Web Enterprise Business Services Q-A.pdf

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

HQ0516-FY-25-0001

Sources Sought Notice for Web Enterprise Business Services – FOR MARKET RESEARCH PURPOSES ONLY

Business Type: NAICS code 541512, Computer Systems Design Services or contractor’s recommended NAICS

# Reference Question/Comment

Q: The RFI document states this is a potential new requirement, but also references a transition plan with an incumbent. Is this a completely new requirement or is there an incumbent? If the latter, please provide the incumbent contractor name and contract number.

A: WEB.mil’s previous contract was awarded to Zolon Tech, HQ0516-22-C-0007. However, the original award will have some differences from the new contract. This is also an IDIQ where task orders will be issued as needed vs the current structure. There is also a greater focus on the NextGen Content Management System (CMS) vs the original AFPIMS CMS. Some of the required s/w license purchases for things like server support may also change.

2 Migration operations

Q: Can the government confirm the expected timeline for the transition from AFPIMS to WEB NextGen and any associated milestones?

A: Currently, the time frames are still undetermined. The Government expects the transition to happen within the next 3-5 years.

3 Cloud Commodity and Labor

Q: Will the government keep the requirement for an information contract with commodity and professional labor elements valued at $30 million or greater for establishing a cloud architecture? It is our understanding the architecture and hosting infrastructure is established.

A: This requirement is an IDIQ, so we are listing all potential purchases during the life of this contract. The $30 million means the Contractor needs to have an IT contract that was at least $30M total and this contract also requires a Cloud architecture.

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

4 Software Development

Q: Is there a preference for specific security frameworks or tools for vulnerability assessments and compliance reporting (e.g., ACAS, HBSS)?

A: Yes, all DoD enterprise security tools (e.g., ACAS, Trellix/HBSS, Forescout, eMASS, S- CAP/StigViewer)

5 Training and LMS

Q: Can you clarify the scope of the training services, including the percentage of training expected to be delivered online versus in-person?

A: Training offers a variety of options. Generally training is virtual for live sessions (webinars) and the bulk is given in CBT modules. In person training is by special request only. In-person training is charged back to the requestor based on whatever they ask for.

The team uses MS Teams for live delivery and for recording special sessions for anytime/anywhere viewing. The bulk of the module-based training is developed using Articulate 360, In-Design, and Adobe Acrobat Pro. Modules and quick reference guides are updated annually or when a new change/upgrade is pushed.

The LMS is hosted by DAU, however, the team is responsible for the administration as well as content There is a plan ahead to incorporate AI

6 Optional Services

Q: Does the government have a preferred tool or methodology for conducting website customer satisfaction surveys?

A: We prefer JIRA but are currently using TouchPoints.

7 Compliance and Reporting

Q: Will the government provide existing Risk Management Framework (RMF) documentation, or is the contractor expected to start from scratch?

A: The Government will provide the existing RMF documentation.

8 Compliance and Reporting

Q: Can you clarify how the government intends to measure and report compliance with Zero Trust principles?

A: Complying with Operational Orders, STIG compliance and CMRS reporting.

9 Migration and Transition

Q: What are the key challenges or risks identified for website migration to WEB NextGen, and how should the contractor address these risks in their proposal?

A: The Government expects the major challenges to revolve around change management and

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity addressing resistance to change.

10 Background and context

Q: Purpose and scope – Can you please identify the incumbents associated with the efforts listed AFPIMS support, AFPIMS transition, web NextGen implementation?

A: WEB.mil’s previous contract was awarded to Zolon Tech, HQ0516-22-C-0007.

Q: Can you please provide the technical details (users/functions, api’s, applications user and serving, database CMS, tech stack(s), and cost centers across each ‘enterprise’) related to the two main environments (AFPIMS, Web.mil)? This will be important for the LMS, Develop and Test Center, Support Center(help desk), engineering, and the use of the GCDN.

A: This is only a source sought, so very general information is discussed here.

Q: Can you provide the details related to operational concepts (Or actual current plan) of building a technical operations support center? On prem off prem? Government facilities or contractor?

It seems some preparatory planning has been done to scope out what should be included ( I think generally a good list) – has a plan been derived or is the government requesting a contractor to assist with the planning?

A: This is only a source sought, so very general information is discussed here.

13 Background and context

Q: In 2023 a contract was provided to another group under the same title – there are no details to that work can the tasks, work completed and contractor recommendations (adjusted based on your needs) be made available for planning purposes? There appear to be other contracts that are supporting portions of the work with DMA, these would be helpful as well. This would help present the context for how to build and structure our team.

A: The new contract will be similar to HQ0516-22-C-0007 in terms of general tasks. There are other contracts that provide things like Government provided Microsoft server licenses and renewal of some licenses, but the main support/products will be acquired through the new contract.

14 Concept discussion

Q: In Mar 2024 DMA highlighted both the Web NextGen and web.mil efforts along with several related initiatives which a few seem to be consolidated in this request. Is the intent for this effort to create a single supporting contract to the government’s needs? A match to similar work as a whole could not be found in

SAM.

A: WEB.mil’s previous contract was awarded to Zolon Tech, HQ0516-22-C-0007. However, this new contract is an IDIQ. The original base contract discusses support of the AFPIMS Content

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

Management System, but some support for the NextGen CMS was subsequently added as well. The new IDIQ will support the new NextGen CMS and remaining work on the AFPIMS CMS.

Capabilities summary

Q: A fairly exhaustive list is provided of operational areas – each has a high level description towards an objective state. Have any of these been looked at from an integration stand point? It seems that the agency might need a centralized integration plan that moves efforts into a consolidated set of services. Some though seem to have many dependencies to existing efforts such as support with the GCDN, GSA, DISA and some existing contracts for training, web, creative support. An organizational chart of the supported offices may assist in understanding the objectives of the government.

A: This is only a source sought, so very general information is discussed here.

Cloud and

Commodity Acquisition

Q: Has the agency performed its own rationalization of systems and capabilities and be able to provide a list of all critical systems, data and data bases? Is this method of rationalization institutionalized for review each year?

A: Yes, we are able to provide a list of all critical systems, data and databases. This information is reviewed multiple times a year.

Q: Has the agency established a cloud migration office which assesses critical functions, systems cloud readiness and indications of both on and of prem requirements for cloud compute and store options?

Does the agency already run a contractor supporting acquisition and business case process to support the acquisition, development, modification and sustainment of its systems? Is that contractor run or government run? This would include Config Control Boards, Engineering Review Boards, Architecture Review Boards.

A: The Agency follows DoD and DMA CIO guidance on RMF steps for on-prem and cloud implementations. A new system would have an opportunity to assert the manner in which changes are managed, to the extent they are in-line with RMF and DoD best practices.

18 Operations Center

Q: Has the government already established an operations center? If not, has a plan already be put in place for that center? What functions fall under the purview of that center – either as is, or in the future plan? A plan or established activity would require an outline that generally addresses all needs– covered by DOTLMPF (sometimes with a C for Cost or P for Policy).

A: Yes. Details will be provided in the future, but not at this time.

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

19 Scope of operations

Q: From many of the sub areas - Web, web transition, GCDN, Development Center (include test and integration for a DevOps or DevSecOps approach), LMS delivery support and trouble shooting – configuration management and LCS supporting systems need to be in place. Does the government expect the contractor to create and then provision these needs as part of its proposal, or will there be an initial set to transition into?

A: The PWS will be sent in the future with specifics, but not for a sources sought. Contractors will have access to prior documents, but should have the capability to create their own if required.

Is there a cost management activity associated with the acquisitions?

Q: Typically contracted support efforts for acquisitions require designated procedures for sourcing, quality control checks, supply chain reviews and purchase, process, accounting and delivery.

A: Contractor will propose purchases (e.g., software) to meet Government requests. DMA will provide procedures for the proposals to be vetted (e.g., review costs to determine whether it is reasonable and discuss if it meets needs such as form/fit/function).

21 CMS

Q: What is the standard CMS, or approved CMS’s for use by your customer? Is this modified with custom code by the contractor or the government? Are there any other approved CMS that can be used such as those outlined on open system forums?

A: Homegrown AFPIMS CMS and Adobe AEM CMS are currently in use.

22 Tasks and Deliverables

Q: There currently are not any specific deliverables or performance standards for the contractor to meet.

This would be critical to assist in focusing the response to the expected performance desired by the government.

A: This is only a sources sought per DMA’s normal process, so the PWS was not added to the notice.

However, the sources sought listed the general deliverables (e.g., plans, reports).

23 Transition

Q: The current description of the transition plan requires the successor contractor to maintain personnel without compensation for time worked as an observer across at least 15 task areas. This can only be achieved with sufficient understanding of the organization, tasks, stakeholders, internal process for accounts.

A: The successor contractor will be compensated for time worked as an observer during the transition as part of the OJT.

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

24 $30M in Cloud and Commodity Section

Q: Are only seeking contractors with $30M in labor sales in cloud computing or did you mean under $30M?

A: The Contractor must previously have been awarded an information technology (IT) contract with commodity and professional labor elements valued at $30M or greater with the requirement for establishing a Cloud architecture. This means the Contractor needs to have an IT contract that was at least $30M total and this contract also requires a Cloud architecture.

Q: Propose and procure IT hardware and associated products to support WEB data center on Governance request. Size and scope of data center (VM's, endpoints, traffic/bandwidth, architecture?

A: Our data center includes 120 VMs which are hosted on our VxRails platform. Total bandwidth is 75 Mbps

Q: Can we get a copy of Government Task Manager instructions and COR guidance for Assessment Procedure (AP) in eMASS?

A: After the award, this information will be provided.

Q: Are there are other software applications or 3rd party plugins/addons related to Web.Mil that are in scope?

A: The s/w list will be provided in the PWS in the future. This is only a source sought, so very general capabilities are discussed here.

Q: Who will be responsible for after hours emergency support? "After hours emergency on call support will be provided by the Government outside of these service desk hours"

A: All after hours emergency calls are currently handled by the Infrastructure chief. However, we may add an overtime CLIN for after hours emergency support.

Q: Can we get a list of requirements pertaining to Email Subscription Service requirements: "The Contractor must provide deliverables that comply with Federal laws, regulations, and policies identified by the Government Task Managers and COR.”

A: The general deliverables are in the sources sought (e.g., reports). It’s stating that when deliverables are requested, they should comply with Federal laws, regulations, and policies identified by the Government Task Managers and COR (e.g., provide FedRAMP compliant software).

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

30 Page 1, Opening Paragraph

Q: Can and will DMA specify which of the Sources Sought requirements are net new requirements? The opening line of the Sources Sought states this is a new requirement.

A: This is new, since it is an IDIQ and there will be 2 CMS vs 1 at base award. There will also be some changes to the PWS such as licenses and clarifications to tasks in the future.

31 Page 1, Instruction #3.

Comment: Itemized estimates are difficult with the information provided. Will bidders be given additional information with regards to being able to give budgetary estimates.

A: This is a sources sought notice, this is not a RFQ or RFP. If this requirement goes to solicitation, a detailed PWS of all requirements will be included in the solicitation.

32 Overall Q: Any consideration given to existing contract vehicles or set asides?

A: Market Research will dictate use of existing contract vehicles or set aside requirements.

Paragraph titled Global Content

Distribution

Q: What is meant by the term frontline security in relation to the web application firewall?

A: The protection from DDoS, and other known threats at the perimeter are critical elements of frontline security. Tailoring the WAF configuration to the needs of the DoD is an essential component of frontline defense.

34 Overall

Q: What are the specific deliverables or performance outcomes for each task area (e.g., migration, training, GCDN services)?

A: The deliverables are listed in the sources sought.

35 Overall

Q: What are the minimum qualifications for required personnel (Adobe, AWS, Azure expert certifications, program managers?

A: Personnel are not required to have expert level certifications

36 Service Desk Paragraph

Q: What is the intended staffing model for the 24/7 help desk (number of personnel and hours)?

A: We are currently not 24/7. We are 7 days a week but limited hours on weekends. Monday - Friday from 7:00 AM until 9:00 PM EST Saturday - Sunday from 9:00 AM to 5:00 PM EST We have 15 contractors total which includes the Service Desk manager

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

Overall

Q: What requirements exist for key personnel, to include restrictions?

A: While not a comprehensive list, examples would be a DMA issued CAC for all key personnel, and DMA issued government furnished equipment for sensitive/privileged work. Defense Cyber Workforce (DCWF) certifications for cyber and cyber-related roles.

38 Overall Q: What is the expected start date for performance period?

A: This is a sources sought notice, this is not a RFQ or a RFP. If this requirement goes to solicitation, a detailed PWS of all requirements will be included in the solicitation.

39 Security

Q: What does the government anticipate for new security requirements (Zero Trust integration per the DOD Zero Trust Strategy).

A: The government anticipates compliance for any new security requirements, to include DoD directions and instruction on Zero Trust.