m2P1_Draft_PWS_Questions__Answers_28_Jun_2016.pdf

Questions & Answers to Draft PWS for m2P1 published on 5/31/16

Reference Questions Government’s Response

23. General Question Due to the nature of the scope of this effort and level of technical expertise required, does the Government anticipate a Best Value award? Please clarify the evaluation criteria.

Best Value Trade Off will be utilized. Evaluation criteria will be outlined in the RFP

Package.

24. General Question Due to the level of effort associated with this effort, does the Government anticipate using a T&M contract type for transition and support services?

Please clarify the Government’s expectation for this work.

This will be outlined in the RFP Package.

Contractor will be asked to provide a firm fixed-price

(FFP) quote for each transition effort based upon the labor rates for transition support services established in the contract. Upon completion of negotiation which will include timeline, FFP task orders will be issued for this work.

31. Entire Document There is zero requirement or expectation of Government or Contractor responsibility associated with Consumer’s system accreditation validation, the PPSM DB validation, and the network access enablement to the DODIN. Can the government provide expected requirements associated with the various tasks on restriction and enablement based upon the various stages of a system’s accreditation (T&D Zones A,B,C,&D, IATT, ATO)?

Contractor will perform and update PPSM entries related to the vendor provided infrastructure, and will support that information for Consumer System accreditations. Consumers will create, enter and update

PPSM related to the consumer systems and their own accreditation.

71. General How many actual portals are required?

A management console for DISA, a self-service portal for consumer usage, other?

As many portals required to provide IaaS services. A single portal may offer more than one capability. Roles and related capabilities must be managed based on the individual role.

72. FedBizOpps

HC1028-16-R-0020

Change, 23 May

Is it the intent of the Government to host a site survey at DECC Montgomery after or before release of the final PRF?

Before.

73. General What type of contract does DISA plan on using, eg. cost, time and material, etc?

How is the Contractor reimbursed for infrastructure setup?

Is Contractor reimbursement based upon customer usage and billing?

Is Contractor reimbursement only limited by number of users?

Does the Government guarantee a minimal level of revenue?

Resulting contract will be

FFP.

Upon successful completion of milestones, contractor will receive guaranteed minimum payment which will partially offset infrastructure costs.

Remaining costs must be amortized into the proposed IaaS rates quoted.

Reimbursement is only limited by billings based upon actual usage and the contract ceiling.

No guarantee will be made of the revenue to be generated

96. General Will the DISA ITSM be covering Tier 1 help desk calls and routing to tickets related to cloud services to the m2P1 team?

The mission partners will call into the DISA Service Desk and will route tickets related to Infrastructure as a Service to the vendor.

125. Draft PWS document Is it incumbent upon the Prime contractor to fund the infrastructure costs up-front and then recoup the costs through the Mission Partners, as cloud services are deployed? Or is the

Contractor will fund the infrastructure costs up-front and then recoup the costs through billings to the mission partners.

Government going to fund all of the up-front infrastructure necessary to set up the service?

Reference answer to question #73 for more information.

126. Draft PWS document

Industry best practices align to providing both physical and virtual workloads in an IaaS environment.

Recommendation is to provide both physical and virtual in the same IaaS environment as part of the PWS.

This acquisition is focused on virtual workloads.

127. Draft PWS document Industry best practice, as well as what has currently been deployed within the Government, leverages multiple hypervisors. Recommendation is to add multi hypervisor support as a requirement to the PWS.

The number of hypervisors supported is up to the vendor to propose.

128. General How is the term Consumer used – is it an end User, a Customer (branch, division?), an IT team responsible for things in a specific organization, or a central IT management team that would manage services for one Customer/multiple Customers? Our goal is to understand what level of access/control is desired/required at what level.

A consumer is an individual or organization who consumes cloud computing services.

129. General Is every single point listed a hard requirement, or is the government willing to discuss points and identify a viable solution together? Is the contractor allowed flexibility on how it meets the requirements?

The evaluation factors will be outlined in the RFP.

Although contractors will be encouraged to propose unique technical approaches, minimum criteria outlined in the RFP will not be negotiable.

130. General How will the government determine the winning vendor? Will it be based on the lowest cost per user per month?

The evaluation factors will be outlined in the RFP.

Will it be broken out by region, service lines, etc?

145. General Have application owners for the 50 and 5,000 planned applications agreed to migrate to the cloud and/or to milCloud 2.0?

The application assessment is in progress for pilot applications to migrate to milCloud 2.0.

146. General What level of readiness assessment has been completed on the 50 and 5,000 planned applications?

The application assessment is in progress for pilot applications to migrate to milCloud 2.0.

147. General Can DISA estimate what the minimum order would be on the contract after the migration of the 5,000 planned applications?

This will depend on the size of each workload.

148. General What is the phase-out plan for milCloud 1.0 so that it does not affect the cost efficiencies and commercial viability of milCloud 2.0?

The intent is for milCloud 1.0 customers to be the first to migrate to milCloud 2.0.

149. General Will existing applications in milCloud

1.0 be mandated to move to milCloud 2.0?

The intent is for applications within milCloud 1.0 to eventually move into milCloud 2.0.

150. General If existing applications in milCloud 1.0 move to milCloud 2.0, will there be a mandated migration timeline?

The intent is for applications within milCloud 1.0 to eventually move into milCloud 2.0.

151. General If existing applications in milCloud 1.0 move to milCloud 2.0, who will be funding the migration?

Pre IOC, the vendor will capitalize the infrastructure and migration up to the first

50 workloads; and

Post IOC, if the mission partner chooses to exercise the transition support task order with the vendor then the mission partner will pay for the transition support service.

The Government is asking the vendor to capitalize the migration of the first 4 applications (up to 50 workloads).

152. General Can DISA indicate who will be funding the cloud assessment, cloud migration, ongoing monthly hosting, and Operations and Maintenance (O&M) fees for customers in milCloud 2.0 Phase I (e.g., will it be DISA, the individual mission owners, or a combination of both)?

The Government is asking the vendor to capitalize the migration of the first 4 applications (up to 50 workloads). Future workload migrations will be funded by mission partners.

153. General Will DISA describe its milCloud 2.0 program organization at the headquarters level and the two chosen DoD sites so that CSPs can understand their interaction with DISA personnel for milCloud 2.0 Phase I?

A DISA Cloud PMO has been stood up to interact and coordinate with the contractor post award.

Prior to award, all communication must be through the Contracting

Officer.

154. General Regarding DISA personnel interaction with CSP personnel, how many DISA personnel and what roles will be part of the DISA milCloud 2.0 environment and interacting with CSPs?

A DISA Cloud PMO has been stood up to interact and coordinate with the contractor post award.

155. General Will DISA establish a formal Program Management Office to manage milCloud 2.0 Phase I?

A DISA Cloud PMO has been stood up to interact and coordinate with the contractor post award.

156. General Will DISA act in a broker or Managed Service Provider (MSP) capacity for milCloud 2.0 Phase I?

Yes, DISA will be the Managed Service Provider.

157. General If DISA will be acting in a broker or Managed Service Provider (MSP) capacity for milCloud 2.0 Phase I, can DISA provide further details?

The importance of Phase I will be to identify the business processes and implement efficiencies with mission partner billings and payments.

158. General If DISA will be establishing a formal Program Management Office to manage milCloud 2.0 Phase I, can DISA provide further details?

A DISA Cloud PMO has been stood up to interact and coordinate with the contractor post award.

161. General Please describe whether DISA prefers to receive an on-premises DoD community cloud from a single DoD SRG-approved commercial CSP or from an “integrated solution” from multiple Original Equipment Manufacturers (OEMs) (e.g., systems integrator prime, hardware provider[s], software provider[s])?

DISA prefers to receive an on-premises DoD community cloud from a single DoD SRG-approved commercial contractor.

162. General Is there a DoD cloud mandate or other incentive for DoD mission owners to leverage the on-premises milCloud 2.0 environment over the life of the contract?

The intent is for applications within milCloud 1.0 to eventually move into milCloud 2.0. It is anticipated there will be a cutoff date when milCloud 1.0 will not be accepting new customers. If the objective of providing a lower-cost solution under m2P1 is achieved, mandates would not be necessary.

164. General What is the acquisition mechanism for mission owners to procure capacity through milCloud 2.0 Phase I?

The Government will provide lines of accounting (LOAs) for billing purposes on the task order and advise those authorized to place orders against the specific LOA.

Contractor will be required to monitor available funding and provide advanced notice when additional funds are required.

170. General (corrected per Alicia’s comments)

What types/sizes of databases (e.g.

relational [SQL], non-relational [NoSQL], data warehouse) will DISA require for the two identified DoD sites?

There are no specific database requirements.

188. General What capacities of crypto are available for DoD SRG Impact Level 6 traffic?

The vendor will have to meet all SIPR connection processes and approvals if the optional

CLIN is exercised.

189. General Can DISA provide its forecast for crypto capacity for DoD SRG Impact Level 6 traffic for the base and option periods?

The vendor will have to meet all SIPR connection processes and approvals if the optional

CLIN is exercised.

205. General What is DISAs contract celling value for milCloud 2.0 Phase I?

This will be outlined in the RFP Package.

206. General – previous

DISA RFI

#PL83220028 –

milCloud 2.0 Phase I, section 1.2, question 1.0

What was DISA’s rationale for not including the relevant experience requirements that were stated in the RFI (RFI PL83220028 – milCloud 2.0 Phase I, section 1.2, question 1.0) in the

PWS?

Other parameters were determined after additional market research.

207. General We recommend that DISA consider including relevant experience requirements (e.g., managing a certain number of concurrent workloads over a specific period of time; offering on-demand, automated, and self-service billing; providing hyper-scale services) as part of the RFP.

Evaluation factors outlined in the RFP will be used during the source selection process.

212. General Where does the milCloud 2.0 Phase I project fit in the prioritization of risk management authorizations and accreditations for DoD?

milCloud 2.0 Phase I will follow the same provisional authorization process as other cloud projects.

213. FedBizOpps announcement

Regarding the June 14, 2016, Montgomery, Alabama, site visit, what are the registration instructions and maximum number of allowed employees per company?

This was posted to FBO on 6/2/16.

214. FedBizOpps announcement

What is the timeline for a site visit for the Oklahoma City, Oklahoma, location?

A second site visit has not been scheduled. DECC

Montgomery is representative of typical DECC capabilities.

215. General We recommend that DISA include ISO 27017, which is the newest code of practice released by ISO and provides implementation guidance on information security controls that specifically relate to cloud services, as a contract requirement

DISA will follow the Cloud Computing SRG for information security controls of cloud services.

224. General Can DISA confirm that any published reference architectures produced under the contract would remain confidential information and not be subject to disclosure (e.g., Freedom of Information Act [FOIA])?

DISA will protect contractor confidential/proprietary information as required under the federal law.

248. FEDBIZOPS:

https://www.fbo.gov/i ndex?s=opportunity& mode=form&id=d604 b6e8f86c43fa744633f 7f9069959&tab=core &_cview=0

The Capital investment necessary to implement m2P1 Site 1 and Site 2 within 8-12 weeks after contract award necessitates a greater commitment on the part of the Government. Will DISA consider a minimum of 5 year base contract?

Anticipated contract period of performance will be a three year base with five 1-year options.

249. FEDBIZOPS:

https://www.fbo.gov/i ndex?s=opportunity& mode=form&id=d604 b6e8f86c43fa744633f 7f9069959&tab=core &_cview=0

Given DISA seeks “commercially developed” Private Cloud Services and makes reference to Commercial Cloud and Commercial investment over 11 times throughout the PWS. Will DISA consider FAR Part 12 Contracting Terms and Conditions so that Commercial Cloud companies may

This requirement has been determined to be a commercial product offering IAW FAR Part 12.

https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=3bbc81912d0af08d1187fd23ddf87f01&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=3bbc81912d0af08d1187fd23ddf87f01&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=3bbc81912d0af08d1187fd23ddf87f01&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=3bbc81912d0af08d1187fd23ddf87f01&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&id=d604b6e8f86c43fa744633f7f9069959&tab=core&_cview=0 seek to prime this requirement?

74. p. 3

Section 2

The contract title refers to “Phase 1”, how may phases does the Government anticipate and what is the desired end-state?

The total number of phases has not been finalized. Cloud strategy will be ever-evolving.

75. p. 3

Section 2

The contract title refers to version 2.0, what is the status of 1.0? If 2.0 is an expansion of 1.0 when will the 1.0 architecture be released? Is 2.0 independent of 1.0?

milCloud 1.0 is operational today. milCloud 2.0 is independent of 1.0, therefore, milCloud 2.0 is not dependent on the milCloud 1.0 architecture.

76. p. 3

Section 2

Is there an incumbent for milCloud 1.0?

M2P1 is not the recompete of an existing contract. There are multiple contracts associated with the provisioning of milCloud 1.0 along with services provided by Government employees.

32. Section3.

Background (paragraphs 4/5

The Govt references compliance with CC SRG Level 5 in paragraph 4 but in paragraph 5 the Govt states the system will directly connect to DODIN NIPRnet. Will CC SRG be followed to include the Govt furnishing and operating of an Internal Cloud Access Point (ICAP) or will this system not actually require registration as a Cloud Service Provider (CSP) Cloud Service Offering (CSO)?

IAW SRG Level 5 data, the boundary protection will be provided by the Government.

There will be protections in place to secure the connection to the DoDIN.

104. 3. Background. This DPWS states this procurement will be for private cloud only. Has DISA considered mission partner requirements for other cloud deployment models, to include private cloud, hybrid cloud, and community/public/government cloud (from commercial data centers)?

This requirement is for an on premise cloud to be used by

DoD mission partners.

250. Page 4, para 3. Since DISA will act as the Authorizing Official for the Commercial Private

A mutually agreed upon work

Background Cloud Services certification, and achieving DIARMF and DOD SRG IL 5 is listed as a pre-requisite for scaling the environment, how will DISA define the shared responsibilities in the certification process due to the facilities and network GFE? What penalties will be established for the Government and incentives for the Prime Contractor to ensure that the Certification process (DIARMF, DOD SRG, and possible future FedRAMP) is completed in an efficient and effective way?

breakdown strucutre (WBS) will be developed for this work outlining the roles and responsiblities of each party.

The incentive for the contractor will be to begin billing IaaS services. The governement cannot agree to accept penalties levied by a contractor.

33. Section 4 Item I The Govt states the objective will include operating up to 50 workloads successfully between both sites. Is there an expectation to be able run 50 workloads at a single site with COOP at the second site as well as expectation to run 50 workloads concurrently on both in a MAC I level of uptime?

Yes. MAC Levels will depend on the individual applications.

Requirements will be identified as part of the transition requirements.

77. p.4

Para. 4.i).

What is the Government’s definition of a workload?

Is a workload only IaaS or does it also include user desktops that provide access to required applications?

A workload is an instance of a virtual machine.

108. 4. Objectives Is there any baseline reference to demonstrate items (b): Improved performance and availability or (c) reduced total cost of ownership?

Not at this time.

251. Page 4, para 4.

Objectives “

This PWS describes milCloud 2 Phase 1 (m2P1) but in many cases suggests future phases that are NOT defined.

Request a comprehensive description of all intended phases, associated milestones, timeline, and acquisition strategy for those phases so prospective

Timeline and milestone deliverables will be provided in the PWS for Phase 1.

Additional phases of milCloud

2.0 will be assessed upon the success of phase 1.

commercial cloud service providers can properly assess the Total Addressable Market, level of effort and investment required to pursue and capture this opportunity.

Note: Each phase will be accomplished via independent and separate competitive acquisition(s) with acquisition strategies based on the needs of the Government at that time.

34. Section 5 Scope Object Storage

Can the government provide an interface specific expectations for Object Storage (e.g. HTTPS, SFTP)?

The Government is looking for existing CSP object storage capabilities

35. Section 5 Paragraph before the graphic

Govt states “Additional workload transition engineering support via portal”.

Is there a scope or maximum level of scalable support the Govt can provide (E.G. no more than 50 workloads to support transitioning at a given time)?

There is no minimum or maximum level of workload transition. Government cannot forecast workload transition.

78. p. 4

Section 5

Para. 1

The term “unit of service” is in quotes, what is the Government’s definition of a “unit of service”?

Any service offering

79. p. 5

Section 5

What are the sizes of the required VMs, ie. RAM, VCPU, Video RAM, and disk space?

What are the capacity requirements or limitations?

How is capacity expected to scale long term?

Is the licensing model covered by the customer or does the Government expect the contractor to include it into the cost model?

The Government is asking the vendors to propose the sizes of their VMs and how they will be priced. The pricing table included in the RFP will specify certain standard configurations. The contractor may propose additional configurations.

Estimated workloads are provided in the PWS. Uptake and scaling will be dependent on the value to the Government of the contractors offer. Client OS licensing for supported OS will be provided by the contractor.

80. p. 5

Para. 2

The draft PWS describes “contractor provided online ordering and provisioning” and requests for Service Level Agreements, is this independent of DISA Business Development Center’s effort to create on-line provisioning of DISA services via the merger of DISA Storefront and DISA Service Catalog?

The contractor provided portal will be independent of the DISA storefront and service catalog. However, links between the two may exist in the future.

109. 5. Scope Is there any workload expectation for SIPR (wrt subtask 1.2 optional

CLIN)?

There is a workload expectation for SIPR after a successful IOC and FOC.

110. 5. Scope Pg 5: is there an expected time period when the contractor is expected to provide an online ordering and provisioning system?

A part of IOC is testing out the entire billing and provisioning process.

142. Scope Will DISA’s approval be required in order for the contractor to “refresh the provided technology? Or is the contractor allowed to make upgrades and enhancements as it deems appropriate?

The contractor will be allowed to make upgrades and enhancements to their infrastructure. Updates must be documented in the accreditation documentation via the Change Request process.

143. Section 5.0 Scope Has DISA already identified the 50 and 5,000 planned applications?

The application assessment is in progress for applications to migrate to milCloud 2.0

144. Section 5.0 Scope If DISA has already identified the 50 and 5,000 planned applications, can DISA provide additional details on the nature of those applications?

The application selection process is in progress for the first 4 applications.

159. Section 5.0 Scope Will there be a Phase II of milCloud

2.0 (e.g., beyond the 5,000 FOC workloads)?

Yes, however the requirements for Phase II are not finalized at this time.

160. Section 5.0 Scope If there will be a Phase II of milCloud 2.0, what will be included (e.g., workload size and scale, build/adoption timelines, classification levels)?

Yes, however the requirements for Phase II are not finalized at this time.

163. Section 5.0 Scope How does DISA intend to procure milCloud 2.0 Phase I (e.g., through a task order on an existing contract, through a new cloud vehicle)?

A single award IDIQ.

165. Section 5.0 Scope (corrected version per Alicia’s email)

Are any of the 50 or 5,000 planned DISA applications also part of the

Army Private Cloud Enterprise (APCE) initiative?

Intent is to eventually move off of the current milCloud

1.0 solution and only have milCloud 2.0 as DISA’s on premises cloud solution.

167. Section 5.0 Scope What types/sizes of servers (e.g., general purpose, compute-optimized, memory-optimized, storage-optimized [high IO vs. dense], graphics processing-optimized, high memory) will DISA require for the two identified DoD sites?

No preference. DISA is looking for the contractor to describe this in their technical proposal.

172. Section 5.0 Scope Has DISA coordinated with utility power, water, space, and bandwidth providers to gain their assessment of realistic timelines to meet milCloud 2.0’s demands for operation?

Power, Space, and Bandwidth will be provided by the DoD data centers.

227. 5. Scope

(pg.4)

PWS states: “The anticipated contract will have fixed prices for each type of “unit of service” for the defined cloud infrastructure services in this PWS.”

Does the Government know what these "unit of services" will be, and will the government provide that information prior to RFP release? Or, will the offeror be asked to consult and provide input?

DISA is looking for the contractor to provide this in their proposal.

228. 5. Scope PWS states: “•Task Area 1:

Infrastructure Services Deployment and

Please reference the RFP.

(gp.6) Operations; • Task Area 2: Transition Services and Program Management Support“

The requirements have been divided into two focused task areas. Will the Government issue separate CLINs for each task area? Within these task areas will additional CLINs be issued for each infrastructure site location (two) and infrastructure services for both NIPR and SIPR network boundaries?

81. p.6

Task Area 1

Subtask 1.2

Will different equipment be required for SIPRNet accreditation?

There may be additional equipment required for a

SIPR connection. SIPRNet hardware must be physically separate from NIPR hardware.

97. 5. Scope; 6.1.2.5;

6.3.1.1

The PWS refers to “workload transition engineering services” and “methods to migrate workloads”.

Does the “workload” include the application and the data? When working with legacy Defense Systems/Applications, there is an assumption that there will be a need to prepare legacy data, as well as the application. Will data preparation be listed as a separate SME Infrastructure Engineering Service?

Application owners may need assistance with migrating the application and its data.

Legacy systems may need additional engineering support as well.

99. Figure 5.1: Overview of milCloud 2.0

What are the DISA value-added services referenced in this figure?

The Government value added services will be services only the Government can perform.

100. Figure 5.1: Overview of milCloud 2.0

Will DISA’s cost recovery rate/surcharge include the cost of the value-added services in this figure?

The DISA hosting rate is separate from the DISA value added services rates. The

Also, could you please confirm the rate – we understand it to be 7% for FY16 and FY17.

DISA hosting rate will be applied to the infrastructure invoice only.

101. Figure 5.1: Overview of milCloud 2.0

How will DISA apply their cost recovery rate/surcharge? Will it be applied to the price of the prime’s cloud offering? Or, will it be applied to the price of the prime’s cloud offering after the price of DISA value-added services has been added to the prime’s price?

Mission partners will pay DISA a rate and the contractor a rate. Value added services from DISA and the contractor will be an additional option for mission partners.

102. Figure 5.1: Overview of milCloud 2.0

Are DISA’s value-added services ones the prime could perform, perhaps at a reduced price to DISA’s mission partners (to help achieve the objective of reduced DoD TCO)? Are these services inherently governmental?

Some value added services will be inherently governmental.

103. 5. Scope. The Scope of this DPWS is for IaaS only. Do the mission partners have requirements for cloud service models beyond IaaS, i.e, PaaS and/or SaaS?

Mission partners may have a requirement for PaaS and

SaaS. This acquisition is for IaaS only.

122. 5.0 The DoD anticipates that infrastructure services will need to be capable of scaling from a small initial implementation of approximately 50 workloads at Initial Operational Capability (IOC) to a target state supporting approximately 5,000 workloads at Full Operational Capability (FOC), with the ability to scale beyond this target state if

Please provide Virtual Machine Sizing Requirements for the 50 IOC Workloads and the 5,000 FOC Workloads including: CPU, Memory and Disk Space requirements.

This information will be provided in the RFP.

supported by DoD consumer demand.

123. 5.0 The DoD anticipates that infrastructure services will need to be capable of scaling from a small initial implementation of approximately 50 workloads at Initial Operational Capability (IOC) to a target state supporting approximately 5,000 workloads at Full Operational Capability (FOC), with the ability to scale beyond this target state if supported by DoD consumer demand.

An initial deployment of 50 workloads does not prove scalability of any vendor’s solution. Recommend requiring and deploying 5,000 workload capacity so DISA can evaluate scalability of vendor’s solution. This eliminates all schedule risks associated with installation and implementation of infrastructure.

Evaluation factors will be used to award the contract.

There is a requirement in the PWS to provide a capacity management plan.

225. 5.0 Scope. “The selected m2P1 Contractor will use DoD data center floor space, in two locations for Phase 1, to offer their commercial cloud infrastructure services to the DoD Consumers.”

Can the contractor provide out of band administration support of the commercial cloud infrastructure remotely from non-government locations?

Yes, in accordance with the

SRG.

252. Page 4, para 5. Scope

Please define the term “Workloads” as it pertains to the “small initial implementation” to Full Operational Capability. Does workload equate to an Application, System of Applications, a Virtual Machine of various sizes, a Physical bare metal instance assigned to a single compute core, or some other measureable

A workload is an instance of a virtual machine.

capacity of IT infrastructure?

253. Page 4, para 5. Scope

Please define “DOD Community” and “Mission Partners” specifically; will this offering be used to host non-DOD applications and systems?

Any DoD sponsored workload. This offering will not be used to host non-DoD applications and systems.

254. Page 4, para 5. Scope

Commercial Cloud Services typically include more services and capabilities than are described here, how does DISA plan to add new “services” to the offering when required?

If the Government identified the need for more services, it will be handled through a contract modification IAW

FAR Part 43.

255. Page 5, para 5. Scope

Page 15, para 6.1.10.1

Please provide the SLAs and SLOs required for the various services described in this Draft PWS in order to develop a solution that meets the requirement for SLA compliant infrastructure.

Performance Standards are provided in the QASP.

1. Task 6.1 Task 1, Subtask 1.1

Infrastructure Workload and Data

Are there any data types not allowed-such as PII?

All data up to Impact Level 5 is allowed. See SRG Impact

Level 5 list.

36. 6.1 “Data provided by the contractor must be presented in a readable format”.

Can the Govt clarify whether this should be machine readable? And if so, must it be in a VM image format equivalent to imported image types stated in 6.1.2.6 of OVF, VMDK, VHD?

Machine readable is a viable option.

2. 6.1.1 Infrastructure Services

During assessment of the designated data centers, will DISA require they meet a specific Tier level equivalent to certain Uptime Institute standards?

Yes.

131. 6.1.1.1 Who manages the infrastructure in the DISA DECC facilities? What flexibility is there to meet the needs of

The Cloud PMO and onsite personnel will be available to coordinate work orders.

a contractor during implementation?

37. 6.1.1.2 Installation Plan and Timeline

“COR may choose to accept some risks and proceed with installation”. What penalties exist for the Govt when some of those risks are not accepted and installations do not proceed – yet the contractor must complete installation NTL 8 weeks for the first site and 12 weeks for second?

Deviations from the schedule could be allowed to mitigate risk for implementation.

38. 6.1.1.2 Installation Plan and Timeline

“COR may choose to accept some risks and proceed with installation”. What penalties exist for the Govt when some of those risks are not accepted and installations do not proceed – yet the contractor must complete installation NTL 8 weeks for the first site and 12 weeks for second?

See question #37 for answer (duplicate question).

111. 6.1.1.2 Installation Plan & Timeline

Does the 2 week timeline include potential SIPR workloads / environment?

No.

112. 6.1.1.2 Installation Plan & Timeline

Does this installation include ALL expected services from the contractor;

i.e. the online ordering system?

Yes.

173. 6.1.1 Infrastructure Services Detailed Facilities Analysis

What is the availability of utility power (in megawatts) by substation feeder line to the two identified sites?

DISA raised floor spaces are laid out per the enterprise master-plan in zones developed and managed by the DISA facilities team.

Each zone is a self-contained entity providing redundant (2N) power, (N+1) cooling, and (2N) datacomm support to the IT and communications equipment in that zone.

To minimize negative maintenance power impacts, all vendor equipment installed in the racks is required have 2N fully redundant hot swappable power supplies.

Individual pieces of IT equipment that consume more than 1kW (1000 Watts) will have power supplies that are

Energy Star compliant or have an 80 Plus Bronze certification. For more power information please reference the milCloud industry day script published on FBO.

DISA has reserved 1,500 sf of raised floor space with a minimum of 150 kW of power per site for the initial execution of this requirement.

Additional power and/or space can be provided based on vendor growth projections.

174. 6.1.1 Infrastructure Services Detailed Facilities Analysis

What is the availability of utility power (in megawatts) at the two identified DoD sites?

Duplicate question. See answer to #173 above.

175. 6.1.1 Infrastructure Services Detailed Facilities Analysis

What is the availability of water (in gallons per day) at the two identified DoD sites?

The DECC facility raised floor environment is conditioned using a 2N central cooling plant distributing chilled water solutions to the IT data center spaces. All chilled water distribution systems will provide a minimum of N+1 piping configuration from the cooling plant to the CRAH units.

176. 6.1.1 Infrastructure Services Detailed Facilities Analysis

Can DISA provide its forecast for future water capacity in gallons per year for the base and option periods?

Additional power and/or space can be provided based on vendor growth projections.

177. 6.1.1 Infrastructure Services Detailed Facilities Analysis

What is the availability of space (in square feet) at the two identified DoD sites?

DISA has reserved 1,500 sf of raised floor space with a minimum of 150 kW of power per site for the initial execution of this requirement.

Additional power and/or space can be provided based on vendor growth projections.

178. 6.1.1 Infrastructure Services Detailed Facilities Analysis

What is the availability of bandwidth (in TB per second) at the two identified DoD sites?

The Government does NOT have any site with more than 10gbps WAN connectivity.

179. 6.1.1 Infrastructure Services Detailed Facilities Analysis

Can DISA provide its forecast for future network capacity in peak TB per second per year for the base and option periods?

The Government cannot forcast at this time.

180. 6.1.1 Infrastructure Services Detailed Facilities Analysis

How long (e.g., months, weeks) does DISA think it will take to provision additional network capacity/performance to accommodate service consumption growth over time?

Initial network capacity will sufficiently meet the growth expectations for milCloud 2.0 Phase 1.

181. 6.1.1 Infrastructure Services Detailed Facilities Analysis

How long (e.g., months, weeks) does DISA think it will take to provision one addition megawatt to accommodate increasing workloads over time?

DISA has reserved 1,500 sf of raised floor space with a minimum of 150 kW of power per site for the initial execution of this requirement.

Additional power and/or space can be provided based on vendor growth projections.

182. 6.1.1 Infrastructure Services Detailed Facilities Analysis

Can DISA provide its forecast for future electrical capacity in megawatts per year for the base and option periods?

DISA has reserved 1,500 sf of raised floor space with a minimum of 150 kW of power per site for the initial execution of this requirement.

Additional power and/or space can be provided based on vendor growth projections.

183. 6.1.1 Infrastructure

Facilities Analysis

What is the maximum weight that the environment floors (in pounds per square foot) can bear (i.e., floor load capacity) at the two identified DoD sites?

Equipment loading on the raised floor will be limited to

1,250 pounds per sf.

184. 6.1.1 Infrastructure Services Detailed Facilities Analysis

Can DISA provide its forecast for physical site expansion capacity in square foot per site per year for the base and option periods to accommodate growth and adoption?

DISA has reserved 1,500 sf of raised floor space with a minimum of 150 kW of power per site for the initial execution of this requirement.

Additional power and/or space can be provided based on vendor growth projections.

202. 6.1.1.2 Installation Plan and Timeline

What is DISA’s basis of estimate for the realism of the proposed schedule of the two locations?

To start offering IaaS on premise as a service to mission partners.

203. 6.1.1.2 Installation Plan and Timeline

Is DISA’s basis for the 8/12-week timeline for the two locations founded on a previously successful commercial cloud deployment in a secure, on-DoD premises model?

No.

204. 6.1.1.2 Installation Plan and Timeline

Will DISA consider a different plan and timeline based on CSP input for the milCloud 2.0 Phase I build if it leads to a better value solution for DoD?

Yes.

220. 6.1.1.2 Installation Plan and Timeline

In cases where the CSP’s schedule takes more time than DISA’s goals (e.g., delay in a local permit, delay in sufficient substation capacity, delay in the assessment/accreditation), will DISA agree that significant dev/test preparatory work can be done in off-premises infrastructure while the CSP continues to build the on-premises version?

Yes.

221.

6.1.1 Infrastructure

Services Detailed

In order to protect the CSP’s intellectual property from other

The contractor will be allowed to have locked racks in the

Facilities Analysis vendors and to ensure the security of DoD data, will DISA agree to allow the CSP to build fixed walls and separate access controls into the CSP’s server rooms?

secure DoD data center.

222.

6.1.1 Infrastructure

Facilities Analysis

In order to protect the CSP’s intellectual property from other vendors and to ensure the security of DoD data, can DISA support lights out, locked, no access operations of milCloud 2.0 locations with full physical security?

All physical security process will follow standard DISA

DECC Standard Operating Procedures (SOPs).

229. 6.1.1 Infrastructure Services Detailed Facilities Analysis -

(pg.6)

PWS states: “subject matter expertise to assess the two selected DoD facility sites“

Does the Government have a will the government provide, a list of strategically viable DoD facility sites?

The DoD data center locations are outlined in the PWS.

230. 6.1.1.2 Installation Plan and Timeline-

(pg.7)

PWS states: “Having been informed of all identified issues, the COR may choose to accept some risks and proceed with the installation. “

What is the alternative course of action if the Government chooses NOT to accept identified risks, in particular risks that the offeror has no control over and thus impacting the targeted implantation plan?

Deviations from the schedule could be allowed to mitigate risk for implementation.

231. 6.1.1.2 Installation Plan and Timeline –

(pg7)

PWS states: “Installation of at least one site shall be completed no later than eight weeks after contract award and second site no later than twelve weeks

Deviations from the schedule could be allowed to mitigate risk for implementation.

after contract award.“

Please explain the reasoning for the Government establishing distinct installation target timescales for the two (2) facility sites. If installation activities cannot begin until the required predecessor Report has been accepted - a shift in installation timescales will occur. Is the Government aware of this impact?

256. Page 7 para 6.1.1.2

Page 7-8, paras 6.1.2.10.

6.1.2.11 6.1.2.12

Page 15, para 6.1.10.1.

DISA requests a two-site architecture delivered within 12 weeks of award, automated failover, and DR/COOP capabilities; but infrastructure and Services that only deliver 99.95% availability. Does DISA require both a “DevOps or Standard” tier of cloud service with 99.95% availability and an “Enterprise Class” tier of Cloud service with 99.9995% availability; if so, please provide SLA and SLOs for that tier of service?

The DoDIN network has an availability of 99.95%. The Government is looking for proposed SLAs from the contractor.

168. 6.1.2 Compute Requirements

What types/sizes of compute instances (e.g., general purpose, compute-optimized, memory-optimized, storage-optimized [high IO vs. dense], graphics processing-optimized, high memory) will DISA require for the two identified DoD sites?

DISA is asking the contractor to propose compute instances.

3. 6.1.2.1 Will milCloud 2.0 continue to leverage VMware suite of products?

milCloud 2.0 environment does not exist, milCloud 2.0 is unknown until contract is awarded

There are no preferences for a particular brand name/product. Contractor shall propose platform.

39. 6.1.2.2 “Contractor will define pre-packed VMs”.

Will the Govt provide a minimum level of expectations/offerings of their pre-defined configurations using their verbiage of “(e.g. Small, Medium, Large VMs” to include memory, storage, processing, IO, Network Bandwidth resources?

DISA is asking the contractors to propose their pre-packed VMs.

132. 6.1.2.3 Does “The compute services shall require the Consumer’s identity to be associated to any VM that the Consumer provisions. The identity information shall include the personal identity of the Consumer and an organizational affiliation.” mean that Users must be associated with specific VMs that are provisioned, or something else?

Yes, users must be associated with VMs they provision.

82. p.7

Section 6.1.2.6

Para (1)

Who will approve the request from the users?

Who will provide daily operation and support of users?

The importance of Phase I will be to identify the business processes and implement efficiencies with mission partner provisioning, billings and payments.

Daily operation support is dependent on the user’s purchased services.

16. 6.1.2.6 (1-6) DISA states that “The Contractor shall provide rapid, self-service provisioning which includes, at a minimum:

(1) The provisioning service shall offer self-service initiation of provisioning actions through a programmatic interface (both an Application Programming Interface (API) and a command line interface

The contractor will provide.

Please reference the SRG and

PWS for more details.

(CLI)) or through a management console. Workflow approval processes shall be required regardless of the method used to initiate the provisioning action.

(2) The Contractor's self-service interface shall be able to provision multiple compute instances for multiple Consumers at the same time, without dependencies between those provisioning jobs.

(3) Provisioning shall initially utilize DISA-provided “Gold Images” as approved baseline machine images, but allow for consumers to store customized images built on the core images.

(4) The compute service shall allow the Consumer to bring their own workload machine images for importation. Image conversions may be required during importation.

(5) The compute service shall support the import and export of workload machine images to enable future hybrid or multi-vendor infrastructure approaches. The Contractor shall be able to support the importation of Open Virtualization Format (OVF), Virtual Machine Disk Format (VMDK) or virtual hard disk (VHD)-based images. Image conversions may be required during importation.

(6) The contractor shall have documented high availability and disaster recovery capabilities and procedures between the two physically separated and hosted infrastructure locations. This includes data backup and restore functions.”

Does DISA intend to offer its Consumer’s a Self Service Portal for provisioning of backups as well?

113. 6.1.2.6 Item (2): Can the contractor limit the amount of (not sure what this means)?

Provisioning of multiple VMs should not be dependent on each other.

83. p. 7

Section 6.1.2.6

Para (3)

What format is the DISA gold image?

Does each customer determine their own gold image for servers and desktops?

Please refer to iase.disa.mil for STIG information.

Mission partners may have their own mandates for standard baselines.

133. 6.1.2.6 (3) Are cloud-optimized versions of DISA gold images an option?

As stated in the PWS:

provisioning shall initially utilize DISA-provided “Gold Images” as approved baseline machine images, but allow for consumers to store customized images built on the core images.

40. 6.1.2.6 (4) Can the Govt state whether the consumer must provide both a physical (E.G. USB Disk Drive, DVD) and network interface (HTTPS self-service portal/Object Storage)? Can the Govt provide minimum interface specifics for network interface?

This is not a requirement.

The vendor may use their best judgement.

84. p. 7

Section 6.1.2.6

Para (4)

Will the consumer be responsible for maintaining, upgrading, and ensuring IAVA updates to their “own workload machine images”?

Yes.

114. 6.1.2.6 Item (4): Who is responsible for The consumer/mission validating the security posture (ATO, STIGs, Patching, etc.) of a Consumer image brought into the environment?

partner will be responsible.

134. 6.1.2.6 (4) Do we know what OS/hypervisor will be used in these images? Will it be the same as what is available in the two data centers that are selected?

The PWS states OS requirements. The hypervisor solution is to be proposed by the vendor.

232. 6.1.2.6 –

(pg7)

PWS states: “(4) The compute service shall allow the Consumer to bring their own workload machine images for importation. Image conversions may be required during importation. “

Will the Government provide guidance on Chargeback scales for imported Consumer workloads that do NOT fall within the small, medium, and large VM configuration model (possibility of a NOT one-for-one match)?

The contractor will provide rates.

41. 6.1.2.6 (5) The Govt defines what formats the contractor must support for importation but does not define what formats must be included for exportation. Yet 6.1 references “data…provided…by the Contractor be presented in a readable format”. What minimum exportation formats does the Govt expect?

Import and export requirements are the same.

115. 6.1.2.7 Does the gov’t have an expectation of detail for metering services (1/4 hour, minute, millisecond)?

Answered in 6.1.12?

Please referPWS Section 6.1.12.

116. 6.1.2.7 Per the SRG, the compute services require a ‘test’ ‘pre-prod’, and ‘production’ enclaves. Any expectation of different metered rates per environment?

The Government is asking the contractor to provide rates per workload.

233. 6.1.2.7 – PWS states: “The compute service shall support metering of workload usage.

No, the PWS outlines the

(pg.7) Metering shall include how many workloads each Consumer is running;

what type they are; and how long they are operated. Workload reporting will support a number of management activities including chargeback for resources used, planning for future infrastructure growth, guest operating system license management, or assessing which organizations are using what portion of the infrastructure resources.“

The Government has presented a requirement for low level design criteria, versus a measureable performance objective? Will the government consider recasting this from a requirements statement to a performance objective to allow for design latitude required by a commercial solution?

Government’s needs.

185. 6.1.2.8 What Linux guest operating system will the vendor need to support for patch management?

The list of operating systems is defined in the PWS.

234. 6.1.2.8 –

(pg.7)

PWS states: “The Contractor’s infrastructure services shall support Microsoft and Red Hat guest operating systems releases within 30 days of general availability in the marketplace.

DISA intends to provide a gold image of new releases for Consumers as soon as practicable. “

Will the Government expunge this requirement and recast as a practical measureable performance objective; it contradicts PWS Section 6.1.6 -

Windows Server 2016 will have a DISA STIG eventually.

Other operating systems may not have official DISA STIGs that the mission partner wants to install. However, it is up to the mission partner to apply the necessary configurations and receive approval from their respective

Authorizing Official.

Supported Guest Operating System Requirements, P. 10, which is also inaccurate as Windows Server 2016 and CentOS 6.x, 7.x are NOT DISA STIG’d Operating Systems (see http://iase.disa.mil/stigs/os/Pages/index .aspx)

135. 6.1.2.9 (4) What work flow does the government have in mind? If the government team is the one making the changes, who approves the resource update?

The PWS has been updated for clarification.

4. 6.1.2.10 What product is being considered for the COOP solution? Is there a VMware component associated like Site Recovery manager?

milCloud 2.0 environment does not exist, milCloud 2.0 is unknown until contract is awarded

235. 6.1.2.10 -

(pg.8)

PWS states: “The infrastructure services shall be architected to avoid VM outages or downtime when the Contractor is performing hardware or service maintenance.