FSA Next Generation Cloud RFI.pdf

Request For Information (RFI) U.S. Department of Education (ED), Federal Student Aid (FSA)

NEXT GENERATION CLOUD (NGC)

Table of Contents

1. DISCLAIMER

2. DESCRIPTION

3. FSA’S NEED

4. COMPANY INFORMATION AND CAPABILITY STATEMENT

5. HOSTING ENVIRONMENT AND COMMON SHARED SERVICES CAPABILITY

6. VENDOR ONE-ON-ONE’S

7. RESPONSE GUIDELINES & FORMAT

1. DISCLAIMER

This is a Request for Information (RFI) to determine available sources and their capability to provide the product or service described below and for such other purpose as described below. This request for information does not constitute a solicitation and is not an indication that the Government will contract for any of the items and services discussed in this notice. Submission of a response to this RFI is entirely voluntary. The voluntary submissions of answers to this RFI shall not obligate FSA to pay or entitle the submitter of information to claim any direct or indirect costs, charges, or other compensation whatsoever.

For clarification, respondents are advised the Government will not pay for any information provided, the use of such information, the preparation of such information, travel expenses, nor any administrative costs incurred in response to this market research. All costs associated with responding to this market research will be solely at the interested parties’ expense.

Any information considered proprietary should be noted via appropriate markings. The Government will use such information only to inform and support any potential solicitation and contract or for such other purposes as described herein.

Not responding to this market research does not preclude participation in any future request for proposal (RFP) or request for quotation (RFQ), if any is issued. Were the Government to issue an RFP or RFQ for the acquisition of FSA NGC, any such solicitation may include, but not limited to, additional requirements for procurement of the required hosting environment, system installation, training, and on-site Interim Contractor Support. Respondents need not address any of these elements in their RFI submission.

This is market research, as defined in Federal Acquisition Regulation (FAR) Part 10. The Government does not intend to award a contract/order based on responses received from this market research effort.

Respondents are advised that the Government is under no obligation to provide feedback with respect to any information submitted.

2. DESCRIPTION

Federal Student Aid (FSA), an office of the U.S. Department of Education, is currently conducting market research as part of its effort to compete the Next Generation Data Center (NGDC) follow-on contract (or contracts) FSA Next Generation Cloud (NGC).

FSA requires an Enterprise scale contractual vehicle for a Managed Services Provider (MSP) who shall assume responsibility for, expand, optimize, modernize, operate, and continuously improve upon the FSA NGC Amazon Web Services (AWS) GOV Cloud environments. This is inclusive of the common shared services that will allow FSA to reduce complexity, increase security, eliminate duplication of effort, and increase FSA-wide adoption of cloud computing technologies. The MSP shall ensure that cloud, and infrastructure be brokered by automated, on-demand, self-service, templated designs, and services to the maximum extent possible, as is done in the commercial world.

Today, there are 28 Federal Information Security Modernization Act (FISMA) reportable applications, minor applications and system tools in a hybrid environment operated on-premises and cloud.

3. FSA’S NEED

In accordance with the Federal requirements, FSA must evolve cloud capabilities to support agility, resilience, and quality of mission applications. Additionally, the White House Executive Order on Improving the Nation’s Cybersecurity states that the United States Government (USG) must accelerate movement to secure cloud services to keep pace with today’s dynamic and increasingly sophisticated cyber threat environment. As such, FSA requires a standardized, secure, trusted, agile and resilient set of Cloud shared services for general-purpose business use.

The preponderance of FSA’s applications will migrate into FSA NGC, managed by the FSA Chief Information Officer (CIO). NGDC currently offers Government Owned Contractor Operated authorized and operational common shared services in Amazon Web Services (AWS) and a physical contractor owned and operated data center. Within the first year of award, all remaining on-premise applications, infrastructure, and tools will transition to cloud. In year two and three, the entire cloud environment must be optimized and modernized as a dedicated workstream using Cloud Native Design principles, to take advantage of the full benefits of commercial cloud, and the FSA NGC Environment and Common Shared Services.

For reference, the following enclosed documents are provided:

• Attachment 1: NGDC On-Premises and Cloud System Inventory.

• Attachment 2: Potential NGC Minimum Information Technology (IT) Contract

Requirements (MITCR).

• Attachment 3: FSA’s IT Standards Library.

FSA is still developing the acquisition strategy; therefore, requirements are still subject to change.

4. COMPANY INFORMATION AND CAPABILITY STATEMENT

Please provide the following information:

1. Company Name:

2. Unique Entity ID:

3. Address (Including Telephone Number and Email Address):

4. Points of Contact:

5. Size of business pursuant to North American Industry Classification System (NAICS) Codes:

NAICS Code NAICS Code Description Size Standard

518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

$40M

541511 Custom Computer Programming Services $34M 541512 Computer Systems Design Services $34M 541519 Other Computer Related Services $34M

Based on the above NAICS Codes, state whether your company is:

• Small Business

• Woman-Owned Small Business

• Economically Disadvantaged Women-Owned Small Business

• Small Disadvantaged Business

• 8(a)

• HUBZone

• Service-Disabled Veteran-Owned Small Business

6. Description of your company’s primary business product/service line.

7. Are your services available on the General Services Administration’s (GSA) Federal Supply

Schedule? If yes, provide the contract number(s) and corresponding NAICS Code(s).

8. Are your services available through any other Government contract vehicles? For example, National Aeronautics and Space Administration's Solutions for Enterprise-Wide Procurement (NASA SEWP) government-wide acquisition contract (GWAC), National Institutes of Health (NIH) GWACs, etc. If yes, provide the contract number(s) and corresponding NAICS Code(s).

9. Capability Statement

5. HOSTING ENVIRONMENT AND COMMON SHARED SERVICES CAPABILITY

FSA seeks industry feedback on the below targeted questions/topics related to a potential solicitation for a MSP who shall assume responsibility for, expand, optimize, modernize, operate, and continuously improve upon the FSA NGC AWS GOV Cloud environments.

1. Please describe your organization’s ability and approach to act as a Managed Services Provider (MSP) for the FSA NGC environment and common shared services, and leading change to reduce complexity, increase security, eliminate duplication of effort, and increase FSA wide adoption of cloud computing technologies.

2. Please provide detailed insight regarding how your organization would optimize and modernize existing environments in contract year two and three based on information provided. Please be descriptive in your organization’s response regarding vision, direction, and approach.

3. Please describe your organization’s ability to provide Enterprise Cloud Environment and Common Shared Services support as described for applications and services using Agile / DevSecOps principles. Please provide at least two examples, where possible, of your organization’s successful support of similar Cloud Environments and common shared services of this scope/scale, to include Digital Engineering Platforms as a Service within a Cloud Environment.

4. Please provide demonstrable examples of the processes and technical capabilities your company employs to enable Privileged Access Management (PAM) capabilities. Please provide two examples, where possible, of your organization’s modernized approach for continuous monitoring (24/7/365), and automations within the PAM space.

5. Please describe your organization’s experience and available industry practices to employ business relationship management services starting with customer onboarding and throughout the entire application lifecycle. Please provide at least two examples, where possible, of how your organization integrates financial information with technology strategies and decisions.

6. Please provide your organization’s specific experience with supporting detail in operating an Internal Revenue Service Publication 1075 (IRS 1075) integrated application environment that allowed for receiving native IRS Personal Identifiable Information (PII) data within your Authority to Operate (ATO) boundary.

7. Please describe how your organization can recruit, hire, and retain the necessary talent to meet the FSA NGC cloud mission which includes supporting Environments and Common Shared Services. Describe an optimal and minimal staffing plan, clearly identifying key/critical staff positions (with associated labor categories) to meet FSA NGC Environment and common shared services requirements unless your organization has another best practice approach.

8. Please detail any existing contracts (including the contract and/or order number) in which your company is currently a prime vendor that you believe would be relevant to this requirement. Information should include the following:

a) The tools, methods, and processes your organization uses to automate billing receipt and validation for a federal contract.

b) How do you provide transparent AWS billing to a federal agency, e.g., detailed cost breakdown by application, activity-based costing, forecasting and budgeting, reserved instances and savings plan considering federal acquisitions constraints, invoice transparency, cost optimization recommendations, customer support for billing inquiries, and access to a customer dashboard?

c) Information on building an automated workflow ordering catalogue.

9. Please describe what Service Level Agreements (SLA) your organization would suggest for

FSA NGC.

10. Please provide your approach in keeping FSA NGC environment 100% N-1 hardware and software compliant while engaging with FSA’s business technical and business leaders and the application support contractors.

11. Please provide at least two examples, where possible, of your organization’s successful support of similar Cloud Environments and common shared services of this scope/scale, to include Digital Engineering Platforms as a Service within a Cloud Environment.

12. FSA’s Cloud Vision is focused on achieving a modern automated technical infrastructure supporting container-based Applications – FSA currently has two container-based applications in production today. One is based on AWS Elastic Container Services (ECS) and the other is based on AWS Elastic Kubernetes Service (EKS). Each has a unique DevSecOps automation tool chain.

FSA is planning on standardizing container-based applications to use a common Kubernetes based platform. Critical to this vision is the establishment of a common DevSecOps automation tool chain standardizing Infrastructure as Code (IaC), Continuous Integration (CI) and Continuous Deployment (CD) across all container-based solutions. This tool chain will integrate the development and deployment of solutions from the developer desktop through production.

Please ensure your response focuses on the following areas:

(a) Please provide insight into how your organization provides modern DevSecOps fully automated tool chains integrating the development and deployment of solutions from the developer desktop through production. (IaC, CI, & CD).

(b) Please provide insight into how your organization’s IaC automations allows for new and existing projects to quickly and efficiently provision/scale support and production environments as needed.

(c) Please describe the tool chains you have experience with automating IaC, CI and CD.

(d) Please provide information on how your organization supports legacy (non-container) applications that use manual processes for provisioning and deployment of resources (for example traditional J2EE applications using products like WebSphere application server).

13. Security is a key cornerstone of the FSA NGC environment, please ensure your company’s response focuses on these areas:

a) Please provide at least two examples of your organization’s experience delivering cloud solutions that adhere to the principles of Zero Trust Architecture (Office of Management and Budget (OMB) 22-09, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207 and Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model 2.0 or newer). The response should include measures for granular identity and access management, micro-segmentation, least privilege access, and continuous monitoring and verification.

b) Please provide at least two examples of your organization’s experience designing, implementing, and operating log management and Security Information and Event Management (SIEM) solutions according to Executive Order (EO) 14028, related OMB Memo(s) and Binding Operational Directives (BODs). When addressing this request reference OMB Memorandum 21-31 and BOD 23-01. In the examples, please illustrate the ability of the solution(s) to collect and centralize logs from native and non-native cloud resources including Kubernetes’ nodes/clusters, applications, services for effective security monitoring and incident response, and an idea of the scale of these activities.

c) Please provide at least two examples of your organization’s experience implementing cloud solutions that align with the Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) Program and Binding Operational Directive BOD 23- 01 and the scale of your CDM projects.

d) Please provide at least two examples of your experience strategizing, implementing, and maintaining a strong Vulnerability Management process, including adherence to Binding Operational Directives 22-01 and 23-01. Please provide your organization’s experience with discovering, scanning, and assessing databases for vulnerability and compliance.

e) Please provide at least two examples of your organization’s experience implementing and operating an environment governed by strong Configuration and Change Management process.

f) Please provide at least two examples to demonstrate your experience deploying and operating endpoint detection and response solutions for cloud workloads, including capabilities for monitoring, detecting, and responding to advanced threats and security incidents.

g) Please provide at least two examples of your organization’s experience implementing and maintaining solutions compliant with NIST 800-53r5 controls, Security Technical Implementation Guides (STIG) and Center for Internet Security (CIS) benchmarks.

h) Please describe your organization’s experience in Incident Response NIST SP 800-61 rev2 and NIST Cybersecurity Framework 2.0.

i) Please provide at least two examples of your experience with Risk Management in the context of Federal Information Systems – NIST SP 800-37 rev.1 or newer.

j) Please provide a description of your experience implementing and maintaining solutions that meet IRS 1075 security requirements.

6. VENDOR ONE-ON-ONE’S

Depending on the responses received to this RFI, FSA may conduct vendor One-on-One Sessions, not to exceed four hours, with each interested vendor separately through a Microsoft Teams meeting. This will provide an opportunity to further discuss the vendors responses, capabilities, and lessons-learned for these types of services outlined in the RFI. Vendor One-on-One Sessions, if held, are anticipated to be held in June 2024 and July 2024.

7. RESPONSE GUIDELINES & FORMAT

Respondents are urged to respond to this RFI in accordance with the instructions provided below.

Responses must specifically address the questions/topics set forth in Section 4 and 5 of this RFI.

Respondents are encouraged to be as specific as possible in addressing each section of the RFI.

Feedback of a general or non-specific nature is less useful and may not be used in refining the acquisition strategy and impacting the content of a possible RFP/RFQ.

Your response must be submitted in Microsoft Word document. Page sizes will be 8.5” x 11.0” with 1” margins all around. Font will be Times New Roman with font no smaller than 12-point. The capability statement and any other items associated with the RFI response should not exceed a 5 MB email limit.

Respondents should identify their company name, address, telephone number, and point of contact (name, phone, e-mail) on the title page. The company name should appear clearly on every page of the submittal and proprietary information must be clearly marked. To the maximum extent possible, please provide non-proprietary information. Respondents are strongly urged to adhere to the page limitation as defined in the designated sections as well as to limit marketing material to provide more substantive information in their response. Respondents are urged to limit their responses to the following format and page limitations.

Section Content Page

Limitation I Company Information and Capability Statement 2

II Hosting Environment and Common Shared Services Capability Response 30

III Vendor Questions None

Please submit responses no later than 4:00 PM Eastern Time, Wednesday, May 29, 2024 via email to Keonna Smith-Gordon, Keonna.Smith-Gordon@ed.gov, and copy Michael Pigram, Michael.Pigram@ed.gov. Title e-mail responses in the subject line of the e-mail as follows: “RFI Response: FSA NGC – [Vendor Name]”. Thank you for your interest.

Attachments: Attachment 1: NGDC On-Premises and Cloud System Inventory.

Attachment 2: Potential NGC Minimum Information Technology (IT) Contract Requirements (MITCR).

Attachment 3: FSA’s IT Standards Library.

mailto:Keonna.Smith-Gordon@ed.gov mailto:Michael.Pigram@ed.gov