Integrated Productivity RFI.pdf

SENSITIVE BUT UNCLASSIFIED

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITIONS (ITA)

REQUEST FOR INFORMATION

for

INTEGRATED PRODUCTIVITY, COLLABORATION, AND SECURITY SOFTWARE FOR

ON-PREMISES, MOBILE, AND CLOUD-BASED ENVIRONMENTS

PART 1: REQUEST FOR INFORMATION BACKGROUND AND OBJECTIVES

1.1 PURPOSE

This Request for Information (RFI) is issued as market research to determine industry’s capabilities to provide a Commercial-off-the-Shelf (COTS) suite of software tools, applications, and supporting cloud infrastructure services to provide an integrated, comprehensive ecosystem to include operating systems, business productivity tools, unified communications and collaboration solutions, comprehensive cloud services (PaaS, IaaS, SaaS), and a robust suite of enterprise security offerings to support the Department of State’s (“State”) global on-premises, mobile, and cloud environments.1

State has diverse development needs and derives strategic value from a unified set of tools. State requires access to a single integrated solution that provides these capabilities to further State’s Information Technology Strategic Plan (ITSP) for Fiscal Years 2024-2026. By adopting technology to address State’s critical ITSP goals, State can deliver modern, secure, integrated solutions that enable the diplomatic mission both domestically and overseas, an enable its globally distributed workforce.

The U.S. Government (USG) does not commit to award a contract on the basis of this RFI or reimburse any costs associated with the preparation of responses. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI that is marked “Proprietary” will be handled accordingly. Responses to the RFI will not be returned. In accordance with FAR 15.201(e), responses to this RFI are

1 UCaaS = Unified Communications as a Service, PaaS = Platform as a Service, IaaS = Infrastructure as a Service, SaaS = Software as a Service not offers and cannot be accepted by the USG to form a binding contract. Responses to this RFI will assist the Department in determining the potential level of interest, competition adequacy, and technical capabilities of commercial vendors to provide the required products and/or services. The USG does not guarantee any action beyond this RFI.

1.2 BACKGROUND

The Department’s mission is to advance the interests of the American people, their safety, and economic prosperity by leading America’s foreign policy through diplomacy, advocacy, and assistance. The mission of the Bureau of Diplomatic Technology (DT) is to rapidly and securely deliver, anytime and anywhere, the knowledge resources and IT services needed to support the over 300 sites and 275 missions it services worldwide.

DT is seeking input from industry regarding their capability to provide market-leading solutions capable of meeting the full breadth of functional requirements outlined in this RFI. The Department requires access to a platform that is compliant with current Federal security requirements, is easy to use, flexible, scalable, customizable, and configurable to meet specific Department requirements as further detailed below.

1.3 RFI OVERVIEW

As further detailed in Section 2, the Department is seeking to identify capable and interested partners able to provide the products and/or services required to meet the full range of functional capabilities outlined in this RFI. Viable partners shall have demonstrated experience deploying the solutions and delivering the ongoing support required to maintain, expand, and upgrade the solution over time for an organization of similar size, global scope, and mission complexity as the Department.

Information requested in this RFI includes the following categories:

Company Information (Section 1) - Identification of interested vendors, socio-economic status, and potential acquisition vehicles to inform the Department’s potential acquisition strategy options.

Capability to meet the Functional Requirements (Section 2) - Description of vendor’s technical solution to fully meet the Department’s functional requirements.

Past Experience (Section 3) - Past project example(s) demonstrating vendor’s experience implementing their proposed solution to address the needs of an organization of similar size, global scope, and mission complexity to the Department.

1.4 SUBMISSION INSTRUCTIONS

All written responses should be submitted in Microsoft compatible formats (e.g., Word) or PDF.

Responses shall use 12-point font and 1-inch margins, including all text, tables, and graphics. Additional attachments, brochures, or other marketing materials are not requested and will not be considered as part of the response. Response page limit(s) by section are noted below.

• Section 1 - 1 page

• Section 2 - 30 pages

• Section 3 - 5 pages

Please submit all materials to John Warner at WarnerJ1@state.gov no later than Monday, March 31, 2025 at 3:00PM ET.

The Government will not accept questions AFTER Friday, March 21, 2025, at 3:00PM ET. Please submit questions to WarnerJ1@state.gov.

The Government will post the questions and responses on SAM.gov with sufficient time for vendors to complete their responses. Please be advised that all submissions become Government property and will not be returned.

UNDER NO CIRCUMSTANCES SHALL ANY RESPONDENT CONTACT ANY STATE

PERSONNEL REGARDING THIS NOTICE.

mailto:WarnerJ1@state.gov

PART 2: REQUESTED INFORMATION

Respondents are asked to provide the information requested below per the instructions outlined in Section 1.4 above.

Section 1 - Company Information

Please provide the following details regarding your organization:

1. Company name.

2. Company’s point of contact (POC) name.

3. Company’s POC phone number.

4. Company’s POC email address.

5. Company’s URL/web address.

6. Company’s Cage Code.

7. Company’s UEI Number.

8. Company federal socioeconomic classification(s), if any, based on North American Industry Classification (NAICS) Code that applies to the proposed solution.

9. List of GSA schedule, Government wide acquisition contracts (GWACs), or other federal IDIQs or contracts your company holds that are accessible by the Department and where the full proposed solution can be procured, including corresponding schedule number or GWAC number.

Section 2 - Functional Requirements

State’s functional requirements are outlined below. Respondents are asked to provide a structured response that meets the following format requirements:

a. Response shall be structured and annotated to clearly map the detailed description of the proposed solution’s capabilities to the numbered requirements captured in the sections below. Responses should clearly map to the information in the Department’s requirements below.

b. Response narrative content should provide sufficient details regarding the proposed solution’s specific technical capabilities to demonstrate that the solution is capable of fully satisfying the Department’s requirements.

2.1 Mandatory Qualifications

The following qualifications and capabilities are mandatory requirements for any potential solution addressing the needs outlined in this notice. Vendors should assess these requirements carefully and fully describe their ability to meet them.

Key requirements are as follows:

a. The solution must be a proven, industry-leading Commercial-off-the-Shelf (COTS) software solution that is capable of meeting the full range of requirements within a single integrated platform.

o No custom-built solutions will be considered. State seeks software solutions that have been successfully deployed at other federal agencies similar in size and global scope as State.

b. The solution must be able to facilitate big data storage and real-time analytics utilizing enhanced tools for data visualization and reporting support-decision making, particularly in program management and monitoring.

c. The solution must comply with FedRAMP High, ITAR and other government specific security requirements such as DoD Impact Level 6 (IL6) and CJIS certifications.

d. The solution must support integration into existing agency security frameworks, including Zero Trust Architecture.

e. The solution shall ensure data sovereignty by using dedicated U.S based data centers managed by U.S. citizens.

f. The solution must offer robust disaster recovery and high availability through geographically distributed Availability Zones.

g. The solution shall facilitate application modernization using containerization and microservices architecture.

h. The solution shall provide secure, single sign-on identity management via an Active Directory, enhancing efficiency for workforce operations.

i. The solution shall support pre-configured, mission-critical AI models tailored for government use-cases.

j. The solution shall align with federal procurement vehicles and offer tailored Enterprise Agreements (EA), specifically designed for public sector scalability and cost management.

k. The solution must be able to comply with the Department's Cybersecurity Supply Chain Risk Management (C-SCRM) policy (refer to provided attachments to RFI posting). The vendor must describe its ability to keep its software and product supply chains secure in accordance with NIST SP 800- 53.

2.2 Business Productivity Suite for On-Premises, Mobile, and Cloud Environments

State requires a comprehensive and fully integrated suite of business productivity, unified communications, collaboration, mobility, and security features interconnected and seamlessly accessible across on-prem, mobile, hybrid, and cloud environments. Key capabilities include:

a. The solution must be compatible with State’s current OpenNet/ClassNet, GO Platforms, and multi cloud environments.

b. The solution must be compatible with government data centers that are authorized to hold process-controlled information.

c. The solution must include onboarding and technical support specialists to assist State customers in effectively utilizing the solution and its component tools and applications.

d. The solution must be capable of sending real-time dashboard alerts regarding overall suite health and provide real-time and regular service updates with notifications specifying areas requiring attention.

e. The solution must support custom domain creation and verification.

f. The solution must offer the ability to link external data sources into proprietary suite applications to facilitate data analysis and visualization.

2.3 Business Productivity Tools

State requires a solution that can provide a variety of robust business productivity tools that have the flexibility to meet optimal levels of accessibility, performance, cost, and capacity as demanded by workload. Key capabilities include:

a. The solution must provide State users access to a comprehensive suite of enterprise-class business productivity tools and applications (e.g., email, spreadsheet, document and presentation creation, visualization, project management, communications, meeting hosting, etc.) integrated and accessible across desktop, mobile, and multi cloud environments.

b. The solution must combine secret-level identity capabilities, directory services, advanced identity governance, security, and application access management for the productivity suite to enable operations on State’s classified networks.

c. The solution must integrate productivity tools with other suite applications to easily embed and link data across the integrated suite.

d. The solution must provide up-to-date installation rights to the latest desktop operating system for qualifying State environments.

e. The solution must provide applications with offline capabilities that integrate seamlessly to enable mobile and remote work where network connectivity may not be consistently available.

f. The solution must offer a document storage and management capability that supports real-time collaboration, development, and editing of documents and other artifacts created in any of the individual applications in the productivity suite.

g. The solution must support a robust tool for developing diagrams of various types utilizing a wide range of predefined templates and shapes for flowcharts, organizational charts, floor plans, network diagrams, and similar visualization requirements.

h. The solution must provide a robust project management software tool to support detailed project planning and management including defining project tasks, timelines, milestones, and dependencies; resource allocation, management, and tracking of assigned tasks by resource; and detailed reporting and dashboards to track project progress, budget status, expense tracking, and resource allocations.

2.4 Unified Communications as a Service (UCaaS)

Key capabilities include:

a. The solution must offer telephone, chat/messaging, meeting and webinar hosting, and robust audio/video conferencing capabilities via a comprehensive and fully integrated cloud based UCaaS offering.

b. The solution must integrate the productivity suite with the UCaaS solution to enable State-hosted virtual meetings from any device for internal and external users. The virtual meetings feature must include:

o Seamless integration with productivity tools, including real-time collaboration with documents, spreadsheets, and presentations within the meeting interface, integrated scheduling with calendar applications, task and project management tools, and note-taking and annotation capabilities that sync with team collaboration platforms.

o Advanced communication features, including high-definition audio and video quality, screen sharing and remote desktop control, breakout rooms, persistent chat rooms, and direct messaging for telephone and webinar services on a cloud-based platform.

o Accessibility and device compatibility, including cross-platform support for desktops, laptops, tablets, and mobile devices, including web-based access without the need for additional software installations.

o End-to-end encryption for all meeting communications, compliance with relevant State and federal regulations, role-based access control, and secure guest access options.

o Enhanced user experience, including an intuitive user interface, customizable meeting layouts and backgrounds, and AI-powered features such as noise cancellation, real-time transcription, and language translation services.

o Information barrier features that enable communication and collaboration across groups and organizations while supporting ways to restrict communication and collaboration among specific groups of users.

c. The solution must be able to fully replace desktop phone Private Branch Exchange capabilities and integrate with the suite’s virtual meetings and collaboration tools to provide a comprehensive and seamless unified communications capability across on-prem and mobile devices. Desktop phone replacement required capabilities include, but are not limited to:

o Domestic and overseas users across the globe placing and receiving phone calls across State’s global locations through an integrated phone conferencing application.

o Emergency calling services (including E911 in the U.S.) leveraging dynamic routing and autodetection of the user’s location when processing emergency calls.

o User-defined rules for call forwarding, transferring calls, sending calls to voicemail, sharing incoming calls with other colleagues, and other user preferences for managing cross-platform communications.

2.5 Cloud Computing

Key capabilities include:

a. The solution must provide virtualized computing resources over the internet, allowing users to provision and manage virtual machines, storage, and networking as needed, with the ability to scale resources dynamically based on demand.

b. The solution must offer a managed environment for developing, testing, deploying, and managing applications, providing integrated tools and services that simplify the development lifecycle, increase productivity, and reduce the complexity of infrastructure management.

c. The solution must support delivering software applications over the internet, offering a range of ready-to-use applications that can be accessed through a web browser and not solely require local installation and maintenance.

d. The solution must allow resources to be scaled based on workload demands, automatically adjusting computing power, storage capacity, and network bandwidth to maintain optimal performance and cost efficiency during peak and off-peak periods.

e. The solution must support high-performance computing workloads, providing specialized computing resources such as GPU and CPU clusters, high-speed networking, and parallel processing capabilities necessary for tasks like simulations, large-scale data analysis, and scientific research.

f. The solution must support big data analytics for large-scale data processing, providing tools and services for data ingestion, storage, processing, and visualization, enabling data analysis to derive insights from vast amounts of structured and unstructured data.

g. The solution must support artificial intelligence (AI) and machine learning (ML) capabilities, offering pre-built models, customizable ML frameworks, and tools for building, training, and deploying AI applications allowing for the integration of intelligent solutions into organizational workflows.

h. The solution must be able to deploy AI that is custom built with capable and cost-effective small language models (SLMs).

i. The solution must support use of Databricks notebooks to clean and prepare data and store prepared data in Delta Lake.

j. The solution must support robust development tools and environments, integrating with popular Integrated Development Environments (IDEs) and offering features like code debugging, version control, and automated deployment pipelines to streamline the development and deployment process.

k. The solution must support hybrid cloud deployments, integrating on-prem and cloud resources seamlessly, enabling data and application portability, and providing consistent management and security across hybrid cloud environments.

l. The solution must support multi-cloud deployments, enabling interoperability with other cloud providers, allowing for the distribution of workloads across multiple clouds for redundancy, cost optimization, and to leverage the unique strengths of different cloud platforms.

m. The solution must enable users to create, configure, and manage Virtual Machines of various sizes and operating systems, with automated scaling based on predefined policies.

n. The solution must integrate seamlessly with DevOps tools to facilitate continuous integration and continuous deployment. Users must be able to create Continuous Integration and Continuous Delivery/Deployment (CI/CD) pipelines that automate the building, testing, and deployment of applications, ensuring faster delivery and higher quality software releases.

o. The solution must extend services and capabilities to on-prem, hybrid, multi-cloud, and remote locations to build and deploy edge computing applications with no location boundaries.

p. The solution must provide rapid insights and network data transfers using compute or hardware-accelerated machine learning for Internet of Things (IoT) and AI workloads.

q. The solution must modernize data centers using hybrid solutions to scale virtualization and storage, modernizing on-prem architecture, and enabling high-performance workloads.

r. The solution must provide a cloud-based service providing Natural Language Processing (NLP) features to build applications using Rest Application Programming Interface (APIs), client libraries, and web-based Language Studio.

s. The solution must deliver a secure remote desktop and application for employees to experience and collaborate at any location while maintaining State security and configuration standards.

t. The solution must enable a reduction in IT infrastructure costs by moving on-prem solutions onto a virtual desktop and allowing multiple users to work on a single virtual machine/desktop at once.

u. The solution must allow for the building and deploying of web and cloud applications while also ensuring load balancing and provisioning are maintained.

v. The solution must provide extended support to increase regional resiliency using capabilities such as role-based access control (RBAC), tags, and policy support to ensure deployment runs smoothly.

w. The solution’s cloud services must allow users to scale cloud infrastructure based on real-time demand and manage unexpected traffic by scaling the cloud environment for optimal user experiences.

x. The solution must provide a unified open analytics platform to build, deploy, share, and maintain an enterprise-level data analytics and AI solution at scale.

y. The solution must enable data lake houses to lighten up analytical workloads and allow for open data lakes on unified and governed data.

z. The solution must unify workloads to eliminate data silos and allows data analysts to collaborate on multiple datasets, data processing, generating dashboard visualizations, machine learning, and modeling.

aa. The solution must automatically scale virtual machines according to organizational demand or based on the organization’s defined schedule.

bb. The solution must enhance network and storage performance with custom hardware and optimized hypervisor design.

cc. The solution must monitor virtual machine performance in real-time and automates any key configurations based on solution insights.

2.6 Datacenter Infrastructure Management and Security

Key capabilities include:

a. The solution must support efficient management of on-premises infrastructure for both State’s OpenNet and ClassNet data centers.

b. The solution must provide a server management suite for the main operating system on server-class hardware.

c. The solution must offer a centralized management and monitoring system that provides deployment, configuration, management, and monitoring of both servers and desktops within State’s environment.

d. The solution must provide an integrated set of tools for data center optimization including virtual machine provisioning that is optimized for compute-intensive and memory-optimized workloads.

e. The solution must offer service level agreements uptime for virtual machines to ensure resilience against hardware failures and data center outages.

f. The solution must contain hybrid capabilities to allow enterprises to integrate on-prem infrastructure with cloud computing services to provide operational flexibility with reduced costs.

2.7 Relational Database Capability

Key capabilities include:

a. The solution must provide robust data storage and retrieval capabilities, supporting structured data and enabling efficient data manipulation through queries.

b. The solution must facilitate the definition and enforcement of data integrity constraints through primary and foreign keys.

c. The solution must support referential integrity, ensuring that relationships between tables are maintained accurately and automatically handle cascading updates and deletes.

d. The solution must guarantee that all database transactions are processed reliably, adhering to ACID principles to ensure that each transaction is completed fully (Atomicity), maintains data integrity (Consistency), operates independently (Isolation), and records are permanently saved even in case of system failures (Durability).

e. The solution must offer high performance for both transactional (OLTP) and analytical (OLAP) workloads.

f. The solution must support both vertical scaling (enhancing hardware capabilities) and horizontal scaling (adding more servers) to handle growing data volumes and concurrent user access.

g. The solution must provide mechanisms for distributed data storage and load balancing to ensure continuous performance under increasing demands.

h. The solution must support encryption for data at rest and in transit, using industry-standard encryption algorithms. It should offer features such as transparent data encryption (TDE) and column-level encryption to protect sensitive information without impacting performance.

i. The solution must allow granular control over data access through RBAC, enabling administrators to define roles with specific permissions.

Additionally, row-level security should be available to restrict access to individual rows in a table based on user roles or other criteria.

j. The solution must offer dynamic data masking features to obfuscate sensitive information, allowing users to see only masked data unless they have the required permissions.

k. The solution must support high availability configurations such as clustering, replication, and automated failover to ensure minimal downtime.

l. The solution must have comprehensive disaster recovery solutions such as point-in-time recovery, backup and restore capabilities, and geo-redundant storage. It should enable quick recovery of data and services in case of unexpected failures or disasters.

m. The solution must integrate advanced analytics tools, allowing the execution of complex analytical queries and the use of machine learning models directly within the database.

n. The solution must support languages such as R and Python for structuring in-database analytics.

o. The solution must provide built-in business intelligence tools for creating, managing, and sharing reports and dashboards. It should support interactive data visualization capabilities to help users make informed decisions based on real-time data insights.

p. The solution must offer development environments and tools that facilitate database design, coding, debugging, and deployment. Features like version control integration, code refactoring, and automated deployment pipelines should be supported to streamline the development process.

q. The solution must provide a suite of management tools for tasks such as performance monitoring, tuning, backup management, and security configuration. It should include user-friendly interfaces and dashboards to simplify administrative tasks and enhance productivity.

r. The solution must seamlessly integrate with cloud services for hybrid deployment between on-premises and cloud environments.

s. The solution must be capable of operating in multi-cloud environments, providing flexibility and redundancy. It should support data and workload portability across different cloud providers, ensuring high availability and disaster resilience.

2.8 Comprehensive Security Offering

The solution provides a comprehensive security offering integrating state-of-the-art security tools across desktop, mobile, cloud, and data center environments to provide robust threat detection and prevention, identity and access management and endpoint security across the State enterprise. Key capabilities include:

2.8.1 General

a. The solution must adhere to FedRAMP High compliance standards and complies with US Public Sector certification and accreditation requirements.

b. The solution must offer a Secret cleared (and above) cloud computing platform able to support tenants requiring full Department of Defense (DoD) Impact Level 6 (IL6) certification for storage and processing of classified information up to the secret level.

c. The solution must have a cloud computing platform that has Federal Risk and Authorization Management Program (FedRAMP) authorization on all commercial, government, and secret cloud platforms.

d. The solution must meet National Institute of Standards and Technology (NIST) definitions of Cloud Computing as published in NIST Special Publication 800-145.

e. The solution must adhere to Executive Order 14028 “Improving the Nation’s Cybersecurity” while providing a full suite of Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) cloud service offerings.

2.8.2 Threat Detection and Prevention

a. The solution must automate threat responses and utilizes global threat intelligence to provide centralized security management for incidents within a single console.

b. The solution must provide a unified portal that provides out-of-the-box extended detection and response (XDR) capabilities for Windows, Linux, macOS, and mobile operating systems.

c. The solution must include vulnerability management capability that provides State with continuous asset visibility, intelligent risk-based assessments, and remediation tools prioritizing and addressing critical vulnerabilities and misconfigurations.

d. The solution’s security offering must safeguard State’s email and collaboration tools from advanced threats including phishing, business email compromise, and malicious URLs and attachments.

e. The solution’s security offering for cloud applications must provide State with visibility, strong data controls, and enhanced cloud threat protection with a comprehensive cross-SaaS security posture management solution capable of processing Secret level information and data.

2.8.3 Identity and Access Management (IAM)

a. The solution must provide cloud-based security by utilizing a State-approved, on-premises authorized user database to identify, detect, and investigate threats.

b. The solution must provide user account management capability that identifies users by cloud identity, federated identity, and/or multi-factor authentication.

c. The solution must allow IT administrators to set rules and parameters to configure user access privileges and permissions based on defined roles and other factors.

d. The solution’s identity security offering must provide State with a cloud-based security solution leveraging on-premises user information databases which signal identifying, detecting, and investigating advanced threats, compromised identities, and malicious insider actions.

e. The solution must include an application that can monitor and protect cloud application data using cloud access security broker (CASB), app-to-app protection, advanced threat protection, and security posture management (SPM) to control access surrounding productivity, security, compliance, and collaboration applications.

f. The solution’s identity protection offering must provide State with ongoing risk detection and remediation of suspicious user accounts, providing automatic responses to prevent any identity compromise or abuse.

g. The solution must provide account security for on-prem and cloud environments by enforcing single sign-on, multifactor authentication, identity governance, and event logging/reporting.

2.8.4 Unified Endpoint Management (UEM)

a. The solution’s security offering must provide State with an enterprise-wide unified endpoint protection platform to prevent, detect, investigate, and respond to threats using cloud analytics, behavioral sensors, and known threat intelligence.

b. The solution must offer user endpoint analysis to provide organizations metrics and insights into the end-user experience while proactively detecting and troubleshooting issues.

2.8.5 Security Information and Event Management (SIEM)

a. The solution must provide a scalable and cloud-native security information and event management (SIEM) tool for security orchestration, automation, and response (SOAR).

b. The solution must offer a unified tool set to detect attacks, enhance threat visibility, and conduct proactive threat hunting through artificial intelligence/machine learning (AI/ML) capabilities.

c. The solution must support data collection and analysis to detect, investigate, and respond to incidents crossing silos.

d. The solution must allow analysts to search for specific MITRE attacks, malicious activity, user behavior analytics, or custom machine learning models via Jupyter notebook integration.

e. The solution must allow State users to ingest the following data sources at no cost, cloud computing platform activity logs, productivity suite audit logs, security alerts from all modes of security, identity protection, and endpoint offerings.

f. The solution must offer a risk management offering that can be enabled to identify potential malicious or inadvertent insider risks such as IP theft, data leakage, and security violations across the Department.

g. The solution must offer an audit tool that is integrated to help State effectively respond to security events, forensic investigations, internal investigations, and compliance obligations.

2.9 Artificial Intelligence Capability

Key capabilities include:

a. The solution must provide an artificial intelligence (AI) capability integrated into the solution’s business productivity suite and broader application ecosystem to guide users in completing key business processes and tasks more efficiently.

b. The AI solution must enable/facilitate content creation, task automation, development and learning, and enhanced decision-making.

c. The solution must securely combine enterprise data with AI large language models (LLMs) furthering automation and enhancing productivity and user experience.

d. The solution must provide real-time Artificial Intelligence support based on the user’s provided context.

2.10 Data Security, Data Loss Prevention, Data Governance, and Compliance Management

The Solution provides a robust set of tools for managing overarching data governance and security while supporting compliance management requirements across the enterprise. Key capabilities include:

2.10.1 Data Security and Loss Prevention

a. The solution must provide robust and coordinated data security solutions to identify, classify, and protect sensitive data and information wherever it lives or travels.

b. The solution must prevent users from inappropriately sharing sensitive data.

c. The solution’s access management offering must protect State from breaches and help to meet compliance best practices by limiting standing access to sensitive data or access to critical configuration settings.

d. The solution must provide a robust data loss prevention tool and controls sensitive information including financial data, proprietary data, credit card numbers, health records, or social security numbers.

e. The solution’s data loss prevention policies must identify, monitor, and protect sensitive data across the Solution’s suite of services, productivity applications, operating systems, cloud applications, on-premises file sharing, and data analytics tools.

2.10.2 Data Governance and Management

a. The solution must provide a data catalog solution that enables data consumers to easily find the data needed for analytics, reporting or other data-focused requirements.

b. The solution must provide a data mapping offering that allows State to capture metadata present in analytics tools, software-as-a-service (SaaS), and operational systems in hybrid, on-premises, and multi-cloud environments in support of State’s data governance objectives.

c. The solution must provide a data sharing solution allowing State users to share data in-place from State’s data lakes and storage applications across the Department, with real-time access to shared data.

2.10.3 Compliance Management

a. The solution must contain a communication compliance tool to manage regulatory compliance (for example, SEC or FINRA) and business conduct violations such as sensitive or confidential information, harassing or threatening language, and sharing of adult content.

b. The solution’s communication compliance tool must create usernames that are pseudonymized by default, role-based access controls are built in, investigators are opted in by an admin, and audit logs are in place to help ensure user-level privacy.

c. The solution must offer a compliance management tool that allows State users to automatically assess and manage compliance across a multi-cloud environment to manage risk and liability.

d. The solution must provide a data insight offering that can assist State stakeholders on data management, compliance, and data use while providing actionable insights into the organization’s data estate, catalog usage, adoption, and processes.

2.11 Application Development and Workflow Automation

Key capabilities include:

a. The solution must provide a low-code web and mobile platform for developing custom applications and workflows that enables integration across other tools and applications within the overall solution ecosystem (e.g., business productivity suite, collaboration, and file sharing applications, etc.).

b. The solution must facilitate automation of workflows and business processes through a low code/no code interface accessible by users with a limited technical background while simultaneously also providing robust tools for experienced developers.

c. The solution must enable users to easily analyze data, create applications, automate multiple workflows, and integrate AI capabilities.

d. The solution must provide a virtual chatbot functionality enabling users to converse with agents.

e. The solution must allow for the creation of data-centric websites linked to a broad range of enterprise data sources.

f. The solution must utilize a robust data management platform and toolset to securely store and manage data to unify application development ecosystems.

g. The solution must store data in structured formats and allow for complex data structures and relationships to support data needs for complex business solutions.

h. The solution must emphasize security in processing and transferring data and integrate seamlessly with established security infrastructure.

SECTION 3 - PAST PERFORMANCE

The Department is seeking a solution that has a proven track record in the USG with demonstrated experience supporting USG agencies of similar size, global scope, and mission complexity as the Department. Such experience is critical to ensuring the solution has been proven to be secure and reliable under the required IT security, data management, privacy, and other federal regulations that IT implementations within the USG environment.

Please provide the following information regarding your experience deploying your solution for USG customers.

a. Please list (no more than three (3)) USG agencies where you have successfully deployed the proposed solution in the last three years. For each experience noted, in no more than one paragraph, please provide:

i. U.S. agency and organization name.

ii. Period of performance.

iii. Solutions provided to the U.S. agency.

Disclaimer: This RFI notice is for information gathering purposes only as a means to identify interested and capable sources that can provide a solution that fully meets all requirements outlined in Part 2 of this notice. The information provided in this RFI is subject to change and is not binding on the USG. The Department has not made a commitment to procure any of the items/services discussed and release of this RFI shall not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought.

The Department will not publicly disclose proprietary information obtained as a result of this RFI. To the full extent that it is protected by law and regulations, information identified by a respondent as “Proprietary” or “Confidential” will be kept confidential. All submissions become USG property and will not be returned.