MEMS RFI_M67854-26-I-4925_Govt Responses.pdf

Q# RFI Reference RFI Response

Will the Government require that the proposed solution operate entirely on-premises with zero dependency on vendor-operated cloud infrastructure for any function — including but not limited to license validation, telemetry ingestion, anomaly detection, AI/ML processing, product updates, or long-term data retention? Please confirm whether any outbound network connection to vendor cloud infrastructure would be disqualifying.

The Government require that the proposed solution operate entirely on-premises with zero dependency on vendor-operated cloud infrastructure for any function. System operating under MEMS must remain isolated from external/vendor-managed cloud services.

Does the Government require that the proposed solution's AI/ML analytics, anomaly detection, and automated baselining functions operate entirely within the on-premises deployment without offloading computation to vendor cloud services? If so, is this a mandatory requirement or a desired capability?

Yes. When MEMS rules prohibit outbound connections, AI/ML analytics must run fully on-prem, and in that context it's a mandatory requirement, not just a preference.

Will the Government require the vendor to provide a written attestation that no telemetry data, configuration data, or metadata collected from MCEN devices will transit vendor infrastructure at any time, including during software updates or product diagnostics?

Yes

The RFI states the solution must operate in IL5 and IL6 environments. Does the Government require the vendor to hold an existing, current Authority to Operate (ATO) or Provisional Authorization (PA) for an on-premises deployment at IL5 and IL6 at the time of proposal submission? Or will the Government accept a plan to achieve accreditation post-award?

Existing approval is required

Given the classified nature of the operating environment, will the Government require that the prime contractor and all subcontractors performing on this contract be U.S.-owned companies with no Foreign Ownership, Control, or Influence (FOCI) as defined by the

National Industrial Security Program Operating Manual (NISPOM)? If FOCI exists, will a mitigation agreement (e.g., Special Security

Agreement, Proxy Agreement) be required prior to award?

The Government would require the prime contractor and all subcontractors performing on this contract be U.S.-owned companies.

Will the Government require that all technical support, help desk personnel, and engineers with access to MCEN data or systems be

U.S. citizens holding active security clearances? Will offshore or third-country-national support be explicitly prohibited under the contract?

Government plans on requiring that all technical support, help desk personnel, and engineers with access to MCEN data or systems be U.S.

citizens holding active security clearances. Offshore or third-country-national support WILL be explicitly prohibited.

Will the Government require that the proposed solution's source code development, security patching, and vulnerability remediation be performed exclusively by U.S.-based personnel in U.S. facilities? If so, will vendors be required to certify this in writing as part of their proposal?

Yes, this is the hard compliance requirements, not a preference.

The RFI states "where practical, a single solution that integrates all requirements should be implemented." Will the Government require that all capability areas listed in Table 1 — specifically Network Health & Performance Monitoring, NetFlow & Traffic Analysis, Network

Device Configuration Management, Application & Services Monitoring, Virtualization Infrastructure Management, and Call Center Traffic

Quality Management — be delivered by a single vendor's natively integrated platform rather than a consortium of separately licensed third-party tools integrated by a prime contractor?

It is the Government’s preference that solutions be delivered via a single platform. If meeting the requirements means using multiple tools, the analysis of solutions will have to factor in any additional costs for licenses/hardware and also the possible increase in labor hours to manage/operate multiple tools

Will the Government require that a vendor proposing a "suite" of products demonstrate that all modules share a single database, single authentication framework, single web console, and single licensing agreement — as opposed to separate products with API-based data exchange between them? What weight will single-platform integration receive in the technical evaluation?

Every solution will be compared against the same weight system but there will be a reduction for any solution that requires additional labor to support sustainment or operational activities as compared to sustaining and operating one system.

The requirement includes monitoring of VoIP call quality, CDR/CMR data, and IP SLA operations. Will the Government require this capability to be a native module of the proposed platform rather than a third-party integration? If so, which specific IP SLA operation types (HTTP, FTP, DNS, DHCP, UDP Jitter, VoIP UDP Jitter, ICMP Path Echo) must be supported out-of-the-box without custom development?

Every solution will be compared against the same weight system but there will be a reduction for any solution that requires additional labor to support sustainment or operational activities as compared to sustaining and operating one system. Preference is to at least measure

UDP Jitter, VoIP UDP Jitter, ICMP Path Echo

The requirement includes Network Device Configuration Management (automated config backup, bulk changes, compliance policy enforcement, DISA STIG auditing, Cisco ASA ACL visualization). Will the Government require this to be a native capability of the proposed platform, or will a separately licensed third-party configuration management tool integrated via API be acceptable?

Every solution will be compared against the same weight system but there will be a reduction for any solution that requires additional labor to support sustainment or operational activities as compared to sustaining and operating one system.

The requirement states the solution must "detect configuration policy violations to ensure compliance with federal regulations." Will the

Government require the proposed solution to include pre-built, out-of-the-box compliance policy templates for DISA STIGs (Network

Devices, Cisco IOS, Juniper), NIST FISMA, and DoD 8500 standards — without requiring the Government or contractor to author custom compliance scripts? If so, which specific STIG benchmarks must be supported at time of delivery?

Every solution will be compared against the same weight system but there will be a reduction for any solution that requires additional labor to support sustainment or operational activities as compared to sustaining and operating one system.

Will the Government require the solution to perform automated firmware vulnerability scanning by cross-referencing monitored device firmware versions against the NIST National Vulnerability Database (NVD) in real time, and generate prioritized remediation recommendations — without requiring manual vulnerability database imports or third-party scanning tools?

Any automation that saves manpower time and effort will be evaluated with higher weighting

Does the Government require that the solution support DISA STIG-compliant deployment configurations (TLS 1.2+, FIPS 140-2 validated cryptography, DoD PKI integration, CAC/PIV authentication) as a baseline deployment posture — not as an optional hardening add-on — and that the vendor provide a DISA-reviewed STIG or Security Technical Implementation Guide for the product itself?

The solution must meet STIG requirements

The RFI requires the solution to "extend to the tactical edge" and "execute functions when disconnected from the network." Will the

Government require that remote data collection components (polling engines, agents, or probes) deployed at the tactical edge continue to collect, store, and buffer telemetry locally during periods of WAN disconnection — and automatically resync to the central management platform upon reconnection — without any data loss? What is the minimum required local buffering duration (e.g., 24 hours, 72 hours, 7 days)?

Yes, 72 hours of buffer

Will the Government require the solution to support hierarchical, multi-tier deployment with a central enterprise console, regional aggregation nodes, installation-level polling engines, and tactical edge collectors — all managed from a single pane of glass with unified

RBAC — where each tier can operate independently if upstream connectivity is lost?

Yes

For tactical edge deployments operating in bandwidth-constrained environments, will the Government require the solution to support WAN-optimized communication protocols between remote polling engines and the central management server — including data compression, configurable polling intervals, and bandwidth throttling — to minimize impact on limited tactical transport capacity?

This is preferred

The RFI requires CAC/PIV authentication. Will the Government require that CAC/PIV authentication be natively enforced at the application layer — meaning users cannot authenticate via username/password as a fallback — and that this enforcement apply to all user roles including administrative accounts? Will solutions that offer CAC as an optional configuration rather than an enforced baseline be considered compliant?

As long as CAC authentication and access is supported, this requirement will be met

Will the Government require integration with Active Directory at the group policy level for RBAC — meaning that user roles and permissions within the monitoring platform are automatically inherited from and synchronized with existing AD Organizational Unit (OU) structure and group memberships — without requiring manual role assignment within the monitoring tool itself?

Yes

The RFI requires the solution to "not impose a cap on the number of devices and equipment monitored." Will the Government require that the licensing model be node-based or element-based rather than consumption-based, data-ingestion-based, or per-user — ensuring that monitoring costs remain predictable regardless of data volume, event frequency, or number of concurrent users? Will solutions with uncapped data ingestion charges or consumption-based billing be evaluated differently for total cost of ownership?

The Government does not have a preference for licensing model. Cost will be evaluated separate from technical capability. As long as you meet the technical capability (ability to support the enterprise node count with capability of expanding as necessary) then system costs will be compared to other systems that meet the requirements

The RFI references the SolarWinds Enterprise Operations Console scaling to enterprise environments. Will the Government require that a single licensing agreement cover all distributed deployment components — including central servers, remote polling engines, tactical edge collectors, and web console users — without separate per-engine or per-site licensing fees?

The Government does not have a preference for licensing model. Cost will be evaluated separate from technical capability. As long as you meet the technical capability then system costs will be compared to other systems that meet the requirements

Will the Government require that 24x7 technical support be provided exclusively by U.S. citizens holding active Secret or higher clearances, with no offshore escalation paths — and that this requirement be contractually enforceable with financial penalties for non-compliance? Will vendors be required to identify their support center locations and staff clearance levels in their proposal?

The Government will require that 24x7 technical support be provided exclusively by U.S. citizens holding active clearances. Yes proof of identify and clearance level for support staff will be required.

Will the Government require that the proposed solution be available for purchase through a pre-existing DoD Enterprise Software

Initiative (ESI) Blanket Purchase Agreement (BPA) with pre-negotiated intellectual property terms and conditions applicable to classified

Government procurements? If so, will vendors not currently on an ESI BPA be required to demonstrate an equivalent existing IP agreement with the DoD?

Pre-existing agreements will be taken into consideration in final selection of the system when considering the time and effort that will be required to procure the system

Will the Government require that the vendor's proposed solution have been previously deployed and operationally accepted within at least one DoD or Intelligence Community program of record operating at IL5 or above at time of proposal submission — with verifiable past performance references? Or will the Government accept proposed solutions without existing classified DoD deployments?

The Government will review all responses to this RFI

25 General Requirements – Mapping & Discovery What network discovery mechanisms are enabled across MCEN segments (e.g., CDP, LLDP based discovery)? CDP and SNMP

26 Network Discovery Are all MCEN network segments reachable from a centralized discovery and collection point, or are distributed collectors required for isolated or tactical segments?

All segments are reachable, however, some segments (such as tactical) may be intermittent and we would like to capture data from those segments once connectivity is restored

27 Network Discovery What is the mix of routed protocols in use? IPV4, IPV6? Any old legacy protocols e.g. DecNet, SNA etc? IPv4 currently with plans to roll out IPv6 soon

28 Network Discovery What are the routed/infra protocols in use. E.g. BGP, OSPF, EIGRP, MPLS, 8021.q, VRF, etc.

You can expect common protocols to be in use such as: BGP, OMP, OSPF, IS-IS, EIGRP, 802.1q, LACP, TACACS, RSTP, SSH, SCP, NTP, syslog, udld, DHCP

29 Network Discovery Is most of the WAN infrastructure discoverable or obfuscated via black box tunnels. E.g. Tunnels not directly controlled by MCEN? Most is discoverable

30 Integration – Enterprise Ticketing Does the MCEN enterprise ticketing system expose a REST or SOAP API for bi‑directional incident synchronization?

Yes to both, but REST API is recommended by the vendor of the ticketing system

31 Integration – Enterprise Ticketing Can Help Desk telemetry (e.g., ticket volume, MTTR) be accessed programmatically for correlation and analytics purposes? Yes

32 Integration – Adjacent Systems Is Kafka deployed or designated as a telemetry broker on MCEN, and should integrations be performed via Kafka or directly with downstream systems (e.g., SIEM)?

Kafka is deployed although some systems interface directly with other systems, either will work, but operator labor required to support the system will be weighted

33 Integration – Enterprise Ticketing Are the enterprise NOC and the help desk operating on the same ticketing instance, or are separate integrations required? Same

34 Situational Awareness Dashboards Does MCEN currently operate an established Common Operational Picture or situational awareness dashboard that MEMS must integrate with?

We have a ticketing system, a SIEM and a Big Data Platform that MEMS must integrate with

35 Call Center Traffic Quality Management Is a centralized enterprise call‑control or unified communications platform deployed to support active VoIP quality monitoring? No 36 Call Center Traffic Quality Management Are there any on-network node collectors configured and or available? For example, IP SLA? No

37 Call Center Traffic Quality Management Which unified communications or call‑control platforms are used in tactical or Fleet Marine Force environments?

The assumption can be made that we use standard ports and protocols for this service

38 Security and Encryption Which eMASS authorization boundary and RMF package will the MEMS solution be assessed under? The MEMS solution will be under it's own RMF package

39 Security and Encryption Is IL5 sufficient for initial pilot or fielding activities, or is IL6 required prior to initial operational capability?

All solutions will be considered, however, the timeline to reach FOC (based on ability to deploy to IL6) will be factored in the total evaluation of the system

40 Authentication Does the MCEN identity environment support SAML 2.0 or OIDC service provider onboarding for new applications, including IL6 environments?

We are still building out the IL6 environment but both will be supported.

41 Tactical Edge / Fielding Which tactical edge environments are in scope (e.g., afloat, expeditionary, FOB, air‑gapped nodes)?

Any deployable unit that may have intermittent connectivity based on mission support requirements within a location

42 Tactical Edge / Disconnected Ops What functionality is required during disconnected or DDIL operations (e.g., local monitoring only, data buffering, full triage)? Local monitoring and buffering to sync when connectivity is restored

43 Tactical Edge / Deployment What is the minimum hardware profile that will need to be supported at the tactical edge deployment (CPU, memory, storage)?

The minimum hardware profile would be whatever is needed to meet the requirements, the vendor would tell us this information. If you are asking what will need to be managed at the tactical site, you can assume infrastructure, services and end user devices to support about 150 people

44 Enterprise Scalability Approximately how many network infrastructure devices and endpoints are in scope at full operational deployment? 225k IL5 and 25k IL6

45 Enterprise Scalability What is the general mix of endpoints? Windows (versions), Linux (distros). Network MGF (e.g. Cisco Juniper, Palo Alto), Other.

130k Windows IL5 with a mix of the rest, 15k Windows IL6 with a mix of the rest

46 Enterprise Scalability What is the general mix of servers? Windows, Linux, Unix, other Mostly Windows but some UNIX/Linux

47 Graphical User Interface & Users How many concurrent users are expected at peak usage, and what proportion require administrative versus read‑only access?

50 admin peak average, 30 read only peak average with the ability to support additional as needed

48 User Experience / Behavioral Indicators Is automated correlation of existing help desk metrics a Day‑1 requirement for behavioral and attitudinal indicators?

As long as the requirement can be met by FOC is fine. FOC timeline will have to be taken into account if that is the case.

49 User Experience / Behavioral Indicators Is active end‑user feedback collection (e.g., surveys or usability scoring) required at any phase of deployment?

As long as the requirement can be met by FOC is fine. FOC timeline will have to be taken into account if that is the case.

50 Coalition Considerations Is cross‑command interoperability or data sharing with joint force, MARFORCYBER, or USCYBERCOM systems required at Day‑1?

As long as the requirement can be met by FOC is fine. FOC timeline will have to be taken into account if that is the case.

51 Core Monitoring Capabilities Are Session Border Controllers deployed at the enterprise or tactical level, and is SBC monitoring required in the initial deployment?

No, they are at the BAN level, as long as the requirement can be met by FOC is fine. FOC timeline will have to be taken into account if that is the case.

52 Deployment How many CONUS and OCONUS locations will require onsite deployment support?

Up to 5 physical locations for support of the enterprise system, support personnel will not deploy with units to support the solution

53 Deployment Options Is a centralized, distributed, or hybrid deployment architecture preferred?

Centralized management, with options to provide distributed RBAC for on-prem, cloud and deployed

54 High Availability Should the MEMS solution inherit high availability from an existing MCEN platform, or provide its own high‑availability architecture?

High availability should be built into the solution itself and should not rely on other infrastructure unless the solution is a virtual application without it's own hardware

Background, page 1; Question 14, page 3. “other factors or considerations that Government should review”

Given that this requirement appears similar to a prior industry outreach effort, can the Government share any lessons learned or material changes in scope, funding, priorities, or acquisition strategy that informed release of the current RFI?

The rapid development of industry's technology influenced the release of this RFI to assist the Government in having up-to-date information.

Table 1 – Proposed Consolidated Solution, page 3: “Where practical, a single solution that integrates all requirements should be implemented.”

Can the Government clarify whether it is seeking a single platform, or whether an integrated multi-tool approach would be acceptable where it better satisfies the full requirement set?

It is the Government’s preference that solutions be delivered via a single platform; for this RFI solutions with a multi-tool approach will also be reviewed.

Table 1 – Solution Characteristics, page 3: “extend to the tactical edge” / “autonomous syncing capability” / “able to execute functions when disconnected from the network”

Can the Government further define the intended operational scope of support at the tactical edge, including which capabilities must remain available when operating in a disconnected or intermittently connected environment?

Local monitoring and buffering to sync when connectivity is restored

What architectural deployment models are acceptable for MEMS to include containerized microservices, virtual appliances, traditional server-based deployments, or managed platform approaches?

All are acceptable and will be evaluated the same

Table 1: Platform Security, page 10: The third requirement listed under Platform Security states “The solution shall not require consultants for deployment, implementation, configuration, or customization.

Can the government clarify the requirement? One way to interpret this requirement is that the government is not expecting any professional services as part of this solution and that the solution should be able to be turned over to USMC employees for configuration and deployment in the MCEN environment using the manuals/guides provided with the product. Was that the government’s intent by including this requirement?

If not, please clarify.

Cost will be evaluated separate from technical capability. As long as you meet the technical capability then system costs will be compared to other systems that meet the requirements. If a solution requires full time OEM support for the system vs the ability to have the system operated by Civilian/military personnel, that will be evaluated

How important is it for the Government to avoid long-term dependency on proprietary platforms, licensing models, or vendor-controlled data pipelines?

Cost will be evaluated separate from technical capability. As long as you meet the technical capability then system costs will be compared to other systems that meet the requirements.

61 Does the Government prefer solutions built on open-source platforms More importantly is the ability to get the solution approved through the RMF process

62 Is the Government interested in incorporating private LLM-based capabilities to support analysis of unstructured or non-numeric event data?

This will be considered, thanks for bringing this up, but it is not an immediate requirement for this system

Is the government open to a custom-built AI-based solution to address the documented requirements in lieu of a COTS events management product?

The Government will review all responses to this RFI.

64 Post RFI, would the Government consider meeting with vendors for a deep analysis into this solution's requirements?

The Government will meet with vendors post RFI submission if time is available.

65 Can we include supplemental appendices along with our 30-page response document? No

Is it acceptable to provide our responses without using tables in Microsoft Word, as long as we maintain the same order and organization of the requirements?

This is fine; as long as we can trace the responses back to the requirements.

67 Are the title page, cover letter, and table of contents included in the 30 page limit?

Title page, cover letter, and table of contents are not included in the 30 page limit

Does the Government intend “single solution” to mean a single product, or is a federated best‑of‑breed architecture with integrated platforms acceptable?

It is the Government’s preference that solutions be delivered via a single platform. If meeting the requirements means using multiple tools, the analysis of solutions will have to factor in any additional costs for licenses/hardware and also the possible increase in labor hours to manage/operate multiple tools

69 Are all Table 1 requirements weighted equally, or will certain capability areas receive higher evaluation emphasis?

For this RFI all requirements will be evaluated equally, however, if we deem meeting a requirement a certain way might increase labor requirements, there will be a deduction

Can the Government clarify how proposed MEMS capabilities are expected to align with existing MCEN systems, including whether they are intended to replace, enhance, or complement current solutions

This MEMS solution is intended to be the sole system to meet all requirements outlined in the RFI. However, to perform that functionality, the system, must be able to gather the required data from other systems

Describe how your product supports network segmentation.

What is meant by network segmentation?

Segmentation is logically separating traffic based on type, user or other factors

Core Monitoring Capabilities - The solution shall be able to monitor wireless devices

Every RF/data link device is a wireless device. Does this refer to anything more specific than this? wi-fi connected devices

Core Monitoring Capabilities - The solution shall be able to monitor Section Board Controller (SBC)

Does this refer to Single Board Computer? Session Border Controllers

Core Monitoring Capabilities - The solution shall automatically provide real-time, in-depth network performance statistics after discovery/configuration of devices, including but not limited to: Packet loss

Please provide more details Requirement is written for vendors to provide solution capabilities to the Government for review of current technological landscape.

Additional Components - The solution shall be able use external authentication server like

RADIUS/TACACS.

Please provide more details Requirement is written for vendors to provide solution capabilities to the Government for review of current technological landscape.

Additional Components - The solution shall be able to discover all security contexts on Cisco ASA and individually handles configuration backup and restore.

Please provide more details Requirement is written for vendors to provide solution capabilities to the Government for review of current technological landscape.

Additional Components - The solution shall be able to visualize ACLs configured on Cisco ASA, with the ability to detect and notify on changes on ACLs, display rules hit count, identify shadow and redundant rules.

Please provide more details Requirement is written for vendors to provide solution capabilities to the Government for review of current technological landscape.

Core Monitoring Capabilities - The solution shall be able to get Disk I/O Performance Metrics for Processes & Services Monitored via WMI.

Please provide more details Requirement is written for vendors to provide solution capabilities to the Government for review of current technological landscape.

GUI and Customization – The solution shall have horizontal scaling options available to support high volumes of users.

Please provide more details Requirement is written for vendors to provide solution capabilities to the Government for review of current technological landscape.

80 Disconnected / Offline Operations The RFI requires autonomous syncing capability and the ability to execute functions when disconnected from the network. Can the Government clarify the expected maximum disconnection duration, the types of functions that must remain operational during disconnection, and whether local data buffering with automatic sync-on-reconnect satisfies this requirement?

72 hours of buffering, while disconnected - Local monitoring and buffering to sync when connectivity is restored

81 Consolidated Solution Architecture The RFI requires a consolidated solution. Will the Government require all capabilities (SIEM, observability, network monitoring, flow analysis, APM) to reside in a single unified data store with a common schema, or will siloed products with separate databases and separate UIs that are loosely integrated be acceptable?

Every solution will be compared against the same weight system but there will be a reduction for any solution that requires additional labor to support sustainment or operational activities as compared to sustaining and operating one system.

82 Role-Based Access Control Granularity The RFI requires RBAC. Will the Government clarify whether coarse-grained role-based access (e.g., read/write/admin) is sufficient, or whether the requirement includes field-level and document-level security — meaning individual users can be restricted from seeing specific data fields or documents within the same index based on their clearance, region, or organizational unit?

The expectation is that access can be tailored down to a region or site. A site admin might want to only see infrastructure for a specific location.

83 End-of-Life / End-of-Support (EoL/EoS) Information The RFI requires EoL/EoS information. Will the Government accept a solution that enriches device inventory data with EoL/EoS feeds from external sources (e.g., vendor APIs, NIST NVD, custom lookup tables) displayed in unified dashboards, rather than requiring a hardcoded internal EoL database?

If the AO will approve the solution to call out to external resources, we will consider that, however, this capability is needed even if external reach back is not approved.

84 Dynamic Baselining and Automatic Threshold Setting The RFI requires dynamic baselining and automatic threshold setting. Will the Government consider machine learning-based anomaly detection that automatically learns normal behavior and alerts on deviations — without requiring administrators to manually set Warning/Critical thresholds — as meeting or exceeding this requirement?

It depends on if this capability requires external connectivity back to a vendor or other resource. This capability is needed even if we cannot get external reach back approved by the AO.

85 Malicious Traffic Detection and Correlated Threat Analysis The RFI requires the solution to identify malicious traffic including DoS attacks. Will the Government add a requirement that SIEM detection rules and ML anomaly detection be applied to flow data within the same platform used for infrastructure and application monitoring, enabling correlated threat detection across all telemetry types simultaneously?

This could be a possible future addition

86 Configuration Policy Violation Detection The RFI requires detection of configuration policy violations. Will the Government consider a solution that correlates device syslog and SNMP events against pre-built compliance detection rules aligned to DoD STIGs and NIST 800-53 controls as meeting this requirement?

If those compliance detection rules can be expanded beyond the DoD STIGs and NIST controls to include any MCEN specific policy, then yes.

87 USMC Incident Ticketing System Integration The RFI requires creation of incident records within the USMC Incident Ticketing tool. Can the Government identify the specific ticketing system in use (e.g., ServiceNow, Remedy) and confirm whether bidirectional REST API integration satisfies this requirement?

BMC Remedy/Helix, Yes Test API satisfies that