ISN-M RFI Vendor Questions Responses_4May26.xlsx
XLSX spreadsheet 27 KB Posted
- Attached to
- Installation Service Node Modernization (ISN-M)
- Solicitation number
- ISN-M-RFI2026
About this file
This file contains government responses to vendor questions submitted during the Request for Information (RFI) phase for the Installation Service Node Modernization (ISN-M) program, a significant Air Force IT initiative to consolidate and modernize disparate NIPR and SIPR network infrastructures. The RFI is being conducted by the Department of the Air Force Materiel Command Lifecycle Management Center at Hanscom Air Force Base and is intended for market research purposes only, with no guarantee of future contract award.
The government is evaluating multiple acquisition strategies and contract vehicles, including Commercial Solutions Openings (CSOs), Indefinite Delivery/Indefinite Quantity (IDIQ) contracts, Government-Wide Acquisition Contracts (GWACs), Enterprise Software Agreements (ESAs), and small business set-aside vehicles, with final strategy determination based on market research. Vendors are expected to independently derive Total Cost of Ownership (TCO) baselines that comprehensively address hardware, software licensing, labor, sustainment, power, cooling, and refresh costs, while proposing strategies for managing pricing volatility. The government requires vendors to describe detailed infrastructure pricing methodologies, including bundling approaches, recurring cost calculations, existing volume licensing utilization, and implementation versus sustainment cost breakdowns. The ISN-M solution must operate effectively in both connected and disconnected environments, support a common hardware and software baseline across NIPR and SIPR with functional equivalence acceptable where security differs, and adhere to DoD and Air Force STIGs and Risk Management Framework requirements. Implementation is anticipated to be phased across approximately 186+ sites with a low single-digit percentage annual growth assumption over five years, and vendors will be responsible for site surveys, migration planning, and providing infrastructure hosting and cutover support. Additional RFI responses address operating models (hybrid GOCO/GOGO), 24/7 global support requirements with cleared personnel at CONUS and OCONUS locations, hypervisor-agnostic architecture openness, and vendor lock-in reduction through infrastructure-software decoupling. Submission deadlines include April 24, 2026 for the GSA MRAS platform and May 8, 2026 for the SAM.gov platform, with concurrent submissions encouraged.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| ISN-M RFI Cover Page_Final_9Apr26.pdf | ||
| ISN-M SOO_Final _9Apr26.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| ID | Category | Question | Government Response |
| Q1 | ACQUISITION, STRATEGY, & PRICING | What contract vehicle is being considered (CSO, IDIQ, etc.) and expected timeline? | The Government is currently evaluating a full spectrum of acquisition strategies and contract vehicles to best meet this requirement. This includes, but is not limited to, Commercial Solutions Openings (CSOs), Indefinite Delivery/Indefinite Quantity (IDIQ) contracts, existing Government-Wide Acquisition Contracts (GWACs), Enterprise Software Agreements (ESAs), and targeted Small Business or 8(a) set-aside vehicles. The final acquisition strategy, vehicle selection, and formal timeline will be determined based on the market research gathered through this process. |
| Q2 | ACQUISITION, STRATEGY, & PRICING | How will pricing volatility (hardware/software) be handled over the lifecycle of the program? | The Government generally expects the contractor to manage and account for potential pricing volatility (hardware and software) within their proposed solution. While the Government will not inherently assume this risk, respondents are encouraged to describe any proposed strategies, mechanisms, or structured relief options they would utilize to manage extreme pricing fluctuations over the program's lifecycle. |
| Q3 | ACQUISITION, STRATEGY, & PRICING | Will the Government provide an authoritative current Total Cost of Ownership (TCO) baseline, or are offerors expected to independently derive the baseline? | Offerors are expected to independently derive a TCO baseline as part of their response. |
| Q4 | ACQUISITION, STRATEGY, & PRICING | Which cost categories must be included in TCO calculations (e.g., hardware, software licensing, labor, sustainment, power, cooling, refresh)? | The Government expects TCO calculations to be comprehensive and include, at a minimum, the cost categories listed in the question (hardware, software licensing, labor, sustainment, power, cooling, and refresh). |
| Q5 | ACQUISITION, STRATEGY, & PRICING | To ensure responses align with expectations, please clarify the specific information required in response to Technical Question #7 ('Describe your company's infrastructure pricing model, e.g., space, power, network connectivity, support'). This phrasing is typically associated with a Hosting Service Provider. Does the proposed solution intend to include hosting services, and what is the specific intent of this question? | The intent is not to mandate a specific Hosting Service Provider model, but to understand the various methodologies available for pricing complex infrastructure deployments and ongoing sustainment. At a minimum, respondents should clarify the following specific areas of the proposed infrastructure pricing methodology: |
1. How hardware, software, and long-term support are bundled or separated within the pricing structure.
2. The methodology for calculating recurring costs such as power, space, and network connectivity.
3. The extent to which the Government would be able to utilize existing Volume Licensing Agreements (VLAs) or Enterprise License Agreements (ELAs) for software components within the proposed solution.
4. The breakdown of one-time implementation/installation costs versus ongoing sustainment and maintenance fees.
While these are the primary areas of interest, respondents are encouraged to provide any additional details or innovative pricing structures they believe would be beneficial to the Government.
Q6 ACQUISITION, STRATEGY, & PRICING Please clarify the reason for two different submission dates on this opportunity (GSA MRAS vs. SAM.gov). Are vendors on a GSA MAS vehicle required to submit by the earlier GSA deadline of April 24, 2026, as opposed to the SAM.gov deadline of May 8, 2026? The Government is utilizing two distinct and parallel methods for market research, resulting in different submission timelines:
1. GSA MRAS RFI: Supplemental effort managed by GSA to provide independent analysis and insights regarding vendors available through GSA contract vehicles.
2. SAM.gov RFI: Primary market research effort conducted directly by the Air Force PMO.
Submission through the GSA RFI (due 24 April 2026) is not required. Responses may be submitted through the GSA RFI, the SAM.gov RFI, or the two platforms concurrently. Submission to the available platforms is encouraged to provide the most comprehensive data set. Responses will be reviewed independently and consolidated as part of the overall market research effort.
| Q7 | ARCHITECTURE & DESIGN | What is the target end-state architecture for ISN-M (e.g., HCI-based, hybrid cloud-enabled, or platform-agnostic)? | The Government's primary objective is to acquire an innovative and sustainable NIPR and SIPR infrastructure solution. The Government is open to various modern architectural approaches, provided they meet the core requirement to operate effectively in both connected and disconnected environments. |
| Q8 | ARCHITECTURE & DESIGN | Is the Government open to hypervisor-agnostic solutions, or is there a preferred virtualization stack? | Yes, the Government is open to hypervisor-agnostic solutions. |
| Q9 | ARCHITECTURE & DESIGN | What are the minimum compute, storage, and network performance requirements per site? | Minimum requirements will be based on the core services and applications the Government provides as GFE, plus any anticipated new workloads and established performance thresholds. Offerors should describe their methodology for sizing an appropriately-scaled solution. |
| Q10 | ARCHITECTURE & DESIGN | Is there interest in decoupling infrastructure from hypervisor/software to reduce vendor lock-in? | Yes, the Government has a strong interest in solutions that reduce vendor lock-in by decoupling the infrastructure from the software and hypervisor layers where feasible. |
| Q11 | ARCHITECTURE & DESIGN | How does the Government define a “common hardware and software baseline” between NIPR and SIPR—must components be identical, or is functional equivalence acceptable where security constraints differ? | The Government defines a "common baseline" as a standardized, unified technical architecture and management framework to be applied across both network infrastructures. The emphasis is on standardizing the architectural design and operational processes rather than mandating strictly identical physical hardware. Functional equivalence is acceptable to accommodate differing security constraints or performance requirements between specific enclaves. |
As the Government is currently refining its implementation priorities, respondents are encouraged to describe architectures that can be deployed securely and efficiently to high-priority environments first, while maintaining the potential for enterprise-wide scalability.
| Q12 | CYBERSECURITY & ATO | Will there be an existing ATO baseline to inherit, and what is the target ATO timeline? | The solution is expected to inherit the existing ATO. The next ATO renewal is scheduled for submission by October 2026. |
| Q13 | CYBERSECURITY & ATO | Are there mandated STIG baselines or security tools that must be pre-integrated? | Yes, offerors should assume that adherence to mandated DoD and Air Force STIGs and the integration of specific security tools will be required. |
| Q14 | CYBERSECURITY & ATO | Which cybersecurity frameworks and baseline standards should be considered authoritative for this effort (e.g., CSRMC, RMF, Zero Trust Architecture targets, DISA STIG versions)? | All activities must adhere to the Risk Management Framework (RMF) as defined in DoDI 8510.01. The authoritative standards include all applicable DoD and Air Force cybersecurity policies and DISA STIGs for the components proposed. |
| Q15 | CYBERSECURITY & ATO | Should offerors plan for inheritance of existing ATOs, or assume a new accreditation boundary and full RMF lifecycle for the unified ISN solution? | Offerors should plan for the full lifecycle management of the solution's Authorization to Operate (ATO). |
| Q16 | INTEGRATION | What workloads are expected to remain on-prem vs migrate to cloud or hybrid environments? | The Government is currently evaluating the optimal mix of on-premises, cloud, and hybrid environments for its core services and workloads. The specific workloads intended for migration are at the vendor's discretion to propose as part of their overall architectural strategy. |
Offerors should describe their methodology for determining which workloads are best suited for each environment. However, any proposed solution must guarantee that critical infrastructure and services remain fully operational in both connected and disconnected states to ensure continuity of operations.
| Q17 | INTEGRATION | How should ISN-M integrate with JWCC, Azure, or other DoD cloud environments? | Direct integration with specific cloud environments like JWCC or Azure is not a requirement for this effort. |
| Q18 | INTEGRATION | What are the requirements for integration with existing enterprise management centers? | The proposed solution must be designed to be operated by Air Force personnel within designated enterprise management centers. |
| Q19 | INTEGRATION | Will the Government provide a responsibility matrix (e.g., RACI) defining roles and boundaries between the ISN contractor and EITaaS Wave 1 providers? | The Government will not provide a formal responsibility matrix (e.g., RACI) at this stage of the RFI process. Offerors should describe their methodology and past experience in establishing clear roles, boundaries, and integration points with existing enterprise service providers and associate contractors. |
As the Government is currently refining its implementation strategy, respondents are encouraged to highlight how their proposed management framework can adapt to various operational models and demarcations of responsibility.
| Q20 | OPERATIONS, SUSTAINMENT, & MANAGEMENT | What is the intended operating model (GOCO, COCO, or hybrid)? | The Government anticipates a hybrid operating model, incorporating both Government and contractor responsibilities. |
| Q21 | OPERATIONS, SUSTAINMENT, & MANAGEMENT | What are the expectations for Tier I–III support responsibilities between OEM, integrator, and Government? | Respondents should describe their notional approach to providing Tier I-III support within both a Government-Owned, Government-Operated (GOGO) and Government-Owned, Contractor-Operated (GOCO) construct. |
| Q22 | OPERATIONS, SUSTAINMENT, & MANAGEMENT | Is 24/7 global support with cleared personnel required at all CONUS and OCONUS sites? | Yes, offerors should assume a requirement for 24/7 global support that includes cleared personnel for CONUS and OCONUS locations. |
| Q23 | OPERATIONS, SUSTAINMENT, & MANAGEMENT | Is there a requirement for pre-positioned spares at critical locations? | While there is no definitive requirement for pre-positioned spares, offerors should describe their sparing strategy, particularly for remote or OCONUS locations, to meet required service level agreements. |
| Q24 | OPERATIONS, SUSTAINMENT, & MANAGEMENT | Will the contractor have authority to enforce configuration baseline compliance across the enterprise, or will final configuration control remain with Government or base-level authorities? | The proposed infrastructure must be designed to operate within a Technical Order Controlled System environment. As such, final configuration control and enforcement authority will remain with the Government, in accordance with formal Air Force technical data and publication standards. |
| Q25 | OPERATIONS, SUSTAINMENT, & MANAGEMENT | Will the Government provide an enterprise Out-of-Band Management (OOBM) network, or is the contractor expected to design and deploy OOBM connectivity for the enterprise or at each site specifically? | The contractor is not expected to design or deploy new Out-of-Band Management (OOBM) connectivity. The proposed solution must be fully manageable via the existing Government-provided OOBM network. |
| Q26 | OPERATIONS, SUSTAINMENT, & MANAGEMENT | For the listed core services (e.g., AD, DNS, MECM, CyberArk), which services are considered enterprise-managed, base-managed, or contractor-managed? | The Government is still refining the management responsibilities for specific core services. Offerors may assume that services could be either enterprise-managed or contractor-managed. |
| Q27 | OPERATIONS, SUSTAINMENT, & MANAGEMENT | What systems or tools will serve as the authoritative source for KPI measurement, and will minimum acceptable performance thresholds be defined for metrics such as uptime, MTTR, and vulnerability patch timelines? | The Government is unable to answer this question at this time. Key Performance Indicators (KPIs) and their associated metrics will be formally defined for any future contract action. |
| Q28 | PROTOTYPING & PHASING | For Phase I prototype efforts awarded under the CSO, how many installation sites, enclaves (NIPR and/or SIPR), and ISN stacks should offerors assume per prototype award? | The Government is unable to answer this question at this time. The Government, at its discretion, may award a follow-on prototype contract. The objective of any prototype is to deliver a final design that can serve as the blueprint for the entire enterprise. |
| Q29 | PROTOTYPING & PHASING | Is the Phase I prototype expected to be representative of a full production deployment (including hardware scale, security controls, and licensing), or may offerors propose a reduced-scale environment? | The scale of any potential prototype is at the offeror's discretion. The proposal should clearly justify how the proposed scale is sufficient to validate the solution's architecture and performance claims. |
| Q30 | PROTOTYPING & PHASING | What objective technical, cost, and performance criteria will the Government use to determine “successful prototype” and eligible to inform Phase II? | A successful prototype will be evaluated on a combination of technical performance, lifecycle cost projections, and adherence to performance criteria that will be defined in any possible future solicitation. |
| Q31 | SCOPE, SCALE, & MIGRATION | Will ISN-M be executed as a full enterprise rollout or phased by site/region? | The Government anticipates a phased implementation approach. |
| Q32 | SCOPE, SCALE, & MIGRATION | Are all ~186+ sites in scope for initial award, or will there be prioritization tiers? | The Government is currently refining its site implementation and prioritization strategy. Respondents should not assume all sites are in scope for an initial award. |
| Q33 | SCOPE, SCALE, & MIGRATION | Will the contractor be responsible for site surveys and legacy migration planning? | Yes, the contractor will be responsible for activities related to site surveys and migration planning. |
| Q34 | SCOPE, SCALE, & MIGRATION | Will a parallel/dual-stack environment be required during transition? | The legacy system will remain operational during the transition to the new architecture to ensure continuity of service. |
| Q35 | SCOPE, SCALE, & MIGRATION | Approximately how many NIPR and SIPR ISN locations are currently in scope, and what growth assumptions should offerors use for a five-year planning horizon? | The Government is still refining the final site-count and growth assumptions. For the purpose of this RFI, respondents may assume a low single-digit percentage for annual growth. |
| Q36 | SCOPE, SCALE, & MIGRATION | Does “migration” include contractor responsibility for data, identity, and application migration, or is scope limited to infrastructure hosting and cutover support? | The term "migration" encompasses contractor responsibility for infrastructure hosting and cutover support, as well as providing the necessary tools and processes to enable the Government's migration of data, identity, and applications. |
File details come from the government source that posted it. Updated .