AFLCMC Response to Industry Questions Final.xlsx
XLSX spreadsheet 24 KB Posted
- Attached to
- Project Night Owl: Managed Service Provider under AFLCMC Data Operations Commercial Solutions Opening
- Solicitation number
- FA8600-23-S-C056-004
- Issued by
-
Department of the Air Force
About this file
This document is a Commercial Solutions Opening (CSO) solicitation from the Department of the Air Force (DAF) Air Force Life Cycle Management Center (AFLCMC) for a Managed Service Provider (MSP) to support a highly classified SAP Weapon System. The MSP must be a Microsoft Solutions Partner for Infrastructure and "Digital and App Innovation" with extensive Azure expertise.
Key details include:
- This is a two-step CSO with white papers due by July 26, 2024 and proposal invitations sent after evaluation. Anticipated award in Sept/Oct 2024.
- The MSP will provide operations, sustainment, and user support across three sites, with an initial 200 users scaling to 350 users by year 3. Services include fielding operations, network/security operations, and help desk.
- Vendors must have the required security clearances to operate in IL5, IL6, and IL6+ environments. Pricing should avoid annual licensing fees.
- AFLCMC has an aspirational 15-25% small business participation goal. Evaluation criteria focus on security, Azure expertise, relevant experience, pricing, and technical capabilities.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 1. MSP_Requirements_Night Owl FINAL_Rev.docx | DOCX document | |
| 1. MSP_Requirements_Night Owl FINAL.docx | DOCX document | |
| Night Owl CSO Call FINAL POSTED.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Question Number | Question | Doc Ref (included by 1 company, can remove later) | Response |
| 1 | Summary of Requested Services- What kind of on premise presence are you envisioning for the MSP? A specific set of local resources every day 8-5? Or on-demand local assistance? | MSP support requested from 8-5 local on site with on-call available in specific situations | |
| 2 | Summary of Requested Services- Where do you see the line of demarcation between your CSP and MSP? Do you have a shared responsibility matrix defined? | CSP is providing SKU-based service items for our consumption. MSP is expected to configure and manage CSP services per the CSP defined service responsibility model. |
| 3 | Networks and Infrastructure- In one of your sub-bullets you mention “additional services outside the scope of Azure Stack Hub” and give examples of AD and security stacks. When you mention this, are you describing the facilitation of such services accessibility via network infrastructure configuration or expect the MSP to setup such services as part of the Network and Infrastructure delivery service? | Currently the expectation is the MSP to facilitate consumption of such services as part of the delivery, and work with CSP to fill in gaps in service coverage. The underlying infrastructure exists but requires MSP support to scale. | ||
| 4 | Networks and Infrastructure- It seems like you are bundling under infrastructure the notion of endpoint devices and their procurement, configuration, deployment, and troubleshooting. Is that an accurate assessment? | Yes | ||
| 5 | Networks and Infrastructure- Do you have an idea as to the requested/required SLA for disaster recovery that you mention? | We desire proposed SLAs in concert with CSP as part of a Disaster Recovery plan. | ||
| 6 | Help Desk/Support- What are the expected operating hours for local USG IT support? | Local USG support is available typically 0730-1600 local. Will be site-specific. | ||
| 7 | Help Desk/Support- Are you able to provide any existing helpdesk ticket metrics for the existing services? | No | ||
| 8 | Security/Compliance- You mention some examples of security stacks, would you be against a Microsoft native security stack like in use at some USAF sites? | No, we are not against that. | ||
| 9 | Security/Compliance- You mention that this is explicitly focused on networks and infra provided by MSP. Does this exclude CSP items? | MSP will be responsible for consuming what is provided by the CSP and ensuring that the overall service meets our security requirements. | ||
| 10 | Security/Compliance- What is your expected growth of workloads? | This will be clarified during Second Step. | ||
| 11 | Environment Deployment and Management- Can you provide examples of basic services needed to be rolled out by IAC for these particular workload environments? I suspect our team was just curious on the actual components that you would want deployed via IAC. A typical set of services would include networking, virtual machines, authentication, security stack, and other shared services. If there is a list of standard services that would be nice to understand. | Identity, Virtualization, Security Stack, Containerization, Project Management & Collaboration, Software Config/Version Control, Integrated Dev Environment, CI/CD Tools, Dependency Hosting, Vulnerability Management, Code Analysis, Software Repos, Observability | ||
| 12 | Environment Deployment and Management- Are these cloud environments to be primarily differentiated based on customer in a hub-spoke model? Or is this one environment with different applications to differing testing/classification levels? Or both? | Currently Hub-spoke, but the system architecture is intended to support both models. | ||
| 13 | Section 2.A. Para 2: The Government indicates that the existing environments include IL5 (CUI), IL6 (Secret), and IL6+ (Secret SAP). Within Section 2.B. Para 1, the Gov indicates prospective MSP should have extensive knowledge of Azure Secret and Top Secret. Is it expected that MSP should anticipate delivery within Azure Top Secret SAP as well? | Night Owl CSO Call FINAL POSTED | Yes | |
| 14 | Section 2.B. Para 2: The Government indicates the following: "Therefore, MSP will need to demonstrate ability to meet or exceed critical timeframes for hardware deployments, workstation (thin client and peripherals) procurement and installation, and onsite help desk support." Is this requirement separate from the existing responsibilities of the CSP highlighted in 2.A? | Night Owl CSO Call FINAL POSTED | The deployment requirement is separate but execution of deployment needs to be coordinated with CSP. | |
| 15 | Section 2.2.1: Please confirm that the CSP is responsible for all Azure Stack Hub (ASH) procurement and physical installations. | MSP_Requirements_Night Owl FINAL | Yes | |
| 16 | Section 2.1.1, Paragraph 2, Sub-bullet 5: Please confirm the quantity, if any, of existing workstation hardware at current sites. | MSP_Requirements_Night Owl FINAL | Based on the security posture of the AFLCMC program, AFLCMC will not reveal specific numbers of users, sites, etc. until Step 2 of this Call. Therefore, Step one vendors shall assume the GR&As provided are all new workstations. | |
| 17 | Section 2.3.1, Bullets 2-3: Please confirm whether "24 hours with escalation" means 24x7x365 support or if this refers to a requirement for escalation of phone and email requests to occur within 24 hours of initial submission. | MSP_Requirements_Night Owl FINAL | The latter: "requirement for escalation of phone and email requests to occur within 24 hours of initial submission" | |
| 18 | Section 2.4: Can the Government provide a more specific region for the "mid-west location"? | MSP_Requirements_Night Owl FINAL | AFLCMC will provide specific locations to Step 2 vendors. For the Step one proposal, AFLCMC desires vendors to identify and price a mid-west location for general pricing purposes. | |
| 19 | Section 2.4.2: Please confirm whether the Government requires a single ATO package for all system and edge locations or if individual ATO packages for each location are allowable, for simpler management. | MSP_Requirements_Night Owl FINAL | Assume multiple ATO packages for purpose of the proposal. | |
| 20 | Section 2.2.1: Will the services outlined as "outside scope of Azure Stack Hub" be centrally located and provide distributed services to multiple sites or will these services need to be duplicated at each site? | MSP_Requirements_Night Owl FINAL | Services are expected to be accessible/available at all sites. Vendor solution to ensuring availability is not prescribed. | |
| 21 | Section 2.3.1: Please confirm that the phone / email support can be provided from remote locations for all sites. This would be separate from the 9-5 onsite support. | MSP_Requirements_Night Owl FINAL | All phone and email support can be done remotely, but the remote facility would need to be secure | |
| 22 | Section 2.1: Is the expectation that each user for the three locations will have a separate and distinct work area consisting of a single workstation and designated peripheral equipment - i.e. 200 Users = 200 workstations and peripherals? | MSP_Requirements_Night Owl FINAL | For the Step 1 proposal, you may assume that one user = 1 work station and peripherals. During Step 2 proposals, AFLCMC will give specific requirements. | |
| 23 | Section 2.2.1: What entity is responsible for operations and maintenance of WAN equipment? | |||
| MSP_Requirements_Night Owl FINAL | The transport provider, CSP or other, is responsible for the WAN network devices. | |||
| 24 | Will the MSP be responsible for the Operations and Maintenance (O&M) of the hardware/software in the complete Cloud Edge solution provided by the CSP; e.g. additional server clusters, backup storage hardware, network devices? | MSP_Requirements_Night Owl FINAL | MSP is responsible for applying relevant maintenance patches/updates made available by the CSP. Issues with CSP hardware or services should follow a similar escalation path as done in commercial offerings. | |
| 25 | Section 2 - Will the MSP be responsible for the Operations and Maintenance (O&M) of the hyperscale Virtual Enclave (VE) hosted in CSP IL6 and IL6+ Air Gapped Cloud (AGC) environments? | MSP_Requirements_Night Owl FINAL | Yes | |
| 26 | Section 2.4 - Does the Authority to Operate boundary extend from the edge ASHs to the Virtual Enclaves hosted in CSP IL6 and IL6+ Air Gapped Cloud (AGC) environments? | MSP_Requirements_Night Owl FINAL | No, assume multiple ATO packages for purpose of the proposal. | |
| 27 | Section 2.5 - Can monitoring of systems and infrastructure hosted on ASHs be extended to IL6 and IL6+ Azure Clouds with the intent to use Azure Monitor, Sentinel, and Log Analytics? | MSP_Requirements_Night Owl FINAL | Yes | |
| 28 | Section 2.2.3, Deliverables, #4: Please clarify whether the Government requires the MSP to provide a ticketing system solution or if the MSP will be using an existing ticketing system the Government already has in place. | MSP_Requirements_Night Owl FINAL | MSP to provide ticketing system | |
| 29 | Section 2.2.3, 2.4.2, 2.7.1 - The Government preference is to work with the 559th and to adapt and expand the existing solutions..* . Can you elaborate on existing solutions so that our technical solution may take the adaptation into account? | MSP_Requirements_Night Owl FINAL | More information provided in Step 2 | |
| 30 | Section 2.2.2 - Is there any test infrastructure for the MSP to inherit or to reuse? | MSP_Requirements_Night Owl FINAL | No | |
| 31 | Section 2.2.2 - Can the test infrastructure be hosted in an IL5 Cloud environment? Unclassified environment? | MSP_Requirements_Night Owl FINAL | Yes, a portion of the test infrastructure could be hosted in an IL5 environment. | |
| 32 | Are there existing Self-Service capabilities in the environments today? | MSP_Requirements_Night Owl FINAL | No, outside of CSP offered services | |
| 33 | Does the government have an expected milestone timeline for deliverables required for the MSP? | MSP_Requirements_Night Owl FINAL | Specific timelines and milestones will be provided in Step 2. For Step 1 proposals, MSP vendors shall assume services need to be delivered by 31 Dec of required year. | |
| 34 | Section 2.4.2 - Will the MSP "Active Cyber Defense" capability enhance/adapt the CSP’s CTOC capability or will the MSP's “Active Cyber Defense” create a comparable capability within the ASH environments? | MSP_Requirements_Night Owl FINAL | The former: enhance/adapt the CSP's capability | |
| 35 | Section 1.2.4 - Is the automated infrastructure already available for deployments between dev, testing, and production? (i.e., Pipeline) | MSP_Requirements_Night Owl FINAL | No | |
| 36 | Section 2.2.1 - Is the CSP responsible for providing Linux and Windows client/server images to be hosted on the ASH? | MSP_Requirements_Night Owl FINAL | Yes | |
| 37 | Will the Workload - Developers, Operators and End-Users have access to CSP IL6 and IL6+ Azure Air Gapped Cloud (AGC) solutions - e.g. Azure dashboards hosted in AGC. | MSP_Requirements_Night Owl FINAL | For purposes of Phase 1 proposals, yes. However, more specific requirements will be provided during Phase 2 proposals which will provide specific facility requirements | |
| 38 | Will the Government support vendors using remote employees in an unclassified environment to support classified deliverables; e.g. build low, deploy high. | Night Owl CSO Call FINAL POSTED | The USG will consider these types of solutions and whether they adequately meet security requirements. |
File details come from the government source that posted it. Updated .