Web Enterprise Business Services Q-A Revisions.pdf

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

HQ0516-FY-25-0001

Sources Sought Notice for Web Enterprise Business Services – FOR MARKET RESEARCH PURPOSES ONLY

Business Type: NAICS code 541512, Computer Systems Design Services or contractor’s recommended NAICS

# Reference Question/Comment

Q: The RFI document states this is a potential new requirement, but also references a transition plan with an incumbent. Is this a completely new requirement or is there an incumbent? If the latter, please provide the incumbent contractor name and contract number.

A: This is market research only and there will be some differences from the current contract. There is also a greater focus on the NextGen Content Management System (CMS) vs the original AFPIMS CMS. Some of the required s/w license purchases for things like server support may also change.

2 Migration operations Q: Can the government confirm the expected timeline for the transition from AFPIMS to WEB NextGen and any associated milestones?

A: Currently, the time frames are still undetermined this is for Market Research only.

3 Cloud Commodity and Labor

Q: Will the government keep the requirement for an information contract with commodity and professional labor elements valued at $30 million or greater for establishing a cloud architecture? It is our understanding the architecture and hosting infrastructure is established.

A: This is for Market Research purposes only. The commodity and labor elements have not been decided at this time.

4 Software Development

Q: Is there a preference for specific security frameworks or tools for vulnerability assessments and compliance reporting (e.g., ACAS, HBSS)?

A: Yes, all DoD enterprise security tools (e.g., ACAS, Trellix/HBSS, Forescout, eMASS, S- CAP/StigViewer)

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

5 Training and LMS

Q: Can you clarify the scope of the training services, including the percentage of training expected to be delivered online versus in-person?

A: Training offers a variety of options. Generally training is virtual for live sessions (webinars) and the bulk is given in CBT modules. In person training is by special request only. In-person training is charged back to the requestor based on whatever they ask for.

The LMS is hosted by DAU, however, the team is responsible for the administration as well as content. All other requirements will be determined based on market research results.

6 Optional Services

Q: Does the government have a preferred tool or methodology for conducting website customer satisfaction surveys?

A: We prefer JIRA but are currently using TouchPoints.

7 Compliance and Reporting

Q: Will the government provide existing Risk Management Framework (RMF) documentation, or is the contractor expected to start from scratch?

A: The Government will provide the existing RMF documentation.

8 Compliance and Reporting

Q: Can you clarify how the government intends to measure and report compliance with Zero Trust principles?

A: Complying with Operational Orders, STIG compliance and CMRS reporting.

9 Migration and Transition

Q: What are the key challenges or risks identified for website migration to WEB NextGen, and how should the contractor address these risks in their proposal?

A: The Government expects the challenges to change management. No proposals are required, this if for market research only.

10 Background and context

Q: Purpose and scope – Can you please identify the incumbents associated with the efforts listed AFPIMS support, AFPIMS transition, web NextGen implementation?

A: WEB.mil’s previous contract was awarded to Zolon Tech, HQ0516-22-C-0007.

Q: Can you please provide the technical details (users/functions, api’s, applications user and serving, database CMS, tech stack(s), and cost centers across each ‘enterprise’) related to the two main environments (AFPIMS, Web.mil)? This will be important for the LMS, Develop and Test Center, Support Center(help desk), engineering, and the use of the GCDN.

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

A: This is only a sources sought notice for market research purposes only.

Q: Can you provide the details related to operational concepts (Or actual current plan) of building a technical operations support center? On prem off prem? Government facilities or contractor?

It seems some preparatory planning has been done to scope out what should be included ( I think generally a good list) – has a plan been derived or is the government requesting a contractor to assist with the planning?

A: This is only a sources sought notice for market research purposes only.

13 Background and context

Q: In 2023 a contract was provided to another group under the same title – there are no details to that work can the tasks, work completed and contractor recommendations (adjusted based on your needs) be made available for planning purposes? There appear to be other contracts that are supporting portions of the work with DMA, these would be helpful as well. This would help present the context for how to build and structure our team.

A: This is only a sources sought notice for market research purposes only.

14 Concept discussion

Q: In Mar 2024 DMA highlighted both the Web NextGen and web.mil efforts along with several related initiatives which a few seem to be consolidated in this request. Is the intent for this effort to create a single supporting contract to the government’s needs? A match to similar work as a whole could not be found in

SAM.

Capabilities summary

Q: A fairly exhaustive list is provided of operational areas – each has a high level description towards an objective state. Have any of these been looked at from an integration stand point? It seems that the agency might need a centralized integration plan that moves efforts into a consolidated set of services. Some though seem to have many dependencies to existing efforts such as support with the GCDN, GSA, DISA and some existing contracts for training, web, creative support. An organizational chart of the supported offices may assist in understanding the objectives of the government.

Cloud and

Commodity Acquisition

Q: Has the agency performed its own rationalization of systems and capabilities and be able to provide a list of all critical systems, data and data bases? Is this method of rationalization institutionalized for review each year?

A: Yes, we are able to provide a list of all critical systems, data and databases.

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

Q: Has the agency established a cloud migration office which assesses critical functions, systems cloud readiness and indications of both on and of prem requirements for cloud compute and store options?

Does the agency already run a contractor supporting acquisition and business case process to support the acquisition, development, modification and sustainment of its systems? Is that contractor run or government run? This would include Config Control Boards, Engineering Review Boards, Architecture Review Boards.

A: The Agency follows DoD and DMA CIO guidance on RMF steps for on-prem and cloud implementations.

18 Operations Center

Q: Has the government already established an operations center? If not, has a plan already be put in place for that center? What functions fall under the purview of that center – either as is, or in the future plan? A plan or established activity would require an outline that generally addresses all needs– covered by DOTLMPF (sometimes with a C for Cost or P for Policy).

A: Yes.

19 Scope of operations

Q: From many of the sub areas - Web, web transition, GCDN, Development Center (include test and integration for a DevOps or DevSecOps approach), LMS delivery support and trouble shooting – configuration management and LCS supporting systems need to be in place. Does the government expect the contractor to create and then provision these needs as part of its proposal, or will there be an initial set to transition into?

A: This is only a sources sought notice for market research purposes only. The PWS has not been finalized.

Is there a cost management activity associated with the acquisitions?

Q: Typically contracted support efforts for acquisitions require designated procedures for sourcing, quality control checks, supply chain reviews and purchase, process, accounting and delivery.

21 CMS

Q: What is the standard CMS, or approved CMS’s for use by your customer? Is this modified with custom code by the contractor or the government? Are there any other approved CMS that can be used such as those outlined on open system forums?

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

A: Homegrown AFPIMS CMS and Adobe AEM CMS are currently in use.

22 Tasks and Deliverables

Q: There currently are not any specific deliverables or performance standards for the contractor to meet.

This would be critical to assist in focusing the response to the expected performance desired by the government.

A: This is only a sources sought for Market Research purposes only.

23 Transition

Q: The current description of the transition plan requires the successor contractor to maintain personnel without compensation for time worked as an observer across at least 15 task areas. This can only be achieved with sufficient understanding of the organization, tasks, stakeholders, internal process for accounts.

A: The successor contractor will be compensated for time worked as an observer during the transition.

24 $30M in Cloud and Commodity Section

Q: Are only seeking contractors with $30M in labor sales in cloud computing or did you mean under $30M?

A: This means the Contractor needs to have previously had an IT contract that was at least $30M total.

Q: Propose and procure IT hardware and associated products to support WEB data center on Governance request. Size and scope of data center (VM's, endpoints, traffic/bandwidth, architecture?

A: Our data center includes 120 VMs which are hosted on our VxRails platform. Total bandwidth is 75 Mbps

Q: Can we get a copy of Government Task Manager instructions and COR guidance for Assessment Procedure (AP) in eMASS?

Q: Are there are other software applications or 3rd party plugins/addons related to Web.Mil that are in scope?

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

Q: Who will be responsible for after hours emergency support? "After hours emergency on call support will be provided by the Government outside of these service desk hours"

Q: Can we get a list of requirements pertaining to Email Subscription Service requirements: "The Contractor must provide deliverables that comply with Federal laws, regulations, and policies identified by the Government Task Managers and COR.”

30 Page 1, Opening Paragraph

Q: Can and will DMA specify which of the Sources Sought requirements are net new requirements? The opening line of the Sources Sought states this is a new requirement.

31 Page 1, Instruction #3.

Comment: Itemized estimates are difficult with the information provided. Will bidders be given additional information with regards to being able to give budgetary estimates.

A: This is a sources sought notice for market research purposes only, this is not a RFQ or RFP.

32 Overall Q: Any consideration given to existing contract vehicles or set asides?

A: Market Research results will help determine the use of existing contract vehicles or set aside requirements.

Paragraph titled Global Content

Distribution

Q: What is meant by the term frontline security in relation to the web application firewall?

A: The protection from DDoS, and other known threats at the perimeter are critical elements of frontline security. Tailoring the WAF configuration to the needs of the DoD is an essential component of frontline defense.

34 Overall

Q: What are the specific deliverables or performance outcomes for each task area (e.g., migration, training, GCDN services)?

A: Please see sources sought notice for details.

35 Overall Q: What are the minimum qualifications for required personnel (Adobe, AWS, Azure expert certifications, program managers?

A: Personnel are not required to have expert level certifications

Request For Information (RFI) Web Enterprise Business Services Defense Media Activity

36 Service Desk Paragraph

Q: What is the intended staffing model for the 24/7 help desk (number of personnel and hours)?

A: This is only a sources sought notice for market research purposes only.

Overall

Q: What requirements exist for key personnel, to include restrictions?

A: Defense Cyber Workforce (DCWF) certifications for cyber and cyber-related roles.

38 Overall Q: What is the expected start date for performance period?

A: This is only a sources sought notice for market research purposes only.

39 Security

Q: What does the government anticipate for new security requirements (Zero Trust integration per the DOD Zero Trust Strategy).

A: The government anticipates compliance for any new security requirements, to include DoD directions and instruction on Zero Trust.