requirements should be specified by the vendor. GPU workloads are expected and the OEM solution should support them.

VDI Architecture: Tactical VDI: How many days of disconnected operation must be supported? Are local cached desktops acceptable? What synchronization requirements exist when connectivity returns? Edge/Tactical Operations? Operational requirements will dictate the time a VDI connection may be disconnected. OEMs should specifiy what the bandwidth requirements are for synchronization for their solution.

Edge/ Tactical Operations: DIL Operations: What is the expected worst-case network profile? Bandwidth? Latency? packet loss? Operational requirements will dictate the network available.

OEMs should specifiy the network requirements for operation of their solution.

Edge/ Tactical Operations: Autonomy: How long must edge environments operate disconnected? What services must continue operating when disconnected? What management functions must remain available at the edge? Operational requirements will dictate the the time an environment will be disconnected.

Services required to maintain the environment must continue to operate.

to request licensing/"purchase"? what does the process look like for customers