FDA-RFI-75F40125Q00052_Enterprise Application Programming Interface (API) Management Solutions.pdf

Request for Information (RFI) no. FDA-RFI-75F40125Q00052 Application Programing Interface (API) Enterprise Management Solutions

1. INTRODUCTION

The purpose of this request for information is to obtain technical and/or business information and input from the marketplace for project planning purposes regarding the availability of existing or potential solutions, pursuant to FAR Part 10 Market Research, to identify potential parties from the marketplace capable of providing API Enterprise Management Solutions.

This is a REQUEST FOR INFORMATION ONLY, not a Request for Quote (RFQ). The RFI does not commit the Government to award a contract now or in the future for any supply or services whatsoever. Furthermore, the FDA will not accept unsolicited proposals.

The Government is not responsible for any cost incurred by stakeholders in furnishing information. All costs (time/material/services) associated with responding to this RFI will be solely at the interested stakeholder's expense. Not responding to this RFI does not preclude participation in any future RFI, Vendor Day, or RFQ, if any are issued. Any information submitted by stakeholders to this RFI is strictly voluntary. All submissions will become Government property and will not be returned. The Government reserves the right to request clarifying remarks from RFI submissions. Proprietary, classified, confidential, or sensitive information should not be included in your response. The Federal Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

The FDA will use the results of the market research to determine if sources capable of satisfying the agency's requirements exist based on its response to the information requested in this notice.

The FDA does not intend to make a selection decision or award a contract on the basis of responses.

Acknowledgement of receipt of responses will not be made, nor will respondents be notified of the outcome of the FDA's review of the information received. Additionally, the FDA does not intend to hold discussions concerning this RFI with any interested parties. However, FDA reserves the right to contact vendors if additional information is required.

2. INTRODUCTION

2.1 The U.S. Food and Drug Administration (FDA) is seeking information from qualified vendors regarding enterprise API management solutions that can support our enterprise-wide API strategy. This RFI seeks to identify tools and services that can facilitate the licensing, management, and support of APIs, as well as assist in migrating our existing APIs to a standardized technology stack.

2.2 FDA seeks a solution that provides a robust set of capabilities for API publishing, securing, protecting, and governance of APIs across the organization through the analysis of FDA’s predominant needs and primary use cases listed in the following sections.

3. OBJECTIVES

1. Vendor Identification: Identify vendors offering comprehensive API management, licensing, and support solutions. Identify vendors that provide comprehensive enterprise API management solutions, including licensing, support, and documentation.

2. API Standardization and Migration: Gather information on migration strategies and technologies that standardize our existing APIs and to converge with the new enterprise API technology; all with minimum effort and cost.

3. Scalability and Security: Evaluate solutions for scalability, security, and seamless integration solutions.

4. Total Cost of Ownership (TCO): Analyze cost-effectiveness, advantages, and drawbacks of various solutions.

4. BACKGROUND

The approximately 27,000 federal and contractor staff at FDA are responsible for protecting the public health by assuring the safety, efficacy, and security of human and veterinary drugs, biological products, medical devices, our nation’s food supply, cosmetics, and products that emit radiation. Our national and global operations are also responsible for advancing the public health by helping to speed innovations that make medicines more effective, safer, affordable, and by helping the public get the accurate, science-based information they need to use medicines and foods that maintain and improve their health. Additionally, the FDA has responsibility for regulating the manufacturing, marketing, and distribution of tobacco products to protect the public health and to reduce tobacco use by minors.

Globalization and the explosion of digital information pertaining to regulated industries has challenged the FDA to manage and utilize its information to meet its regulatory and scientific mission more effectively.

The FDA manages a large volume of data across over 1,300 systems, challenging its current disjointed API licensing and purchasing approach. The FDA aims to implement a unified API management platform that streamlines licensing and enables easy scaling as requirements grow. FDA’s approach consists of strategic initiatives spanning three general areas: People, Process, and Technology. These initiatives are being tracked as part of an overall set of the Office of Information Management and Technology’s (OIMT) Strategic Plan Milestones and CIO Council Strategic Roadmap.

FDA is presently using MuleSoft, and several lesser quantities of API technologies scattered across the enterprise, with API tools employed and licensed differently across our nine Centers and multitude of underlying Offices. Currently, our purchasing approach towards license buys is scattered and disjointed within our Centers and their Offices; The FDA’s goal is a unified API management platform, consolidating licensing and simplifying expansion as needs evolve.

5. KEY INTEGRATION REQUIREMENTS

5.1 Integration Platform as a Service

• Multi-cloud architecture to support FDA application in AWS, Azure, On-Premise and Other Cloud Service Provider (CSP) based solutions

• Agency wide Management Portal/Solution

• Product Specific Integration support

• Database (Oracle, MySQL, MS SQL)

• Integration Patterns with major platforms.

o Microsoft – Azure, PowerBI, Office365 (Graph API) with ADFS OAUTH o Salesforce, o Appian, o ServiceNow o Ping Federate o Active Directory o Documentum o Email

• Supported protocols for REST, GRAPH, gRPC, and event Driven API’s

• Support mechanism for Governance, Operations, and Developer o Developer Portal o Administration Portal o API Gateway

5.2 Use Cases

Identify a common platform for the FDA systems and solutions that need to integrate services across multiple systems, applications, and data sources. Some use cases are:

• Process/Event Driven API’s (MQTT) – The ability to trigger based upon an event service and/or small data collection. Enable real-time, responsive interaction between applications, data and workflows.

• Data Service API (mySQL, MariaDB, Oracle, Postgress) – Database to REST, Graph, Event Driven API mechanisms

• Service Delivery API (Requirements driven logic to Route, Decide upon and access services with additional controls over and above the Base API technology) D&B, Office365, etc.

• Support of Internet stable technologies - REST, Graph API’s (Proxy based solutions)

• Real Time Data Integration – The ability to provide real-time data services to applications enabling mobile, client server, and microservice-based applications.

• Master Data Management Operations – Capabilities to enable data translation to support legacy application format requirements during modernization efforts.

• Advanced Multifactor Authentication Services – Capabilities to inject, modify and reinspect authentication and authorization services such as OAuth, OpenID, and other Multi-factor Authentication- (MFA) based systems.

• Orchestrated Processes – Abilities to connect disparate applications, both on-premises and in the cloud, enabling agencies to automate workflows, streamline processes, and improve operational efficiency.

• Legacy System Modernization - Help modernize legacy systems by exposing their functionality as APIs, allowing them to be integrated with newer, cloud-based applications and services.

6. INFORMATION REQUESTED

Interested vendors should provide information on the following:

1. Vendor Overview o Company background, market presence, partnerships, and analysis by research and advisory bodies.

2. Product Capabilities:

API gateway functions, developer and admin portals, analytics, security features (versioning, rate limiting, caching), and compliance with FDA’s multi-cloud and hybrid cloud strategy.

o Description of API management solutions, including features such as:

API gateway (Proxy/Reverse Proxy) Functionality Developer Tools and instrumentation Analytics and monitoring tools Security and authentication mechanisms supported Support for REST, SOAP, RPC, Event Driven (MQTT) and GraphQL

APIs o Detailed feature set (API versioning, rate limiting, caching).

o Integration capabilities with existing tools and platforms.

3. Licensing and Pricing Models o Cloud bases vs. On-Premises Licensing Model Information o Details on licensing options, pricing tiers and modeling structure.

o Options for scaling including custom pricing options based on usage and/or enterprise needs.

o Information on trial periods or demo access.

4. Migration Support o Strategies and tools offered for migrating existing APIs to the new platform, including:

Assessment tools for current API architecture.

Phased deployment & mitigation plans to minimize disruption.

5. Case Studies/References o Examples of similar federal or regulated industry implementations with performance metrics, challenges, and outcomes.

6. Support and Training Overview of training offerings, support tiers (e.g., 24/7, dedicated account management), and knowledge-sharing options (workshops, online courses, etc.).

7. Contracts o Procurement options, contracts, and vehicle options for Federal Government Acquisitions.

o MAS and other Schedules availability.

8. Future Roadmap o Insights into product development plans and upcoming features that may benefit our agency.

o Leading discussions on innovations (e.g., AI-driven API management) and community engagement.

9. Security and Compliance:

o Compliance with industry standards (e.g., GDPR, HIPAA, FISMA Moderation and/or High) and security measures in place.

o Overview of incident response plans for security breaches.

o Overview of incident response plans for security breaches, with a focus on compliance with NIST Special Publications, including (but not limited to) FIPS compliance, incident management, message authentication (SP 800-224), risk management (SP 800-221A), configuration management (SP 800-29R1), vulnerability disclosure guidelines (SP 800-216), general access control guidance for cloud systems (SP 800-210), and Zero Trust Architecture (SP 800-207A).

10. Performance Metrics o Capabilities for real-time monitoring, performance analytics, and logging features including logging integration with Splunk and other tools.

o Service Level Agreements (SLAs) for API utilization and Product performance focused on uptime and response times.

11. Feedback and Improvement o Mechanisms for collecting and implementing user feedback to improve the product.

12. Questions for FDA to Consider o Provide FDA with any issues or questions that it should consider if it moves forward with any next steps. FDA is particularly interested in the long-term implications of the solutions and the total cost of ownership for our agency.

7. SUBMISSION GUIDELINES

A SOLICITATION IS NOT CURRENTLY AVAILABLE. The Government is not obligated and will not pay for any information received from potential sources as a result of this RFI.

For any questions regarding this RFI, please note the question in the response, however FDA will not respond to any questions at this time. The purpose of providing questions, as identified in Section 7.12, is only for FDA to consider them in developing its requirement.

For purposes of the RFI, the capabilities statement shall not exceed 10 pages of text;

graphics, tables and diagrams do not count toward the page limit. The document(s) shall be prepared using Times New Roman 12-point font style for printing on 8.5 X 11-inch paper.

Each page shall identify the submitting respondent and page number. Page Margins shall be no less than 0.5” on all sides. A complete response to the RFI should include answers to all of the information requested. Please note that a respondent’s failure to provide a complete response to a the information requested in Section 7, will be interpreted to mean that it does not understand the what information is being requested and does not demonstrate the capability to provide services required. Responses should demonstrate capability, not merely affirm the respondent’s capability (i.e. the response must go beyond the statement that, “XYZ company can provide O&M support”).

Response Due Date/Time: 4:00 PM EST on Friday, December 20, 2024.

Email responses to: Noah Padilla, Noah.Padilla@fda.hhs.gov

Please include the RFI number FDA-RFI-75F40125Q00052 - Application Programing Interface (API) Enterprise Management Solutions in the subject line. No phone calls will be accepted for this notice.

mailto:Noah.Padilla@fda.hhs.gov