GREX Request for Information final draft 27 Feb 2026.pdf

Request for Information (RFI) Operations & Maintenance (O&M) & Modernization for GSA Real Estate Exchange (G-REX)

RFI Number: 47QACB26N0001 Issue Date: February 27, 2026 Response Due Date: Mar 13, 2026 at 2:00 PM EST Anticipated Solicitation Release: Targeting FY2027 (Q2)

Primary Point of Contact: Sharmel Lane, Contracting Officer Email: sharmel.lane@gsa.gov Phone: (202) 604-3980

Alternate Point of Contact: Kenya McPherson, Contract Specialist Email: kenya.mcpherson@gsa.gov Phone: (202) 716-4512

Disclaimer: This RFI is for planning and informational purposes only. It is not a Request for Proposal and does not commit the Government to any future acquisition. Responses become Government property and may be used to develop acquisition strategy. Use caution when including proprietary information.

1. EXECUTIVE SUMMARY

The General Services Administration (GSA) seeks industry input on capabilities for modernizing and maintaining the GSA Real Estate Exchange (G-REX), a mission-critical Appian-based platform supporting the Public Buildings Service (PBS) in delivering optimal real estate acquisitions to American taxpayers. Both Operations & Maintenance and modernization services are required, with vendors having the option to propose their preferred modernization approach from the available options.

2. G-REX PLATFORM OVERVIEW

2.1 Mission-Critical Role

G-REX serves as PBS's core leasing tool, supporting 1,400+ GSA and external users with electronic lease file management, milestone scheduling, policy guidance integration, and cross-business line communications.

mailto:kenya.mcpherson@gsa.gov

2.2 Current Technical Environment

Platform: Appian 25.3 (on-premise, not containerized, once database migrated system is cloud-ready) Database: MySQL 8.4 (requires migration recommendation for staying on MySQL, migrating to MariaDB or PostgreSQL whether on-premise or in cloud) Operating System: Red Hat Enterprise Linux 8 Environments: Three tier (Integration, Test, Production) Integrations: 12+ active system integrations (see Information exchange diagram section 7.1)

2.3 Current Challenges

● Limited scalability and upgrade path

● Manual deployment processes

● Increasing maintenance costs

● Database migration needed

Note: The infrastructure is not the responsibility of the vendor to create, build or maintain for on-premise deployments, you will need to collaborate with our internal technical team for those activities.

3. PROJECT OBJECTIVES

3.1 Primary Requirement: Operations & Maintenance

Mission-Critical Application Sustainment:

● Application Support: Application-level support ensures uninterrupted G-REX functionality for PBS's critical real estate acquisition and leasing operations across all federal business days, excluding federal holidays.

● Application Security and Compliance: Ongoing management of application layer security controls, FedRAMP compliance requirements, Section 508 accessibility, and federal security standards to support GSA's Ongoing Authority to Operate (OATO)

● Application Performance Monitoring: Proactive application health monitoring, performance tuning, and optimization to sustain efficient processing of high-volume lease transactions and user interactions within existing infrastructure

● Artificial Intelligence (AI): Demonstrate how AI technologies will be integrated and utilized across all aspects of the solution, including application support, security monitoring, compliance automation, performance optimization, and service delivery enhancement, while maintaining federal security standards and compliance requirements.

Operations & Maintenance Services:

● Sustain efficient, secure O&M services for G-REX during and after modernization

● Maintain current functionality while enabling future platform capabilities

● Provide timely identification, tracking, and resolution of system defects and bugs with defined severity levels and response timeframes

● Reduce technical debt in line with overall application roadmap

● Provide system monitoring and incident response capabilities with defined response times

● Maintain comprehensive system documentation, including technical specifications, user guides and operational procedures

● Perform regular system backups, updates and patches in accordance with GSA security requirements

● Conduct periodic system health assessments and provide performance reporting

● Ensure seamless coordination with GSA IT teams and other system stakeholders

● Maintain disaster recovery and business continuity capabilities

Optional Enhancement Services:

● Adaptive Maintenance: Agile response to configuration, integration, and application changes (minimum two sprints per month)

● Feature Enhancements: Major functionality additions requiring high quality enterprise solutions aligned with GSA IT requirements and customer experience standards

● AI - Detail how AI capabilities will be incorporated into agile maintenance processes, change management, and feature enhancements to improve user experience and system capabilities.

3.2 Secondary Requirement: Platform Modernization

Migrate G-REX to a modern, scalable Appian environment. Vendors may respond to one, two, or all three modernization options based on their capabilities and recommended approach:

● Option 1: Appian Cloud

○ Infrastructure and Management: Detail hosting strategy, geographic distribution approach, and infrastructure management philosophy

○ Technical Architecture: Explain Kubernetes implementation strategy and container orchestration approach

○ Security and Resilience: Provide comprehensive backup and disaster recovery strategy with measurable objectives

○ AI Implementation: Describe how AI technologies will be implemented/leveraged within the kubernetes infrastructure management approach, including technical architecture for supporting AI workloads and services, and AI-powered security and resilience capabilities in the backup and disaster recovery framework

● Option 2: OnPremise Implementation

○ Application Deployment and Management: Detail approach for deploying and managing Appian applications on existing GSA Kubernetes infrastructure

○ Containerized Application Orchestration: Describe strategy and coordination with GSA infrastructure teams

○ AI Implementation: Explain how AI tools and services will be deployed and managed within the on-premise environment while coordinating with existing GSA infrastructure teams and polices

● Option 3: Single Tenant Commercial Cloud (Appian)

○ Infrastructure & Management: Detail provider rationale, geographic hosting, dedicated single-tenant architecture, operational strategy, monitoring, and incident response.

○ Federal Compliance: Demonstrate security authorization pathway, compliance framework for federal data, and provide a realistic timeline/methodology for authorization. All cloud software has to be FedRAMPed.

○ Technical Architecture & Delivery: Explain dedicated infrastructure/deployment, risk management/contingency planning, and service level commitments/performance metrics.

○ Additional Requirements: Explain application data protection and audit capabilities, coordinating with existing database/infrastructure teams.

○ AI Implementation: Describe how AI services and capabilities will be implemented, ensuring compliance with federal requirements and FedRAMP pathways for AI components, while detailing integration into technical architecture, delivery approach, data protection, audit capabilities and coordination with existing teams.

Scope Exclusions:

● Replatforming efforts beyond the Appian ecosystem

● Net new functionality unrelated to G-REX requirements

● AI Implementation: AI utilization must align with G-REX requirements and Appian ecosystem capabilities

4. TECHNICAL REQUIREMENTS

4.1 Security and Compliance (Mandatory)

● FedRAMP: If applicable

● FISMA: Full compliance with applicable requirements

● OATO: Maintain current GSA Ongoing Authority to Operate status

● Section 508: Accessibility compliance for all deliverables

● Data Residency: All data hosted exclusively in approved federal environments

4.2 Performance Requirements

● Support users with mission-critical uptime

● High volume transaction processing capability

● Integration with all existing GSA systems (12+ active integrations)(see Information exchange diagram section 7.1)

● Compliance with Geospatial Data Act (GDA) and Real Property Asset Data Standard

(RPADS)

4.3 Development Methodology

● The vendor shall utilize Agile delivery standards including:

● Crossfunctional teams with rapid iteration and regular testing

● Sprint velocity management through historical data analysis

● JIRAbased defect tracking and remediation (GSA licensed)

● CI/CD deployment strategies with automated testing and rollback capabilities

● Backlog management with story point estimation and value-based prioritization

5. RFI RESPONSE REQUIREMENTS

Submission Requirements Page Limit: 15 pages maximum (excluding appendices and resumes) Format: PDF with bookmarked sections for navigation Appendices: Certifications, past performance documentation, capability statements Submission Method: All RFI responses shall be submitted via email to the Contracting Officer, Sharmel Lane (Sharmel.lane@gsa.gov) and the Contract Specialist, Kenya McPherson (kenya.mcpherson@gsa.gov) mailto:Sharmel.lane@gsa.gov

Due Date: Mar 13, 2026 at 2:00 PM EST

Response Structure

Section A: Company Profile and Experience

● Corporate background, Appian Partnership Status, federal experience

● Minimum three (3) federal Appian O&M project references with contacts

● Real estate applications expertise and conflict of interest assessment

Section B: Technical Approach

● Detailed architecture and implementation approach for each modernization option

● Migration methodology with phasegate milestones and risk mitigation

● Integration strategy for existing 12+ system connections (see Information exchange diagram section 7.1)

● Agile development framework and team composition recommendations

Section C: Security and Compliance (See References 7.2)

● Federal authorization experience and personnel security clearance levels

● FedRAMP compliance approach (if applicable)

● Comprehensive security control implementation

Section D: Staffing and Service Delivery

● Key personnel resumes (Technical Lead, Security Officer, Project Manager)

● Team structure, scalability plan, and GSA staff enablement strategy

● Service Level Agreements with historical performance data

Section E: Pricing Information

● Base O&M Support (annual fullyloaded cost)

● Enhancement Services (hourly rates or project estimates)

● Modernization Options (total project cost and duration for each)

6. INDUSTRY QUESTIONNAIRE

6.1 Business Capabilities (Questions 1-10)

Corporate Profile:

1. Company Background: Provide year of incorporation, primary business focus, and total number of employees

2. Federal Market Presence: Describe your federal client base size and geographic distribution

3. Customer References: Provide three (3) current federal references for similar Appian O&M services, including:

● Agency name and project scope

● Contract value and duration

● Key contact information

● Lessons learned and success metrics

Appian Platform Expertise:

4. Partnership Status: Current Appian partnership level and certifications held

5. Experience Duration: Number of years your organization has provided Appian services

6. Federal Projects: Quantify federal Appian application experience (number of projects, total contract value)

7. Real Estate Applications: Specific experience with real estate management or leasing applications

8. Conflict Assessment: Identify any potential organizational conflicts of interest

Technical Capabilities:

9. Platform Versions: Experience with Appian versions 20.1 through current releases

10. Integration Experience: Demonstrate capability managing complex system integrations (10+ concurrent integrations)

6.2 Technical Approach (Questions 11-25)

Operations & Maintenance:

11. O&M Methodology: Describe your approach to sustaining missioncritical applications

12. Performance Monitoring: Detail your application monitoring and performance optimization strategies

13. Security Management: Outline your approach to maintaining security compliance and OATO status

14. Enhancement Process: Describe your agile methodology for adaptive maintenance and feature enhancements

15. Integration Management: Explain your strategy for managing 12+ active system integrations

Modernization Options:

16. Option Recommendation: Which modernization option(s) do you recommend and why?

17. Migration Strategy: Describe your approach to zerodowntime migration

18. Risk Mitigation: Identify key risks and your mitigation strategies

19. Timeline Estimates: Provide estimated duration for each modernization option

20. Database Strategy: Recommend approach for MySQL migration (MariaDB, or PostgreSQL)

Development and Delivery:

21. Agile Framework: Detail your Agile implementation approach

22. CI/CD Strategy: Describe your continuous integration and deployment methodology

23. Quality Assurance: Outline your testing and quality assurance processes

24. Documentation Standards: Describe your approach to technical documentation and knowledge transfer

25. Training Strategy: Detail your approach to GSA staff enablement and knowledge transfer

6.3 Staffing and Management (Questions 26-30)

26. Team Structure: Describe proposed team composition and roles

27. Key Personnel: Provide qualifications for Technical Lead, Security Officer, and Project Manager

28. Scalability Plan: How will you scale resources during peak periods?

29. GSA Collaboration: Describe your approach to working with GSA technical teams

30. Support Model: Detail your support coverage model and escalation procedures

6.4 Pricing and Contract Strategy (Questions 31-38)

31. Contract Vehicle: Preferred contract vehicle (GSA Schedules, GWACs, Open Market) with justification

32. Contract Type: Recommended contract type (FFP, T&M, Hybrid) with rationale

33. Small Business Strategy: Outline approach to small business participation and subcontracting

34. Base O&M: Provide annual ROM cost for ongoing operations and maintenance

35. Enhancement Services: Provide hourly rate structure or typical project cost estimates

36. Modernization Options: Provide ROM costs and timeline for each modernization option you would propose

37. Cost Optimization: Describe strategies for reducing long-term operational costs

38. Payment Structure: Recommend payment milestones and performance incentives

7. Additional Information

7.1 Information Exchange Diagram

7.2 Resources

Maintaining compliance with security configuration management (CM) controls is crucial for both government cloud and on-premise software solutions. This involves establishing and adhering to strict baselines for system configurations, regularly monitoring for deviations, and promptly remediating any identified vulnerabilities. By implementing robust CM processes, organizations can ensure a consistent security posture, mitigate risks associated with misconfigurations, and meet regulatory requirements, regardless of the deployment environment.

7.2.1 Office of the Chief Information Security Officer (OCISO) Tool Directory

AWS Required Tools

Virtual Machine/ EC2 Required Tools

ECS Required Tools

EKS Required Tools

ECR Required Tools

Application Security Required Tools

Others (Not Required, but offered)

7.2.2 FedRAMP Marketplace Authorized list

https://marketplace.fedramp.gov/products?cache=true