IRS-OIT-VI QA Responses 03-18-2025.pdf

IRS-OIT-VI Q&A Responses- March 18, 2025

Is this a re-compete of a contract or a new requirement. If recompete, who is the incumbent vendor?

Can the Government confirm if this procurement is a follow-on to the MIDS contract (2032H521F00298)? Can the Government confirm if this procurement is to replace the current Virtualization technology in the IRS data centers with alternative capabilities, excluding OpenShift?

This is a separate requirement from the MIDS contract. The requirement outlined in the RFI is to replace or re-acquire VMware, the overall requirement has expanded and includes differing requisites from the previous contract

If this were to move forward, is the desire of the IRS to release this as a standalone and new effort, or would IRS leverage existing contracts.

The Government is conducting market research to determine the most appropriate path forward.

Currently, the Government welcomes commentary from industry with optimal solutions to meet its needs.

Does the IRS have an independent government cost estimate (IGCE) of the migration cost from one virtualization environment to another (not an IGCE for the software acquisition cost)?

The Government is conducting market research to assist in developing the IGCE.

What specific evaluation criteria will the IRS use to assess responses to this RFI?

The Government is conducting market research via this RFI/SSN. Data will be used to determine and set-aside opportunities and other acquisition planning.

What is the IRS's approach to managing scope changes during the implementation?

Any required scope changes will be assessed during the time of discovery.

Does the IRS envision this effort to be in the scope of the current MIDS contract?

No. This is a software request for information.

Does the Government have an upcoming procurement strategy in place (for example Single Source award, FFP/LH/Hybrid, etc)? Does the government intend provide a Pricing Template listing out Labor Categories?

The Government is conducting market research to assist in developing the procurement strategy and pricing template. The Government welcomes input from industry to review for any potential solicitation.

To provide efficient cloud procurement and to avoid time-consuming change requests, will IRS consider including Single CLINS for Cloud Services, Cloud Training, Cloud Professional Services, and Cloud Marketplace?

Yes they will be considered.

Will IRS require an in-person demonstration or proof of concept before full deployment?

Yes.

What is the current TCO of your VMware environment, and what cost optimization targets exist?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

What is your timeline for implementation and migration? Are there any critical milestones or deadlines we should be aware of?

The IRS estimates 6–9-month migration from current software solution to new product(s).

Does the IRS have a preferred licensing model (perpetual, subscription, etc.)?

The Government is conducting market research and interested in receiving information for all software licensing models.

Can you provide more details on the existing VMware environment, including versions, specific hardware configurations, and any known pain points or limitations.

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Can you clarify if the minimum requirements (50,000 cores, 2.0PB RAM, etc.) represent current usage or anticipated future needs?

The current usage and needs are less than the requirements however have a potential of growing to the specified size and beyond.

What are the key internal and external systems that require integration? Can you provide an inventory of current interfaces?

There are requirements of the software to function through a configured firewall.

Can the Government confirm if this is intended to be a fully managed service where the vendor owns all the hardware, software and services?

It is not to be fully managed at this time. The IRS will control the licenses as they currently do.

Are you intending to replace all hardware and software at once?

Software will require a migration. Hardware is not in scope.

What is the IRS’s average VM density (number of VMs on a single ESXi host server)?

Dependent on resource utilizations.

Is the Government expecting vendors to host hardware at contractor site, or will all hardware be hosted within IRS locations and/or public community clouds to meet the target compute objectives?

Hardware is not in scope of this RFI. The solution software must be capable of being integrated with a public cloud and hosted in a private cloud. Currently, there is not a public cloud solution however, it is the intent to migrate to a public cloud provider in the future.

Is there a penalty for recommendations that include hardware as it will increase pricing?

Hardware is not a requirement of this RFI unless the software requires a specific hardware solution.

Introduction describes an existing hybrid solution. Is the goal to have a single virtualization solution that spans physical locations (on prem data centers & public cloud)?

The recommended solution must be capable of operating on-prem and cloud-based.

How are the 10+ physical locations connected? What are the current bandwidth capabilities between sites? Are any of the 10+ locations being closed as part of this program?

Sites are connected by AT&T fiber.

Is it IRS’s intent to replace VMWare completely or partially? Would the replacement solution (total or partial) be immediate (within a year) or phased in over time. If phased in, how long is that time period and at what percentage of workloads would be implemented per year?

The Government is conducting market research and interested in receiving information on all solutions.

Is the current IRS ticketing system ServiceNow? Is it expected that the contractor would operate within the IRS's platform or is the IRS looking for the contractor to provide their own environment as it relates to this effort?

Yes. Ticketing must be compatible with the IRS system.

How many applications does the environment represent? What portion are traditional VMs vs containerized?

600. <1% containerized.

Will you provide a detailed VM utilization report for accurate sizing, similar to RVTools?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Are all 10 sites similar in architecture? In the final RFP, does the Government intend to provide a site by site breakdown for existing workloads to be supported and migrated? Will IRS provide documentation on existing system architectures and data models to support integration planning? Can the IRS provide more details on the current network infrastructure that will need to integrate with the new virtualization solution?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Can you elaborate why you highly desire to include hyperconverged? This is not desired or intended to prefer hyperconverged solution. Traditional solutions are welcome. Are there elements of your current environment that are not supported by HCI architectures? No. The SOW mentions hyperconverged storage as "highly desired but not required." Can the IRS elaborate on its preferences regarding hyperconverged versus traditional infrastructure? This is not desired or intended to prefer hyperconverged solution. Traditional solutions are welcome.

What storage platforms are you using?

Pure Storage with Flash.

What do you use site redundancy?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

What tools are you currently using for scripting automated tasks within the environment?

Powershell and other tools/languages utilized by applications such as Aria automation.

What is your current approach to monitoring and managing the virtualized infrastructure? Are there specific tools you're currently using that must be integrated with a new solution?

ServiceNow & Appdynamics.

How many VM's and what platforms are currently in use that will need to be migrated? Does the number of 15k VMs match the number of users?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

How do you currently handle capacity planning and resource allocation? Are there challenges in this area you're looking to address?

Capacity is managed by Service requests and the goal is be become more efficient with current and future VM resources.

Is there a direction on the success criteria for this request?

This is a request for information and sources sought publication.

Can you provide specifics on the types of workloads running on the existing VMware environment (e.g., databases, applications, virtual desktops)?

All of the above.

Workload Optimization: Are there specific performance or efficiency requirements for certain workloads?

All workloads should be treated as optimal and efficient based upon usage and licensing costs.

Modernization Plans: Are there any plans to adopt containers or Kubernetes within the virtualized environment?

Yes, this is in place currently.

Modernization Plans: Are there any plans to adopt large language models or other forms of Private AI within the virtualized environment?

The IRS is at the early stages of Ai and future support for Ai requirements must be available.

Automation Goals: What level of automation is desired for infrastructure management, patching, upgrades, and disaster recovery? What is your current approach to automation and orchestration? Are there specific workflows or processes you're looking to improve? Can you provide more details about your "expanded automation options" requirements? What specific processes do you want to automate?

What level of automation exists in the current environment, and what specific automation capabilities is the IRS looking to implement?

Automation is preferred where applicable.

VMs are currently automated builds.

Process improvement and efficiency are always welcome.

Any options to automate with less human intervention is desired.

Automation of VM build is active. Resource automation adjustments are desired with zero to minimal downtime for both containers and VMs.

What is the current disaster recovery strategy for the virtual infrastructure, and what improvements would the IRS like to see?

Solutions may be suggested for a true DR capability.

East-West Traffic Visibility & Control: Do you have visibility into network traffic flowing between virtual machines within your data center? Are there challenges in controlling access and preventing lateral movement between workloads on the same network segment?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

What is your current change management process and how would you like to see it improved?

The current process follows a formal request which is reviewed and approved by a technical review board. Members will question the request and provide feedback throughout the process.

Is the Government open to outsourcing the IRS data centers to a third-party vendor to build and manage the required services?

The Government is conducting market research and interested in receiving information for all software licensing models.

Please clarify what mobile applications are currently in use that need to be maintained?

Any mobile applications virtualization currently will be to be migrated to the new software solution.

Are there existing integration frameworks or middleware solutions that the new system must align with?

ServiceNow and Cyberark

What products are currently being used from VMWare. Is any version of NSX being used and if so how many applications and clusters are using it. Has IRS installed VCF and if so how many applications & cluster are using it?

As this is a request for information and sources sought publication, the Government will not provide this information at this time.

Can the Government provide details on who will be responsible for application migrations and testing to the new virtualized platform?

Vendor, Application Teams, Sys admin groups, Technical Advisors, Virtualization SMEs.

Does the IRS have a preferred approach for migrating from the current VMware by Broadcom solution to the new virtualization platform?

No

Should all migrated workloads be assumed to be rehosted (“lift and shift”), or is re-platforming, refactoring and retiring applications within the scope of the RFI?

Lift and Shift

Regarding “warm-site replication,” what are your recovery time objectives and recovery point objectives?

RTO 2 hours, RPO 2-8 hours.

For the 1000 VMs, what are the current RTO/RPO? Can you describe your current disaster recovery and business continuity processes? Are there specific improvements you're seeking?

RTO 2 hours, RPO 2-8 hours. As this is a request for information and sources sought publication, the Government is interested in learning about industry opportunities for improvement.

What are your key performance indicators (KPIs) for the virtualized infrastructure? How do you measure success? What quantifiable outcomes does the IRS expect from this virtualization infrastructure investment?

As this is a request for information and sources sought publication, the Government is interested in learning about industry KPIs.

Are there specific performance metrics or SLAs from the current environment that must be maintained or improved upon in the new solution?

As this is a request for information and sources sought publication, the Government is interested in learning about industry SLAs.

Does the supplier have the ability to determine which tool(s) to use to provide all required reporting that is detailed in Task 5, Program Management?

Yes as long as the IRS has full access to the tools.

Section 5.5 specifies a specific IAM solution for SSO. What is that solution?

Must be PIV card compatible and integrated with CyberArk.

Are you currently able to move VMs from on prem to a public cloud? If you are using the public cloud, what provider?

As this is a request for information and sources sought publication, the Government will not provide this information at this time.

Is the Government open to consolidating its virtualization services with another existing private cloud environment?

Yes.

Regarding “Support both on-premises and external cloud service providers,” what on-premises providers are in scope?

The vendor will need to determine the solution.

Multi-Cloud Strategy: What specific multi-cloud platforms are being considered (AWS, Azure, GCP)? Is the Government open to Cloud based solutions like Amazon outpost to meet the Virtualization requirements? Does the IRS have a preference for on-premises solutions, cloud-based solutions, or a hybrid approach? Single or multi-cloud preference? Which CSP('s)?

Open to all cloud solutions. Likely will be a hybrid solution.

With the limited support from FedRAMP for "self-hosted" clouds, will the Government consider solutions implemented meeting moderate cloud baselines as defined in IRM 10.8.24?

Nothing below the IRM requirement will be considered.

Clarifying that the solution needs to be FedRAMP Moderate and not High. What additional security requirements and controls are needed beyond FedRAMP Moderate? Will IRS OIT entertain services with a provisional ATO status? Is FedRAMP compliance a requirement for on-prem hypervisor solutions? If so, low, moderate or high?

Nothing below the IRM requirement will be considered.

Compliance Requirements: Are there specific compliance requirements (e.g., PCI DSS, HIPAA) that dictate how you must secure sensitive data and applications within your virtualized environment?

Yes. 508 for example.

Workload Security Posture: How do you currently assess the security posture of individual workloads within your virtualized environment? Are there concerns about inconsistent security configurations or vulnerabilities across diverse applications?

Security postures are managed by the security team. Notifications with non-compliant concerns are brought to the teams attention with an expected resolution/response time.

Emerging Threats: What are the most significant security threats you anticipate facing in the coming years (e.g., ransomware, targeted attacks, supply chain vulnerabilities)?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Firewall Management Complexity: How complex is it to manage firewall rules across your existing infrastructure? Are there challenges in keeping up with changes in workloads or security threats?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Threat Detection Capabilities: How effectively are you able to detect and respond to advanced threats within your virtualized environment?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Reduced Attack Surface: What are your goals for reducing the attack surface and minimizing the impact of potential breaches?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Improved Threat Detection & Response: Are you looking to enhance your ability to detect, investigate, and respond to security incidents in a timely and efficient manner?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Can you provide more details on your security requirements, especially regarding FISMA High, PCI DSS, and IL5 compliance? Will the IRS require any specialized security requirements beyond the FedRAMP Moderate and FISMA High requirements mentioned?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Beyond the Program Manager's Secret clearance requirement, what specific clearance levels are needed for other key roles?

CI requires a second level clearance separate from the IRS.

Does the Government follow a certain framework or security audits currently?

Yes.

Do all resources require clearances or only the onsite personnel?

All require clearance.

Can we get a comprehensive list of disclosure documents containing requirements and policies?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

Draft SOW only includes Program Manager, System Architect, Developer/Engineer. Are these the only skillsets intended for the procurement or is the Government intending to provide specific skills, Labor Categories and Hours?

These are the only required skill sets seen for this implementation.

How is your current environment supported for Tier 1, 2, & 3 issues? Is this handled by Dell & VMware together? Under Task 3 O&M, the draft SOW mentions Tier I, II, II support. Does the Government intend for the vendor to provide their own IT Service Management (ITSM) service to support tickets or will incidents be managed through IR Works?

Yes, the intent is for the software solution to provide support at different Tiers at industry standard.

What are the current SLAs for each Tier? (Note, only Tier 3 SLA is called out)

As this is a request for information and sources sought publication, the Government is interested in learning about industry SLAs.

How do you envision the transition process? What level of support do you expect from the vendor during migration? How does IRS's tax season impact its transition from its current VMware environment?

The intent is for the vendor to supply the transition support during migrations and tax season if not implemented by January 1st. It is preferred migrations take place outside tax season.

How do you envision the training and knowledge transfer process for your team? Are there specific areas of expertise you're looking to develop?

Solution dependent however documentation and hands on training.

How will the IRS approach testing and acceptance of the new solution?

Product solutions will be reviewed, and a test implementation is required.

What type of knowledge transfer and training does the IRS expect for its staff during the transition?

Documentation and hands on training for IRS employees will be required depending on the proposed solution.

Is the IRS looking for the contractor to provide ongoing operational support after implementation, or will IRS staff assume operational responsibilities?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. Should the requirement move into a full solicitation phase, the Government will decide an appropriate method of sharing such information at that time.

The SOW mentions training for "at least eight (8) sessions with up to 14 IRS attendees." Is this the total number of staff requiring training, or will there be additional training requirements?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. The Government is interested in learning how industry would approach training IRS staff.

What, if any, major problems have you encountered with this current environment?

As this is a request for information and sources sought publication, the Government will not provide this information at this time. The Government is interested in learning how industry would design a solution to avoid, identify, and manage problems.

Given the current administration’s desire to reduce headcount, is the IRS considering how many FTEs it takes to run a proposed solution as part of Total Cost of Ownership (TOC) analysis?

The RFI/SSN was publicized to obtain market research about current industry practices and capable vendors in the marketplace. Full and actionable requirements will be formulated should this requirement become fully funded and ready for formal solicitation.